Setting up your spare Mac for Claude Code to control, a step-by-step guide

将闲置 Mac 设置为 Claude Code 控制终端的详细指南

Here’s a full step-by-step guide on how to turn your spare Mac into an always-on machine Claude Code can fully control, with computer use enabled. You’ll be able to talk to it from your phone through the Claude app, or from your main Mac over SSH. In case you’re reading this on GitHub Pages, here’s the repo version. 这是一份完整的详细指南，教你如何将闲置的 Mac 变成一台 Claude Code 可以完全控制（并开启计算机使用功能）的常驻机器。你可以通过手机上的 Claude App 或主 Mac 上的 SSH 与其进行交互。如果你是在 GitHub Pages 上阅读本文，这里是对应的仓库版本。

Why do this?

为什么要这样做？

I wanted to create a separate environment Claude Code can control on its own, so I can delegate tasks I don’t necessarily want to run on my own machine - certain types of research tasks, and development tasks. Claude Code, especially with the --dangerously-skip-permissions flag on, carries inherent risk when run on your main machine. You can eliminate / mitigate these risks by creating a separate environment on your spare Mac with everything it needs to have access to. It has an added bonus of being able to talk to Claude Code anytime, anywhere from your phone. I’ve personally found it really useful because I often prefer to talk to Claude Code instead of regular Claude on the mobile app - Claude Code is often more capable. 我希望创建一个独立的运行环境供 Claude Code 自主控制，以便将那些我不希望在主力机上运行的任务（如某些研究或开发任务）委托给它。Claude Code 在运行时，尤其是开启 --dangerously-skip-permissions 标志时，在主力机上运行存在固有风险。通过在闲置 Mac 上创建一个拥有必要访问权限的独立环境，你可以消除或降低这些风险。此外，它还有一个额外的好处：你可以随时随地通过手机与 Claude Code 对话。我个人觉得这非常实用，因为相比手机 App 上的普通 Claude，我更倾向于使用 Claude Code，因为它通常能力更强。

The following guide assumes you have your main Mac as well as a spare Mac you can set up for this, but you should be able to take inspiration from it and apply it to any combination of two machines. 本指南假设你拥有一台主力 Mac 和一台可供设置的闲置 Mac，但你可以参考其中的思路，将其应用于任何两台机器的组合。

Why this setup?

为什么选择这种方案？

First, let’s quickly address a few questions you might have. Why not run it in a container? I’m a big proponent of running it in a container - I even built an entire environment for doing so conveniently. However, I’ve found it has a few limitations. First, it still runs on your main machine, so it’s not completely separated. For example, network requests it sends still go through your main machine. Second, there are limitations to the container’s capabilities. For example, I wanted my agent to be able to run Unity for game development, and there’s no easy way to do that in a container. The same goes for any other app that’s only available on a Mac - you won’t have access to it. That’s especially relevant if you want Claude Code to control these apps through computer use - clicking, dragging, and so on. 首先，让我们快速回答你可能有的几个疑问。为什么不使用容器运行？我非常支持在容器中运行——我甚至为此构建了一个方便的完整环境。然而，我发现它有一些局限性。首先，它仍然运行在你的主力机上，因此并非完全隔离。例如，它发送的网络请求仍会经过你的主力机。其次，容器的功能有限。例如，我希望我的智能体能够运行 Unity 进行游戏开发，而在容器中很难实现。对于任何其他仅限 Mac 使用的应用程序也是如此——你将无法访问它们。如果你希望 Claude Code 通过“计算机使用”功能（点击、拖拽等）来控制这些应用，这一点尤为重要。

Why not use something like OpenClaw? I personally like having access to the full, latest features of Claude Code. I also like being able to control it from the Claude app - I’ve found it really convenient. And you get to use your Claude subscription usage if you happen to have one, which is an added bonus. At the end of the day, running an agent with broad permissions is safer on a machine that has nothing to lose - but you get the benefit of being able to use a full Mac instead of a container. 为什么不使用类似 OpenClaw 的工具？我个人喜欢使用 Claude Code 的全部最新功能。我也喜欢通过 Claude App 来控制它——我觉得这非常方便。如果你有 Claude 订阅，还能顺便利用你的订阅额度，这是一个额外的好处。归根结底，在没有重要数据的机器上运行拥有广泛权限的智能体更安全，同时你还能享受到使用完整 Mac 而非容器带来的便利。

The approach here:

本方案思路：

Use an old/spare Mac, not your main one.
Create a fresh local account with no personal data and no Apple ID signed in, so the agent has nothing sensitive to reach.
Drive it over SSH from your main Mac on your local network, and control it from your phone.
使用旧的/闲置的 Mac，而不是你的主力机。
创建一个全新的本地账户，不包含任何个人数据，也不登录 Apple ID，这样智能体就无法触及任何敏感信息。
通过局域网从主力 Mac 进行 SSH 连接，并从手机进行控制。

What you’ll need

你需要准备：

A spare Mac (the target).
Your everyday Mac (the source), on the same Wi-Fi.
一台闲置 Mac（目标机）。
你的日常主力 Mac（源机），需处于同一 Wi-Fi 下。

1. Start fresh on the target Mac

1. 在目标 Mac 上进行初始化

Wipe it first (if it has any personal data) 首先抹掉数据（如果有个人数据的话）

You’ll be giving the agent full access to this machine, so it can reach anything stored on it. If there’s existing data you don’t want it to have access to, erase the machine first: 你将授予智能体对这台机器的完全访问权限，因此它可以触及存储在上面的任何内容。如果有你不希望它访问的现有数据，请先抹掉机器：

Macs that support it: System Settings -> General -> Transfer or Reset -> Erase All Content and Settings.
Older Intel Macs: restart into Recovery (hold Cmd-R at boot), use Disk Utility to erase the internal drive, then reinstall macOS.
支持的 Mac： 系统设置 -> 通用 -> 传输或还原 -> 抹掉所有内容和设置。
较旧的 Intel Mac： 重启进入恢复模式（开机时按住 Cmd-R），使用磁盘工具抹掉内置驱动器，然后重新安装 macOS。

Optionally update to the latest macOS afterward (System Settings -> General -> Software Update). 之后可选择更新到最新的 macOS（系统设置 -> 通用 -> 软件更新）。

Create a fresh, isolated account 创建一个全新的隔离账户

Create a new local user account (System Settings -> Users & Groups). I recommend not signing into an Apple ID. Skip it during setup. 创建一个新的本地用户账户（系统设置 -> 用户与群组）。建议不要登录 Apple ID，在设置过程中跳过即可。

Make the account an admin (if you haven’t already) 将该账户设为管理员（如果尚未设置）

The account needs admin rights or sudo will refuse to run. System Settings -> Users & Groups -> set the account to Allow this user to administer this computer. 该账户需要管理员权限，否则 sudo 将无法运行。系统设置 -> 用户与群组 -> 将账户设置为“允许用户管理这台电脑”。

If you ever need to repair it from another admin account: 如果你需要从另一个管理员账户进行修复： sudo dseditgroup -o edit -a <user> -t user admin

2. 在目标 Mac 上启用远程登录 (SSH)

On the target, turn on SSH so the source Mac can connect: 在目标机上开启 SSH，以便源机可以连接： sudo systemsetup -setremotelogin on

If the command fails with Turning Remote Login on or off requires Full Disk Access privileges, give your terminal app Full Disk Access first: System Settings -> Privacy & Security -> Full Disk Access. Click +, then in the file picker go to Applications -> Utilities -> Terminal and add it. Quit and reopen the terminal, then rerun the command. 如果命令报错“Turning Remote Login on or off requires Full Disk Access privileges”，请先授予终端应用“完全磁盘访问权限”：系统设置 -> 隐私与安全性 -> 完全磁盘访问权限。点击“+”，在文件选择器中找到“应用程序” -> “实用工具” -> “终端”并添加。退出并重新打开终端，然后重新运行命令。

3. Passwordless sudo for the target account

3. 为目标账户设置免密 sudo

This is so the agent (and your SSH commands) can run admin tasks without a password prompt each time. Run this once on the target. It asks for the login password this one time: 这样智能体（以及你的 SSH 命令）就可以在执行管理任务时无需每次都输入密码。在目标机上运行一次以下命令。它会要求输入一次登录密码：

echo "<user> ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/<user>-nopasswd >/dev/null
sudo chmod 440 /etc/sudoers.d/<user>-nopasswd
sudo visudo -cf /etc/sudoers.d/<user>-nopasswd # validate - must print 'parsed OK'

This creates a small rule file telling the Mac that <user> can run sudo without a password prompt: 这会创建一个小的规则文件，告诉 Mac 该 <user> 可以免密运行 sudo：

line 1 writes the rule into /etc/sudoers.d/.
line 2 makes it read-only - sudo ignores the file otherwise.
line 3 validates the syntax; a typo in a sudoers file can lock you out of sudo entirely, so it must print parsed OK.
第一行将规则写入 /etc/sudoers.d/。
第二行将其设为只读——否则 sudo 会忽略该文件。
第三行验证语法；sudoers 文件中的拼写错误可能会导致你完全无法使用 sudo，因此必须输出 parsed OK。

After this, sudo runs with no prompt - test with sudo -n true, which succeeds silently if passwordless sudo works. 之后，sudo 运行将不再提示——使用 sudo -n true 进行测试，如果免密 sudo 设置成功，它将静默执行成功。

4. Find the target’s address (hostname or IP)

4. 获取目标机的地址（主机名或 IP）

You can reach the target by either a hostname or an IP. I recommend using the hostname: it stays the same, while the IP can change. 你可以通过主机名或 IP 地址连接目标机。我建议使用主机名：它保持不变，而 IP 可能会变。

Hostname (recommended). Run on the target: 主机名（推荐）。 在目标机上运行： scutil --get LocalHostName # prints the hostname, e.g. MacBook-Pro scutil --get LocalHostName # 输出主机名，例如 MacBook-Pro

Add .local to form the address: <target-host>.local. You can also read it from System Settings -> General -> Sharing, shown as Local hostname. Give the target a unique name. 加上 .local 组成地址：<target-host>.local。你也可以在“系统设置” -> “通用” -> “共享”中查看，显示为“本地主机名”。请给目标机起一个唯一的名字。