> you cannot have both and be serious about security
Why not? I think DSH does this pretty well with an agent preset that exposes the tools required for the agent to modify the harness.
It's kind of like how the kernel can expose interfaces to allow userspace to load kernel modules at runtime: you "just" have to control which processes can use them.
Between that, and a couple of extra injected bwrap args to make my SSH keys and LLM API credentials unreadable from the agent's shell by default, I'm pretty comfortable using the harness outside of a VM for most things.
Why not? I think DSH does this pretty well with an agent preset that exposes the tools required for the agent to modify the harness.
It's kind of like how the kernel can expose interfaces to allow userspace to load kernel modules at runtime: you "just" have to control which processes can use them.
Between that, and a couple of extra injected bwrap args to make my SSH keys and LLM API credentials unreadable from the agent's shell by default, I'm pretty comfortable using the harness outside of a VM for most things.