Skip to content

v0.1.0 — a guarded git for AI coding agents

Choose a tag to compare

View all tags
@suzuke suzuke released this 04 Jul 17:22
v0.1.0
50d376f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A guarded, transparent git for AI coding agents. A small Rust binary that masquerades as git on an agent's PATH — invisible until the moment it matters.

Extracted from agend-terminal (where it ran a production fleet of coding agents sharing real repos on one machine), with full shim history preserved. Apache-2.0.

What's in it

  • Per-agent worktree routing — every mutating git command is routed into the agent's bound worktree (HMAC-signed binding).
  • Deny guardrail matrix — blocks the operations that wreck multi-agent setups (git worktree lifecycle, cross-branch/protected-branch checkout, unbound mutations, canonical-HEAD detaching, pushing trust-root files) with actionable, LLM-readable remedies.
  • Commit provenance — a prepare-commit-msg hook attributes every commit to the agent that made it; a reference-transaction hook journals ref moves.
  • Audited bypass — AGENTIC_GIT_BYPASS=1 (+ per-agent / time-boxed forms), logged.
  • agentic-git run --branch <b> -- <cmd> — standalone session mode that provisions a worktree, key, signed binding, and hooks, then launches your agent inside the guarded session.
  • Recovery layer — before a destructive op (reset --hard, clean -f*, worktree-overwriting checkout/restore, switch --discard-changes, stash drop|clear, merge/rebase/…) the shim snapshots the working tree into a private refs/agentic-git/snapshots/… ref first (fail-open, never blocks). Restore via git checkout <snap> -- .; manage with agentic-git snapshots list|prune.

Honest positioning

A seatbelt, not a cage: a same-uid userspace shim aimed at semi-trusted, accident-prone agents. It stops a prompt-injected or buggy agent from trashing your checkout by habit or mistake; it is not a hard boundary against a determined adversary calling /usr/bin/git directly. For that, run kernel-level isolation underneath it.

Install (from source)

git clone https://github.com/suzuke/agentic-git && cd agentic-git
cargo build --release

crates.io publish is pending (cargo install agentic-git not yet available).

Compatibility

Every AGENTIC_GIT_* env var falls back to its legacy AGEND_* name, so an existing agend-terminal fleet can adopt this binary with zero orchestrator changes.

Platforms

macOS (Apple Silicon) and Linux x86_64 are tested. Windows cfg paths exist but are unverified (CI runs them as a non-blocking advisory job).

This is an alpha: battle-tested logic, fresh packaging. See the README for the full mechanism, environment contract, and roadmap.

Assets 2
Loading