Directory cage not effective

[eternaldensity]

When prevented from reading files outside the project root using read_file, agents will sidestep that by using bash cat