The hard part of giving ChatGPT a shell is the trust boundary

What changed when I stopped treating an MCP-to-WSL bridge as a connectivity problem and separated files, Bash, code intelligence, terminal lifetime, browser control, and constrained-client access into explicit authority boundaries.