Your AI coding agent can read your SSH keys. I built a Neovim plugin that won’t start it unprotected

Описание и применение

Плагин xyno-sandbox.nvim запускает кодинг‑агент в изолированной среде bubblewrap, запрещая доступ к ~/.ssh, ~/.aws и git‑истории. Если изоляция не создаётся, агент не запускается, защищая от утечки ключей.

Задача

When a Neovim coding agent runs with the editor’s privileges, it can access sensitive files such as ~/.ssh, ~/.aws, and git history, exposing credentials to the agent.

Результат

The sandboxed agent prevents accidental exposure of SSH keys, AWS credentials, and git history while still allowing normal coding workflow. It fails closed if the sandbox cannot be created, ensuring no unprotected agent runs.

Рабочий процесс

• 1. Install the xyno-sandbox.nvim plugin.
• 2. The plugin launches the coding agent via bubblewrap with a read‑only view of the filesystem.
• 3. Credential folders (~/.ssh, ~/.aws) are replaced with empty ones.
• 4. Secret‑looking environment variables are removed.
• 5. Git directories are locked read‑only.
• 6. If sandbox creation fails, the agent does not start and the editor reports an error.
• 7. The agent can still read its own token file but cannot touch other sensitive data.

Доказательства

The plugin runs a command-line agent inside bubblewrap: a read-only filesystem except the project and a scratch directory, credential folders such as ~/.ssh and ~/.aws replaced with empty ones, secret-looking environment variables removed, and git directories locked read-only.

Источник

The design rule is that it fails closed. If no sandbox can be created, the agent does not start, and Windows and macOS are refused rather than silently run without one.

Источник