I don't want any LLM tool prompting me to install and run software it makes up on the fly.

Typosquatting is a thing, for example, and I'm sure hallucination squatting will be, too.

I also don't want to run anything in a "sandbox", either. Containers are not sandboxes despite things like the Gemini CLI pretending they are.