ShellTool

Tool for executing shell commands under a strict allowlist.

IMPORTANT: This tool requires an explicit allowlist of commands for safety. It will not execute any command whose first token is not in the allowlist.

== Execution model ==

Commands are tokenized with shell-style quoting (see CommandTokenizer) and executed directly via ProcessBuilder '''without invoking a shell'''. As a consequence:

• No glob expansion (*, ?, [abc] are passed literally to the program).
• No variable substitution ($VAR, ${VAR}, $(...), backticks).
• No command chaining or redirection (&&, ;, |, <, >, &).
• Quoted arguments are honoured: echo "hello world" runs echo with one argument hello world, not two.

Combined with the allowlist, this means LLM-supplied input that contains shell metacharacters cannot escape into a shell — characters such as && survive tokenization as literal argument bytes and are handed to the allowlisted program, which generally treats them as harmless input.

== Features ==

• Command allowlist for security
• Configurable working directory
• Timeout support
• Output size limits