I tried this but it's incredibly annoying as you'll get a mixture of file ownerships and permissions.

Instead I run it in bubblewrap sandbox: https://blog.gpkb.org/posts/ai-agent-sandbox/