macOS sandbox config for Claude that restricts read access to filesystem | Heykuki News