This hits a real pain point in larger repos: the expensive part is often not one bad prompt, but stale logs and generated files silently getting pulled back into context. I’d be curious if the firewall mode supports per-task allowlists, because that seems useful for reducing false positives without making people maintain a huge global ignore file.