Configurable Command Run Tool for Agents

[srtab]

Description

Introduce a new tool that allows DAIV agents to execute shell commands within a sandboxed environment, restricted by a configurable allowlist. This will give repository maintainers precise control over what operations DAIV is permitted to perform, enhancing both the security and customizability of its autonomous behaviors.

User Story

As a repository maintainer, I want to allow DAIV agents to run only specific shell commands in a sandboxed environment so that I can benefit from automated assistance without risking arbitrary or unsafe command execution.

Benefits

• Enhances the security of DAIV’s autonomous features
• Empowers safe and gradual adoption of agent-based automation
• Increases user trust through fine-grained execution control

Use Cases

• Agent runs black or eslint during issue resolution workflows
• Install new dependencies via package manager inside the sandbox: uv add pytest.

Additional Notes

• Should integrate with DAIV’s existing sandbox (e.g., daiv-sandbox)
• Allowlist defined in .daiv.yml, with optional regex or strict matching
• Requires input validation to prevent chaining or command injection