Your AI coding agent can read your SSH keys. I built a Neovim plugin that won’t start it unprotected

Description and use

The xyno-sandbox.nvim plugin runs a coding agent inside a bubblewrap sandbox, preventing access to ~/.ssh, ~/.aws, and git history. If the sandbox cannot be created, the agent does not start, safeguarding credentials.

Problem

When a Neovim coding agent runs with the editor’s privileges, it can access sensitive files such as ~/.ssh, ~/.aws, and git history, exposing credentials to the agent.

Outcome

The sandboxed agent prevents accidental exposure of SSH keys, AWS credentials, and git history while still allowing normal coding workflow. It fails closed if the sandbox cannot be created, ensuring no unprotected agent runs.

Workflow

• 1. Install the xyno-sandbox.nvim plugin.
• 2. The plugin launches the coding agent via bubblewrap with a read‑only view of the filesystem.
• 3. Credential folders (~/.ssh, ~/.aws) are replaced with empty ones.
• 4. Secret‑looking environment variables are removed.
• 5. Git directories are locked read‑only.
• 6. If sandbox creation fails, the agent does not start and the editor reports an error.
• 7. The agent can still read its own token file but cannot touch other sensitive data.

Evidence

The plugin runs a command-line agent inside bubblewrap: a read-only filesystem except the project and a scratch directory, credential folders such as ~/.ssh and ~/.aws replaced with empty ones, secret-looking environment variables removed, and git directories locked read-only.

Source

The design rule is that it fails closed. If no sandbox can be created, the agent does not start, and Windows and macOS are refused rather than silently run without one.

Source