git for humans.
au
for agents.
4 MB Rust binary · works with Codex, Claude Code, Cursor, Cline, Aider, and plain CLI wrappers
The shift
Source control assumed a human writer.
AI broke the assumption.
git
Versions human intent.
- You commit when you mean to.
- Every change is a deliberate act.
- History reflects what you wanted to keep.
git blametells you which human wrote each line.
au
Records agent action.
- Every byte is captured on write.
- No deliberate act required.
- History reflects what actually happened.
au blametells you which agent wrote each line.
Not a replacement. A second system, running alongside.
Why this exists
The current safety nets
break under agent speed.
The receipts happen to come from Cursor because the receipts are public and unusually blunt. The underlying problem is broader: editor-local undo and checkpoint features were not designed for tools that can rewrite a project between commits.
“This is a known issue, a bug caused by a conflict between the Agent Review Tab and file editing. Close the Agent Review Tab before the agent makes edits.”
“cursor agent went off the hinges and started deleting my entire app. 90% of my app is gone … I hadn't gotten a chance to push to github yet.”
Install
One command.
No account. No telemetry.
If your tool exposes hooks, add them. If it does not, wrap the CLI with
au exec --agent ... . The watcher is the base layer either way.
The principle
The agent is
an untrusted process.
Every piece of engineering ceremony — commits, review, blame, audit — assumed one thing: the writer of the code is a human you can hold accountable.
That assumption broke. Agents silently delete tests, rewrite mocks to pass, refactor across boundaries without understanding intent. A bad decision at 14:32:07 is 200 files deep by 14:32:42.
Treat AI coding agents the way a security engineer treats any process with write access: assume it will eventually do something wrong, and build the controls that let you recover.
au is the substrate. Observability, attribution, reversibility — the three primitives the next decade of agent-aware tooling will be built on.
Questions
Seven things developers ask
before they install.
How is this different from git?
Does it replace my editor's undo?
Does it work with Cursor, Cline, Aider, Codex?
au exec --agent ... already works for any CLI you can wrap.Does it touch my .git directory?
.agent-undo/. If your agent nukes .git itself, au is unaffected and can still roll everything back.What if the daemon isn't running when my agent writes?
au init sets up the project. au serve --daemon starts the watcher. au doctor tells you at a glance whether it is alive.How much disk does it use?
au gc uses a 7-day cutoff by default and you can change that in .agent-undo/config.toml.Can I run it on CI?
Stop reconstructing
what your agent did after the fact.
Install the binary. Start the watcher. Add hooks where they exist, or wrap the CLI you use. Leave it alone until you need a rollback.