{"slug": "new-sw-dev-tool-for-safe-local-ai-usage", "title": "New sw dev tool for safe local AI usage", "summary": "Developer Alex S. released sde, a single-binary CLI tool that creates role-separated, network-isolated containers for AI-assisted development on macOS 13 or later. The tool enforces an egress allowlist by default, keeps credentials on the host via a Unix-socket broker, and requires explicit time-boxed grants for write operations such as git push, aiming to prevent AI agents from exfiltrating code or secrets.", "body_md": "**Role-separated container isolation for AI-assisted development on macOS.**\n\n`sde`\n\nis a single-binary CLI that boots a private, network-isolated environment\nfor your project — a workspace container where your code (and AI agents) run,\nrole-separated data services, an egress firewall, and a credential broker that\nkeeps secrets on the host and out of the container filesystem.\n\nThink `docker compose up`\n\nfor AI-agent-safe development: your agent gets what\nit needs to work, nothing more.\n\nRunning an AI agent against your codebase means giving it a shell. That shell\ncan `curl`\n\n, `git push`\n\n, `aws s3 cp`\n\n, and read every `.env`\n\non your disk. `sde`\n\ndraws the boundary in the right place:\n\n**Egress allowlist by default**— the workspace can only reach the domains you list. Everything else is`NXDOMAIN`\n\nat the DNS layer and`DROP`\n\nat iptables. Cloud instance-metadata (`169.254.169.254`\n\n) is always blocked.**Credentials never leave the host**— Git tokens live in your macOS Keychain. The workspace talks to a Unix-socket broker; tokens are minted per-operation and injected via`GIT_CONFIG_COUNT`\n\nenv vars (no`.gitconfig`\n\non the container filesystem).**Write access is grant-based**—`git pull`\n\nis default-allowed;`git push`\n\nrequires an explicit, time-boxed`sde grant push`\n\nfrom your host terminal. Your agent can read; you decide when it can write.**AWS via credential_process**— no static keys in the container.`sde`\n\ninjects a`~/.aws/config`\n\ninside the workspace that calls back to the broker via`credential_process`\n\n; the broker shells out to`aws configure export-credentials`\n\non the host, so short-lived SSO credentials are vended per-operation without touching the container filesystem.\n\nBuild from source using `git`\n\n, `go`\n\n, and `make`\n\n— no package manager needed:\n\n```\ngit clone https://github.com/alexs60/safe-sde.git ~/src/sde\ncd ~/src/sde\nmake build helper\nsudo make install\n```\n\nFull instructions, Intel/arm64 notes, container image build, and air-gapped\nworkflow: see [ docs/INSTALL-LOCAL.md](/alexs60/safe-sde/blob/main/docs/INSTALL-LOCAL.md).\n\nHomebrew:`brew tap alexs60/sde && brew trust alexs60/sde && brew install sde`\n\n. The`brew trust`\n\nstep is required for any third-party tap. See[.]`docs/INSTALL.md`\n\n```\nsde version\nsde doctor\n```\n\n`sde doctor`\n\nchecks the configured runtime, Keychain access, credential\nstore, and your topology file — run it any time something feels off.\n\n- macOS 13 (Ventura) or later — Apple Silicon or Intel\n[Colima](https://github.com/abiosoft/colima)(`brew install colima`\n\n) — free, Apache 2.0, Docker-API compatible container runtime- Git\n\nOptional:\n\n- AWS CLI v2 (\n`aws configure export-credentials`\n\n) if you want AWS credentials available inside containers\n\nOrbStack works with a one-line topology change. See\n[docs/RUNTIMES.md](/alexs60/safe-sde/blob/main/docs/RUNTIMES.md) for installation, licensing, and\nthe `runtime_options`\n\nreference.\n\n```\n# 1. Store a GitHub PAT so workspace containers can clone private repos\nsde auth github --store\n\n# 2. Go to your project\ncd ~/my-project\n\n# 3. Generate a topology.yaml from the detected stack\nsde init\n\n# 4. Boot the environment (detaches by default)\nsde up\n\n# 5. Open a shell in the workspace container\nsde shell\n\n# 6. Grant write access when you want to push\nsde grant push --repo my-org/my-project --ttl 10m\n\n# 7. Stop everything\nsde down\n```\n\n`sde up`\n\nis idempotent — run it twice and it tells you the environment is\nalready running. `sde down`\n\nstops containers but preserves volumes;\n`sde nuke`\n\nwipes state entirely.\n\nFor a full walkthrough including AWS SSO and first-run setup, see\n[ docs/GETTING-STARTED.md](/alexs60/safe-sde/blob/main/docs/GETTING-STARTED.md).\n\n```\nproject: my-project\n\nnetworks:\n  subnet: 172.30.0.0/16\n  egress:\n    deny_all_else: true\n    allow:\n      - registry.npmjs.org\n      - github.com\n      - api.anthropic.com\n\nservices:\n  dev:\n    role: workspace\n    image: ghcr.io/alexs60/sde/node-22-pnpm:latest\n    mounts:\n      - { type: bind, source: ., target: /workspace }\n      - { type: volume, source: node_modules, target: /workspace/node_modules }\n    ports: [3000, 3001]\n\n  db:\n    role: datastore\n    image: postgres:16\n    env:\n      POSTGRES_DB: myapp\n      POSTGRES_PASSWORD: dev\n    volumes: [pgdata]\n    ports: [5432]\n\ncredentials:\n  provider: pat            # or \"github-app\" for teams\n  push_requires_grant: true\n\naws:\n  profile: bedrock-dev\n  region: us-west-2\n```\n\nSee [ topology.example.yaml](/alexs60/safe-sde/blob/main/topology.example.yaml) for the full reference.\n\n| Command | What it does |\n|---|---|\n`sde init` |\nDetect the project stack and generate `topology.yaml` . `--template <name>` for a named template. |\n`sde up` |\nBoot the environment. Detaches by default; `--foreground` for debugging. |\n`sde down` |\nStop containers and the broker. Preserves volumes. |\n`sde nuke` |\nStop everything and delete named volumes for this project. |\n`sde shell [service]` |\nInteractive shell in a container (default: workspace). |\n`sde run <cmd...>` |\nRun a one-off command in the workspace container. |\n`sde logs <service> [-f]` |\nStream container logs. |\n`sde ports` |\nTable of service → host URL. |\n`sde status` (alias `sde ps` ) |\nServices, broker, AWS server, active grants, DNS. |\n`sde grant push --repo <r> --ttl 10m` |\nGrant time-boxed push access to a repo. |\n`sde revoke [--all | --id <id>]` |\nRevoke one or all active grants. |\n`sde audit [--tail N] [--project P]` |\nRead the JSONL credential audit log. |\n`sde auth github --store` |\nStore a GitHub PAT in macOS Keychain. |\n`sde auth github --status` |\nCheck whether a PAT is configured. |\n`sde auth aws [--profile <p>] [--device-code]` |\nTrigger AWS SSO re-auth from inside a container. |\n`sde doctor` |\nDiagnose runtime, credentials, socket, and topology. |\n`sde version` |\nVersion information. |\n\n```\nHost (macOS)                          Container runtime\n────────────────                      ─────────────────\n\n  sde CLI ────────► broker daemon ◄────── credential helper\n                    (~/.sde/broker.sock)  (in workspace container)\n                          │\n                    macOS Keychain          workspace: node/pnpm/git/gh\n                    (PATs, AWS creds)             │\n                                                  │\n  aws CLI ◄── aws configure export-credentials    │\n  (host process, reads SSO cache)                 │\n                                                  ▼\n                                          DNS resolver container\n                                          (allowlist enforcement,\n                                           IMDS always blocked)\n                                                  │\n                                                  ▼\n                                          datastore containers\n                                          (postgres, redis, ...)\n```\n\nThe container runtime is Colima by default; OrbStack is an alternative —\nsee [ docs/RUNTIMES.md](/alexs60/safe-sde/blob/main/docs/RUNTIMES.md).\n\n**Workspace containers** run your code and any AI agent. They can`git pull`\n\nfreely but need a grant to push.**Datastore containers** are network-reachable by workspaces (`db.myproject.sde.local`\n\n) but have no external network access.**The credential broker** runs on the host, listens on a Unix socket bind-mounted into workspace containers, mints per-operation tokens.**The DNS resolver** runs as a sidecar container on a pinned bridge IP; workspace containers use it via`--dns`\n\n. iptables inside the workspace drops raw-IP traffic to block DNS bypass.\n\nThe full architecture lives in [ docs/](/alexs60/safe-sde/blob/main/docs) once you have it locally,\nbut the CLI is the primary interface — start with\n\n`sde --help`\n\n.\n\n```\ngit clone https://github.com/alexs60/safe-sde.git\ncd sde\ngo mod download\nmake build          # produces bin/sde and bin/sde-credential-helper\nmake test           # unit tests\nmake test-int      # integration tests (requires Colima or OrbStack running)\nmake lint\n```\n\nGo 1.25+ required. No CGo dependencies — binaries are fully static.\n\n**Hexagonal architecture.** Core domain (`internal/core/`\n\n) has zero external imports. Everything crosses a port interface (`internal/port/`\n\n) to reach an adapter (`internal/adapter/`\n\n). Colima is the default; swapping to another Docker-API-compatible runtime (e.g. OrbStack) requires one topology line change and one interface implementation.**Boring where possible.** No custom crypto, no bespoke daemon frameworks. Unix sockets, JSON-newline protocol, standard`os/exec`\n\n, standard`text/template`\n\n,`github.com/docker/docker`\n\nSDK,`miekg/dns`\n\n,`github.com/spf13/cobra`\n\n.**Failure closes.** Broker crash → containers lose credential access, not gain it. Missing allowlist → deny by default. iptables not available in a BYOI image → warn and continue with DNS-layer protection only.**Zero sudo for the happy path.** mDNS/Bonjour handles`*.sde.local`\n\nname resolution on the host. No`/etc/hosts`\n\nwrites, no LaunchDaemon requiring root.\n\nGNU General Public License v3.0 or later (`GPL-3.0-or-later`\n\n) — see\n[ LICENSE](/alexs60/safe-sde/blob/main/LICENSE) for the full text and\n\n[for the notice and third-party summary.](/alexs60/safe-sde/blob/main/COPYRIGHT)\n\n`COPYRIGHT`\n\nsde is copyleft: if you distribute it, or a modified version, you must make the corresponding source available to your recipients under the same licence. Running it — including inside your own organisation — carries no such obligation.\n\nThe GPL covers sde's own source. The container images under `images/`\n\naggregate\nDebian/Ubuntu packages and third-party CLIs under their own licences; that\naggregation does not relicense them. See [ COPYRIGHT](/alexs60/safe-sde/blob/main/COPYRIGHT).\n\n`sde`\n\nis under active development. The v1 target covers workspace isolation,\ncredential brokerage, egress policy, and AWS/GitHub credential integration on\nmacOS with Colima (default) or OrbStack. Linux runtime support and additional\ntoken providers are on the roadmap.\n\nBug reports and contributions welcome via GitHub issues and pull requests.\n\n*Latest E2E verification: 2026-07-21. Binary: sde 2fa6dcd.*", "url": "https://wpnews.pro/news/new-sw-dev-tool-for-safe-local-ai-usage", "canonical_source": "https://github.com/alexs60/safe-sde", "published_at": "2026-07-29 01:53:45+00:00", "updated_at": "2026-07-29 02:22:27.096989+00:00", "lang": "en", "topics": ["developer-tools", "ai-safety", "ai-agents"], "entities": ["sde", "Alex S.", "Colima", "OrbStack", "GitHub", "AWS", "macOS"], "alternates": {"html": "https://wpnews.pro/news/new-sw-dev-tool-for-safe-local-ai-usage", "markdown": "https://wpnews.pro/news/new-sw-dev-tool-for-safe-local-ai-usage.md", "text": "https://wpnews.pro/news/new-sw-dev-tool-for-safe-local-ai-usage.txt", "jsonld": "https://wpnews.pro/news/new-sw-dev-tool-for-safe-local-ai-usage.jsonld"}}