Comment by kstenerud

I built yoloAI for this kind of nightmare scenario (among others).

- The sandboxed agent has no access to your homedir, or ANY dir on your machine except what you explicitly give it access to.

- Even with your workdir, it honors .gitignore and refuses to copy in any ignored paths to the sandbox copy.

- The sandboxed agent doesn't have access to your ENV (unless you explicitly pass things through one-by-one).

- Networking can be restricted any way you like.

- Credentials are proxied (currently Claude only), so the agent has access to NO secrets at all.

- You pick the security backend to match your needs (containers, VMs, etc).

- It's FOSS.

https://github.com/kstenerud/yoloai