Ask HN: How do you sandbox your AI agent so it can't delete your files?