The cheapest bug to fix is the one in code nobody can reach.

SIwithin (Apache-2.0, Python standard library only, v0.5.0 on Monday, 8 points on Show HN) runs Claude Code or the Codex CLI on a written brief with no one watching. Each run gets a generated sandbox-exec profile, saved as fence.sb in the run folder, that denies reads and writes to your whole home directory and then re-allows only the run's folders, the CLI binary and its caches. Writes to /tmp, /usr/local, /Applications and /Volumes are refused, and open, osascript, launchctl and crontab are blocked. In the default network mode, the only socket the run can open is a loopback proxy that holds the real API key outside the fence, hands the run a token that works nowhere else, and returns HTTP 402 once --budget is spent. Every run appends a line to ledger.md and writes a receipt.json of file hashes chained to the previous one, which --verify checks.

This is Anthropic's "default configuration" pass applied to an agent run. Start from nothing reachable and add back what the brief needs, instead of starting from your whole account and hoping. The README's limits section is unusually specific about what the fence doesn't cover: what the agent sends to the API in request bodies, reads outside the home folder, and a key exposed through shell rc files. On HN one commenter asked what this adds over Claude Code's own budget flag. The README's answer is that the budget is enforced three ways: the CLI's own flag, a stop on streamed usage, and the proxy outside the fence. Another commenter running agents unattended said the harder problem was "telling 'done' apart from 'stopped'," which the ledger's status column only partly answers.

Reach for it if you already leave Claude Code running overnight on a Mac with your real home directory visible to it. Delete the throwaway macOS user account you made so an agent couldn't read ~/.ssh. Tradeoffs: macOS only, and it refuses to run elsewhere rather than run unfenced; the Codex adapter and --reconcile against the provider's usage API were built from docs and haven't been run live; the proxy stops after the response that crosses the budget, so a run can overshoot; and it is 10 commits from one author, with 3 stars.

Snitch (AGPL-3.0, Python and Electron, 477 stars, v1.0.6 this morning) captures packets through libpcap (Npcap on Windows), parses DNS and TLS SNI itself, and shows each connection by app on a force graph, a world map and a 15-, 30- or 60-minute timeline. Geolocation uses a bundled offline database, history sits in a local SQLite file kept 24 hours by default, and the API binds to 127.0.0.1 behind a token. It flags port scans, beaconing, possible exfiltration and known trackers from domain lists. brew install --cask aixisstudio/tap/snitch installs it on Apple Silicon Macs, and there are Linux AppImage and .deb builds, a Windows installer and a Docker image. The Show HN title says the author's Mac talked to 347 servers in one idle hour, which the README doesn't break down.

Anthropic's method starts with an inventory of entry points, and this is the outbound equivalent for one machine: what it actually reaches, before you decide what to block. Snitch watches and explains but doesn't block, which the README says plainly in its Little Snitch comparison. The threat model in docs/threat-model.md is the strongest part of the repo. It lists each trust boundary and its mitigation, including an Origin allowlist against cross-site WebSocket hijacking, and admits that another process running as you can read the token file and that the history database isn't encrypted. Capture needs admin rights, so the backend runs privileged while the UI doesn't.

Reach for it if you've added MCP servers, editor extensions and local model runners this year and want to see who they phone. Delete the nettop and lsof -i sessions you run when a fan spins up at idle. Tradeoffs: it observes only, so blocking still needs a firewall; the macOS build is ad-hoc signed, not notarized; Docker Desktop on Mac and Windows can't see host traffic; and one author wrote 130 of 157 commits.

Yana (Apache-2.0, Rust runtime with Python tooling, 9 stars, Studio v1.7.0 on Friday, 8 points on Show HN) is a local control plane between models and your machine. A Rust runtime, yana-rt, runs one turn loop and one authority check for every client, so its desktop Studio, CLI and MCP all go through the same rules. An action passes an authority check (may this agent ask), a capability check (which exact power), then a policy check, rules first and then a human, before a scoped executor runs it. Force-push, publish, deploy and delete need confirmation in the current session even if you approved them yesterday, and every outcome goes to a hash-chained audit log. Harness adapters cover Claude Code, Codex, Cursor and Antigravity. Install the CLI with pip install yana-ai or cargo install yana-rt.

The useful part is the limits section, which reads like an attack-surface report on itself. The destructive-command guard matches strings, not a full shell parse, so crafted commands can get past it. Antigravity enforcement is advisory only, Cursor doesn't screen MCP tool calls, and on Codex the pre-tool hook fires only for shell commands. Most of the files in core/rules are guidance the agent applies to itself, and only what a hook wires in is enforced. That last point is the distinction most agent-guardrail projects blur, and Yana states it.

Reach for it if you switch between several agent hosts and want one set of rules and one audit log across them. Delete the per-host allow and deny lists you keep in sync by hand. Tradeoffs: enforcement strength differs by host, as above; local-model tool calling has been tested only against a mock; the Studio build is macOS Apple Silicon only and not notarized; the README says nothing about telemetry either way; and one person wrote 2,186 of its 2,362 commits.

PatchWave (hosted GitHub App, 10 points on Show HN) sits on top of your existing Dependabot setup. It groups dependency PRs from every repo into one inbox, writes an analysis report for each, and can auto-merge the ones that pass your policy, set by dependency type and version jump. When an update breaks your checks, a fix agent, on by default, tries a scoped change, and the page says PatchWave "never merges a change it wrote." PRs it isn't confident about get labeled for review, and nothing auto-merges until you turn it on. The free tier covers 25 dependency PRs a month, paid plans start at $10 a month for 35, and all plans include unlimited repos and users.

This is the slate's opposite case. A dependency bot that can merge is a new path into every repo you enable, and the question Anthropic's post asks of code applies to it: what does it reach by default, and what checks it. The page doesn't say what the static analysis examines or whether it looks at whether your code reaches the changed functions. It doesn't list the GitHub permission scopes, and it doesn't name the languages it supports, though every example is an npm package. Code goes to Amazon Bedrock and Fireworks.ai, which the page says are configured not to retain prompts or train on it, and the company is in its SOC 2 audit period, not yet certified.

Reach for it if Dependabot PRs pile up across a dozen small repos and you'd rather review one report than open each one. Delete the weekly afternoon you spend merging patch bumps that passed CI. Tradeoffs: the safety logic is undocumented; there are no accuracy figures, only a relative chart without a method; Dependabot only, with Renovate "coming"; and the Show HN post drew no comments.

Voxtral 3 (API, released yesterday, 704 points on HN) covers transcription, realtime transcription, text-to-speech and a voice-agent SDK built on LiveKit with SIP and WebRTC. Small Transcribe 3 costs $0.004 a minute, Mini Transcribe 3 in batch $0.0035 and the realtime model $0.008, with sub-500 ms latency claimed. Transcription covers 50+ languages with diarization, keyterm and free-text context biasing without fine-tuning, and end-of-turn prediction. TTS is $13 per million characters across 35+ languages, with voice cloning from about 30 minutes of audio. On Mistral's diarization chart, Small Transcribe 3 scores 18.4% cpWER against 19.0% for pyannote and 38.4% for Gemini 3.5 Transcribe. Some charts are marked "internal eval," and the TTS comparisons use a Gemini judge.

The thread was mostly about one change. The previous Voxtral weights are on Hugging Face (the 4B realtime model has 2.2 million downloads), and this generation's aren't. Self-deployment means "talk to our team." Several commenters who run speech locally said that rules it out and named Qwen3-TTS, Kokoro and Parakeet instead. For the voice agents the SDK is built for, one commenter's design rule fits today's theme: put the agent behind an API "you'd be comfortable exposing directly to the user themselves," because a caller can say anything to it.

Reach for it if you need diarized transcription across EU languages at a per-minute price and can send audio to Mistral's EU, US or global endpoints. Delete the pyannote-plus-Whisper pipeline you glue together for speaker labels. Tradeoffs: no open weights for this generation, so audio leaves your network unless you negotiate on-prem; several commenters said the new TTS voices sound more synthetic than Voxtral 1 in Mistral's own comparison clips; voice presets cover only 18 languages; and the page gives "over 35" and "40+" for realtime language coverage in different places.

Also today: Google open-sourced TorchTPU (Apache-2.0, 351 points on HN), a native PyTorch backend for TPUs with torch.compile() integration and data and tensor parallelism. The README gives no maturity label and no benchmark numbers, and its Dependencies section reads "TBD."

Verification notes: star, license, creation, release, contributor and commit data are from the GitHub API on 2026-10-21; commit totals use the per_page=1 Link-header last-page count. HN points and comments are from the Algolia API. Anthropic's counts, the OpenSSH figures and the unreleased-skill status are from its October 20 post. The eMudhra key sizes, the 17-month window and the under-a-second recovery are from Scott Helme's post; the HN figure is item 50166579. SIwithin's fence, proxy, ledger and limits are from its README; the comments are from HN item 50167456. Snitch's capture method, platforms and egress claims are from its README, and its trust boundaries and limitations from docs/threat-model.md; the 347-server figure is from the Show HN title only. Yana's governance flow and limitations are from its README. PatchWave's features, pricing, AI providers and SOC 2 status are from patchwave.ai; it has no public repo. Voxtral 3's prices, languages and benchmark figures are from Mistral's announcement; the prior weights and download counts are from the Hugging Face API; the closed-weights discussion, alternatives, voice-quality complaints and the API-exposure quote are from HN item 50168396. TorchTPU's details are from its README. Pipeline health: today's pool held 72 rows, against the ~280 the compose prompt assumes. github:trending returned 1 row, from the all-languages feed only, with python, typescript, rust and go all empty, and Reddit returned zero again, 165 days since its last nonzero day on May 9.