OneCLI (YC S26) ships an OSS sandboxed agent harness - the team-scale answer to Claude Code

A Launch HN post from a Y Combinator S26 startup positions itself as "personal Claude Code, but with enterprise guardrails" — the harness-ops market keeps getting more crowded.

In plain terms. Two founders launched OneCLI on Hacker News: an open-source sandboxed agent harness with connectors for GitHub, Gmail, Notion, and Dropbox, and a deterministic human-in-the-loop approval step baked into the chat. Positioning: give every employee a personal coding agent, but with the sandbox and approval gates a CISO can actually sign off on.

Context

The harness-ops thread has moved fast this summer. Wallfacer shipped a terminal session manager for Claude Code (#1826); AI agent Skills got standardized (#1894); Context engineering became its own discipline (#1939); Cloudflare pushed "Agents Week" positioning edge as the agent runtime (#1766); Zhipu shipped GLM-5.3 tuned for coding-and-security (#1947). Every layer of the agent stack is being productized.

Under the hood

Per the Launch HN post, OneCLI is open source (repo published on GitHub), gives each user a sandboxed personal agent, exposes chat-native connectors to GitHub / Gmail / Notion / Dropbox, and - critically - implements human-in-the-loop approval as a deterministic in-chat step rather than an out-of-band modal. That means the same audit log captures both the agent's proposed action and the human's decision, in the same conversation history.

Analysis

The interesting bet here is deterministic HITL. Most current harnesses use LLM judgment to decide when to escalate to a human. That fails at exactly the moments you'd want it not to - high-value transactions, credential-touching operations, anything with a policy tag. Making the approval step deterministic (rules-driven, chat-native) is closer to how bank compliance systems work, and much closer to what enterprise buyers actually want to hear when the word "agent" is followed by the word "production."

Scenarios

• Base case (60%): OneCLI captures a niche - regulated mid-market where audit-trail-visible approvals matter more than raw agent smarts.
• Consolidation case (25%): Anthropic or GitHub ships an equivalent HITL primitive natively; OneCLI's differentiator narrows.
• Enterprise case (15%): A big-four consulting firm picks it as the "reference agent harness" for regulated clients; OneCLI wins on reputation.

Risks

OSS with commercial SaaS on top has a well-known monetization gap. The connector strategy is a race against the broader agent-tooling ecosystem. And "deterministic HITL" is a claim that will be stress-tested by real deployment.

So what

If you're evaluating agent harnesses for a regulated team, put OneCLI on the shortlist and stress-test the HITL specifically - feed it a task that requires touching a secret, and see if the approval flow is reviewable in your SIEM. That's the acceptance criterion nobody publishes and every buyer needs.