AI coding

Sandboxing and isolating agent runs

• Running Agents on Ephemeral CI Runners Instead of Your Laptop
• Using Git Worktrees to Isolate Agent Changes
• A Pre-Edit Gate That Cannot Write: Scratch Clones and Deny Paths
• A Sandbox That Refuses Irreversible Calls
• Blocking Agent Writes That Escape the Worktree
• Blocking Install Scripts in Agent Environments
• Cleanup Rules for Worktrees: When to Prune, Lock or Archive
• Denying Package Install Scripts in Agent Sandboxes
• Ephemeral Worktrees in CI: Wiping, Caching and Fresh Checkouts
• Runner Image Drift: Detecting When Your Agent's Env Moves
• Statement Timeouts and Pool Limits for Read-Only Agent Queries
• Where an Agent's Temporary Work Lives Outside the Branch
• Worktrees for Parallel Agents: Setup, Teardown and Limits
• Wrapping a Filesystem for Agents: Symlinks and Race Conditions