macOS-native sandboxing for local agents | Hacker News Reader