[Feature]: First-class command wrapper policy for tool shells (RTK-style command and output shaping)

Aperta
  • Qualcosa non va?
#3,660 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@wsp1911 ci sta già lavorando.

Dal 2/11/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
Più di una settimana
Idoneità per principianti
12/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust, shell
Ambito
devtools

Direzione di ricerca

Start with src/crates/assembly/core/src/agentic/tools/pipeline/tool_pipeline.rs to see the single dispatch point, then read exec_command/command.rs around the cmd schema and max_output_chars. Check native_hooks/output.rs for how updatedInput works in PreToolUse. This is design work, and the issue leaves the first step and the policy location open, so it is not a starting point. Done would mean a maintainer-agreed design, not a patch.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem / opportunity

Agent harnesses spend a lot of context on raw shell output (git status, cargo test, ls, rg). Wrapper tools such as RTK take the opposite approach: rewrite the command, run the real one, emit only the slice the model needs.

OpenBitFun has three partial ways to do this today, and none of them sits at the harness layer:

  • User hooks can rewrite the command, but not the output. PreToolUse with updatedInput can replace ExecCommand.cmd. PostToolUse only appends additionalContext (agent-runtime/src/native_hooks/output.rs), so there is no way to trim or replace the tool result.
  • Hooks do not run on remote workspaces. docs/features/agent-hooks.md states hooks are not dispatched for SSH/remote workspaces (remote_workspace_unsupported), which is where context pressure is usually highest.
  • PATH shims work but live below the harness. The remote shell bootstrap prepends $HOME/.local/bin (acp/src/client/remote_shell.rs), so a shim is picked up — but local, remote, docker exec, and WSL paths each need their own shim, the command that actually ran diverges from what the transcript shows, and the user's own shell in the workspace is altered as a side effect.

So a user who wants this must choose between "works only locally" and "works, but invisibly and per-path".

Proposed behavior

One policy inside ToolPipeline, applied before dispatch, so every execution path behaves the same:

  • Opt-in setting, off by default, that declares which command families get wrapped and by which wrapper provider.
  • Applies only to ExecCommand's cmd, and only to single commands. Anything with a pipe, redirection, chaining, or command substitution is left untouched.
  • The effective command is recorded next to the original in the session/transcript. A reader must never believe git status ran when rtk git status did.
  • Permission rules and the existing guard checks keep evaluating the original command; a wrapper prefix must not become a bypass.
  • Wrapper missing or failing: run the original command and surface one notice. No silent success, no silent skip.
  • Naming, settings shape, and provider abstraction are for maintainers to decide; the only hard requirements are the four behavioral ones above.

Optional and separable: a real output-shaping seam after execution, for harness-side trimming with the raw result kept for evidence. Today the only shaping control is coarse (max_output_chars on exec output). Prefer letting the wrapper own trimming first; add this only if a wrapper cannot deliver it.

Notes

Alternatives considered

  • Hooks only: no remote dispatch, and no way to replace tool output.
  • PATH shims only: shell-layer solution with three implementations, invisible in the transcript.
  • An MCP tool instead: an MCP server adds a tool the model must choose to call. Command wrapping has to be transparent; a model-mediated wrapper spends part of what it saves.
  • A MiniApp: runs only while open; a UI surface, not a dispatch lifecycle owner.

Constraints worth stating up front

  • Wrapping must not weaken the permission or guard path (this is the failure mode that matters most).
  • Compound commands must pass through unchanged; a semantic change costs more than the tokens saved.
  • Remote workspaces are a first-class target, not a follow-up: a local-only policy recreates the gap it is meant to close.
  • Upgrade compatibility: new settings default off; older builds must keep working with profiles that carry them.

References

  • src/crates/assembly/core/src/agentic/tools/pipeline/tool_pipeline.rs — single dispatch point shared by all execution paths.
  • src/crates/assembly/core/src/agentic/tools/implementations/exec_command/command.rs — cmd is the field to rewrite (schema around line 715); max_output_chars shows where output size is currently controlled.
  • src/crates/execution/agent-runtime/src/native_hooks/output.rs — updatedInput is PreToolUse-only; additionalContext cannot replace a tool result.
  • docs/features/agent-hooks.md — hooks are not dispatched on remote workspaces.
  • src/crates/interfaces/acp/src/client/remote_shell.rs — remote shell prepends ~/.local/bin, which is why shims work today.
  • Prior art: RTK, a command-rewriting wrapper that trims tool output to save context.

Open questions

  1. First step: a narrow ExecCommand argument transform, or a generic tool-argument middleware other tools can opt into?
  2. Where should the policy live — a user setting only, or also per-workspace / per-connection (a remote workspace often needs a different wrapper binary than the local machine)?
Lingua principale
Rust
Stelle
2.3k
Fork
236
Merge medio
13h 16m
PR unite (30g)
315

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di GCWing/OpenBitFun

Tutte le issue di GCWing/OpenBitFun

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.