The best coding-agent feature is still a good refusal: tell me the risky command before touching the repo.