I have been kicking the tires on yoloai which seems to automate the "intercept API calls to hide API keys" step and the "sandbox the files in a docker container" step, with support for inspecting the files / diff before applying.

I don't quite have it to a smooth workflow for my needs ("research this codebase and draft a plan we can discuss, with code examples") but it seems promising.

https://github.com/kstenerud/yoloai