Comments URL: https://news.ycombinator.com/item?id=47575811

Points: 2

# Comments: 0

On (1), the agent runs in its own container where OneCLI doesn't exist. It can't spin up OneCLI or access its process because it's completely isolated from it. The agent only ever sees placeholder tokens, the real secrets live in a separate container it has no way to reach.

On (2), we actually address this with OneCLI Rules, deterministic constraints enforced at the proxy level before a request ever hits the API. So the agent doesn't need to "behave", it just can't do what the rules don't allow. Would love to hear more about your signed tokens approach.

Re TLS: OneCLI itself runs in a separate container, acting as an HTTPS proxy. The SDK auto-configures agent containers with proxy env vars + a local CA cert. When the agent hits an intercepted domain, OneCLI terminates TLS, swaps placeholder tokens for real creds, and forwards upstream. Containers never touch actual keys.

More here: https://www.onecli.sh/docs/sdks/node#how-it-works

Re 1Password adapters: not yet, but on the roadmap.

- Requiring human approval before sensitive actions go through (as @guyb3 mentioned in the post)

- Managing short-lived JWT tokens (refresh/access) with tight TTLs.

- Scoping permissions per-session rather than per-service

Auth-proxying solves the "don't give the box your API key" part. But the approval layer and token lifecycle management are what make this agent-specific, not just "SSO proxy repackaged."

it worked, but was hard to tell what agents were doing, why something failed, or whether a workflow was actually progressing.

We thought it would be more interesting to treat agents as long-lived workers with state and responsibilities and explicit handoffs. Something you can actually see and reason about, instead of just tailing logs.

So we built Clawe, a small coordination layer on top of OpenClaw that lets agent workflows run, pause, retry, and hand control back to a human at specific points.

This started as an experiment in how agent systems might feel to operate, but we're starting to see real potential for it, especially for content review and maintenance workflows in marketing. Curious what abstractions make sense, what feels unnecessary, and what breaks first.

Repo: https://github.com/getclawe/clawe

Comments URL: https://news.ycombinator.com/item?id=46966209

Points: 62

# Comments: 41

Our OSS launch (1y ago) - https://news.ycombinator.com/item?id=41339308

Now we’re launching ChartDB Cloud - built for teams:

- Embed ERDs into docs, dev portals, or Miro/Notion etc.

- Collaborate in real-time (with live cursors like Figma)

- Keep diagrams always in sync with your database

- Organize large, messy schemas without pain

- Export DDL in multiple SQL dialects (solved deterministically)

- AI assistant to brainstorm and generate new schema objects or schema changes

We designed it so working with databases feels less like a chore and more like a creative process.

Would love feedback - especially from teams dealing with messy schemas or outdated docs.

https://app.chartdb.io

Comments URL: https://news.ycombinator.com/item?id=44972238

Points: 101

# Comments: 13

Supports Postgres, MySQL, SQLite, MSSQL, ClickHouse. Includes AI export to generate DDL in any SQL dialect.

17.5k+ GitHub stars, Feedback welcome!

https://github.com/chartdb/chartdb https://www.chartdb.io

It may be early, but great job putting it out there! Appreciate seeing alternatives that keep things lean and accessible-nice work!

Comments URL: https://news.ycombinator.com/item?id=41339308

Points: 227

# Comments: 64