Direct POSIX Terminal Shim

For raw terminal agents, shell bots, and CI environments executing without a host IDE or MCP bridge, ctxsec provides a direct POSIX terminal execution wrapper (ctx exec).

---

Direct Command Invocation

Wrap any binary or shell command to enforce kernel boundaries directly:

# Execute with researcher constraints (no outbound network, read-only root)
ctx exec --role=researcher -- bash -c "python train.py"

# Execute with coder constraints (workspace writes allowed, restricted egress)
ctx exec --role=coder -- go test -v ./...

---

Shell Aliasing & Env Wrapper

You can automatically enforce kernel sandboxing across an entire interactive shell session or CI job:

# In ~/.zshrc or ~/.bashrc
export CTX_AGENT_ROLE="coder"
alias bash="ctx exec --role=$CTX_AGENT_ROLE -- /bin/bash"

When an agent issues a shell command inside this environment, the process is spawned under the appropriate operating system sandbox profile automatically.