1 hack
Turn on `/sandbox` so OS-level filesystem and network boundaries replace many per-command Bash prompts.