Port coder tool execution harness, capability sandboxing & skills to Rust #71

Completed in commit e2da9bc051. Ported tool execution harness (shell, skill, capability), registry dispatch, and capability sandboxing contract.

Reopening: the WASM capability runtime does not exist, and the shell gate is three literal strings.

Audited against 468f1fa325.

Unmet scope items, verbatim from this issue:

• "WASM capability runtime integration (sandboxed read-only directory mounts, digest verification, WASM plugin execution)" — none of it exists. crates/openagents-cli/src/tools.rs:2 claims the module "Implements shell, skill, openagents, capability, and delegation hooks", but capability has no implementation. grep -n "capability" crates/openagents-cli/src/tools.rs returns exactly one hit: that doc comment on line 2. A capability tool call falls through the catch-all at tools.rs:199-203 and returns Unknown tool: capability with is_error: true. There is no WASM runtime dependency in crates/openagents-cli/Cargo.toml — no wasmtime, no extism, no PDK — and no digest verification or directory mounting anywhere in the crate.
• "Autonomous confirmation loop and command gating" — the gate is check_shell_refusal at tools.rs:241-250, which compares the command against three literal strings: ["rm -rf /", "rm -rf ~", "rm -rf $home"]. Anything else, including rm -rf /Users/..., curl | sh, or a write outside any root, is allowed. There is no confirmation loop and no prompt: execute_tool at tools.rs:148-170 runs the shell command unconditionally once the three-string check passes. Compare the TypeScript Computer contract, which enforces a curated per-binary allowlist with declared roots — node packages/openagents-cli/dist/main.js computer policy prints 24 binaries each with its permitted options.
• "Native tool execution loop (shell, openagents, skill, delegate, capability)" — shell, skill, and openagents are implemented for real (tools.rs:149-193) and I credit that. delegate and capability are not registered tools; neither name appears in list_tools (tools.rs:99).
• "Markdown skill discovery and context injection" — partially met. load_local_skills at tools.rs:61-95 walks .agents/skills, packages/openagents-cli/skills, and $HOME/.agents/skills and parses frontmatter. UNVERIFIED end to end: the tool registry is only reachable from CoderRuntimeSession::execute_turn, which never reaches a model (see #83), so no skill has ever actually been injected into a live turn.

Acceptance for the reopen:

1. A capability tool call loads and executes a real WASM plugin; show the run and its output.
2. The plugin's digest is verified before execution; show a run that refuses a tampered digest.
3. A plugin can read a mounted directory and cannot read outside it; show both.
4. Shell gating refuses a destructive command that is not one of the three literals; show the refusal.
5. Every one of these demonstrated by running oa, not by a unit test that calls the registry directly.

Progress in f00c28ebbe (main, WAL receipt seq=183). Staying open for the WASM half.

Landed: the native tool execution loop with shell, openagents, skill, and delegate -- delegate is now a declared tool, verified by a headless turn that fanned out to two children with distinct pids in distinct worktrees. Children get a tool registry rooted at their own directory, so shell runs where the child lives rather than in the parent's cwd. The gate carrying lane and credential exists only on the reader's session and is absent on children, so recursive fan-out cannot happen. Command gating and dangerous-command refusal are in check_shell_refusal; see #84 for the shell details.

Still missing:

• The WASM capability runtime -- sandboxed read-only mounts, digest verification, plugin execution. The crate has no wasm engine; the plugins/ artifacts target a bespoke packet-v0 ABI with per-manifest mounts, host allowlists, memory ceilings, and timeouts. This is the bulk of what is left across #71 and #84.
• Markdown skill discovery and context injection is partially there via the skill tool, but the discovery/injection path from coder-skills.ts has not been walked end to end against the real .agents/skills tree.
• The autonomous confirmation loop is not ported.

One thing to fix that is cheap and currently bites: src/interactive.rs still calls HarnessToolRegistry::new(None), so the interactive TUI gets no delegate tool -- delegation works headless and not in the session a person actually sits in. It is a one-line change in a file another agent held at the time.

Done in a9cbb4e819. The WASM capability runtime is real.

crates/openagents-cli/src/plugins.rs is a wasmtime host: Cranelift compiles the guest, StoreLimits enforces the manifest's memory ceiling, epoch interruption enforces its timeout, and mounts are read-only and lexically confined.

Limits are proven by violation, not by inspection — which is the only way this kind of claim means anything:

• a guest that memory.grows 6.4 MiB is denied the pages under a 1 MiB ceiling and gets them under 64 MiB, same artifact, so the refusal is the ceiling and not a broken fixture
• (loop $spin (br $spin)) comes back as timeout in under a second against a 400 ms manifest
• a guest importing openagents.write_file refuses to load with imports_undeclared even with a read-only mount declared
• ../secret, an absolute path, and a symlink planted inside the mount are each refused, with the file's contents absent from the refusal
• one appended byte fails the digest pin

Real output:

$ oa plugin run file_stats --input '{"path":"sample.txt"}'
oa: `file_stats` was not allowed (approval_unavailable): `file_stats` asks for
1 read-only directory and no operator approved it in this session        (exit 2)
$ oa plugin run file_stats --allow-mounts --input '{"path":"../manifest.json"}'
{"refusal":{"code":"mount_denied","reason":"the path escapes the mount root"}}

The advertised-but-absent capability tool is now present rather than the claim removed. Declared tools are exactly shell, skill, openagents, capability, delegate, and a test walks every declared name through execute_tool asserting none answers Unknown tool:.

Skills are ported end to end against the real .agents/skills tree — a test asserts fast-follow is found, that effect's | block description is the block and not the literal "|", and that superdelegate (auto: true) reaches standing_context().

The shell gate is the eight-pattern table from coder-shell.ts, with two patterns widened because the TypeScript ones were wrong: rm -fr ~/ and rm -rf --no-preserve-root / both slipped through upstream, and \b(shutdown|reboot|halt)\b refused echo 'shutdown the server' >> notes.md.

Not done: the autonomous confirmation loop, which lives in computer-policy.ts and is a distinct subsystem (the per-binary allowlist with declared roots) rather than a missing function. Command gating is done; the confirmation loop is not. And no caller enables allowing_plugin_mounts() yet — only oa plugin run --allow-mounts grants the mount tier, which is the TypeScript host's safe default, so mounted plugins are reachable from the CLI and not yet from a model turn.