I don't think its an architecture (on the high level; there are probably architecture details like the specifics of the tokenizer that need adaptation in a straightforward way) problem, I think its a training/dataset generation/labelling problem.

That is, I think it is both simple and incredibly expensive/arduous, because the masses of free data to train models on doesn't come with a command-space/untrusted-input-space dichotomy, that’s something you have to impose onto the training data, with appropriately differentiated completions.

(On top of the fact that it likely requires de novo model training, which is itself expensive.)