Tool string allow_write: no, project, or colon-separated absolute roots on Unix. Parsed in execute() before permission.