I’ve been looking along a similar line, but I came at it from the infra side rather than the software. Mine pretends to be a local ACP agent, but it’s actually

I’ve been looking along a similar line, but I came at it from the infra side rather than the software. Mine pretends to be a local ACP agent, but it’s actually managing a Docker container and proxying the ACP connection into the container over websocket. You can specify a bunch of utility stuff in the YAML definition like directories to bind-mount, directories to copy from the host, scripts to run when the container starts, etc. You can also toggle whether ACP-native tools like read/write file and shells execute on your host or in the container (in container by default). Works well, I forget whether I’m on that or pi-ACP directly until it spits out a time in the wrong timezone or I forget that it can’t check my DNS settings or something. Really cuts down on the damage it can do. Mine is basically down to “it can delete my ~/.pi and the repo it’s working on” and that’s about it unless it can escape the container. https://github.com/SethCurry/abyss https://github.com/SethCurry/abyss