Try an external sandboxing tool. When you need to adjust the sandbox, close the agent, launch it with the new params, and resume the session. It doesn't take long to arrive at a stable configuration; for me it's mostly about rw access to the CWD, read access to other local repos, and access to Nix. Other than that I can just use YOLO modes and not sweat it.

I briefly evaluated a bunch (had an LLM make a list of those that satisfied some basic criteria, then visited READMEs and websites) and chose nono. No regrets: https://nono.sh/

I'm on the $100/m plan and it works.