core/cli+config: confirm destructive tools and path denylist

Wire [agent] confirm_destructive / path_denylist into CLI; default
confirm prompt denies; document Phase C safety hooks.

tests/test_cli/test_limits.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-from plyngent.cli.limits import install_cli_limit_hooks, prompt_continue_limit
+from plyngent.cli.limits import install_cli_limit_hooks, prompt_confirm_tool, prompt_continue_limit
 from plyngent.tools.process.pty_session import PtyManager
 
 if TYPE_CHECKING:
@@ -25,6 +25,19 @@ def test_prompt_continue_limit_no(monkeypatch: pytest.MonkeyPatch) -> None:
     assert prompt_continue_limit("hit a wall") is False
 
 
+def test_prompt_confirm_tool_default_deny(monkeypatch: pytest.MonkeyPatch) -> None:
+    seen: dict[str, object] = {}
+
+    def _confirm(message: str, **kwargs: object) -> bool:
+        seen["message"] = message
+        seen["default"] = kwargs.get("default")
+        return False
+
+    monkeypatch.setattr("click.confirm", _confirm)
+    assert prompt_confirm_tool("delete_path", {"path": "x"}, "delete path 'x'") is False
+    assert seen["default"] is False
+
+
 def test_install_cli_limit_hooks() -> None:
     install_cli_limit_hooks()
     # Hook is installed process-wide for the CLI session.

tests/test_config/test_agent_section.py

@@ -15,6 +15,8 @@ def test_agent_section_defaults(tmp_path: Path) -> None:
     assert store.agent_config.system_prompt == ""
     assert store.agent_config.max_tool_result_chars == 32_000  # noqa: PLR2004
     assert store.agent_config.parallel_tools is True
+    assert store.agent_config.confirm_destructive is True
+    assert store.agent_config.path_denylist == []
 
 
 def test_agent_section_parse(tmp_path: Path) -> None:
@@ -25,6 +27,8 @@ def test_agent_section_parse(tmp_path: Path) -> None:
 system_prompt = "Be brief."
 max_tool_result_chars = 100
 parallel_tools = false
+confirm_destructive = false
+path_denylist = ["/secrets/", ".ssh/"]
 """,
         encoding="utf-8",
     )
@@ -32,3 +36,5 @@ parallel_tools = false
     assert store.agent_config.system_prompt == "Be brief."
     assert store.agent_config.max_tool_result_chars == 100  # noqa: PLR2004
     assert store.agent_config.parallel_tools is False
+    assert store.agent_config.confirm_destructive is False
+    assert store.agent_config.path_denylist == ["/secrets/", ".ssh/"]