Indeed, there's a very large number of things an agent can do to workaround those restrictions (for example, maybe you make it so justfile is off limits, but wh

Indeed, there's a very large number of things an agent can do to workaround those restrictions (for example, maybe you make it so justfile is off limits, but what about .env? what about ~/.bashrc?). Running commands in your dev machine is dangerous and AI agents should never have this kind of unsandboxed access