Harness in a Box
(HIB)
A local, security-first harness over the coding CLIs you already pay for. It decides what the agent may touch and shows you what left the machine.
HIB sits between you and Claude Code or Codex. It runs the official CLIs on your own subscriptions, as you would run them yourself, and adds the controls those CLIs leave to you: per-folder policy, an egress log, a redaction guard and an approval prompt for every risky action. It never extracts your logins and never calls a private endpoint.
⚡ Quick start
# Needs Bun >= 1.4, git, and one logged-in CLI (claude or codex)
git clone https://github.com/matijazezelj/hib.git && cd hib
bun install
ln -s "$PWD/src/cli.ts" ~/.local/bin/hib
cd ~/code/myproject
hib # terminal coding agent for this folder
hib serve # the same folder in the browser on 127.0.0.1:4141
macOS or Linux. Everything runs on your machine; there is one background daemon and its log is ~/.hib/daemon.log.
What HIB answers
| Question | Where HIB answers it |
|---|---|
| What is the agent about to do? | A live timeline of reads, edits and commands. Edits show a diff and wait for Allow, Always or Deny. |
| What did it send out? | The egress log: each turn’s redacted prompt, the account it went to, and every tool call. |
| Can I keep people and companies out of the prompt? | A local entity-recognition model and pattern rules swap names, places, organisations, addresses, emails, IPs and secrets for placeholders before the prompt leaves. The real values are restored in the answer. |
| Can this folder be kept away from other vendors? | A sensitive workspace is pinned to exactly one vendor account. Handoff, failover, advisor and classifier calls are refused there. |
| Can I get an answer about a table without sending the table? | hib analyze sends a profile and gets code back. The code runs locally and the data does not leave. |
| Which model for which job? | A local OpenAI-compatible router that classifies the request, skips accounts near their quota, and learns from your feedback. |
Names never leave
Pattern rules catch emails, keys, IPs, usernames and home paths. They cannot catch “Ana Kovač from Zeleni Val d.o.o. in Osijek”. With name detection on, a multilingual entity-recognition model runs on your machine and finds people, places and organisations. Rules add companies with legal suffixes and street addresses.
Each finding becomes a stable placeholder such as […-PERSON-1]. The same value gets the same token for the whole conversation, so the model can still reason about who did what, and IPs on one /24 share a network label. The model is told to use the placeholders and not to ask about hidden values. The answer streams back with the real values restored, and the token map is sealed at rest with AES-256-GCM.
- Pinned and local. A one-time ~180 MB download, pinned to an exact model revision, then no network needed.
- Fails closed. If the model is missing or errors, the request waits for your approval. Oversized input is refused, not half-scanned.
- Prose only. Code is skipped, and common tech names are not mistaken for companies.
- Measured small. The README reports 24/24 and 19/20 entities on two hand-labelled sets in English, Croatian, Serbian and German. It is a model: it adds to the rules and does not replace them.
- Scope. It covers router prompts,
hib ask -ftables and sensitive-folder prompts. In agent mode the CLI reads your files itself, so the guard covers what you type, and the sandbox and approvals cover the rest.
Controls you can inspect
- Local only. The daemon listens on
127.0.0.1. Requests are checked for Host (DNS rebinding) and Origin, and the browser session cookie isHttpOnlyandSameSite=Strict. API clients use a token in~/.hib/token. - Files at rest. Everything in
~/.hibis mode0600. Each conversation’s token map is sealed with AES-256-GCM. - A redaction guard. Secrets, IPs, emails, usernames, home paths and your own terms become per-conversation tokens, restored in the answer. Private keys, database URIs and cloud keys stop and ask first. Optional local name detection runs a pinned model and fails closed.
- Credentials are off-limits. Workspace sessions are denied reads of
~/.hib,~/.claude*,~/.codex,~/.ssh,~/.aws,~/.gnupgand~/.config/gh. - Policy lives outside the repo. A sensitive-workspace policy is stored in HIB’s database, so an agent working in the folder cannot edit it. Lifting it takes a command at the terminal, not just the API token.
- Repo config is ignored in sensitive folders. Claude sessions load only your user settings, never the repository’s
.claude/settings or hooks, and no MCP servers. - No shell strings. HIB starts the CLIs and git with argument arrays, not shell command lines.
- Every command runs in an OS sandbox. Claude Code’s Bash sandbox (Seatbelt on macOS, bubblewrap on Linux) or Codex’s sandbox with a HIB permission profile. Writes stay in the folder, the network is closed, and the daemon,
~/.hib, CLI logins and credential folders cannot be read. It covers scripts the agent writes and runs. - Browser login uses a one-time code. A link from the terminal carries a code that works once within 15 minutes, and minting one needs the token.
- Paths are resolved before they are judged.
src/../.git, doubled slashes and symlinks into.gitcount as.git, so “Always allow edits” cannot reach tool config or git hooks.
Work on data without handing it over
hib analyze logins.csv "impossible travel: consecutive logins per user implying more than 900 km/h"
hib ask -f users.csv "which three people in Engineering earn the most?"
hib analyze shows the model column names, types, counts and three made-up rows. Columns that look identifying are never shown. The model writes an analyze(rows) function, you read and approve it, and it runs in a separate process. An offline gazetteer (hib geo setup) lets that code compute distances and speeds without sending a single city name out.
hib ask -f is for questions that need rows: identifying columns become stable tokens, categories and numbers stay readable, and the answer comes back with real values restored.
Background work you can review
hib task "…" hands a job to an agent in its own git worktree and branch. You get a notification when it finishes or hits a command that still needs approval, and you review the diff before hib tasks merge or discard. Tasks start from your last commit, and they are not offered in sensitive folders.
Honest boundaries
- Auto mode needs the sandbox, and still asks. It approves edits and sandboxed commands inside the folder. It asks for a new network host (package registries excepted), web fetches and searches,
git push, publishing,sudo, recursive deletes and anything touching HIB’s own folders. Without a sandbox (Linux without bubblewrap and socat, or Windows) it stays off, and so do background tasks. - The agent’s own file tools are not sandboxed. Read and Edit are held to the folder by permission rules and HIB’s prompts.
- Your own account is trusted. Anything else running as you, outside an agent sandbox, can still read
~/.hib/token. - “Always” is narrow. Interpreters and wrappers such as
python,bash,envandxargsmatch only the exact command line. - The analysis sandbox needs Seatbelt or bubblewrap. On macOS, or on Linux with
bwrapinstalled, model-written code runs with no network, no writes and no reads of your home folder. Withoutbwrapon Linux it is a separate process with a restricted JavaScript context, which is a weaker guarantee. - Codex reads cannot be gated. Codex runs read-only commands without asking, so prefer a Claude account for sensitive folders.
- Name detection is a model, not a promise. Measured on two small hand-labelled sets: 24 of 24 and 19 of 20 entities found.
- The egress log keeps redacted text locally. Anything the guard missed is in there too.
- Subscriptions have their own rules. Retention and training settings belong to each vendor. HIB cannot change them.
- Young project. It started in October 2026 and has over 150 tests. It has had its first outside-in review and fixed what that found, and it still needs real-world use.
Run it on a folder you care about
MIT licensed. The source is small enough to read in an afternoon, and the controls above are meant to be checked, not trusted.
🚀 Need Help Getting Started?
Self-hosting is free and always will be. But if you'd rather have it deployed, configured, and maintained for you — I can help.