A local firewall for agent-invoked CLIs: splitting read-only flags from dangerous writes
it_beaver · reddit · 2026-10-29
Background: the author maintains where-are-we, a CLI that builds a repo map (locations, call graph, test coverage) so coding agents can query it instead of grepping. Most agent usage is read-only, but a few flags mutate state outside the map: --agent-file rewrites CLAUDE.md/AGENTS.md, --install-hook edits /.claude/settings.json, and --specs/--spec-cmd fetch from a ticket tracker or run a command. When an agent fires these mid-task, you find out later when your instructions or hooks look different.
Solution: an extension for HOL Guard, an open-source local firewall sitting between agent and shell (merged last week): read-only calls pass silently; repo writes and tracker calls pause for approval; hook installation is marked high-risk; unknown flags also pause so newer tool versions can't slip past.
Gaps: tracker access via env vars, anything bypassing the agent's shell (e.g. pre-installed git hooks), and it's opt-in. The author asks CLI builders: do you split read/write flags yourself or leave it to the harness?
More from coding & agent
- Anthropic surfaced 29,000+ Node.js bug candidates in six months; fixing is now the bottleneck — dscape · 2026-10-29
- Six months later nobody remembers why: Reddit debate on architecture decision records — djgoel123 · 2026-10-29
- Auto-Company: open-source firm of 14 AI agents runs 24/7 with one markdown file as memory — JafarNajafov · 2026-10-29
- One rule for posting agents: never auto-retry a failed publish — petrusenko_max · 2026-10-29
- Explosion ships agent-ready NLP project templates that cut pipeline cost 20x — _inesmontani · 2026-10-29
- Live recursive self-improvement: AI optimizes GPU kernels on-screen, every gain measurable — heyshrutimishra · 2026-10-29