Function run_rust_tool 

pub fn run_rust_tool(
    vfs: &mut Vfs,
    vfs_path: &str,
    program: &str,
    args: &[String],
) -> Result<ExitStatus, SandboxError>

Export VFS subtree at vfs_path, run program with args in that dir, sync changes back, then cleanup. Returns the child’s exit status. Caller should check status.success().

Isolation

See parent module docs: temp export + host PATH binary; optional Linux mount namespace via DEVSHELL_RUST_MOUNT_NAMESPACE (no container engine).

Errors

Returns SandboxError if binary not in PATH (ExportFailed with a message), export fails, spawn fails, or sync fails.