Maybe the tokenizing proxy could work both ways? If the agent tries to read secret.txt, it gets back the placeholder.