Shell Execution Tools

Relevant source files

Overview

Shell execution tools enable the agent to run commands on the user's system. The codebase provides three distinct tool variants that execute shell commands with different capabilities and interfaces:

shell - Function-based tool for executing arbitrary shell commands (used with older models)
shell_command - Function-based tool with explicit shell control and login shell support (freeform variant for newer models)
exec_command / write_stdin - Unified exec tools for interactive process management with PTY sessions

For interactive process management details, see Unified Exec Process Management. For approval and sandboxing flows, see Tool Orchestration and Approval and Sandboxing Implementation.

Sources: codex-rs/core/src/tools/handlers/shell.rs codex-rs/core/src/tools/handlers/unified_exec.rs

Tool Variants

`shell` Tool

The shell tool executes a command using the session's configured shell. It accepts a ShellToolCallParams structure with the following schema:

Parameter	Type	Description
`command`	`Vec<String>`	Raw command vector to execute
`workdir`	`Option<String>`	Working directory (relative to turn CWD)
`timeout_ms`	`Option<u64>`	Execution timeout in milliseconds
`sandbox_permissions`	`Option<SandboxPermissions>`	Sandbox permission overrides
`justification`	`Option<String>`	Justification for escalated permissions
`prefix_rule`	`Option<Vec<String>>`	Prefix rules for approval policy

The handler converts the command vector directly to ExecParams using the session's shell without additional transformation.

Sources: codex-rs/core/src/tools/handlers/shell.rs46-62

`shell_command` Tool

The shell_command tool is a freeform variant that wraps commands with shell-specific invocation patterns. It provides explicit control over shell selection and login shell behavior:

Parameter	Type	Description
`command`	`String`	Command string to execute
`workdir`	`Option<String>`	Working directory (relative to turn CWD)
`login`	`Option<bool>`	Explicit login shell flag
`timeout_ms`	`Option<u64>`	Execution timeout in milliseconds
`sandbox_permissions`	`Option<SandboxPermissions>`	Sandbox permission overrides
`justification`	`Option<String>`	Justification for escalated permissions
`prefix_rule`	`Option<Vec<String>>`	Prefix rules for approval policy

The handler constructs shell invocations using Shell::derive_exec_args, producing platform-appropriate command vectors (e.g., ["/bin/bash", "-lc", "<command>"] for Bash with login shell).

Sources: codex-rs/core/src/tools/handlers/shell.rs65-106

`exec_command` Tool

The exec_command tool creates interactive PTY sessions that persist across multiple tool calls. Unlike shell and shell_command, which execute and terminate, exec_command can leave a process running:

Parameter	Type	Description
`cmd`	`String`	Command string to execute
`workdir`	`Option<String>`	Working directory (relative to turn CWD)
`shell`	`Option<String>`	Shell path override
`login`	`Option<bool>`	Login shell flag
`tty`	`bool`	Enable TTY mode (default: false)
`yield_time_ms`	`u64`	Time to wait for output (default: 10000ms)
`max_output_tokens`	`Option<usize>`	Maximum output tokens to return
`sandbox_permissions`	`SandboxPermissions`	Sandbox permission overrides
`justification`	`Option<String>`	Justification for escalated permissions
`prefix_rule`	`Option<Vec<String>>`	Prefix rules for approval policy

When a process remains running after yield_time_ms, it returns a process_id that can be used with write_stdin for continued interaction.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs28-49

`write_stdin` Tool

The write_stdin tool interacts with persistent processes created by exec_command:

Parameter	Type	Description
`session_id`	`i32`	Process ID from previous `exec_command`
`chars`	`String`	Input to write to stdin (empty for polling)
`yield_time_ms`	`u64`	Time to wait for output (default: 250ms)
`max_output_tokens`	`Option<usize>`	Maximum output tokens to return

Empty chars values act as output polls with longer minimum yield times (MIN_EMPTY_YIELD_TIME_MS = 5000ms) to allow background processes to produce output.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs51-61

Handler Architecture

Handler Dispatch Flow

All three handlers implement the ToolHandler trait with these key methods:

matches_kind - Checks if the handler supports the payload type (Function, LocalShell, Custom)
is_mutating - Determines if the command is safe (uses is_known_safe_command heuristic)
handle - Executes the tool call and returns ToolOutput

The ShellHandler and ShellCommandHandler both route through ToolOrchestrator to ShellRuntime, while UnifiedExecHandler routes to UnifiedExecProcessManager for PTY-based execution.

Sources: codex-rs/core/src/tools/handlers/shell.rs108-181 codex-rs/core/src/tools/handlers/shell.rs183-251 codex-rs/core/src/tools/handlers/unified_exec.rs75-246

Shell Selection and Command Construction

Session Shell vs. Model-Provided Shell

The shell execution system supports two shell selection modes:

Session Shell - The user's configured shell from session.user_shell(), detected at session startup
Model-Provided Shell - An explicit shell path from the shell parameter in tool arguments

The get_shell_by_model_provided_path function parses shell paths like /bin/bash, powershell, or cmd and constructs appropriate Shell instances with ShellType detection.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs249-272 codex-rs/core/src/tools/handlers/shell.rs79-105

Config Setting - turn.tools_config.allow_login_shell from configuration
Explicit Parameter - The login field in tool arguments
Default Behavior - Falls back to config setting when parameter is None

The resolution logic:

if login == Some(true) && !allow_login_shell:
    return Error("login shell is disabled by config")
else if login == Some(value):
    use_login_shell = value
else:
    use_login_shell = allow_login_shell

Login shells source profile files (.bash_profile, .zshrc, etc.) and use the -l flag on Unix systems or -NoProfile on PowerShell to maintain consistency.

Sources: codex-rs/core/src/tools/handlers/shell.rs66-77 codex-rs/core/src/tools/handlers/unified_exec.rs261-269

Command Vector Construction

The Shell::derive_exec_args method produces platform-specific command vectors:

Shell Type	Login	Non-Login
Bash	`["/bin/bash", "-lc", cmd]`	`["/bin/bash", "-c", cmd]`
Zsh	`["/bin/zsh", "-lc", cmd]`	`["/bin/zsh", "-c", cmd]`
PowerShell	`["powershell", "-NoProfile", "-Command", cmd]`	`["powershell", "-NoProfile", "-Command", cmd]`
Cmd	`["cmd", "/c", cmd]`	`["cmd", "/c", cmd]`

These vectors are recognized by is_known_safe_command when the command itself contains only safe operations (ls, pwd, echo, etc.).

Sources: codex-rs/core/src/tools/handlers/shell.rs394-435 codex-rs/core/src/tools/handlers/unified_exec.rs311-345

Unified Exec Environment

The exec_command tool applies additional environment variables to create a consistent execution environment:

This environment suppresses ANSI color codes, configures UTF-8 encoding, and sets minimal pagers to produce clean, parseable output.

Sources: codex-rs/core/src/unified_exec/process_manager.rs55-66

Output Formatting

Structured Output Format

The shell tool uses structured output formatting via format_exec_output_for_model_structured:

Exit code: <exit_code>

stdout:
<stdout_text>

stderr:
<stderr_text>

Duration: <duration> seconds

This format provides clear separation of stdout/stderr and includes execution metadata.

Sources: codex-rs/core/src/tools/events.rs286-296

Freeform Output Format

The shell_command tool uses freeform formatting optimized for LLM consumption:

<aggregated_output>

Stderr is only included if the command fails (exit code != 0):

<aggregated_output>

<stderr_text>

This format reduces token usage for successful commands and provides full context on failures.

Sources: codex-rs/core/src/tools/events.rs286-296

Unified Exec Response Format

The exec_command and write_stdin tools use a specialized format via format_response:

Chunk ID: <chunk_id>
Wall time: <seconds> seconds
Process exited with code <exit_code>
Original token count: <token_count>
Output:
<output>

Or for running processes:

Chunk ID: <chunk_id>
Wall time: <seconds> seconds
Process running with session ID <process_id>
Original token count: <token_count>
Output:
<output>

The chunk_id is a 6-character hex identifier for correlating multi-part outputs, and Original token count indicates truncation when output exceeds max_output_tokens.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs274-301

Apply Patch Interception

All shell execution handlers intercept commands that match the apply_patch pattern:

When detected, the handler:

Records a model warning: "apply_patch was requested via {tool_name}. Use the apply_patch tool instead."
Delegates to the ApplyPatchHandler for proper patch application
Returns the patch result without executing through shell runtime

This ensures file modifications go through the patch approval system regardless of which tool the model invokes.

Sources: codex-rs/core/src/tools/handlers/apply_patch.rs192-274 codex-rs/core/src/tools/handlers/shell.rs294-308 codex-rs/core/src/tools/handlers/unified_exec.rs171-185

Approval Policy Guards

All handlers enforce approval policy constraints before execution. Commands requesting escalated sandbox permissions must use AskForApproval::OnRequest:

This prevents the model from circumventing approval requirements by requesting dangerous permissions in stricter approval modes.

Sources: codex-rs/core/src/tools/handlers/shell.rs279-292 codex-rs/core/src/tools/handlers/unified_exec.rs153-164

Integration with Tool Orchestration

Execution Flow

The orchestrator handles:

Approval requirement evaluation
Sandbox selection and retry logic
Network policy integration (for unified exec)
Error propagation and denial detection

Sources: codex-rs/core/src/tools/handlers/shell.rs254-368 codex-rs/core/src/tools/handlers/unified_exec.rs108-246

Tool Event Emission

All shell handlers use ToolEmitter to emit standardized events:

Shell and ShellCommand Events:

ExecCommandBegin - Command start with parsed command, CWD, and source
ExecCommandEnd - Command completion with stdout, stderr, exit code, duration, and status

Unified Exec Events:

ExecCommandBegin - Includes optional process_id for persistent sessions
ExecCommandOutputDelta - Streaming output chunks during execution (up to MAX_EXEC_OUTPUT_DELTAS_PER_CALL per process)
TerminalInteraction - Emitted for write_stdin calls with input echo
ExecCommandEnd - Final aggregated output and exit code (may emit in background for long-lived processes)

The emitter abstracts event construction and ensures consistent formatting across all execution types.

Sources: codex-rs/core/src/tools/events.rs89-357 codex-rs/core/src/tools/handlers/unified_exec.rs221-231

Mutating Command Detection

All handlers implement is_mutating to classify commands as safe or potentially dangerous:

The is_known_safe_command heuristic recognizes common read-only commands like:

ls, pwd, echo, cat
git status, git log, git diff
Shell-specific wrappers: bash -c ls, zsh -lc pwd, etc.

Non-safe commands trigger stricter approval requirements in approval policies like UnlessTrusted.

Sources: codex-rs/core/src/tools/handlers/shell.rs120-131 codex-rs/core/src/tools/handlers/shell.rs193-212 codex-rs/core/src/tools/handlers/unified_exec.rs85-106

Dependency Environment Injection

Shell handlers inject dependency environment variables from session.dependency_env():

Dependencies are managed tools (like Node.js, Python) that Codex has installed or configured. Environment variables provide PATH updates and tool-specific configuration, allowing commands to reference managed binaries without absolute paths.

Sources: codex-rs/core/src/tools/handlers/shell.rs267-277

Testing Infrastructure

The test suite validates shell execution across multiple dimensions:

Command Construction Tests:

Shell selection (session vs. model-provided)
Login shell flag handling
Platform-specific command vectors
Safe command detection with wrapped commands

Unified Exec Integration Tests:

Short-lived command execution
Long-lived process persistence
Process ID allocation and reuse
Apply patch interception
Output streaming and delta events
Terminal interaction events
Background exit watching

Key Test Utilities:

test_codex() - Builder for test session configurations
mount_sse_sequence() - Mock model responses
wait_for_event() - Event stream assertions
parse_unified_exec_output() - Response format parsing

Sources: codex-rs/core/src/tools/handlers/shell.rs370-550 codex-rs/core/src/tools/handlers/unified_exec.rs303-391 codex-rs/core/tests/suite/unified_exec.rs

Shell Execution Tools

Relevant source files

Overview

Shell execution tools enable the agent to run commands on the user's system. The codebase provides three distinct tool variants that execute shell commands with different capabilities and interfaces:

shell - Function-based tool for executing arbitrary shell commands (used with older models)
shell_command - Function-based tool with explicit shell control and login shell support (freeform variant for newer models)
exec_command / write_stdin - Unified exec tools for interactive process management with PTY sessions

For interactive process management details, see Unified Exec Process Management. For approval and sandboxing flows, see Tool Orchestration and Approval and Sandboxing Implementation.

Sources: codex-rs/core/src/tools/handlers/shell.rs codex-rs/core/src/tools/handlers/unified_exec.rs

Tool Variants

`shell` Tool

The shell tool executes a command using the session's configured shell. It accepts a ShellToolCallParams structure with the following schema:

Parameter	Type	Description
`command`	`Vec<String>`	Raw command vector to execute
`workdir`	`Option<String>`	Working directory (relative to turn CWD)
`timeout_ms`	`Option<u64>`	Execution timeout in milliseconds
`sandbox_permissions`	`Option<SandboxPermissions>`	Sandbox permission overrides
`justification`	`Option<String>`	Justification for escalated permissions
`prefix_rule`	`Option<Vec<String>>`	Prefix rules for approval policy

The handler converts the command vector directly to ExecParams using the session's shell without additional transformation.

Sources: codex-rs/core/src/tools/handlers/shell.rs46-62

`shell_command` Tool

The shell_command tool is a freeform variant that wraps commands with shell-specific invocation patterns. It provides explicit control over shell selection and login shell behavior:

Parameter	Type	Description
`command`	`String`	Command string to execute
`workdir`	`Option<String>`	Working directory (relative to turn CWD)
`login`	`Option<bool>`	Explicit login shell flag
`timeout_ms`	`Option<u64>`	Execution timeout in milliseconds
`sandbox_permissions`	`Option<SandboxPermissions>`	Sandbox permission overrides
`justification`	`Option<String>`	Justification for escalated permissions
`prefix_rule`	`Option<Vec<String>>`	Prefix rules for approval policy

The handler constructs shell invocations using Shell::derive_exec_args, producing platform-appropriate command vectors (e.g., ["/bin/bash", "-lc", "<command>"] for Bash with login shell).

Sources: codex-rs/core/src/tools/handlers/shell.rs65-106

`exec_command` Tool

Parameter	Type	Description
`cmd`	`String`	Command string to execute
`workdir`	`Option<String>`	Working directory (relative to turn CWD)
`shell`	`Option<String>`	Shell path override
`login`	`Option<bool>`	Login shell flag
`tty`	`bool`	Enable TTY mode (default: false)
`yield_time_ms`	`u64`	Time to wait for output (default: 10000ms)
`max_output_tokens`	`Option<usize>`	Maximum output tokens to return
`sandbox_permissions`	`SandboxPermissions`	Sandbox permission overrides
`justification`	`Option<String>`	Justification for escalated permissions
`prefix_rule`	`Option<Vec<String>>`	Prefix rules for approval policy

When a process remains running after yield_time_ms, it returns a process_id that can be used with write_stdin for continued interaction.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs28-49

`write_stdin` Tool

The write_stdin tool interacts with persistent processes created by exec_command:

Parameter	Type	Description
`session_id`	`i32`	Process ID from previous `exec_command`
`chars`	`String`	Input to write to stdin (empty for polling)
`yield_time_ms`	`u64`	Time to wait for output (default: 250ms)
`max_output_tokens`	`Option<usize>`	Maximum output tokens to return

Empty chars values act as output polls with longer minimum yield times (MIN_EMPTY_YIELD_TIME_MS = 5000ms) to allow background processes to produce output.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs51-61

Handler Architecture

Handler Dispatch Flow

All three handlers implement the ToolHandler trait with these key methods:

matches_kind - Checks if the handler supports the payload type (Function, LocalShell, Custom)
is_mutating - Determines if the command is safe (uses is_known_safe_command heuristic)
handle - Executes the tool call and returns ToolOutput

The ShellHandler and ShellCommandHandler both route through ToolOrchestrator to ShellRuntime, while UnifiedExecHandler routes to UnifiedExecProcessManager for PTY-based execution.

Sources: codex-rs/core/src/tools/handlers/shell.rs108-181 codex-rs/core/src/tools/handlers/shell.rs183-251 codex-rs/core/src/tools/handlers/unified_exec.rs75-246

Shell Selection and Command Construction

Session Shell vs. Model-Provided Shell

The shell execution system supports two shell selection modes:

Session Shell - The user's configured shell from session.user_shell(), detected at session startup
Model-Provided Shell - An explicit shell path from the shell parameter in tool arguments

The get_shell_by_model_provided_path function parses shell paths like /bin/bash, powershell, or cmd and constructs appropriate Shell instances with ShellType detection.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs249-272 codex-rs/core/src/tools/handlers/shell.rs79-105

Config Setting - turn.tools_config.allow_login_shell from configuration
Explicit Parameter - The login field in tool arguments
Default Behavior - Falls back to config setting when parameter is None

The resolution logic:

if login == Some(true) && !allow_login_shell:
    return Error("login shell is disabled by config")
else if login == Some(value):
    use_login_shell = value
else:
    use_login_shell = allow_login_shell

Login shells source profile files (.bash_profile, .zshrc, etc.) and use the -l flag on Unix systems or -NoProfile on PowerShell to maintain consistency.

Sources: codex-rs/core/src/tools/handlers/shell.rs66-77 codex-rs/core/src/tools/handlers/unified_exec.rs261-269

Command Vector Construction

The Shell::derive_exec_args method produces platform-specific command vectors:

Shell Type	Login	Non-Login
Bash	`["/bin/bash", "-lc", cmd]`	`["/bin/bash", "-c", cmd]`
Zsh	`["/bin/zsh", "-lc", cmd]`	`["/bin/zsh", "-c", cmd]`
PowerShell	`["powershell", "-NoProfile", "-Command", cmd]`	`["powershell", "-NoProfile", "-Command", cmd]`
Cmd	`["cmd", "/c", cmd]`	`["cmd", "/c", cmd]`

These vectors are recognized by is_known_safe_command when the command itself contains only safe operations (ls, pwd, echo, etc.).

Sources: codex-rs/core/src/tools/handlers/shell.rs394-435 codex-rs/core/src/tools/handlers/unified_exec.rs311-345

Unified Exec Environment

The exec_command tool applies additional environment variables to create a consistent execution environment:

This environment suppresses ANSI color codes, configures UTF-8 encoding, and sets minimal pagers to produce clean, parseable output.

Sources: codex-rs/core/src/unified_exec/process_manager.rs55-66

Output Formatting

Structured Output Format

The shell tool uses structured output formatting via format_exec_output_for_model_structured:

Exit code: <exit_code>

stdout:
<stdout_text>

stderr:
<stderr_text>

Duration: <duration> seconds

This format provides clear separation of stdout/stderr and includes execution metadata.

Sources: codex-rs/core/src/tools/events.rs286-296

Freeform Output Format

The shell_command tool uses freeform formatting optimized for LLM consumption:

<aggregated_output>

Stderr is only included if the command fails (exit code != 0):

<aggregated_output>

<stderr_text>

This format reduces token usage for successful commands and provides full context on failures.

Sources: codex-rs/core/src/tools/events.rs286-296

Unified Exec Response Format

The exec_command and write_stdin tools use a specialized format via format_response:

Chunk ID: <chunk_id>
Wall time: <seconds> seconds
Process exited with code <exit_code>
Original token count: <token_count>
Output:
<output>

Or for running processes:

Chunk ID: <chunk_id>
Wall time: <seconds> seconds
Process running with session ID <process_id>
Original token count: <token_count>
Output:
<output>

The chunk_id is a 6-character hex identifier for correlating multi-part outputs, and Original token count indicates truncation when output exceeds max_output_tokens.

Sources: codex-rs/core/src/tools/handlers/unified_exec.rs274-301

Apply Patch Interception

All shell execution handlers intercept commands that match the apply_patch pattern:

When detected, the handler:

Records a model warning: "apply_patch was requested via {tool_name}. Use the apply_patch tool instead."
Delegates to the ApplyPatchHandler for proper patch application
Returns the patch result without executing through shell runtime

This ensures file modifications go through the patch approval system regardless of which tool the model invokes.

Sources: codex-rs/core/src/tools/handlers/apply_patch.rs192-274 codex-rs/core/src/tools/handlers/shell.rs294-308 codex-rs/core/src/tools/handlers/unified_exec.rs171-185

Approval Policy Guards

All handlers enforce approval policy constraints before execution. Commands requesting escalated sandbox permissions must use AskForApproval::OnRequest:

This prevents the model from circumventing approval requirements by requesting dangerous permissions in stricter approval modes.

Sources: codex-rs/core/src/tools/handlers/shell.rs279-292 codex-rs/core/src/tools/handlers/unified_exec.rs153-164

Integration with Tool Orchestration

Execution Flow

The orchestrator handles:

Approval requirement evaluation
Sandbox selection and retry logic
Network policy integration (for unified exec)
Error propagation and denial detection

Sources: codex-rs/core/src/tools/handlers/shell.rs254-368 codex-rs/core/src/tools/handlers/unified_exec.rs108-246

Tool Event Emission

All shell handlers use ToolEmitter to emit standardized events:

Shell and ShellCommand Events:

ExecCommandBegin - Command start with parsed command, CWD, and source
ExecCommandEnd - Command completion with stdout, stderr, exit code, duration, and status

Unified Exec Events:

ExecCommandBegin - Includes optional process_id for persistent sessions
ExecCommandOutputDelta - Streaming output chunks during execution (up to MAX_EXEC_OUTPUT_DELTAS_PER_CALL per process)
TerminalInteraction - Emitted for write_stdin calls with input echo
ExecCommandEnd - Final aggregated output and exit code (may emit in background for long-lived processes)

The emitter abstracts event construction and ensures consistent formatting across all execution types.

Sources: codex-rs/core/src/tools/events.rs89-357 codex-rs/core/src/tools/handlers/unified_exec.rs221-231

Mutating Command Detection

All handlers implement is_mutating to classify commands as safe or potentially dangerous:

The is_known_safe_command heuristic recognizes common read-only commands like:

ls, pwd, echo, cat
git status, git log, git diff
Shell-specific wrappers: bash -c ls, zsh -lc pwd, etc.

Non-safe commands trigger stricter approval requirements in approval policies like UnlessTrusted.

Sources: codex-rs/core/src/tools/handlers/shell.rs120-131 codex-rs/core/src/tools/handlers/shell.rs193-212 codex-rs/core/src/tools/handlers/unified_exec.rs85-106

Dependency Environment Injection

Shell handlers inject dependency environment variables from session.dependency_env():

Sources: codex-rs/core/src/tools/handlers/shell.rs267-277

Testing Infrastructure

The test suite validates shell execution across multiple dimensions:

Command Construction Tests:

Shell selection (session vs. model-provided)
Login shell flag handling
Platform-specific command vectors
Safe command detection with wrapped commands

Unified Exec Integration Tests:

Short-lived command execution
Long-lived process persistence
Process ID allocation and reuse
Apply patch interception
Output streaming and delta events
Terminal interaction events
Background exit watching

Key Test Utilities:

test_codex() - Builder for test session configurations
mount_sse_sequence() - Mock model responses
wait_for_event() - Event stream assertions
parse_unified_exec_output() - Response format parsing

Sources: codex-rs/core/src/tools/handlers/shell.rs370-550 codex-rs/core/src/tools/handlers/unified_exec.rs303-391 codex-rs/core/tests/suite/unified_exec.rs

Shell Execution Tools

Overview

Tool Variants

shell Tool

shell_command Tool

exec_command Tool

write_stdin Tool

Handler Architecture

Shell Selection and Command Construction

Session Shell vs. Model-Provided Shell

Login Shell Resolution

Command Vector Construction

Unified Exec Environment

Output Formatting

Structured Output Format

Freeform Output Format

Unified Exec Response Format

Apply Patch Interception

Approval Policy Guards

Integration with Tool Orchestration

Execution Flow

Tool Event Emission

Mutating Command Detection

Dependency Environment Injection

Testing Infrastructure

On this page

Shell Execution Tools

Overview

Tool Variants

shell Tool

shell_command Tool

exec_command Tool

write_stdin Tool

Handler Architecture

Shell Selection and Command Construction

Session Shell vs. Model-Provided Shell

Login Shell Resolution

Command Vector Construction

Unified Exec Environment

Output Formatting

Structured Output Format

Freeform Output Format

Unified Exec Response Format

Apply Patch Interception

Approval Policy Guards

Integration with Tool Orchestration

Execution Flow

Tool Event Emission

Mutating Command Detection

Dependency Environment Injection

Testing Infrastructure

On this page

`shell` Tool

`shell_command` Tool

`exec_command` Tool

`write_stdin` Tool

`shell` Tool

`shell_command` Tool

`exec_command` Tool

`write_stdin` Tool