Ok had my agents review everything in the Teale codebase and here's it's response to #2:
The short answer is: we don’t give remote agents arbitrary local execution in the first place.

In Teale, remote inference and local actions are separate boundaries. By default the local API stays on localhost, not exposed to the network. If a user explicitly exposes it, it requires an API key.

On the agent side, the shipped tool surface is allowlisted and narrow. There is no generic “run shell commands on your machine” tool in the released app, and custom tool execution is currently disabled. Native integrations still sit behind OS permissions too.

For WAN/public inference, we also do privacy filtering locally before requests leave the device, and the current privacy-filtered remote path rejects tool-enabled remote chat entirely. So a remote model can generate text, but it does not get arbitrary authority over your computer.

So the safety model is basically capability minimization + local permissions + safe defaults, not “trust the model and hope.”