Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auto mode is now the default in Claude Code

claude.com

Post reply on HN
Print view View original

331–334 of 334 posts

Re: Auto mode is now the default in Claude Code

#331

Post by olek1983 »

Retr0id wrote: post #170
awkii wrote: post #52

I'm apparently from the very small faction of users who's been running `--dangerously-skip-permissions` in every instance of Claude for the last year. It's almost a reflex to me. For the most part Claude behaves well, but I don't blindly trust it. LLMs are inherently dangerous tools, and reviewing individual commands (or spamming `y`) doesn't make them less so. Safety is the responsibility of the developer putting sa…

I manually approve everything (aside from the "allow commands like this" option). Not because I'm worried it's about to do something harmful but because I want to stop it from wasting tokens doing something stupid like implementing a feature I never asked ask for. I'm not even reading the commands, just checking it's going in vaguely the right direction. I think my ideal setup would not involve approving commands, bu…

Tough call. On one hand, CC keeps asking me about the permissions; it shouldn't. On the other hand, I would rather not unleash it.

Currently, I'm running an internal experiment.

1. I have a side project. 2. I want to give the full control; CC is the so-called CEO, and I'm the so-called president of the board.

The cost of an error is marginal. I would like to see how this will end. The test is in progress.

Re: Auto mode is now the default in Claude Code

#333

Post by e1g »

shelled wrote: post #328
e1g wrote: post #266

Earlier quoted context omitted.

On a Mac, you can do this via OS-native Seatbelt sandboxing - you define a static text file and it locks down the process so it can't read/write anything it's not supposed to. The syntax is a bit archaic, so I built a Bash wrapper around it to dynamically detect which agent you use and from what dir, and then generate the policy to lock down its process - https://github.com/eugene1g/agent-safehouse

Hey, thank you. Looks like a tool easy enough to use and start with the agentic world in a sandboxed and much safer manner. Just clarifying a bit (haven't gone through details yet): 1. So, a harness gets installed within the bounds of this script via agent-safehouse? (I doubt this is the case) 2. Or they are installed as a normal app , but when I run them in the terminal within the bounds of "safehouse " (saw this) t…

“safehouse ” hides and protects your filesystem from the agent CLI - it cannot read/write/delete anything outside of the current folder, no matter what Bash/code it tries (short of finding some 0-day within MacOS sandboxing). We added exceptions for dev tooling (so eg NPM works), but generally keep same defaults (eg no Docker access by default as having that socket bypasses all protection)

Re: Auto mode is now the default in Claude Code

#334

Post by glerk »

imtringued wrote: post #271
glerk wrote: post #95

Earlier quoted context omitted.

No. I haven't approved commands in more than a year. Worst that I've seen was some agent running git checkout -- in a repo with uncommitted changes. Annoying, but not catastrophic. Imo these explicit tool-level permissions are really just a bandaid for bad sandboxing. Just be aware of where you are running your agent and what data is at risk of being destroyed or compromised. Assume that arbitrary code can run at any…

I struggle to see the difference between sandboxing and only allowing access to specific executables (not bash for starters) with an approval rule for the arguments.

Mainly ergonomics. Deriving all these approval rules is a pain and you're likely to miss something.

> not bash for starters

you'll end up either severely limiting what your agent can do or force it into finding some inefficient workarounds (they can be very creative...)

Post reply on HN