3 ms·

Came here to write this. Built my own harness with much better sandboxing, because I am using abliterated models for the implementations and they sure try to e

Came here to write this. Built my own harness with much better sandboxing, because I am using abliterated models for the implementations and they sure try to escape out of their sandboxes. A lot. The sandbox from other harnesses like e.g. OpenCode essentially is useless. They think parsing arguments alone to detect paths helps, and LLMs know that because they will just pipe data differently then to escape the path traversal checks. Happened a lot to me (and was the primary reason for my to write my own harness from scratch). Thinking in filesystem access alone is also a futile attempt at sandboxing. A much better way to think about sandboxes is policies and capabilities, with temporary access for agent roles rather than sessions (or, well, forever). [1] UI still needs lots of work though: https://github.com/cookiengineer/exocomp https://github.com/cookiengineer/exocomp

everforward 23d ago
I’ve been looking along a similar line, but I came at it from the infra side rather than the software. Mine pretends to be a local ACP agent, but it’s actually managing a Docker container and proxying the ACP connection into the container over websocket. You can specify a bunch of utility stuff in the YAML definition like directories to bind-mount, directories to copy from the host, scripts to run when the container starts, etc. You can also toggle whether ACP-native tools like read/write file and shells execute on your host or in the container (in container by default). Works well, I forget whether I’m on that or pi-ACP directly until it spits out a time in the wrong timezone or I forget that it can’t check my DNS settings or something. Really cuts down on the damage it can do. Mine is basically down to “it can delete my ~/.pi and the repo it’s working on” and that’s about it unless it can escape the container. https://github.com/SethCurry/abyss https://github.com/SethCurry/abyss

everforward 23d ago

I’ve been looking along a similar line, but I came at it from the infra side rather than the software. Mine pretends to be a local ACP agent, but it’s actually managing a Docker container and proxying the ACP connection into the container over websocket. You can specify a bunch of utility stuff in the YAML definition like directories to bind-mount, directories to copy from the host, scripts to run when the container starts, etc. You can also toggle whether ACP-native tools like read/write file and shells execute on your host or in the container (in container by default). Works well, I forget whether I’m on that or pi-ACP directly until it spits out a time in the wrong timezone or I forget that it can’t check my DNS settings or something. Really cuts down on the damage it can do. Mine is basically down to “it can delete my ~/.pi and the repo it’s working on” and that’s about it unless it can escape the container. https://github.com/SethCurry/abyss https://github.com/SethCurry/abyss