tool-gate

Auto-approves agent tool calls: fixed rules for the clear cases, Jev for the gray zone, one push-back to the agent, and only then a question for you. For pi and opencode.