Sandboxed AI agents are safer — but they're blind to your codebase. File-system agents are risky, but they're the only way an AI coding tool can ship the last mile with you: actually extending and wiring code, instead of hallucinating against an empty stage. This divide isn't academic. It decides whether your coding agent is a co-pilot that can ship features, or just a chatbox with code syntax.
AI-native templates only work if the agent can see and shape real files. Every OTF kit ships as a codebase by default — plus a CLAUDE.md, .cursorrules, and hand-authored AI config in-tree — because the contract is to hand you a working starting point, not a PDF or a throwaway black box.
The core divide: sandboxed agents vs. file access
There are two kinds of code AI agents: those that run inside a safe, limited sandbox (no real file I/O, read-only ASTs, sometimes access to snippets or project.json), and those that can inspect and rewrite your actual file tree.
Sandboxed agent:
