agx now asks for confirmation from the user when it wants to run a potentially destructive tool call, like running a shell command, or editing a file.

The user can also provide feedback in the same confirmation prompt to guide agx in a different direction (like Claude Code), which I find quite useful.

Next up: a permissions management system that tracks user’s preference per tool call.