Expand description
Filesystem tools: read_file, write_file, list_dir.
All paths are sandboxed to a workspace root. Reads/writes outside the root are rejected at the tool layer, so the model can’t (accidentally or otherwise) touch the rest of the disk.