内置 ShellExecuteTool 没有规则配置 只能自定义tool吗

[zxqQing]

public class ShellExecuteTool {
public static final String NAME = "execute";
private final AbstractSandboxFilesystem sandbox;

public ShellExecuteTool(AbstractSandboxFilesystem sandbox) {
    this.sandbox = sandbox;
}

@Tool(
    description = "Execute a shell command. Use for git, npm, build, test, and other terminal operations. Returns combined output and exit code. If a dedicated tool exists (e.g., read_file, write_file), you MUST use it instead of shell commands."
)
public String execute(RuntimeContext runtimeContext, @ToolParam(name = "command",description = "Shell command to execute") String command, @ToolParam(name = "working_directory",description = "Working directory (relative to workspace root, optional)",required = false) String workingDirectory, @ToolParam(name = "timeout",description = "Timeout in seconds (default: 30)",required = false) Integer timeout) {
    String effectiveCommand = command;
    if (workingDirectory != null && !workingDirectory.isBlank()) {
        String wd = workingDirectory.strip();
        if (wd.startsWith("/") || wd.startsWith("~") || wd.contains("..")) {
            return "Error: working_directory must be a relative path within the workspace (absolute paths, '~', and '..' are not allowed).";
        }

        effectiveCommand = commandWithWorkingDirectory(wd, command, System.getProperty("os.name").toLowerCase().contains("win"));
    }

    int timeoutSeconds = timeout != null && timeout > 0 ? timeout : 30;
    ExecuteResponse result = this.sandbox.execute(runtimeContext, effectiveCommand, timeoutSeconds);
    StringBuilder sb = new StringBuilder();
    sb.append("Exit code: ").append(result.exitCode()).append("\n");
    if (result.output() != null && !result.output().isBlank()) {
        sb.append("\n").append(result.output());
    }

    if (result.truncated()) {
        sb.append("\n(output was truncated)");
    }

    return sb.toString();
}

static String commandWithWorkingDirectory(String workingDirectory, String command, boolean windows) {
    if (windows) {
        String var3 = workingDirectory.replace("\"", "\"\"");
        return "cd /d \"" + var3 + "\" && " + command;
    } else {
        String var10000 = workingDirectory.replace("'", "'\\''");
        return "cd '" + var10000 + "' && " + command;
    }
}

}

[stanleys12]

不一定要完全自己写。分两种情况。

1. 只要整个 execute 工具的 allow / ask / deny,用权限系统就行,不用改 ShellExecuteTool。它的工具名是 execute(ShellExecuteTool.java#L35),@Tool 方法会被包成 ToolBase(ReflectiveFunctionTool.java),所以可以按工具名配规则,例如让每次执行都先问用户:

PermissionContextState permCtx = PermissionContextState.builder()
        .mode(PermissionMode.DEFAULT)
        .addAskRule("execute",
                new PermissionRule("execute", null, PermissionBehavior.ASK, "userSettings"))
        .build();
// 再传给 HarnessAgent.builder().permissionContext(permCtx)

用法见 permission-system.md。

2. 如果你想要按命令内容匹配(比如只允许 git status,禁止 rm -rf),内置的 execute 目前做不到。规则里的 ruleContent 由工具自己的 matchRule 解释,而 ToolBase 默认实现只在 ruleContent == null 时才匹配(ToolBase.java#L244),ReflectiveFunctionTool 也没有覆盖它,checkPermissions 同样默认返回 passthrough(ToolBase.java#L235)。所以带命令内容的规则对它不会生效。

这种情况下的做法是:在 HarnessAgent.builder() 上调用 disableShellTool()(HarnessAgent.java#L2245),不再注册内置的,然后自己写一个继承 ToolBase 的 shell 工具,里面调用同一个 AbstractSandboxFilesystem.execute(...),并覆盖 checkPermissions / matchRule 实现命令白名单、黑名单。文档里有 checkPermissions 的自定义示例。覆盖后,命令级的 PermissionRule("你的工具名", "git *", ...) 就能按你定义的 matchRule 语义匹配。

另外,贴出来的代码和当前主干有点不同:主干的 execute 返回 ToolResultBlock,不是 String。自定义时以主干为准。

(I looked this up in the code with help from an AI assistant; the links are to the lines I checked.)