Article Summary (Model: gpt-5.2)
Subject: Mac agent sandbox wrapper
The Gist:
Agent Safehouse is a macOS-native way to run local coding agents “full-auto” while reducing the blast radius of mistakes. It generates and applies deny-first sandbox-exec (SBPL) policies so an agent can write only inside a chosen work directory (e.g., the git root) and is blocked by the kernel from accessing other repos, personal files, and common credential locations like ~/.ssh and ~/.aws. It ships as a single Bash script plus presets/investigations for many popular agent CLIs, and includes an online policy builder to produce a static profile you can reuse.
Key Claims/Facts:
- Deny-first SBPL profiles: Nothing is accessible unless explicitly granted; workdir is RW by default, other paths denied.
- Presets for agent tools: Provides templates/investigations for multiple agent CLIs and common integrations to keep them functional while constrained.
- Zero-dependency distribution: Designed as a self-contained shell wrapper and/or a policy generator you can run directly with
sandbox-exec.
Discussion Summary (Model: gpt-5.2)
Consensus: Cautiously Optimistic — people like the pragmatic “least-privilege on macOS” approach, but debate whether
sandbox-exec-based sandboxes are sufficient or even future-proof.Top Critiques & Pushback:
sandbox-execprofiles, so a second wrapper may feel redundant unless it improves UX/presets and works across tools (c47304797, c47305823).sandbox-execlongevity/security concerns: A recurring worry is that Apple has long-deprecatedsandbox-exec, so relying on it could be risky if it’s removed or has latent vulns (c47303842, c47304713).~/.gitconfig,~/.gitignore) or wanting process/debug tooling (lldb,pkill) and ask for more fine-grained toggles/overrides (c47302262, c47302500).Better Alternatives / Prior Art:
containertool and wrappers like Lume are mentioned (c47302154, c47305249).sandbox-exec) is suggested as easier to reason about as defense-in-depth (c47302271, c47305879).Expert Context: