feat: add workspace-isolated toolhost runtime and capability-gap skill loop

internal/toolhost/runtime.go

@@ -0,0 +1,45 @@
+package toolhost
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"laodingbot/internal/config"
+	"laodingbot/internal/logger"
+	"laodingbot/internal/tools"
+	"laodingbot/internal/tools/filetool"
+	"laodingbot/internal/tools/shelltool"
+)
+
+func RunChild(ctx context.Context, cfg config.Config, log *logger.Logger) error {
+	var registryLog *logger.Logger
+	var fileLog *logger.Logger
+	var shellLog *logger.Logger
+	var serverLog *logger.Logger
+	if log != nil {
+		log.Infof("toolhost child starting")
+		registryLog = log.WithComponent("toolhost.registry")
+		fileLog = log.WithComponent("toolhost.file")
+		shellLog = log.WithComponent("toolhost.shell")
+		serverLog = log.WithComponent("toolhost.server")
+	}
+	registry := tools.NewRegistry(registryLog)
+	registry.Register(filetool.New(cfg.Security.AllowedDirs, cfg.ToolOutputMaxChars, fileLog))
+	registry.Register(shelltool.New(
+		cfg.Security.AllowedCommands,
+		cfg.Security.WorkDir,
+		time.Duration(cfg.ToolCallTimeoutSec)*time.Second,
+		cfg.ToolOutputMaxChars,
+		shellLog,
+	))
+
+	server := NewServer(registry, serverLog)
+	if err := server.Serve(ctx, stdin(), stdout()); err != nil && ctx.Err() == nil {
+		return fmt.Errorf("toolhost serve failed: %w", err)
+	}
+	if log != nil {
+		log.Infof("toolhost child stopped")
+	}
+	return nil
+}