An agent nuked half my Obsidian vault. How are you sandboxing your coding agents?

Mid-session, Claude Code was running inside my Obsidian Second Brain when it fired off a cleanup command that deleted half my notes. Only Obsidian Sync backups saved 2 years of work. I first did what everyone recommends and ran my agents in a completely different VM. The UX was terrible. You lose your conversations, config, and memory every time you switch. For day-to-day operations, I hated it. Instead of jailing the entire environment, I considered sandboxing only the computer-use tools (read, write, edit, bash) while keeping the harness on my local computer, transforming my harness into a control plane. Every tool the LLM emits gets wrapped by a sandbox executor. The tool never knows where the command runs. You keep your conversations, config, and memory, while execution stays isolated. Which means you can easily swap your execution backend: local Docker/Podman containers, or remote Modal sandboxes. By running remote sandboxes, you have some dope side effects: You can easily swap compute: Switch your sandbox from a CPU to a GPU machine for agentic inference or fine-tuning tasks. Such as renting 8xB200 on Modal to process your docs with Kimi K3. You can orchestrate a swarm of subagents with your host harness, each running in a different remote sandbox, without being limited by your own machine. Still, for ad-hoc supervised sessions, a sandbox feels like overkill. I am still running Claude Code in my Obsidian vault without sandboxing, as the friction annoys me more than the possibility of losing data. That's why I am curious: how do you sandbox your coding agents while nicely integrating them into your existing workflow?