The agent can rm -rf whatever it wants, and the proxy says no

You're letting an agent build inside a container with a terminal and a filesystem. The question isn't whether it will try something destructive; it's what happens when it does.

AI traffic on Hoody is plain HTTP, so hoody-exec sits in front of the gateway. A catch-all script at scripts/default/1/api/v1/[...path].js forwards every request to ai.hoody.com, reads the response, and edits the tool calls before the agent sees them: write_file paths get /sandbox prepended, execute_command arguments matching rm -rf or sudo come back blocked. Enabling it is a base-URL change in the client; the container token stays the same.

No framework, no permission system bolted onto the agent, no prompt begging it to behave. Thirty lines in the response path.

The guardrail sits between the model and the agent, where neither gets a vote.