$ gate: cat note.txt
Meeting at 3pm. Bring coffee.
[exit 0]

$ gate: cat secrets.env
REFUSED: path 'secrets.env' looks like a secrets file (matches a deny pattern)
[exit 126]

$ gate: rm note.txt
REFUSED: command 'rm' is not on the read-only allowlist (cat, grep, head, ls, tail, wc)
[exit 126]

$ gate: cat ../gate.py
REFUSED: path '../gate.py' resolves to /work/gate.py, outside the work folder /work/workfolder
[exit 126]

$ gate: cat /etc/passwd
REFUSED: path '/etc/passwd' resolves to /etc/passwd, outside the work folder /work/workfolder
[exit 126]

$ gate: cat ../workfolder/./secrets.env
REFUSED: path '../workfolder/./secrets.env' looks like a secrets file (matches a deny pattern)
[exit 126]

$ gate: ls
note.txt
secrets.env
[exit 0]

$ gate: grep -i coffee note.txt
Meeting at 3pm. Bring coffee.
[exit 0]

$ gate: cat note.txt; rm note.txt
cat: '/work/workfolder/note.txt;': No such file or directory
cat: /work/workfolder/rm: No such file or directory
Meeting at 3pm. Bring coffee.
[exit 2]

$ gate: cat -f note.txt
REFUSED: option '-f' is not allowed for cat
[exit 126]

$ gate: cat link.txt
REFUSED: path 'link.txt' resolves to /etc/hostname, outside the work folder /work/workfolder
[exit 126]

--- environment seen by a child (should be empty):
''
--- note afterwards:
total 8
-rw-r--r-- 1 wstudio-floris wstudio-floris 30 Oct  5 20:59 note.txt
-rw-r--r-- 1 wstudio-floris wstudio-floris 63 Oct  5 20:59 secrets.env
Meeting at 3pm. Bring coffee.
