{"id":48558325,"title":"Show HN: Kintsugi – a local-first safety net for AI agents and humans","points":1,"user":"arr0wassass1n","time":1781629229,"time_ago":"5 hours ago","type":"link","content":"

AI coding agents now run real shell commands on your machine — rm -rf, git\npush --force, DROP TABLE, dd, writes straight to disk. Almost always that's\nfine. The one time it isn't (a hallucinated path, a prompt-injected\ninstruction, a confident wrong guess) there's no undo and you find out after.

Kintsugi sits between the agent and your system. It catches the dangerous\ncommand before it runs, explains it in one plain sentence, makes\ndestructive actions reversible with a snapshot, and writes every command\nevery agent ran to an append-only, hash-chained log you own. Local-first:\nno cloud, no account, nothing leaves the machine.

It's not only for AI. A passive bash/zsh recorder (no agent involved) puts\nevery command a person runs on the same tamper-evident log and snapshots the\ndestructive ones just-in-time — so `kintsugi undo` rolls back a DBA's\nfat-fingered rm -rf or clobbering overwrite the same way it rolls back an\nagent's. On a managed host you can seal the settings behind an admin password,\nenforced daemon-side with brute-force lockout, so an agent or a normal user\ncan't quietly turn it off.

The design rule I cared most about: the decision to block a catastrophic\ncommand is made by deterministic rules a human wrote — never an LLM. A local\nmodel can only explain a command and add caution to the ambiguous middle;\nit can never unlock or downgrade a rule-based block. So the block is\npredictable and can't be talked out of by a clever prompt.

A few things that turned out to matter:

- It parses real shell structure, not text. Two passes — a fast tokenizer and\n a true bash AST parser (brush-parser, pure Rust) — and it takes the more\n cautious verdict. That catches commands hidden inside $(...), here-docs,\n subshells, and if/for/while blocks, which substring scanners wave through.\n echo "$(rm -rf /)" is caught.\n- It fails toward caution. A line the parser can't fully understand is held,\n never assumed safe. The hard invariant, enforced by a golden corpus, is\n zero catastrophic-classified-as-safe.\n- It works at the process/PATH layer, not as a per-tool plugin. Native\n pre-tool hooks for Claude Code, Cursor, Codex, Qwen, Gemini, Copilot,\n OpenCode — plus a $PATH shim and an MCP server for everything else,\n including a raw bash script or a Makefile. `kintsugi init` wires them in\n one command.

I want to be honest about the guarantee, because a lot of tools in this space\noversell. Kintsugi is a seatbelt, not a kernel firewall. Hooks are an\ninterception layer — an agent in a yolo/auto-approve mode, or a process that\ncalls a binary by absolute path, can bypass them. That's exactly why there's\na filesystem-watcher backstop: the promise is "nothing is unrecoverable," NOT\n"nothing runs un-warned." And the admin lock defeats an agent or a non-root\nuser — it does not stop root. It guards against mistakes, not a malicious\nsame-user process with root.

I ran an adversarial assessment against it: 0/176 dangerous commands leaked\nto "safe" across a MITRE ATT&CK + GTFOBins corpus, 1.4M fuzz inputs — which\nsurfaced one real heap-DoS, now fixed, and no crashes since — and zero unsafe\nblocks. Every figure is reproduced by a committed test.

It's Rust, MIT, cross-platform (macOS/Linux/Windows). Install is one line and\nit works immediately with no model — an optional local GGUF just sharpens the\nplain-English summaries:

  curl -fsSL https://github.com/arrowassassin/kintsugi/releases/latest/download/install.sh | sh\n\n  # or, from source:\n  cargo install kintsugi\n

\nThis is an early release and I'd genuinely like to be told where the model is\nwrong — both false alarms on safe commands and, more importantly, any\ncatastrophic command that slips through. Happy to answer anything about the\nrule engine, the AST approach, or the threat model.","url":"https://github.com/arrowassassin/kintsugi","domain":"github.com","comments":[{"id":48562788,"level":0,"user":"Jimmy0252","time":1781647365,"time_ago":"10 minutes ago","content":"

[flagged]","dead":true,"comments":[]}],"comments_count":1}