Agent Safehouse – macOS-native sandboxing for local agents

Re:Agent Safehouse – macOS-native sandboxing for local agents by divmain on Sunday March 08, 2026 @05:51PM (#47301930)

This is what I was going for with Treebeard[0]. It is sandbox-exec, worktrees, and COW/overlay filesystem. The overlay filesystem is nice, in that you have access to git-ignored files in the original directory without having to worry about those files being modified in the original (due to the COW semantics). Though, truthfully, I haven’t found myself using it much since getting it all working.

[0] https://github.com/divmain/treebeard

[ Parent | on HN ]

Re:Agent Safehouse – macOS-native sandboxing for local agents by xyzzy_plugh on Sunday March 08, 2026 @06:53PM (#47302477)

This approach is too complex for what is provided. You're better off just making a copy of the tree and simply using sandbox-exec. macFUSE is a shitshow.

The main issue I want to solve is unexpected writes to arbitrary paths should be allowed but ultimately discarded. macOS simply doesn't offer a way to namespace the filesystem in that way.

[ Parent | on HN ]

Re:Agent Safehouse – macOS-native sandboxing for local agents by divmain on Sunday March 08, 2026 @11:39PM (#47304631)

Completely agree; my approach was not the most practical. I mostly wanted to know how hard it would be and, as I said, haven’t used it much since. Yes, macFUSE is messy to rely upon. I feel as though the right abstraction is simply unavailable on macOS. Something akin to chroot jails — I don’t feel like I need a particularly hardened sandbox for agentic coding. I just need something that will prevent the stupid mistakes that are particularly damaging.

[ Parent | on HN ]