Tools and the sandbox
agent/tools/base.py
defence in depth, layer by layer
call {{ call.text }} {{ verdict.text }}
class Tool(ABC):
name: str
description: str
parameters -> JSON Schema
run(arguments, ctx) -> str
read write edit glob grep bash
The description goes into the model's context on every single call. It is prompt engineering wearing a docstring costume, and it is billed accordingly.
1 · disposable container
one per task · network off · planned v0.1.0
2 · PermissionPolicy
deny-list, before the command runs
3 · ToolContext
every tool receives it, none can bypass it
resolve()
workdir / path
both .resolve()d
then compared
timeout_s
30.0
a hanging command
hangs the agent
max_output_chars
20_000
... [48213 chars
truncated]
{{ line }}
{{ caption }}