Your AI coding agent can read your SSH keys. I built a Neovim plugin that won’t start it unprotected

说明与用途

xyno-sandbox.nvim 插件使用 bubblewrap 将编码代理运行在沙箱中，阻止访问 ~/.ssh、~/.aws 和 git 历史记录。如果无法创建沙箱，代理将不启动，从而保护凭据。

问题

When a Neovim coding agent runs with the editor’s privileges, it can access sensitive files such as ~/.ssh, ~/.aws, and git history, exposing credentials to the agent.

结果

The sandboxed agent prevents accidental exposure of SSH keys, AWS credentials, and git history while still allowing normal coding workflow. It fails closed if the sandbox cannot be created, ensuring no unprotected agent runs.

工作流

• 1. Install the xyno-sandbox.nvim plugin.
• 2. The plugin launches the coding agent via bubblewrap with a read‑only view of the filesystem.
• 3. Credential folders (~/.ssh, ~/.aws) are replaced with empty ones.
• 4. Secret‑looking environment variables are removed.
• 5. Git directories are locked read‑only.
• 6. If sandbox creation fails, the agent does not start and the editor reports an error.
• 7. The agent can still read its own token file but cannot touch other sensitive data.

证据

The plugin runs a command-line agent inside bubblewrap: a read-only filesystem except the project and a scratch directory, credential folders such as ~/.ssh and ~/.aws replaced with empty ones, secret-looking environment variables removed, and git directories locked read-only.

来源

The design rule is that it fails closed. If no sandbox can be created, the agent does not start, and Windows and macOS are refused rather than silently run without one.

来源