Shell Service

The service reads the environment stored in each sandbox record (populated at sandbox-start time by the block-env resolver) so it does not need to re-parse stack files at launch time.

Security

This service runs inside the single-user Stackie daemon. All sandbox lookups are scoped to the daemon’s in-memory sandbox map — there is no cross-user isolation concern in the current model. If multi-tenant support is added in the future, ownership checks must be added here before the SandboxManager lookup.

Stack and sandbox names are validated to contain no path-separator characters before they are joined into fallback working-directory paths. If a name contains / or .., the launch is rejected rather than allowing the path to escape ~/.stackie/storage/.

Examples

use std::sync::Arc;
use stackie::platform::terminal_launcher::OsTerminalLauncher;
use stackie::sandbox_manager::manager::SandboxManager;
use stackie::services::shell_service::ShellService;

async fn example(manager: Arc<SandboxManager>) -> Result<(), stackie::services::shell_service::ShellServiceError> {
    let launcher = Arc::new(OsTerminalLauncher);
    let svc = ShellService::new(manager, launcher);
    svc.launch_block_shell("sandbox-id").await
}