I really think that using something like Paseo (I use Ouijit[1] because I think it's actually a step ahead of where most of these multiplexers are) and nono[2] is basically the best coverage you can have, and really lets you go crazy with auto mode or permission skipping withiout having to worry about any security concerns.
A lot of people lean into the VMs but realistically it's not actually doing a lot of the security work that you need and leaves you wide open to prompt injection/exfiltration attaacks. The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better
The basis of the argument is that the labs are constantly pushing updates to their system prompts that are used in claude code or codex, which are exceptionally bloated and change the sand beneath your feet with every update.
By rolling your own harness, as long as you keep up with the latest advances and changes in the ecosystem, you capture a lot of the 'control' that LLM-based development feels like it strips from you.
Obvious disclaimer that I use pi.dev when I am aiming for consistency, not absolute quality. Custom harnesses on pi are what I ship, claude code is still my fallback if I need to make sure a PR is the highest absolute quality
My own opinion is that the "harness companies" (Anthropic, OpenAI, Cursor etc.) are fucked long-term since customers will tire of that quicksand. As the models improve, we will tire of that harness crap.
Oneleet (YC S22) | Multiple Roles | US & NATO Countries | Remote | Full-time
Oneleet is an all-in-one cybersecurity startup that has built its own Attack Surface Monitoring (ASM), Code Scanner, Dependency Management, Endpoint Protection, and Compliance Platform. We recently raised a Series A and are growing at an rapid pace and working on some very exciting projects.
What we're looking for:
- Strong problem solvers who can work independently in a remote environment
- Security-minded professionals passionate about building robust, scalable systems
Tech stack: Go, TypeScript, React, Kubernetes
We have a huge number of roles open across the organization from Engineering (backend, frontend, fullstack, AI, infra) to Operations.
If you're interested in joining our team, please reach out to join<at>oneleet<dot>com with the subject line "HN: <Job Title>" and your resume attached. Alternatively, you can also apply at https://jobs.ashbyhq.com/oneleet
Git worktrees are a great isolation boundary for _changes_ (especially making changes in parallel on a single machine), but not behavior. If you are trying to actually run autonomous agents securely you need something that lives outside the harness that actually blocks actions in a way that can't be prompted around.
We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval. Our developers can just run `task claude` or whatever their harness is) and it pre-wraps it with our profile that enforces:
- Filesystem: read/write only the worktree plus dev-tooling dirs (Go, Doppler, Graphite caches, git common dir); explicitly no Docker socket and it can't edit its own Claude settings files (so it can't loosen its own permissions).
- Network: outbound only to an allowlist - Anthropic, Doppler, Go module proxies, our dev environments while still allowing binding local dev-server ports.
- GitHub: read anything in the org, and create/edit PRs and push branches - but it cannot merge, close, review, or comment on PRs, delete branches, touch repo settings/secrets, manage auth, or use raw gh api. Those are all "human-only". GitHub tokens are never exposed to the agent; they're injected by a proxy so it can't read or exfiltrate them.
This is great because it is harness agnostic - any developer can use whatever harness they want as long as they port the nono profile to it, as it will enforce all of the above in a way that is not tied to a specific harness implementation
nono is great but you'll still won't be able to run multiple dev servers, dbs or test in the browser...
the better alternative is using sandboxes, for TRUE isolation.
but most people skip them because it's harder to set up a dev environment in a sandbox, for this I built agentbox [1], a tool to teleport your files, skills, settings, claude/codex subscriptions etc in any of the popular sandboxes. eg:
agentbox e2b claude
or:
agentbox hetzner codex
each session is persistent, with a full VM, with a browser, webVNC screen sharing and local https tunnel for easy preview on *.localhost domains.
Also git credentials never leave your pc: when a box needs access it passes through the agentbox service running on your machine, which allows PR creations, comments but only on the box branch, no deletion etc.
> nono is great but you'll still won't be able to run multiple dev servers, dbs or test in the browser...
With our profile setup you can do all three of those things - there is a fresh chrome profile that is blocked against the same network firewall. Claude and Playwright can navigate to the dev stack and screenshot/test it (and non-allowlisted websites are blocked at the network level).
As long as the developer runs the `task start` command outside the sandbox (because docker is blocked), the agent can then interact with it all that they want, and our devs can run 2-3 of these per machine and work on concurrent projects. (based on memory usage / cpu usage)
> a tool to teleport your files, skills, settings, claude/codex subscriptions etc in any of the popular sandboxes
FWIW this is _explicitly_ the opposite of our threat model - everything other than your git credentials that you 'teleport' in (code, settings, Claude/Codex subscription tokens) now lives inside the blast radius, on third-party infra, and a prompt-injected agent in the box can send it anywhere unless you're also egress-filtering. A VM isolates the machine - it doesn't protect the data.
Much easier to keep it all local and refuse any network or file access to anything you don't explicitly approve
"read/write only the worktree", but git requires .git dir writable for common commands to work in a worktree. And that's where .git/hooks live. So agent inside that profile can still write a pre-commit hook that runs on your machine whenever you commit outside the sandbox. Or am I missing something?
All git config and hooks are not writable inside the sandbox. This can be somewhat frustrating as you have to run git config commands outside, but the tradeoff is worth it imo. Nono allows for directory level permissioning, so the entire `.git/hooks` directory and `.git/config` / `.git/worktrees/*/config.worktree` are write blocked.
Worth calling out that this doesn't close all of these types of attacks, just the ones that are invisible (claude could very well write ./hack.sh and tie that in to your main.go, but at least it would be a diffable change, instead of invisible like a git hook)
I mean most of these tools pair the notes/transcript with a video recording of the call. It can be super helpful to search the summaries to find the right recording, and then click the line in the transcript to re-watch the meeting.
For work, this is strictly better than not recording the meeting, as it allows for much faster searching, and it is very rarely wrong about the high level topics of a convo. I almost always go "General AI summary search" -> Transcript -> recording when trying to remember a specific item from a call.
That being said the parent article is spot on and I can't imagine someone bringing a recording to a conversation they aren't being paid to have.
Oneleet (YC S22) | Multiple Roles | US & NATO Countries | Remote | Full-time
Oneleet is an all-in-one cybersecurity startup that has built its own Attack Surface Monitoring (ASM), Code Scanner, Dependency Management, Endpoint Protection, and Compliance Platform. We recently raised a Series A and are growing at an rapid pace and working on some very exciting projects.
What we're looking for:
- Strong problem solvers who can work independently in a remote environment
- Security-minded professionals passionate about building robust, scalable systems
Tech stack: Go, TypeScript, React, Kubernetes
Open role highlights:
- Application Security Engineer: Help drive the design and implementation of bleeding edge security tooling
- Application Software Engineer: Contribute to an all-in-one cybersecurity agent for devices, including security alerting and mobile device management
- Product Marketing Manager: Build the sales enablement arsenal and thought leadership content that turns technical capabilities into deals won
- We are also hiring across the stack (backend, frontend, fullstack, AI, infra) on the engineering team.
If you're interested in joining our team, please reach out to join<at>oneleet<dot>com with the subject line "HN: <Job Title>" and your resume attached. Alternatively, you can also apply at https://jobs.ashbyhq.com/oneleet
I do not think that is the problem with markdown lol. There are lots of problems with markdown, especially vanilla or the more limited versions of it - but really its super power is that it is readable with a regular text editor (or `cat`) and can be rendered without a compilation step.
Markdown is not competing with latex or typst, it is competing with (and has won against) .txt files
Actually basic typst is as readable as markdown, e.g. this is the example from the webapp:
= The Typst Playground
Welcome to the Typst Playground! This is a sandbox where you can experiment with Typst. You can type anywhere in the editor panel on the left. The preview panel to the right will update live.
= Basics <basics>
Typst is a _markup_ language. You use it to express not just the content, but also the structure and formatting of your document. For example, surrounding a word with underscores _emphasizes_ it with italics and starting a line with an equals sign creates a section heading.
Typst has lightweight syntax like this for the most common formatting needs. Among other things, you can use it to:
- *Strongly emphasize* some text
- Refer to @basics
- Typeset math: $a, b in { 1/2, sqrt(4 a b) }$
That's just the surface though! Typst has powerful systems for scripting, styling, introspection, and more. In the realm of a Typst document, there is nothing you can't automate.
It's difficult because even if the underlying model is very good, not having a pre-built harness like Claude Code makes it very un-sticky for most devs. Even at equal quality, the friction (or at least perceived friction) is higher than the mainstream models.
If one finds it difficult to set up OpenCode to use whatever providers they want, I won't call them 'dev'.
The only real friction (if the model is actually as good as SOTA) is to convince your employer to pay for it. But again if it really provides the same value at a fraction of the cost, it'll eventually cease to be an issue.
"If one finds it difficult to set up OpenCode to use whatever providers they want, I won't call them 'dev'."
I feel the same way. But look at the ollama vs llama.cpp post from HN few days back and you will see most of the enthusiasts in this space are very non technical people.
You should check out Ouijit [1] - I use it regularly for work and it's nice because it focuses on the environment that you want, and just gives you a shell that you can use any tooling in, as well as VM isolation per worktree if needed.
Been building an E2EE chat client on the weekends that sits right between Discord (but dis-enshittified) and Matrix (but with good UX around encryption). Still got some rough edges - we are in the second nine of the march of nines in terms of quality.
I really think that using something like Paseo (I use Ouijit[1] because I think it's actually a step ahead of where most of these multiplexers are) and nono[2] is basically the best coverage you can have, and really lets you go crazy with auto mode or permission skipping withiout having to worry about any security concerns.
A lot of people lean into the VMs but realistically it's not actually doing a lot of the security work that you need and leaves you wide open to prompt injection/exfiltration attaacks. The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better
1. https://ouijit.com/ 2. https://nono.sh/