Indie agent builds, Sept 21–28: sandbox walls, gated steps, and a memory that keeps every line

Seven releases landed this week, and between them they cover the span of an agent session: the box it runs inside, the checks that decide whether a step is finished, and what is still on the machine once the session has ended.

What shipped. Drop creates disposable, isolated environments for programs and coding agents on a Linux machine. Each environment gets its own writable home directory, and only the files and directories you name are mounted from your real home, mostly read-only. The isolation comes from Linux namespaces — user, mount, network, PID, IPC and cgroup — and Drop needs no root. Before it starts a sandboxed program it drops the user-namespace capabilities, so the program cannot bind-mount or take other privileged actions inside its own namespace. 1 An option runs programs on gVisor's user-space kernel, which keeps them away from the host kernel altogether. A TOML file decides what is exposed, and one shared base config means new environments need no configuration work. 1 It went up on Show HN on September 22, 2026 and drew 193 points and 63 comments. 2

Why it matters. The site names the case a coding-agent user actually has: run the agent with --dangerously-skip-permissions and let Drop enforce permissions at the OS level. A hallucinated rm -rf ~ lands in an empty home directory, a prompt injection aimed at ~/.ssh finds nothing to read, and a connection to a service listening on localhost is refused. 1 Because Drop runs inside the distribution you already have, every tool you have installed is available inside the sandbox — that is the trade it is built around, against container images you would have to rebuild and provision. Its author's own worry was mundane and familiar: one compromised dependency on the machine where you build software can reach the accounts of everyone who uses what you ship. 2 The catch is the platform: Drop is built on Linux namespaces, so the machine has to be Linux.

Try it. The site's installation page walks through setting up the first environment; the documentation is organised around the config file rather than a CLI reference.

What shipped. Venya lets an agent execute commands on remote infrastructure using stored credentials it never sees. The agent discovers what exists through MCP tools — executors and secret metadata, no values — and builds the command. The executor daemon unwraps the credential inside a sandboxed microVM, runs the command with it attached, filters the output and returns the exit code. 3 A person authorises a session with a hardware security key, and revealing an actual value is a separate, single-use, audited act rather than part of normal work. Executor hosts are treated as compromised by design: egress is denied by default, output passes a Rust filter, and an executor's identity is bound by mTLS so it can be revoked. The core server holds the CA keys, the encrypted store and the audit log, and the project's own rule is that core and executor must never share a machine — on one box, run each executor as its own virtual machine. 3 It appeared on Show HN on September 22, 2026. 4

Why it matters. The three usual answers to "the agent needs the SSH key" are to hand it a secrets-manager token it can read in plaintext, to paste the credential into the chat, or to keep the agent off the servers. 3 Venya is aimed at the fourth: the value is injected at the far end, into a microVM, and the agent gets a filtered result. That changes what a prompt injection inside your own agent can steal during a session. The repo is candid about the cost of the model — two hosts, a hardware key at enrolment, and a runbook for the executor side.

Try it. The repository ships separate install scripts for the core, the executor and the CLI, with docs/agents.md as the entry point for wiring an agent and docs/agent-prompts.md holding the operating contract to paste into its instruction file.

What shipped. Foremerge is a coordination layer for parallel coding agents that sits above Git without touching it. Before editing, each agent publishes an intent: a summary plus the semantic scopes it will change and the operation it plans on each one, such as symbol:PaymentService=replace. The next agent to publish against that scope gets a HIGH destructive_vs_additive finding before either has written code. 5 The shared state is one SQLite file in the project's .git directory, so an agent in Claude Code and an agent in Codex, each in its own worktree, read the same list. 6 Detection is deterministic: the same declarations always produce the same verdict, and a match inferred from prose alone never reaches the HIGH level. Claims are advisory leases rather than locks, so two agents can hold one scope without deadlocking a fleet. 5

Why it matters. Git catches agents only when their patches touch the same lines. Two plans that are each reasonable and cannot both be true — one agent replaces PaymentService with StripePaymentService while another adds PayPal support to PaymentService — merge cleanly and leave the PayPal work attached to a class nothing calls any more. 5 Acceptance is separate from the declaration: before a change counts, Foremerge runs a named check you configured against that exact git state, and an agent's claim that the tests pass does not satisfy the gate. 6 The builder reports 98 agents working one repository with no conflicts, and a replay of 76 real intents that flagged one conflict and exposed a blind spot they are still fixing, where one agent claimed a scope by class name and another by an internal method. The README states that version 0.5.0 is a pre-1.0 MVP with no published benchmarks, and that coordination across machines is out of scope. 5

Try it. curl -fsSL https://foremerge.com/install.sh | sh, then foremerge init and foremerge setup all in the repository you want to coordinate; setup wires the client in and installs the skill the agent follows. Prebuilt binaries cover macOS and Linux, and it builds with Rust 1.85 or newer. 5

What shipped. A stepfile is one YAML file describing an agent's procedure: its inputs, the remote APIs and MCP servers it may call, and an ordered list of steps, each declaring the output it must produce and the gates that check that output. The file names no model and no framework. 7 Stepgate itself is an MCP server that offers each stepfile as a tool, so the client's own model does the reasoning and the server makes the calls. The agent is shown one step at a time, and later steps stay hidden until their turn. 7 A gate is JSON Schema, JSONLogic or an HTTP verifier, and it can check the model's output against what the API actually returned, so a version number invented by the model fails against a version number the registry served. A failed gate sends its diagnosis back for a bounded number of retries. A step that writes waits for a person to approve the output through an MCP elicitation first. Every run leaves a hash-chained ledger of steps, tool calls, verdicts and retries, and stepgate --verify detects a ledger edited after the fact. 7 Version 0.1.4 is on npm under Apache-2.0, and the project went up on Show HN this morning, September 28, 2026. 8

Why it matters. A runbook written as markdown tells an agent what to do and leaves it to decide how much of the procedure to follow; a step counts as done when the agent says so. A stepfile moves those two decisions out of the model. The server performs the mechanical work and attaches credentials itself, refusing any host the file does not declare, so the model never holds a key. 7 Portability is the other half: there is nothing to pin and nothing to deploy beyond one file, so the same stepfile runs on any MCP client and on whatever model that client already uses.

Try it. Install the server from npm and add it to your client's MCP configuration; the repository's connect guide names the clients that show the approval form, and stepgate_outline turns an existing runbook into a starting skeleton.

What shipped. A set of four Claude Code skills that turn one of your chess games into a post-mortem you can read. chess-analysis sweeps every move with Stockfish, then runs parallel investigator subagents that keep asking the engine naive questions — why not the move I played, what if Black simply takes — until each mistake is explained, and writes out an annotated PGN, a standalone HTML board and one plan pause per game. It also transcribes a think-aloud recording locally with whisper.cpp and matches each sentence to the move you were deciding, using the clock times in the PGN. chess-video builds a narrated video of the game with the board, arrows, an eval gauge and burned-in subtitles. chess-position studies a single position after asking whether you want the positional or the tactical reading, and chess-play plays a game against Claude over PGN files with adversarial blunder-check subagents. 9 The repository appeared on Show HN on September 26, 2026, reached the front page, and carries the author's own game as a worked example. 10

Why it matters. A Stockfish analysis gives you a number and a twelve-move line you would never find at the board. The loop here is the interesting part: the agent asks the engine the questions a person asks, and because it knows what you were thinking it can test your actual reasoning rather than a guessed one — in the sample video, "at move eight you asked yourself whether the bishop belongs on c4 or e2" is the author's own question, answered with the engine. 9 The guard against confident nonsense is explicit: every claim is checked against Stockfish and a verifier pass re-reads the result. 9 It is slow by design — a full run takes about an hour — which is the reason to save it for games you thought about.

Try it. Clone the repository and copy the skills into ~/.claude/skills/, then give Claude a game: the author's own run came from a 15+10 rapid on lichess, around 1700, Open Sicilian against a Najdorf, plus two minutes of himself thinking aloud in French. 9 The finished output is a 6:49 narrated video, watchable directly alongside the annotated PGN and the transcript it was built from.

What shipped. Leftovers is a free, open-source menu-bar app for macOS that shows what your apps and agents left running. Its measurement is the one that matters on a Mac: it reads each process's footprint — RAM plus compressed plus swapped — instead of the RAM figure Activity Monitor sorts by, because a leak that has been swapped out barely shows up there. The case that started the project was a video-encoder helper reporting 7 MB in RAM while holding a 59 GB footprint, idle for four days. 11 The Agents view lists memory per coding-agent session for Claude Code, Codex, Gemini CLI, Cursor Agent, Aider and OpenCode, everything each session started, and the MCP servers that several sessions each run their own copy of. 11 The leak rules are published in the source: a footprint of at least 2 GB while idle for an hour, an orphaned dev process whose terminal is gone and idle for twelve hours, a dev process whose working folder no longer exists. 11 It also lists the git worktrees whose work is already on main — including branches squash-merged on GitHub, which git branch --merged cannot see — and every background job in your account, with the ones an agent created labelled and dated if the agent writes the small note file the app documents. 11 It went up on Show HN on September 26, 2026. 12

Why it matters. Each agent session starts dev servers, runs builds and spins up its own copy of every MCP server, then moves on and leaves them running; on a laptop that is memory and swap that never come back. 11 Knowing which process to quit is most of the fix, and the app answers that question by session rather than by PID. The binary doubles as a CLI returning text or JSON, so an agent can be asked what it left behind. It requires macOS 14 Sonoma or later.

Try it. brew install --cask arpwal/tap/leftovers, or the signed and notarised DMG from the latest release. 11

What shipped. lossless-memory is a local, file-based long-term memory for a personal AI assistant. Raw conversation logs are stored in full as per-day JSONL files under a fixed seven-field record, with no summarisation anywhere in the pipeline, and every index can be deleted and rebuilt from those logs. 13 Time is the query axis rather than a field on a record: the exact-match index is SQLite FTS5 with a timestamp on every row, and a query parser turns "yesterday", "last week", "3 days ago" or "in July" — or an absolute date in any language — into a range before any ranking happens, returning verbatim lines in chronological order. Semantic search runs only when the exact index returns too little inside that range, and the output header says when it was used. 13 A second, tiny index called LLL holds timestamped topic markers and is injected into the model's context every turn, so a long conversation can pick up where it was after its context window was compacted; the person writes those markers and the model only reads them. 13 It has run daily since July 2026 for a single user, on one machine, with no server. It appeared on Show HN on September 21, 2026. 14

Why it matters. When a memory layer compresses a conversation into notes or retrieves similar chunks, the exact words and the time of night are the first things to go, and those are what make a memory feel like it belongs to someone. 13 The project publishes its operating record the way few do: the exact-search index rebuild went from 40 seconds to 1.24 seconds after a redesign, and the vector store fell from 2.54 GB to 337 MB once a library-contamination bug was fixed, a row count that had climbed to 865,588 at its worst and landed at 124,174 afterwards. The README says plainly that these are operational measurements rather than benchmarks, and that the failure numbers are kept on purpose. 13 Two limits are worth knowing before you point it at your own logs: relative time phrases work in English and Japanese only, and one timezone has to be set explicitly for day boundaries.

Try it. git clone the repository, pip install -e ., copy config.example.json to config.json, then follow examples/quickstart.md, which ingests a sample conversation, builds the indexes and runs a time-scoped query in about five minutes. 13

The seven share a direction: each one puts a decision somewhere other than the conversation — in an OS boundary, in a check that has to run, in a ledger, or in a record that outlives the session. Take the one that matches the part of your own setup you still watch by hand. This roundup runs weekly, on Mondays.