Deny-by-default CLI wrapper for LLM agents — auto-approve safe commands, prompt the rest
/plugin marketplace add Evaneos/agent-callable