pub struct Worker {
pub name: String,
pub command: String,
pub args: Vec<String>,
pub allow: Option<String>,
pub parse: Parser,
pub reports_cost: bool,
pub enforces_budget: bool,
pub sandbox: bool,
pub resumes: bool,
pub env: BTreeMap<String, String>,
}Fields§
§name: String§command: String§args: Vec<String>Arguments, with {prompt}, {dir}, {model}, {budget} and
{timeout} filled in at dispatch. {extra} stands for however many
arguments a preset adds, and sits where a worker wants them: before a
positional prompt for one that takes its message last.
allow: Option<String>A flag and a rule template separated by a space, such as
--allowedTools Bash({cmd}). The flag is emitted once, the rule once
per subcommand of the verify command. None means the worker has no
allowlist, which the worktree and the scope check cover instead.
parse: Parser§reports_cost: boolWhether its output states what the run cost. A worker that does not leaves the cost unknown, never zero.
enforces_budget: boolWhether the budget argument is a bound the worker holds itself.
claude checks its cap between turns and can exceed it, so this is
false for claude too: a timeout is not a spend bound.
sandbox: bool§resumes: boolWhether a rework can continue the earlier session rather than re-prompting. Unused until a worker that does arrives.
env: BTreeMap<String, String>Environment the worker needs, such as a base URL for an
OpenAI-compatible endpoint or a config path. Applied to the child after
the credentials agent::restrict strips, so it cannot restore one.
Provider API keys are inherited from the session and belong here only
when a worker needs a different one from the shell’s.
Implementations§
Source§impl Worker
impl Worker
Sourcepub fn build(
&self,
prompt: &str,
dir: &Path,
model: Option<&str>,
budget: f64,
extra: &[String],
timeout: Duration,
) -> Command
pub fn build( &self, prompt: &str, dir: &Path, model: Option<&str>, budget: f64, extra: &[String], timeout: Duration, ) -> Command
The command to run in dir. An argument whose placeholder has no
value is dropped, and with it the argument before it when that one is
a flag, so --model {model} disappears whole when no model is chosen.
Sourcepub fn allow_verify(&self, cmd: &mut Command, verify: Option<&str>)
pub fn allow_verify(&self, cmd: &mut Command, verify: Option<&str>)
Appends the allowlist for verify, so the worker may run the check
pma runs afterwards. A worker without an allowlist gets nothing:
its reach is bounded by the worktree, not by this.
Sourcepub fn claude() -> Worker
pub fn claude() -> Worker
The worker pma shipped with. Seeded into the store on upgrade, and
editable from there like any other.
Sourcepub fn opencode() -> Worker
pub fn opencode() -> Worker
The two other workers pma ships a template for, both installed
separately. Each reaches OpenAI, OpenRouter or an OpenAI-compatible
endpoint through its own provider configuration: {model} is passed
verbatim as provider/model, and the key comes from the environment.
Both are seeded with text-tail, which takes the verdict from the exit
status and leaves the cost unknown rather than guessing at a field. A
json: parser reads a cost once its output shape is known, and that is
a pma agent set away rather than a code change.
Sourcepub fn sanduk() -> Worker
pub fn sanduk() -> Worker
The same claude, in a disposable container. sanduk holds the API
key on the host and bind-mounts the worktree, so the container has the
files and never the credential.
Four flags are not optional and are the reason this is a template
rather than a line in the README. --work-at-host-path mounts the
worktree at its own path, so a path in a diff or a stack trace resolves
for whoever reads it here. --stream-json passes the agent’s own
output through, which is what claude-json reads a cost from – without
it sanduk reformats the result into prose and the cost is lost.
--no-report-instruction keeps REPORT.md out of the worktree, where
it would land in the diff and in the scope check. --timeout bounds
the container from inside, so sanduk tears it down rather than
leaving it for its own sweep.
key-safe over sealed: sealed blocks the fetch that cargo, go
and pip do mid-build, and a run that cannot fetch fails for a reason
that has nothing to do with the task. pma agent set sanduk args is
where a portfolio whose images carry their toolchains tightens it.
No allowlist. The box is the bound, and a container that denies egress
does not also need a Bash() rule: shipping both means believing in
both.