I denied 7 dangerous commands. My agent deleted the files anyway

I've been building a coding agent from scratch — a plain model-plus-tools loop, no framework — partly to learn where the real problems are. One of them is run_command : the tool that lets the model ru...