I use bubblewrap to sandbox the agent to my projects folder, where the ai gets free read/write reign. Non-synthetic env cars are symlinked into my projects folder from outside that folder.

How have you been tracking down all the bits and pieces from your operating system that the agent still needs to do what it needs to? I'm working with Java projects and Gradle builds and the list of stuff is getting crazy.

I don't work with Java projects, but I just give it access to the basic binaries it needs, though I reserve some commands for myself.