Nine agent builds from Sep 12–18: secret redaction, file-backed memory, and receipts for real actions (2026)

The week indie builders fenced the context window

Between September 12 and September 18, the strongest releases from solo developers and small teams sat at the edges of the model. Agents now read your .env files, call refund endpoints on live Stripe accounts, and open a fresh session with no record of what they decided yesterday. This week's builds are the fences around that: a filter between your repository and the provider, a memory format you can open in an editor, a policy file that decides whether an agent may act alone, and a grader for the skills you hand it.

Nine featured builds follow, grouped by the boundary each one manages. Six smaller releases are collected at the end.

Secrets before the prompt

ContextVeil replaces enrolled values on the way out

ContextVeil appeared on Show HN on September 15 as a local filter for coding agents. 1 The developer who publishes as daniel-sc built it as a hook on the agent's outgoing text: you enrol where a secret lives, such as the value of API_TOKEN or a line in a specific .env file, and ContextVeil reads the current value at runtime and swaps it for a placeholder inside the text the agent is about to send. 2 Matching is literal and case-sensitive, so the agent keeps reading and running commands while the credential itself stays local.

Installation is a single script, then a setup pass from inside your project:

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0/install.sh | bash
~/.local/bin/contextveil setup

Setup walks the credential files it can find and patches the agent integrations, storing the location of each value instead of the value. The whole tool runs on your machine and calls nothing outside it. Two limits matter before you rely on it. Coverage means the exact current value from an enrolled source, so a secret that has been encoded, split across lines, or transformed on the way out slips past. And each integration fails open: a hook that crashes or times out leaves the original text in place. Claude Code is marked production; the Codex CLI, Copilot CLI, and OpenCode integrations are marked experimental.

Nenya puts the same filter at the network boundary

Nenya takes the opposite position. 3 Built by the developer who publishes as gumieri, Nenya is a Go gateway that sits between a local coding client and the provider, speaking OpenAI- and Anthropic-compatible chat-completions so existing clients work unchanged, with 23 provider adapters behind it. 4 An always-on regex layer strips AWS keys, GitHub tokens, and passwords on the way out, before any optional entropy filtering, context pruning, or summarisation runs. The same process handles provider fallback chains, circuit breakers, cost and rate-limit guards, a response cache, and streaming.

It ships as one static binary built on the Go standard library alone, with packages for Debian, Fedora, Arch, and Nix, a systemd unit, a Helm chart, and a container:

podman run -d --name nenya -p 8080:8080 \
  -v ./config:/etc/nenya:ro -v ./secrets:/run/secrets/nenya:ro \
  -e NENYA_SECRETS_DIR=/run/secrets/nenya \
  --cap-drop=ALL --cap-add=IPC_LOCK --security-opt=no-new-privileges:true \
  --read-only --tmpfs /tmp:rw,noexec,nosuid,size=64M \
  ghcr.io/gumieri/nenya:latest

There is an offline redaction demo that runs against a local mock upstream, so you can watch the filter work without an API key. The redaction is best-effort by the project's own description, and a protection layer that fails forwards the request to the provider rather than returning an error, which is the behaviour you want for uptime and the opposite of what you want if the filter is your only control.

Memory that survives as files

DaiDocs turns agent memory into a file format

DaiDocs showed up on Show HN on September 15 with a plain-text format called .dai. 5 A .dai file is three zones: a YAML header, a fenced JSON block, and the text. The store lives at ~/DaiDocs/, one file per conversation, with _index/ holding the manifest and facts that retrieval reads, _unconverted/ holding text that has not been converted yet, and _raw/ keeping your originals byte-for-byte. 6

The repository ships the 4.4 engine, an MCP server, and the benchmark evidence behind the claims on its page — 83% on LongMemEval-S with GPT-4o and 92% with Claude Fable 5, against a store the project says uses about ten times fewer tokens than the alternative it compared with. Setup detects the assistants you already have installed:

npx daidocs setup

That command configures Claude Desktop, Claude Code, Cursor, Windsurf, Codex, Cline, Continue, and Zed, installs the session hooks, and backs up every file it touches. Once hooks are in, every 4,000 new tokens the session so far is converted in the background into the folder you are working in. node daidocs.js convert reads your existing Claude Code history out of ~/.claude/projects and turns it into the same files, quoting the token cost before it makes any paid call. Folders carry types — locked accepts nothing new, confidential stays out of a wider read — which is how you keep one project's memory away from another's. Retrieval classifies each question into one of four strategies before it searches, and the only outside dependency is a cached embedding call.

Continuity keeps the decisions in git

Continuity answers a narrower question than a memory tool. 7 Released at version 1.5 by the developer who publishes as vikcena01, it stores claims as Markdown files with frontmatter, tracked in git: decisions, frozen constraints, rejected paths, open questions. 7 Every claim carries a confidence level of confirmed, tentative, or unverified, plus its provenance, so a new session can tell what you signed off on from what the last agent inferred. When a decision replaces an earlier one, the record keeps the reason it superseded it.

The resume context is a deterministic projection of those files, built with no model in the read path. Install it as a Claude Code plugin:

/plugin marketplace add vikcena01/ai-continuity-plugin
/plugin install continuity@continuity-marketplace

A session-start hook injects the resume context, a stop hook runs an end-of-turn capture check, and /resume, /freeze, and /why cover the rest. State is auto-committed on every change, and pushing stays manual, so git revert is your rollback and git blame your audit. The capture check is throttled to at most once every ten seconds, which means a decision settled inside a very fast exchange can go unrecorded, and the project lists reliable status extraction from messy sessions as its open technical risk. It arrived with two stars, so treat it as something to try on one real repository rather than to roll out.

A receipt for anything with a consequence

ctrlrun decides before the call and remembers after it

ctrlrun launched on Show HN on September 15 as an execution layer for actions with consequences: send, pay, refund, delete, deploy, grant, revoke. 8 You write a policy file, and every protected call is normalised, decided, approved if needed, reserved, executed, resolved, and recorded. 9 A refund rule can allow the agent to act alone up to 500 euros, require a human between 500 and 10,000, and deny everything above that. The default is deny, and a rule has to name the action before it can run at all.

schema: ctrlrun.policy/v2
actions:
  stripe.refund:
    effect: "refund:{payment_id}"
    rules:
      - when: { amount_gte: 0, amount_lte: 50000 }
        decision: allow
      - when: { amount_gte: 0, amount_lte: 1000000 }
        decision: approve
      - decision: deny

Wrap the call with the decorator, or point an MCP gateway at tool servers written in any language:

pip install ctrlrun && ctrlrun demo

The effect key is the interesting part: a retry that resolves to the same effect never executes twice, and an outcome that comes back unknown blocks the retry until you run ctrlrun resolve or reconcile. That refusal to guess is what makes it useful for refunds and deploys, where a duplicate is worse than a delay. SQLite holds the state by default; Postgres is an extra install for multiple hosts. Two limits come with the design. Receipts are chained, so an edit anywhere in the middle shows up, while truncation at the tail is caught only by the separate ctrlrun anchor command, and receipts carry no signature. And an approval narrows the window between the human decision and the execution rather than closing it, because the re-check is a network call.

One goal, many agents

Ordewell turns a goal into an ordered plan you can edit

Ordewell landed on Show HN on September 15 and had reached 54 points by Friday. 10 You give it a goal; a read-only planner researches the repository, asks you the questions it needs answered, and writes an ordered plan where each task names its own runner, model, effort, and mode. 11 The plan is a file, so you rewrite, reorder, add, or drop tasks before anything runs, and independent tasks execute in parallel with a default of three at a time.

Completion is decided by completion markers in the runner's output rather than by the model grading itself, and an exit code counts as diagnostic evidence. The planner and runners reuse the subscription you already pay for, so you point it at a provider and go:

export AI_PROVIDER="claude-code"
ordewell plan --goal "Add rate limiting to the public API" && ordewell run

npm install -g ordewell gives you the terminal interface, and a VS Code extension covers the same core. The terminal interface needs tmux on every platform, so Windows users run it under WSL, and ordewell web serves JSON only, so a browser dashboard is still to come.

firstmate gives you one agent to talk to and a crew behind it

firstmate spent the week at number 13 on GitHub's weekly trending board, with 6,470 stars and 890 added in the seven days to September 18. 12 The author, kunchenguid, calls it an agent distro: a directory of instructions, skills, and state conventions that a terminal coding agent follows, where the cloned repository itself is the installation. You talk to a single first mate, and it dispatches crewmates into their own tmux windows, each working in a clean git worktree so parallel tasks on one repository never collide. Narrow work comes back as a pull request or an approved local merge; investigation work comes back as a standalone report.

Supervision is the part worth stealing. A bash watcher sleeps on the fleet and wakes the first mate only when something needs you, so watching five agents costs nothing in tokens, and all state lives on disk, so a killed session reconciles on the next start. Roughly: pick a harness (Claude Code, Grok, Pi, Codex, OpenCode, or the Cursor agent CLI), make sure git, gh auth login, and tmux are in place, and clone. The first mate keeps itself read-only over your projects apart from a narrow set of guarded operations you approve. One caveat from the README: codex-app is not a runtime backend yet.

A quality bar for skills

Skill Crossroads grades the artifact before you ship it

Skill Crossroads arrived on Show HN on September 18 with a way to check whether the skill you wrote will actually fire. 13 It grades skills, subagents, slash commands, MCP configs, and plugins against a six-part rubric covering correctness, triggering, clarity, token cost, safety, and verifiability, then returns one of three verdicts: ship, fix, or rethink. 14 Every finding is tied to a file and a line, and the report is ranked by how much each fix raises the grade.

npx skillcrossroads ./my-skill

You can point it at a local folder, a repository URL, a CI run, or a pasted SKILL.md. The free tier covers public artifacts and local files and includes the CI action that gates pull requests. In the Show HN post, the author reports what the tool found across 216 public Claude Code skills: 69% of them will not reliably trigger. That number is the author's own summary of grading runs, and the site points to a separate report for the ecosystem figures rather than reproducing them.

i-have-adhd was the week's most-copied fix for a chatty agent

i-have-adhd reached number 2 on GitHub's weekly trending board, at 47,792 stars with 10,800 gained in the week to September 18. 15 It is a skill that attacks one failure: an agent that buries the answer under a preamble. The repository publishes ten rules for output, among them leading with the next action, numbering multi-step work, ending with one concrete next step, restating state each turn, and capping lists at five items. Its worked example turns an opening line of "Great question! Let me think about this" into a command to run followed by three numbered steps.

Installing it means pasting one prompt into your agent, asking it to install the skill from the repository and follow AGENTS.md, and the repository ships integration files for Claude Code, Codex, Cursor, OpenCode, and several other harnesses. It is worth reading even if you keep your own agent chatty, because the ten rules are the clearest statement this week of what people actually wanted from a coding agent's replies. If you fork it to change the rules, remove the upstream marketplace entry first: the fork and the original share the name i-have-adhd, and the install will collide.

Also shipping

Six smaller releases from the same window, each with the one thing worth knowing:

Panel (greentfrapp/panel): a research workspace where chat, notebooks, and PDFs share one dock and the agent can write its own viewer when the built-in panes cannot show what you asked for. 16 Modules start only from a chat message today, and only Claude Code has full support.
context-mode (mksglu/context-mode): an MCP server that keeps raw tool output out of the context window, cutting one measured case from 315 KB to 5.4 KB, and indexes session events into SQLite so a compacted session can still find the file it was editing. It adds routing enforcement to 17 clients; run without --continue and the previous session's data is deleted.
worktrunk (max-sixty/worktrunk): a Rust CLI that makes git worktrees as quick as branches, then starts an agent inside the new one with wt switch -c -x claude feat. Built for the person running five agents at once; wt merge main cleans up behind you.
Graphify C# (zachsaw/graphify-csharp): a headless Roslyn indexer that gives an agent compiler-accurate answers about who calls an overload or implements an interface in C#, instead of guessing from text search. 17 It reports static references, so reflection and dependency injection can still create call paths it never sees.
Vigil PR Scanner (GitHub Marketplace listing): a free, no-LLM GitHub Action that reads a pull request diff for capability rather than style — postinstall hooks, CI tampering, credential reads, reverse shells — and scores them against the file they landed in. 18 Make vigil a required check, or it stays advisory.
SkillBay (skillbay.sh): a small marketplace for agent skills where a person reviews each listing and shows the same prompt answered with and without the skill. 19 The pitch is paid skills, though every listing on Friday was free and newest entries ran to September 17.

Where to start this weekend

Pick by the friction you already have, and try one thing rather than five:

Your agent has read a credential it should not have. Run ContextVeil against the project with the worst .env and watch what it redacts; if your team shares one provider endpoint, put Nenya in front of it instead and let the offline demo show you the filter.
Every session starts with the agent re-learning your project. Install DaiDocs if the gap is context — it will convert your existing Claude Code history into files you can grep. Install Continuity if the gap is decisions, especially the ones you have already rejected once.
An agent can do real damage with one wrong call. Write a ctrlrun.yaml with a single refund or delete action and run ctrlrun demo before you protect anything for real.
You are juggling more than two agents. Ordewell if you want the plan visible and editable before execution; firstmate if you would rather talk to one agent and let a crew work in worktrees behind it.
You maintain skills or install other people's. Point Skill Crossroads at your own skill folder first; the triggering failures it finds are cheap to fix and expensive to debug later.

References

1
Show HN: Let agent read files with secrets while redacting values for LLM context
news.ycombinator.com
2
ContextVeil repository
github.com
3
Show HN: Nenya – 0-deps AI gateway redacts secrets before they reach providers
news.ycombinator.com
4
Nenya repository
github.com
5
Show HN: DaiDocs, AI memory as a plain-text file format, not a service
news.ycombinator.com
6
DaiDocs repository
github.com
7
Show HN: Continuity – project state your AI sessions can't silently contradict
github.com
8
Show HN: An open source safety layer for AI agent actions
news.ycombinator.com
9
ctrlrun repository
github.com
10
Show HN: Ordewell – turn one goal into an ordered plan of coding-agent tasks
news.ycombinator.com
11
Ordewell repository
github.com
12
firstmate repository
github.com
13
Show HN: Linting 216 public Claude Code skills – 69% won't reliably trigger
news.ycombinator.com
14
Skill Crossroads
skillcrossroads.com
15
i-have-adhd repository
github.com
16
Show HN: Panel – A research workspace where the agent can build its own panes
news.ycombinator.com
17
Show HN: Graphify C# – Compiler-accurate Find Usages for coding agents
news.ycombinator.com
18
Show HN: Free GitHub Action that scans PR diffs for malicious code, not quality
news.ycombinator.com
19
Show HN: Craigslist for agent skills, curated by a human
news.ycombinator.com