LianYaoHu炼妖壶

Run Claude Code, Codex, or any code agent behind a helper-managed VPN network guard on macOS or Linux.

📦

Platform confinement

macOS runs the agent under sandbox-exec with a deny-default profile. Linux applies Landlock filesystem rules, seccomp syscall filtering, and owner-scoped firewall rules.

🔒

Network guard

A root helper runs each guarded process with the caller UID and a dedicated _lianyaohu effective GID, then installs group-scoped PF or iptables rules that leave other desktop traffic alone.

🔑

Credentials keep working

Agents join the caller's login session, so keychain-backed logins (Claude Code, gh, git credential helpers) don't prompt again, and loopback-only listeners keep OAuth callback flows working inside the sandbox.

🕵️

Identity hygiene

Host-identifying environment variables (hostname, SSH, MAC, serial, timezone markers) are stripped, TZ is pinned to UTC, and timezone preference files are denied by path — contents and metadata alike, so `readlink /etc/localtime` cannot report the host zone. In the default writable home a renamed parent directory can evade a path-based deny; narrow-home mode closes this.

🧪

Verified end to end

macOS and Linux helper paths are exercised in Tart VMs; Linux verifies firewall, filesystem, and process-syscall confinement in Ubuntu.