Struct ExecutionContext 

pub struct ExecutionContext { /* private fields */ }

Per-turn execution environment for a tool call.

When attached to a crate::ToolCall, executors that honour it (currently crate::ShellExecutor) use these values instead of the process-level CWD and skill env. None on ToolCall::context means “use the executor default” — identical to today’s behaviour.

Cheaply clonable (single Arc) so the same context can be shared across parallel tool calls in one DAG layer without copying the underlying data.

Precedence

When the ShellExecutor resolves the effective (cwd, env) for a call, the highest-priority source wins for each dimension:

Source	CWD priority	Env priority
ToolCall.context.cwd / env_overrides	1 (highest)	1 (highest)
Named registry entry (looked up by name)	2	2
Skill env (set_skill_env)	—	3
default_env registry entry (when set)	3	4
Process CWD	4	—
Inherited process env (minus blocklist)	—	5 (lowest)

Attaching a context for telemetry tagging via env_overrides never silently disables default_env — a more specific source simply overrides a less specific one.

Implementations

impl ExecutionContext

pub fn new() -> Self

Construct an empty, untrusted context.

Env overrides supplied via with_env are subject to the executor’s blocklist filter before reaching the subprocess.

pub fn with_name(self, name: impl Into<String>) -> Self

Set the logical environment name.

The name is matched against [[execution.environments]] in the agent config. An unknown name produces a crate::ToolError::Execution at dispatch time.

pub fn with_cwd(self, cwd: impl Into<PathBuf>) -> Self

Set the working directory override.

Relative paths are joined with the process CWD inside resolve_context before sandbox validation. Non-existent paths are a hard error — no fallback to the process CWD.

pub fn with_env(self, key: impl Into<String>, value: impl Into<String>) -> Self

Add a single environment variable override.

Overwrites any prior value for the same key. Untrusted contexts have the final env re-filtered through the executor’s env_blocklist — blocklisted keys are stripped regardless of their source.

pub fn with_envs<K, V, I>(self, iter: I) -> Self

where K: Into<String>, V: Into<String>, I: IntoIterator<Item = (K, V)>,

Add multiple environment variable overrides from an iterator.

Equivalent to calling with_env for each pair.

impl ExecutionContext

pub fn name(&self) -> Option<&str>

The logical environment name, if set.

pub fn cwd(&self) -> Option<&Path>

The working directory override, if set.

pub fn env_overrides(&self) -> &BTreeMap<String, String>

The environment variable overrides.

pub fn is_trusted(&self) -> bool

Whether this context was built via the trusted constructor.

Trusted contexts bypass the executor’s final env_blocklist pass. Only contexts built from operator-authored TOML (via build_registry) are trusted.

Trust downgrade

When a call-site context wraps a trusted registry entry by name (via ExecutionContext::with_name) but the call-site context itself is untrusted, resolve_context downgrades the effective trust flag to false. This prevents LLM-authored wrappers from escalating privilege by naming a trusted registry entry.

Trait Implementations

impl Clone for ExecutionContext

fn clone(&self) -> ExecutionContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ExecutionContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ExecutionContext

fn default() -> ExecutionContext

Returns the “default value” for a type.

impl PartialEq for ExecutionContext

fn eq(&self, other: &ExecutionContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for ExecutionContext

impl StructuralPartialEq for ExecutionContext