Unix shell + filesystem worker — exec with denylist/timeout/output caps and background jobs; fs::ls|stat|mkdir|rm|chmod|mv|grep|sed|read|write with host jail, denylist, size caps, and sandbox-target forwarding
iiiverifiedexact versions are immutable; binary and bundle artifacts are digest-pinned.
Run an allowlisted command in the foreground and return its full output. Payload: { command: string (program name), args?: string[], timeout_ms?: number, target?: { kind: 'host'|'sandbox', sandbox_id?: string } }. Returns { stdout, stderr, exit_code, duration_ms, timed_out, stdout_truncated, stderr_truncated }. Do NOT pass argv as an array in 'command' — split program and arguments across the two fields.
Spawn an allowlisted command as a background job. Same payload shape as shell::exec; returns { job_id, argv } immediately. Poll with shell::status, terminate with shell::kill, list with shell::list. Do NOT pass argv as an array in 'command' — use 'command' (string) + 'args' (string[]).
Change permissions on host or sandbox
Recursive regex search on host or sandbox
List directory contents on host or sandbox
Create a directory on host or sandbox
Move/rename a path on host or sandbox
Stream a file from a host path or sandbox via StreamChannelRef
Remove a path on host or sandbox
Find-and-replace on host or sandbox
Stat a path on host or sandbox
Stream a file to a host path or sandbox via StreamChannelRef
Kill a running background job
List all background jobs
Get status of a background job
