TLDR; isolate your runtime. I got this working early Q4 2025 for Claude Code, since then I also have it for codex / pi-agent / opencode and I moved to transient workspaces, readonly config mounts. I didn't use incus/lxc because I use throwaway VPSs + docker for process isolation.
The only thing still on my wishlist is a full hashicorp vault secrets orchestration for forge tokens. Currently the forge is isolated over wireguard and mTLS, and RBAC'd, but it would be good to not expose any secrets to agents at all. Just proxy endpoints that inject credentials based on workday authorizations. It can't really do anything except access prior work it is authorized to, but still, 16h token lifetimes are better than 30 day lifetimes.
TLDR; isolate your runtime. I got this working early Q4 2025 for Claude Code, since then I also have it for codex / pi-agent / opencode and I moved to transient workspaces, readonly config mounts. I didn't use incus/lxc because I use throwaway VPSs + docker for process isolation.
The only thing still on my wishlist is a full hashicorp vault secrets orchestration for forge tokens. Currently the forge is isolated over wireguard and mTLS, and RBAC'd, but it would be good to not expose any secrets to agents at all. Just proxy endpoints that inject credentials based on workday authorizations. It can't really do anything except access prior work it is authorized to, but still, 16h token lifetimes are better than 30 day lifetimes.