macOS sandbox config for Claude that restricts read access to filesystem | Hacker News Reader