Makes sense, thanks for the clarification.

I mostly worry about the gap between a correct plan and execution-time behavior — especially when tools touch the filesystem or OS APIs. Even a single malformed argument can have irreversible effects.

Totally agree these guardrails are non-trivial, but it’s great to see the project thinking in this direction.