Sandboxes and Worktrees: The Secure Agentic AI Dev Setup That Actually Works
Agentic AIRunning AI coding agents with production credentials in your primary user account is the default. It is also a significant security exposure. Mike McQuaid, lead maintainer of Homebrew, has published his full agentic setup — and it resolves this with two architectural decisions: sandboxed unprivileged accounts and git worktrees.
The Sandbox Architecture
McQuaid runs agents inside sandvault, a macOS sandboxing tool that creates separate non-admin user accounts. Code repositories live in /Users/Shared/sv-mike/repositories, accessible to both his primary account and the sandboxed sandvault-mike user via a trusted git directory configuration. The security benefit is concrete: agents running in the sandbox cannot execute destructive commands against non-version-controlled files, cannot abuse credentials like GITHUB_TOKEN on sensitive repositories outside the sandbox’s scope, and cannot exfiltrate data from directories the sandboxed user has no access to.
McQuaid’s assessment: “it closes the majority of risk vectors I care about.” The setup does not require a dedicated machine or complex infrastructure — just a disciplined separation between the environment where agents operate and the environment that holds production credentials.
Worktrees as Velocity Multiplier
Git worktrees enable simultaneous branch checkouts from a single repository, and McQuaid has configured Superset (a worktree orchestration tool) to spin up sandboxed agents against individual worktrees with single-prompt commands: sv claude -- or sv codex --. This parallelizes agent work so that multiple AI agents can operate on separate branches simultaneously, without interfering with each other or with the developer’s main working tree.
The toolchain is: Sandvault for isolation, Superset for worktree management, Fork for visual diff review before any output is accepted, Zed as the editor, and a combination of Claude Code, OpenAI Codex, Gemini, and OpenCode as the agents. Multiple agents, multiple branches, simultaneous execution. For the developer, the constraint shifts from “one agent at a time” to “how fast can I review output.”
He extends the architecture further with a ctpo Superset project — a personal context store containing meeting notes, goals, and personal data — enabling an AI executive assistant trained on his own writing style and priorities. The agentic patterns emerging from this approach point toward a persistent, context-rich agent layer sitting alongside the developer, not replacing them.
The So What
The sandbox-plus-worktrees pattern is reproducible without specialized hardware and addresses the most common objection to running AI agents at high autonomy: the risk that an agent with broad filesystem and credential access will cause hard-to-reverse damage. Sandvault or equivalent (Linux containers, dedicated VMs) handles the isolation. Worktrees handle the parallel branching. Review discipline — Fork for visual inspection before merging anything — handles the output quality gate. The result is a setup where, as McQuaid puts it, “more tokens/spend directly translates to more velocity” — because the infrastructure is no longer the constraint.
Source: Mike McQuaid
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →