I don't think it's obvious but in my own experiments with this it's things like permissions that can get a little hairy. It's all doable and IMO preferable to have an agent-as-daemon. aider is kind of like this.