News for hackers. Stuff that matters.

A comment on Auto mode is now the default in Claude Code. Parent comment

Re:Auto mode is now the default in Claude Code by e1g on Monday August 10, 2026 @08:06AM (#49242590)
On a Mac, you can do this via OS-native Seatbelt sandboxing - you define a static text file and it locks down the process so it can't read/write anything it's not supposed to. The syntax is a bit archaic, so I built a Bash wrapper around it to dynamically detect which agent you use and from what dir, and then generate the policy to lock down its process - https://github.com/eugene1g/agent-safehouse
[ Parent | on HN ]
Re:Auto mode is now the default in Claude Code by shelled on Tuesday August 11, 2026 @01:55AM (#49253869)
Hey, thank you. Looks like a tool easy enough to use and start with the agentic world in a sandboxed and much safer manner.

Just clarifying a bit (haven't gone through details yet):

1. So, a harness gets installed within the bounds of this script via agent-safehouse? (I doubt this is the case)

2. Or they are installed as a normal app, but when I run them in the terminal within the bounds of "safehouse <harness>" (saw this) they are bound by the rules I set, right?

I feel it's the latter and I think it's good enough for the time being.

.....

Mac offers some controls at least for personal files and "Full Disk Access" etc. But it's so badly implemented and poorly shown that it's confusing.

Like I can see in "Privacy & Security > Full Disk Access" OpenCode is listed and and "Full Disk Access" toggled off. (I anyway remove OpenCode from here completely by the "-" button after selecting it, just to make sure).

Then I go back a step and in "Privacy & Security > Files & Folders > OpenCode" has "Full Disk Access" is listed there. Strange!

[ Parent | on HN ]
Re:Auto mode is now the default in Claude Code by e1g on Tuesday August 11, 2026 @01:41PM (#49261756)
“safehouse <harness>” hides and protects your filesystem from the agent CLI - it cannot read/write/delete anything outside of the current folder, no matter what Bash/code it tries (short of finding some 0-day within MacOS sandboxing). We added exceptions for dev tooling (so eg NPM works), but generally keep same defaults (eg no Docker access by default as having that socket bypasses all protection)
[ Parent | on HN ]