alchaplinsky

Well, actually `git clone --shared` writes an alternates file pointing at your object store and copies zero objects.

"read/write only the worktree", but git requires .git dir writable for common commands to work in a worktree. And that's where .git/hooks live. So agent inside that profile can still write a pre-commit hook that runs on your machine whenever you commit outside the sandbox. Or am I missing something?

Worktrees are the obvious pick, and I get why. One command, cheap, and if you're the only one driving, then sharing .git is the point rather than a compromise. I started there too.

An agent in a worktree can reach your hooks, your config, another worktree's stash. Probably not a common problem. But when it does happen you're not debugging your code, you're debugging git, and it's not obvious where to even start looking.

The one that actually bothers me is prompt injection. The agent reads an issue, or a dependency's README, or a web page, and what it's told to do is drop a file in the .git it can already write to. Next time you commit, that runs on your machine as you.

Separate thing - worktrees just get annoying to manage. Can't check out the same branch twice, so you're making up branch names to keep git happy. Every one is another directory to keep track of. Then something goes stale and you're back in git worktree prune.

So has any of it got to you? Or do you hit the annoying parts, shrug, and carry on?

Yeah, I haven't enrolled into apple developer program yet. Will notarize installers once i get those certificates

Happy to answer any questions.

Here’s a quick demo of the agent execution view:

https://raw.githubusercontent.com/fwdai/reticle/main/.github...

Agreed on the content part, for now this is just generally available info from tech blogs and wiki. Would appreciate some contribution from people knowing from first-hand experience.