Agreed. I sandbox agents using containers which also allows me to inject credentials and all sorts of things.

I think there's 2 clear layers in these coding tools: the runtime engine that lives ON the system, can execute commands, read/write files, make network calls and the UI, which can be a local (TUI) or remote.

A remote UI allows you to manage multiple remote runtimes concurrently and can even be on your phone.

Anyone preferring Desktop vs TUI is not managing multiple systems I would guess.

It should be three (four) layers, and that seems to be the emerging architecture for agents.

Layer 1 is the frontend (TUI, GUI, phone app). Layer 2 is the brain / harness (the thing that stores sessions, connects to MCP servers and decides what to do next given the latest model answer). This part would ideally run in the cloud, and be independent of the particular ephemeral sandbox you run your commands in, or the particular phone you view the transcript on. Layer three is the hands (the thing that actually executes tool calls on a machine), this should be a small utility that the brain connects to over ssh, or a local Unix socket if colocated.