待翻譯：Show HN: Grith – syscall-level supervision for AI coding agents on Linux

AI 服務暫時不可用，以下為來源正文，待恢復後補全翻譯。

Uh oh! There was an error while loading. Please reload this page. Notifications You must be signed in to change notification settings Fork 0 Star 1 BranchesTags Open more actions menu Latest commit History 29 Commits 29 Commits Folders and files NameName Last commit message Last commit date .cargo .cargo .github .github Formula Formula config config contracts/analytics-v2 contracts/analytics-v2 crates crates dashboard dashboard dist/scoop dist/scoop docs docs scripts scripts .gitignore .gitignore .gitleaks.toml .gitleaks.toml .rustfmt.toml .rustfmt.toml CHANGELOG.md CHANGELOG.md CLA.md CLA.md CODE_OF_CONDUCT.md CODE_OF_CONDUCT.md CONTRIBUTING.md CONTRIBUTING.md Cargo.lock Cargo.lock Cargo.toml Cargo.toml LICENSE LICENSE Makefile Makefile README.md README.md SECURITY.md SECURITY.md SUPPORT.md SUPPORT.md clippy.toml clippy.toml deny.toml deny.toml Repository files navigation Install on Linux (x86_64 or arm64): curl -fsSL https://grith.ai/install | sh Wrap the agent you already use: grith exec -- claude-code "fix the failing test" Or run grith's own agent, with the same filters in front of every tool call: grith run "list every TODO in this repo" Every file read, shell command, network call, and process spawn is scored before the kernel executes it: Score Verdict What happens under 3.0 allow the call proceeds 3.0 to 8.0 queue the process freezes until you approve or deny it over 8.0 deny the call never runs Nothing runs on a maybe. Eleven built-in profiles (claude-code, codex, aider, cursor, cline, copilot, goose and others) auto-allow each tool's routine work, so the queue only sees the calls worth your attention. Supported platforms, other install methods, and building from source Platform Architecture Status Linux x86_64 supported (kernel 4.8+) Linux aarch64 supported (kernel 5.3+) macOS Apple Silicon / Intel v2.0 - needs an Endpoint Security backend Windows x86_64 v2.0 - needs an ETW backend The installer auto-detects your platform, verifies the SHA-256 checksum, and installs to ~/.local/bin. Pass --global to install to /usr/local/bin, or --version to pin a release: curl -fsSL https://grith.ai/install | sh -s -- --global You can also download a binary directly from the latest release, or build from source with Rust 1.88+ and Node 22+: git clone https://github.com/grith-ai/grith.git && cd grith && make dist Full build instructions are in the documentation. Verifying a release Every release ships a static musl binary with a SHA-256 checksum, a cosign keyless signature, a CycloneDX SBOM (itself signed), and SLSA build provenance. If cosign is on your PATH, the installer verifies the signature against the release workflow's identity automatically - no flags needed. To verify by hand, see release verification. What leaves your machine By default, nothing. The free tier runs entirely offline: no account, no telemetry, and the audit log stays in local SQLite. Paid tiers validate their licence against grith.ai roughly once a day, and sync aggregated analytics - counts, verdicts, risk and filter attribution, never commands, file paths, prompts or payloads - until you turn that off with general.audit_sync = false (licence validation continues; air-gapped deployments disable it too). The raw audit log never leaves your machine. Supervision-escape enforcement is on by default as of v0.2.5: spawning something that hands work to an unsupervised peer (systemd-run, docker, tmux) reaches the review queue rather than running unseen. Non-interactive sessions have no one to ask, so they fail safe and deny - if a CI script legitimately delegates, permit the binary in its profile or set supervisor.enforce_authority_delegating_spawn = false. Documentation Getting started - installation, configuration, and the CLI reference Security model - the filter pipeline, scoring, and what it does not cover Supervisor profiles - per-tool allowlists and how to write your own CHANGELOG - including the bypass classes we have not closed yet Contributing Pull requests are welcome - start with CONTRIBUTING.md, which covers the CLA and the local setup. grith is developed in a private monorepo and exported here per release, so this repository's history is one commit per export rather than per change; PRs are reviewed on GitHub and applied upstream with attribution. Found a security issue? Please follow SECURITY.md rather than opening a public issue. Licence Repository code: MPL-2.0 Pro and Enterprise capabilities ship in the same binary and are unlocked by signed licenses. Hosted billing, license issuance, and cloud sync infrastructure are not part of this repository. Topics Resources Readme MPL-2.0 license Code of conduct Code of conduct Contributing Contributing Security policy Security policy Activity Custom properties Stars 1 star Watchers 0 watching Forks 0 forks Report repository