agentvfs gives you a single proxy surface (avfs proxy exec -- cmd) that handles checkpoints, isolation, timeouts, and change tracking without the syscall-level complexity or the daemon overhead.