Shell tools

Code mode can run commands in your workspace via shell tools. Office mode does not expose shell execution.

Main tools

Tool	Behavior
`exec_shell`	Run a command (foreground or background)
`exec_shell_wait` / `exec_wait`	Wait for a background job
`exec_shell_interact` / `exec_interact`	Send stdin to a running process
`exec_shell_cancel`	Cancel a background shell task
`task_shell_start` / `task_shell_wait`	Long-running task helpers

Output streams to the tool result and often mirrors in the embedded terminal.

Approval

Most non-trivial commands trigger the approval dialog. A safe prefix dictionary auto-allows common dev commands (cargo test, npm run, …) when policy permits.

Configure under Tool approval and Execution policy.

Safety (Windows v0.7.4+)

On Windows, exec_shell uses the Windows native sandbox by default instead of your full user token:

Mode	Summary
Elevated (recommended)	No writes outside workspace; blocks profile secrets; default WFP outbound block; ConPTY interactive terminal
Unelevated	Workspace write isolation + best-effort network; no profile read isolation

Results include sandbox_enforced, windows_sandbox_mode, etc.; stderr warns when not enforced.

Destructive patterns should still be denied by policy.
Optional OpenSandbox backend — see Execution policy.
Linux is currently degraded (policy only).

Tips

Complete the sandbox wizard before heavy Code-mode shell use.
Prefer run_tests or cargo check over ad-hoc scripts when available.
For servers (npm run dev), use background exec_shell and exec_shell_wait.

Related: Windows sandbox · File tools · CRAFT