devvm launches isolated VMs for AI coding

devvm targets the biggest weakness in autonomous coding: excessive blast radius. Its per-project VM model makes “full permissions” more practical, though users still need to understand that no sandbox eliminates every attack path.

• –Host-held secrets and proxy-based authentication reduce credential exposure.
• –Default network allowlisting limits prompt-injection and supply-chain exfiltration paths.
• –Auto-detected toolchains and cached images address the setup friction that makes secure environments unpopular.
• –Clone mode provides a safer review workflow by keeping agent changes away from the working tree.
• –Lima-based VMs offer stronger isolation than containers, but consume more resources and add operational complexity.