shield
shield
¶
Shield CLI surface — sandbox-side install + the full shield registry.
Composes sandbox's own install-hooks / uninstall-hooks admin
verbs with every non-standalone-only entry from
terok_shield.COMMANDS. standalone_only=True
on shield's CommandDefs is the explicit "skip me when consumed
downstream" marker; we honour it (filters setup, prepare,
run, resolve).
Per-container shield verbs (allow, deny, down, up,
block, rules, watch, simple-clearance, logs) bind
a terok_shield.Shield via shield's own
resolve_state_dir so the standalone CLI and the sandbox-wrapped
form behave identically.
This module — and therefore terok-shield — is imported only when the
shield verb is actually dispatched: COMMANDS references it by a
lazy source string, so a plain import terok_sandbox or a
terok-sandbox vault … run never pays for the shield stack. As the
sole (import-linter-sanctioned) importer of terok_shield besides the
integrations adapter, keeping the imports at module top is fine here.