Let agents pause and ask before running a migration

Agents can already run terminal commands with approval. I would like a list of command patterns that always require approval, even in auto-run mode, for things like db:migrate, terraform apply or rm -rf.

Yes. A deny-list per project in the rules file would be perfect.

Strong +1, we turned auto-run off entirely because of this.

Would also want it to apply to background agents.