- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find)
to explicit read-only commands; route npx/ruff format through ask
- Deny privilege escalation via su and doas
- Add read denies for env files, key material, SSH/cloud credentials,
package-manager tokens, and container/kube configs
- Add edit denies for dotfiles, .git internals, and git hook injection
- Rename ibmi custom_tools toolset to catalog and enable builtin-tools
with directory-based tool config and SELECTED_TOOLSETS=catalog
- Document tool-preference rules and scratch workspace in AGENTS.md
