SIwithin is a single-file Python tool that runs agent CLIs (notably Claude Code and OpenAI Codex) unattended inside a strict macOS sandbox, enforcing three guarantees: a run may read or write only the folders explicitly allowed, it cannot spend more than a per-run or global dollar budget, and every run leaves an immutable one-line ledger entry recording cost and completion status. It achieves monetary control by creating a per-run token and, for the Claude adapter, a loopback proxy that is the sole network door to the API; the proxy meters each API request, refuses further requests when the budget is exhausted, and terminates the run. The tool refuses to run on Linux or Windows rather than run without a fence.
Implementation details matter: the fence is a generated macOS sandbox profile that denies home access, limits writable paths, forbids certain system executables, and restricts environment variables and network sockets unless a proxy is allowed. Adapters get isolated config directories and runs inherit minimal environment. Auth modes include a safer proxy-token approach and an optional ENV mode that exposes keys to the run (with cautions and recommended provider spend-limits). SIwithin is standard-library-only (Python 3.10+), installs easily, includes tests and docs, is Apache-2.0 licensed, makes no external network calls itself, and is independent of Anthropic/OpenAI.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.