This repository exists because most vibe-coding tools come with permission controls that are far too loose and barely configurable. Instead of waiting for a product that is both pleasant to use and serious about security boundaries, I would rather define those boundaries myself.
The safety of my machine is ultimately my responsibility. This project uses bubblewrap to put that principle into practice with a sandbox I can inspect, tune, and trust.
I am not formally trained in computer science or security; this project mostly comes from reading a bit of the bubblewrap documentation and using it to build boundaries that make sense for my own machine.
The scripts here are meant to be simple starting points for anyone who needs them; I keep them as minimal as possible, and my own workflow is usually to copy one into the place where I need it and then add any special customization there.
bwrapPi.sh intentionally starts pi-permission-modes in YOLO mode. Pi's own permission and sandbox layers are not security boundaries here; the enclosing Bubblewrap namespace is.