> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ziro-agent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shell and files

> Run shell commands on the host or in a Docker sandbox, and read, search, and write project files under path confinement.

This page will cover the two local-execution surfaces. For `run_shell`: the
`shell_policy.yaml` master flag (off by default, so the tool is never registered
until you opt in), host mode versus Docker sandbox mode and its launcher
template, the cross-platform bash interpreter that tokenizes pipes and heredocs
identically on Windows and POSIX, optional persistent per-thread bash sessions
that keep `cd` and environment changes across calls, the non-removable denylist
and optional `confine` cwd containment, the timeout with process-tree kill,
environment scrubbing via `env_passthrough`, and the audit log written to
`data/audit/shell-audit.jsonl`. For the filesystem tools: the read-only `fs`
namespace (`read_file`, `grep`, `glob_files`) and the separately namespaced
`fs_write` (`write_file`, `edit_file`), path confinement to the project root, the
`tmp://` scratchpad, gitignore honouring, and the `deny_paths` list that hard-
refuses secrets, policy files, and git internals for both reads and writes.

<Note>
  This page is in progress. The shipped `shell_policy.yaml` and `fs_policy.yaml`
  files are fully commented and are the best reference until it lands.
</Note>

See [Tool permissions](/guides/permissions) for the approval gate in front of
`run_shell`, [Configuration](/guides/configuration) for a real `fs_policy.yaml`
including `deny_paths`, and [Tools](/concepts/tools) for how deferred tools are
discovered and activated.