Call me paranoid, but I think we need to put all CLI tools in a jail. Any attempt to access sensitive contents like .env, .dev.var, or SSH keys should be guarded by the user's explicit authorization. Some people would say: oh, Claude already has it; if you don't pass the --dangerously-skip-permissions flag, it would ask for permission every time. Yes, you're right, but there are issues: - we can't rely/trust on the built-in permission check within those CLIs. - people have already made that --dangerously-skip-permissions the default. - we need an open-source guard people can trust and verify. It should be as lightweight as possible without affecting normal functionality. any more to add?