I think that's why fork "Gram" exists. It strips all the weird parts and leaves just the editor.

What I do is to have two things, a simple editor, I use helix for normal editing. And in a second terminal a docker container solution where I put opencode or claude in https://git.jeena.net/jeena/agent-container

By sandbox you mean limit to certain files, certain actions, or both?

I've been wanting to look into better emacs integration for agents. Imagine an agent making direct elisp function calls, or using macros... One could limit which functions are allowed to run similar to how cli harnesses work, but plug straight into LSP and etc.