A guide explains how to configure a spare Mac as a dedicated environment for Claude Code, enabling remote control from a phone or a primary Mac via SSH. The guide notes that running Claude Code on a main computer can expose sensitive files and increase permission risk, especially when using the --dangerously-skip-permissions flag. A separate machine provides a sandbox with full access to required tools while minimizing impact on the user’s primary system. Step 1: The target Mac is installed fresh, optionally erased and updated to the latest macOS version. A new local admin account is created without an Apple ID, and the account is set to allow administration. Step 2: SSH is enabled on the target using the command sudo systemsetup -setremotelogin on; full‑disk access is granted to the terminal application if required. Step 3: Passwordless sudo is configured for the target account by adding the line ALL=(ALL) NOPASSWD: ALL to /etc/sudoers.d, making the file read‑only and validating the syntax. Step 4: The target’s unique hostname is set via scutil --set LocalHostName, and the address is used as hostname.local for SSH connections. Step 5: On the primary Mac, an ed25519 SSH key is generated and the public key is installed on the target with ssh-copy-id. The connection is verified with ssh @hostname whoami, which returns the username without a password prompt. Step 6: To prevent automatic sleep, the target runs sudo pmset -c sleep 0, sudo pmset -c disablesleep 1, and sudo pmset -c displaysleep 0, and the screen saver is disabled with defaults write com.apple.screensaver idleTime 0. Step 7: A script named clip.sh is installed on the primary Mac to pipe pbcopy and pbpaste over SSH, providing text and image clipboard sync between the two machines. Step 8: Claude Code is installed on the target by executing ssh target 'curl -fsSL https://claude.ai/install.sh | bash -s -- 2.1.201', and the binary directory is added to the shell environment via export PATH in ~/.zshenv. Step 9: An optional script setup-claude-env.sh can be run to apply predefined aliases, plugins, and settings; it supports interactive checklists or non‑interactive flags such as --all. Step 10: Both Claude and GitHub logins are performed interactively on the target; using a separate GitHub account is recommended to avoid affecting the primary account. Step 11: Computer use is enabled by installing a LaunchAgent that runs a persistent tmux server inside the GUI session, granting Screen Recording and Accessibility permissions to tmux, and restarting the tmux server after permission changes. Step 12: A VPN can be installed on the target, though credentials and manual permission approvals are required; the process can be scripted with clip send for credential transfer. Step 13: Remote Control in the Claude app allows a phone to drive sessions started on the target, either by attaching to an existing session or launching a new one with computer use enabled. Step 14: A Chrome extension can be added to the target to enable browser control; the agent must handle login and permission steps manually. Step 15: Screen Sharing is enabled in System Settings on the target, and the source Mac connects via vnc://hostname. Step 16: Tailscale is installed on both machines to provide encrypted WireGuard tunnels, allowing SSH, clip, and Screen Sharing to function across different networks; device approval and key expiry settings are recommended in the Tailscale admin console. The setup enables secure delegation of tasks to Claude Code, but requires manual permission steps and ongoing maintenance of the isolated environment.