[kasey_junk]

The first step is building a sandbox (vm, container, whatever) that allows you to trust the agent in its most permissive mode.

This varies based on the maturity of my projects but most of my sessions live in VMs with very specific egress rules and permissions.

[londons_explore]

Frustratingly none of the coding harnesses seem to default to just firing up a docker container with the working directory mounted and letting the AI run wild inside the container.

[kasey_junk]

You can get that working for yourself trivially. My agent environment now has 3 different kinds of compute abstractions, 3 different agents and a nascent workflow engine in it.

It works how _i_ want, which is really refreshing.

[londons_explore]

Oh I've built the same too. But it took me a few hours to work out the quirks, when it should just be the default.

[ryandrake]

I think this is an area where the developers of the agent harnesses should be spending a lot of effort. It's not reasonable to expect your users to set up and maintain a VM just to safely use a tool. When I run cmake, I don't have to worry about it accidentally deleting my root filesystem or posting my account credentials to github. Most of the command line coding tools I use don't even need/have a --dry-run option.

[kasey_junk]

Could be. But a) I don’t know why I’d trust them to do that when existing tooling means I don’t have to and b) this is not a new paradigm for me. I’ve been running most of my dev environments in sandboxed mode for a long time. I don’t trust npm either.