/ tools
02 Tools & the Execution Environment
Day 2. A harness that can only talk is a chatbot. We give it hands: file and shell tools with strict schemas, permission gates before dangerous actions, and a sandbox to contain the blast radius.
→
Tool schemas as contractsTOOLS
A tool is a name, a JSON-schema for its arguments, and a function. The schema is the contract between the model and your code. Get it right and the model calls it correctly.
→
The core tools: read, write, edit, bash, search
The handful of tools a coding agent actually needs, how each is shaped, and why edit (not overwrite) and a good search tool matter more than you'd think.
→
Streaming tool calls to the UI
Showing the user what the agent is doing as it does it: partial tool calls, results, and the terminal UI that makes a harness feel alive and trustworthy.
→
Permission gates & approval modes
Why Claude Code asks before rm. Approval modes, allow-lists, and the human-in-the-loop gate that sits between a tool call and its execution.
→
Sandboxing & the blast-radius problem
An agent runs arbitrary commands. How to contain what a mistaken or malicious tool call can touch: sandboxes, working-directory limits, and containers.
→
Code-mode vs. tool-mode
Sometimes the best tool is a sandbox that runs code the model writes. When to let the model compute in a sandbox instead of calling fixed tools, and the tradeoffs.