>and any sandbox needs holes punched otherwise it is not useful in practice

Don't assume our individual use cases. It can be perfectly useful with access to just one folder and zero network asside from the API.

That’s good to hear, it’s a much better approach than expecting humans to read commands and approve them or just trust that the LLM can set the proper horizons for its world itself while working.