run_shell: the
shell_policy.yaml master flag (off by default, so the tool is never registered
until you opt in), host mode versus Docker sandbox mode and its launcher
template, the cross-platform bash interpreter that tokenizes pipes and heredocs
identically on Windows and POSIX, optional persistent per-thread bash sessions
that keep cd and environment changes across calls, the non-removable denylist
and optional confine cwd containment, the timeout with process-tree kill,
environment scrubbing via env_passthrough, and the audit log written to
data/audit/shell-audit.jsonl. For the filesystem tools: the read-only fs
namespace (read_file, grep, glob_files) and the separately namespaced
fs_write (write_file, edit_file), path confinement to the project root, the
tmp:// scratchpad, gitignore honouring, and the deny_paths list that hard-
refuses secrets, policy files, and git internals for both reads and writes.
This page is in progress. The shipped
shell_policy.yaml and fs_policy.yaml
files are fully commented and are the best reference until it lands.run_shell, Configuration for a real fs_policy.yaml
including deny_paths, and Tools for how deferred tools are
discovered and activated.