shield
shield
¶
Shield CLI surface — sandbox-side install + the full shield registry.
Composes sandbox's own install-hooks / uninstall-hooks admin
verbs with every non-standalone-only entry from
terok_shield.COMMANDS. standalone_only=True
on shield's CommandDefs is the explicit "skip me when consumed
downstream" marker; we honour it (filters setup, prepare,
run, resolve).
Per-container shield verbs (allow, deny, down, up,
block, rules, watch, simple-clearance, logs) bind
a terok_shield.Shield via shield's own
resolve_state_dir so the standalone CLI and the sandbox-wrapped
form behave identically.