AWS SafeBox: deterministic policy proxy for agent infra commands
At a glance
PATH-fronted proxies for terraform/aws/kubectl: TOML policies allow plan/read but block destroy/terminate/recursive deletes before the real binary runs—no LLM judgment in the safety path. This workflow is listed under security, guardrails, infra, coding-agents, deterministic.
Managoat turns coding agents into a conversational computer API: POST a prompt, a sandbox wakes with repos/packages/credentials, Claude Code or Codex or Gemini CLI runs, then the machine parks (disk kept, no awake compute) until the next turn. Agent/Environment/Vault templates; secrets merge with Vault winning; bound secrets never enter the sandbox (egress broker). REST API, CLI, TypeScript SDK, demos (Conversations + Workbench), self-host docs. GitHub managoat/managoat actively shipping Oct 17.
Beta plugin sits between the model and your app: write hard-deny/soft-deny/allow rules in prose; Armor evaluates every tool call (powered by a decision model) and blocks policy violations before bash/git/exfil runs—Claude Code auto mode works via Ori on any OpenRouter model.
junegunn (fzf author) documents how shell CTRL-T bindings die once you live in an agent prompt—and how tmux PREFIX bindings restore fzf: tmux-fzf-complete (files/dirs/URLs/on-screen paths/sentences) and fzf-git.sh (commits, branches, PRs) inject selections as keystrokes into Claude Code or Codex. Requires tmux 3.7+ floating panes and agent settings that keep scrollback (/tui default for Claude Code; Codex alternate_screen=never). Pattern: make agent prompts as completable as the shell.