FRESH

Hacker News

Show HN: Ash, an Agent Sandbox for Mac

13 points by amsha

by miltieIV2

1 subcomments

No way to submit bug reports other than email - I'll forward this. How about at least a GitHub stub repo for Issue reports? Lot's of permissions (but missing "Full Disk Access" in the UI setup flow) I didn't know it also needed FDA until I did "ash status". Why is there a Login? GitHub login broken - 404.
No Source - This is a security tool that can't be audited. You had your 5 minutes on HN, but you'll need the community for Linux and Windows.
Yeah, overloaded name - how about AgSh.app / agsh? It's not too late to fix it.

by dhblumenfeld1

0 subcomment

this is great. The environment variable control is particularly interesting to me. I've been working on a related problem but different approach: encrypting/decrypting secrets using the Mac's secure enclave (https://github.com/keypo-us/keypo-wallet/tree/main/keypo-sig...). The two approaches seem complementary: Ash controls the perimeter, encrypted vaults protect the values themselves.

by breadcat

0 subcomment

love the tool but the name is used by a lot of folks. I'll try it regardless though. was just talking to someone about this very thing today during a meeting

by nxtfari

0 subcomment

I believe you’re late to the “ash shell” name by about 36 years
https://en.wikipedia.org/wiki/Almquist_shell

by s3anw3

0 subcomment

Great tool! I've witnessed numerous cases where novice users lost critical data assets by recklessly granting proxies/AI agents excessive permissions without understanding the security implications.

by socialinteldev

1 subcomments

the network restriction question is the interesting one for agent sandboxing — the real risk isn't the agent reading files it shouldn't, it's exfiltrating data through api calls to attacker-controlled endpoints. for agent-to-agent payment protocols like x402 the question gets weird: the agent needs outbound to pay for data, but you want to allowlist which endpoints it can call. per-process network policy + endpoint allowlisting seems like the right primitive here

by ThroneCreator

1 subcomments

One thing that comes to mind is whether the sandbox can restrict outbound network access per process or per command. That could be useful for preventing agents from silently exfiltrating data while still allowing limited API calls.

by jakejmnz

1 subcomments

by tonyekh

0 subcomment

by Muhammad523

1 subcomments

by cjbarber

1 subcomments

See also various sandbox tools I and others (e.g. jpeeler) have collected: https://news.ycombinator.com/item?id=47102258

0 subcomment