As someone whose commercial software needs to ingest PDFs: I stay away from things like lopdf because of how they fail to handle broken pdfs.

The first project you linked explicitly calls out broken pdf handling.

> but they're not even in the same universe as what the Stasi was doing

At what point? It's easy to say when we mention the Stasi or the Nazis that we're comparing it to the end game they had going, but the transformation was a bit of process.

> Textual command filtering is entirely useless. It is fit for no purpose. Nobody with any instinct or experience in security would even bother to implement this filter because it achieves nothing except a false sense of security.

Not if you only use an allow list. E.g. only allow things matching a particular prefix to run. Also, isn't this what every agent does? And by every I mean Codex because I haven't used the others.

Good to see Codex as a datapoint: I haven't used it. I can confirm though that this is certainly what Claude does, with the addition that Claude's adherence to its own string-match based allowlist seems even less deterministic than OpenCode's.