cco I another option in this space.
Agent Safehouse – macOS-native sandboxing for local agents
201–207 of 207 posts
Re: Agent Safehouse – macOS-native sandboxing for local agents
#202Earlier quoted context omitted.
I have sandbox-exec setup for Claude like you suggest, but I’m not sure every CLI supports it? Claude only added it a month or two ago. A wrapper CLI that allows any command to be sandboxed is pretty appealing (Claude config was not trivial). The downside is that it requires access to more than it technically needs (Claude keys for example). I’m working on a version where you sandbox the agent’s Bash tool, not the ag…
I like the idea but not the MCP part. How about using bash-tool to intercept the commands and then passing them onto the containers? https://github.com/vercel-labs/bash-tool
That's exactly what it does -- the bash commands are passed into the containers. It also manages container lifecycle (starting on first request, cleanup on connection shutdown).
If you're using an agent tool that already includes an existing bash tool which calls host OS, just remove that one and add this.
Re: Agent Safehouse – macOS-native sandboxing for local agents
#203fun fact about `sandbox-exec`, the macOS util this relies on: Apple officially deprecated it in macOS Sierra back in 2016! Its manpage has been saying it's deprecated for a decade now, yet we're continuing to find great uses for it. And the 'App Sandbox' replacement doesn't work at all for use cases like this where end users define their own sandbox rules. Hope Apple sees this usage and stops any plans to actually de…
Aside from named profiles, I'm not sure it wasn't born deprecated. In particular, has the profile language ever been documented by anything other than the examples used by the OS and third parties reverse engineering it?
Good point. I have no idea when it was introduced. Would be funny if it's been deprecated since its existence.
Re: Agent Safehouse – macOS-native sandboxing for local agents
#204[dead]
Re: Agent Safehouse – macOS-native sandboxing for local agents
#205See also various sandbox tools I and others (e.g. jpeeler) have collected: https://news.ycombinator.com/item?id=47102258
Priceless thank you
Re: Agent Safehouse – macOS-native sandboxing for local agents
#206Earlier quoted context omitted.
Thanks, Codex helped to put that together in like 20 minutes. Try feeding your agent the idea about an interactive config builder, give it the upstream URL with your condos, and see if it can whip up something for you.
condos?
I would guess conditions. Not certain.
Re: Agent Safehouse – macOS-native sandboxing for local agents
#207Not sure I understand this. Agent CLIs already use sandbox-exec, and you can configure granular permissions. You are basically saying - give the agents access to everything, and configure permissions in this second sandbox-exec wrapper on top. But why use this over editing the CLI's settings file directly (e.g. https://code.claude.com/docs/en/sandboxing#configure-sandbox... )?
Some agents use sandbox-exec, some agents don't, some agents that do use it have bugs configuring & executing sandbox-exec.
This may also have bugs but having a single setup for your sandbox reduces the surface area & frankly I have significantly more trust in literally any individual dev creating a free generic open-source tool than I do in a company selling frontier models as a service & vibe-coding[0] an afterthought companion cli at 80k loc/mo.