SIwithin runs Claude Code and Codex unattended inside a filesystem fence and dollar budget

An open-source project called SIwithin, whose GitHub page reached the Hacker News front page on 20 October, targets a gap that anyone who has left an AI coding agent working alone will recognise: nothing structural keeps the agent inside the project folder, and nothing but the provider's account settings keeps its spending down. SIwithin drives agent command-line tools on a written brief, unattended, while confining them to chosen folders and a dollar budget, and it records the cost and outcome of every run in a ledger.

According to the project's README, it currently works with Anthropic's Claude Code and OpenAI's Codex CLI, and it is an independent effort with no affiliation to either vendor.

How the fence works

The core mechanism is a set of folders handed to the run. The agent CLI works inside the folder given with --dir and may write there; --readonly makes that folder read-only, and --read adds folders the run may look at but not change. The user's home folder is refused outright, for both reading and writing, and only the folders granted to the run are allowed back in.

The fence also explains a sharp platform limit: the tool runs on macOS only, and on Linux and Windows it declines to start, printing a single line, rather than operate somewhere it cannot enforce its boundaries.

The budget and the loopback proxy

The Claude adapter enforces the money side with a small HTTP proxy. Before launch, outside the fence, the runner reads the real API key once — from an environment variable or from a user-configured command such as a keychain lookup — and starts the proxy on a loopback port. The run itself never sees the real key: its environment holds a fresh per-run token of no value elsewhere, plus a base URL pointing at the proxy.

Every request the run makes — from the CLI, typed by hand, or from a second CLI the run launches — passes through that one door. The proxy accepts only the run's token, blocks any path outside the configured API endpoints, attaches the real key, streams the response back, and prices each response using its usage data. Once the total reaches the budget, further requests are refused and the run's processes are killed. Per-request lines covering path, model, status, usage, cost and running total — never bodies or keys — go to a log in the run's folder.

Spending is bounded at three levels: a budget per run, a cap across all runs held in a config file, and a timer on every run. The README says the Claude flow was exercised against the live CLI on 14 and 15 October 2026.

Caveats worth knowing

The Codex adapter is less airtight. The README states it was built from documentation and has not been run against a live CLI. It requires --model, because the Codex CLI reports tokens rather than cost, so runs are priced by model id, and --soft-budget, because usage surfaces only when a turn ends. It also runs with the key placed in the run's environment, which means the network wall cannot be raised and --network open must be passed. The project itself advises using a dedicated key with a provider-side spend limit and treating it as exposed to anything the run reads.

The tool is a single Python file using only the standard library, makes no network calls of its own and sends no telemetry. The stated floor is Python 3.10, though the README concedes the smoke test has only been run on 3.9.6.

Why it matters

Unattended agent runs are becoming routine, and the dominant safety mechanisms — permission prompts, session trust, provider-side spend alerts — put the burden on the operator or the vendor's account limits. SIwithin instead builds containment into the runtime: least-privilege filesystem access, a metered choke point for API traffic, and a throwaway token in place of the real credential. The pattern generalises beyond these two CLIs, and the willingness to refuse to run wherever it cannot fence is itself a design signal. The Codex gaps show the approach depends on what the underlying CLI permits, but as a reference model for agent containment — enforced by a tool rather than by trust — it is a notable contribution.