Solid patterns here. One thing I'd add from running Claude Code in production:

The "give it bash" pattern sounds scary until you realize the alternative is 47 intermediate tool calls that fail silently.

Letting the agent write and run scripts means the agent debugs when something breaks. The feedback loop tightens dramatically.

The trick is sandboxing + cost limits. Not preventing shell access.