Context, Fences and Review: Making Long Agent Runs Trustworthy
The failure mode of agent work is rarely a bad answer. It is an agent that went further than you expected, spent more than you budgeted, or quietly forgot everything it learned last week. The Show HN projects below all target that problem from a different angle: capturing context before it disappears, keeping memory between sessions, putting hard boundaries around what a run may touch, and forcing a review before anything executes.
Eight of them, roughly in the order an agent run encounters them.
Getting the world into the agent
Agents are only as good as what they can see, and most of the working day never reaches them. Ambient Context is a macOS menu bar app that writes down what you worked on, in plain markdown, in a folder you own. While it is open it reads the text of the focused window through the macOS accessibility tree and keeps a running record you can point Claude Code, Cursor, Codex or any MCP client at. The design choice worth copying is that the output is plain files on your disk, not another service holding your history.
For the web side of the same problem, Jurl is curl for pages you want read rather than fetched. You tell it what you want from a URL and it scrapes with intent, returning only what you asked for and following links when the answer sits several pages away. It is the difference between handing your agent a document and handing it the fact.
Memory that survives the session
Every chat client now has some story about memory, and most of them store the transcript. DocuMemory is more selective: it distils raw AI chat sessions into architecture decisions and reusable prompt-injectable context blocks, capturing from Claude Code, ChatGPT, Cursor and Windsurf, stripping noise through subtractive distillation, then recalling and injecting what matters over MCP. The useful distinction is that it wants the decision, not the conversation that produced it.
Aura AI Agent takes the self-hosted route to the same end. It is a Go binary that hosts the runtime, tools, CLI, Telegram gateway and web cockpit, where each person signs in to their own identity with their own memory database. Temporal graph memory, scheduled jobs and MCP tools come along, shipped as a Docker Compose appliance under MIT, so the memory lives on hardware you control rather than in someone else's index.
Fences you can prove rather than promise
Asking an agent nicely to stay inside a folder is not a control. SIwithin runs an agent CLI unattended on a brief, inside a fence around the folders you give it and under a dollar budget. Your home folder is refused for both reading and writing, the run cannot spend more than the dollars it was given, and every run writes one line in a ledger saying what it did. Where the underlying CLI cannot be stopped mid-run, the tool refuses to use it unless you explicitly accept that.
Lights-on Software Factory approaches the same anxiety from the setup side. It is a boilerplate repository for running a lights-on software factory with Claude Code: a container that shares only the workspace directory with the host, a deterministic bash command regulator so routine commands stop asking for permission, and an orchestrator the author reports cut token spend sharply compared with running Claude workflows directly. Clone it and the defaults are already the safe ones.
Review before it runs
The cheapest place to catch a bad agent run is before it starts. Plannotator is free, open-source review tooling for Claude Code, OpenCode, Codex, Pi and Droid: you read the plan before the agent executes it, annotate agent-written code in a full diff viewer, and send structured feedback straight back to the agent, locally. Its Inbox collects the questions, plans and reviews from several agents in one window, which is the part you miss once you run more than one at a time.
Governing the tool call itself
Plans and fences cover intent and scope, but the moment of risk is the tool call. Yana is a local-first control plane that sits between any model and real power over your machine, with deterministic control over what an agent can access, change and execute, plus pre, post and stop hooks around every call. The framing is blunt and correct: models propose, something else decides.
Why this batch matters together
These eight projects share an assumption that the earlier wave of agent tooling did not: that the agent will be running when you are not watching. Once you accept that, context capture, durable memory, provable boundaries, pre-execution review and tool-call governance stop being nice-to-haves and become the checklist. Most teams are missing at least four of the five.
