Host-agnostic safety middleware for tool-using agents that blocks risky tool calls and delegates trajectory decisions to a Watcher.