Building Agents that Don't Break Themselves

Summary

Agents that call shell commands can damage their host, so the post separates the agent’s durable home from the environment where untrusted code executes. It presents Sprites as disposable, isolated sandboxes, with one Sprite per session for the multi-user SpriteDoc and one persistent Sprite per task for Hermes Agent. SpriteDoc injects each user’s flyctl credential only for the command that needs it, avoiding token storage while preserving the user’s permissions; Hermes can omit approval prompts because the sandbox protects the host. The same separation applies when Hermes itself runs inside a Sprite: its commands are dispatched to another Sprite with a different identity and boot. Copy-on-write checkpoints provide an undo path, restoring deleted files and tools in about nine seconds.

Takeaways

1. 1

   SpriteDoc gives each session its own Sprite, isolating commands from both the agent process and other users; idle Sprites become warm or cold and can later be torn down.

2. 2

   SpriteDoc injects a user’s flyctl token only for the duration of an authenticated command, so the credential is never stored at rest in the sandbox.

3. 3

   Hermes can checkpoint a Sprite before risky work and restore it in about nine seconds, recovering deleted files and executables through copy-on-write restoration.