feat: add workspace-isolated toolhost runtime and capability-gap skill loop

internal/tools/shelltool/shelltool_test.go

@@ -0,0 +1,23 @@
+package shelltool
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestCallRejectsEmptyCommand(t *testing.T) {
+	tool := New([]string{"echo"}, ".", time.Second, 4000, nil)
+	_, err := tool.Call(context.Background(), "   ")
+	if err == nil {
+		t.Fatal("expected error for empty command")
+	}
+}
+
+func TestCallRejectsNonAllowlistedCommand(t *testing.T) {
+	tool := New([]string{"echo"}, ".", time.Second, 4000, nil)
+	_, err := tool.Call(context.Background(), "cat test.txt")
+	if err == nil {
+		t.Fatal("expected allowlist rejection")
+	}
+}