feat: add agent-sandbox.nix

[archie-judd]

Add agent-sandbox.nix to Development

Adds agent-sandbox.nix to the Development section.

It's a lightweight Nix library for sandboxing AI coding agents (Claude Code, Copilot CLI, etc.) on both Linux and macOS using bubblewrap and sandbox-exec respectively. The agent gets read/write access to the project directory and any paths you explicitly declare; everything else - $HOME, SSH keys, other projects, the system keychain - is hidden behind an ephemeral tmpfs. Network access can optionally be restricted to an allowlist of domains and HTTP methods via a filtering proxy.

It slots in alongside the other dev-environment libraries already listed in this section (devshell, make-shell, MCP-NixOS, etc.) - you wire it into a flake.nix or shell.nix and invoke the wrapped binary from a dev shell.

Checklist

• Searched previous pull requests for duplicates.
• I am the author and active maintainer; have personally used it.
• Individual PR for a single suggestion.
• Uses the format [Resource Title](url) - description. (matching the existing entries in the file).
• Resource is more than 30 days old.
• Description is short.
• Entry is placed alphabetically (top of the Development section, before Arion).
• Spelling and grammar checked.

[cyntheticfox]

Is this PR LLM-generated? It feels...overly structured.

Also, given this project is a curation of tools for using and developing with the Nix language, this project seems at best a highly-specific mkShell framework using bubblewrap or container-exec.

Not saying it's not worth using for some individuals, I just don't see how this is really a project for using Nix than a project for using LLMs

[archie-judd]

Is this PR LLM-generated? It feels...overly structured.

Also, given this project is a curation of tools for using and developing with the Nix language, this project seems at best a highly-specific mkShell framework using bubblewrap or container-exec.

Not saying it's not worth using for some individuals, I just don't see how this is really a project for using Nix than a project for using LLMs

Yes, I wrote the description with an LLM.

The project is built to give Nix users an ergonomic way to sandbox their LLM usage. I see it is a development tool for Nix users - it seems congruent with the vein of some other tools in the repo, such as docker/containerisation utils.

But perhaps it might sit better in an LLM section?

I'm interested to hear your thoughts.

(Not written with an LLM)