Shepherd Makes AI Agent Runs Reversible

Shepherd now holds every agent file edit as a reversible proposal, per the project's GitHub page. That's the fix for a failure mode that's easy to hit blind. One unreviewed agent run merged roughly 535,000 lines straight into a codebase with no human review.

Nothing touches a file until you accept it. Agent work sits as a fork you can inspect, replay, or discard, with three settlement verbs: select, apply, discard.

The v0.3.0 release, shipped July 8, enforces filesystem permissions with OS-level jails, Seatbelt on macOS and Landlock on Linux. It doesn't trust the model to respect that permission on its own. Copy-on-write forking runs about five times faster than docker commit, with roughly 95% KV-cache reuse on replay.

The project has picked up 1,431 stars and 104 forks since June 24. It's MIT-licensed and still early alpha, with unstable APIs, something the README admits outright.

It lands next to two other agent-observability tools that shipped within a day of it. mindwalk shipped July 9, built by Ricko Yu, who also wrote the Go live-reload tool air.

It replays a Claude Code or Codex session across a 3D map of a repo. Files glow cool where the agent reads, warm where it edits.

Claude Code's v2.1.211 added a --forward-subagent-text flag that streams subagent reasoning into its structured output. Cursor 3.11 shipped a comparable afterAgentThought hook the same week.

The Claude Code v2.1.210 worktree bug was a permission flag the harness was supposed to honor, and it didn't. That's a silent failure, and nobody caught it until after the fact.

Seatbelt and Landlock don't have that problem. The agent doesn't get filesystem access it might abuse. It never gets the access at all.

If you run agents unattended, the low-cost move is forking one throwaway run on Shepherd now, not waiting for it to be production-ready. Once you've watched a replay-gated run, letting an agent commit straight to disk starts looking reckless.