we should have just given agents an unpriv user on our PCs. it'd keep 99% of the isolation boundary you want without any overhead & every single OS is already multi-user. /home/claude, done.
sandbox/vms add too much friction, obviously everyone ended up with "yolo" (or auto-review which is pretty much "yolo")