The way this is generally implemented is that agents have the ability to request a tool use. Then you confirm "yes, you may run this grep".

Same, but I felt okay sticking my code base in a VM and then letting an agent run there. I’d say it worked well