{"slug": "show-hn-wtf-auto-check-what-your-coding-agent-changed", "title": "Show HN: WTF > Auto-check what your coding agent changed", "summary": "A new open-source tool called WTF (agent-wtf) lets developers auto-audit changes made by coding agents such as Claude Code, Cursor, Copilot, Codex, and Aider by inspecting the resulting Git diff rather than the agent itself. WTF compresses mechanical churn from lockfiles, minified bundles, and snapshots, reporting that 3,812 changed lines reduced to 94 meaningful lines to review (97.5% compressed), and its `wtf verify` command runs tests to produce an independently verified local execution receipt. The tool runs locally with no account and no AI required via `npx agent-wtf`, and `wtf init-agent` configures AGENTS.md, CLAUDE.md, .cursorrules, and .github/copilot-instructions.md so agents self-audit before declaring completion.", "body_md": "Any agent. Any Git repo. Local. No account. No AI required.\n\nWTF works with any coding agent (Claude Code, Cursor, Copilot, Codex, Aider) because it inspects the resulting software change, not the agent.\n\n```\nnpx agent-wtf\nbash\n$ npx agent-wtf\nWTF — what just happened?\n2 files changed · +7 / -5\n\nVERIFIED\n  ○ Tests not yet run · Run wtf verify to validate\n    tests (npm test)\n\nPAY ATTENTION\n  1. TESTS\n     Test skipped or disabled\n     test/charge.test.js:9\n     > test.skip('handles VIP coupon cap calculation', () => {\n\nALSO\n  ⚠ 1 skipped test\n  ⚠ 1 debug statement (console.log)\n\nReview surface:\n  12 lines to review across 2 files\n```\n\nThen:\n\n``` bash\n$ npx agent-wtf verify\nWTF — what just happened?\n2 files changed · +6 / -5\n\nVERIFIED\n  ✓ tests       (254ms)\n\nReview surface:\n  11 lines to review across 2 files\nAgent finishes\n     ↓\n    WTF\n     ↓\n  Evidence\n     ↓\nAgent fixes\n     ↓\nWTF verify\n     ↓\nHuman gets receipt\n```\n\nCoding agents can generate more code in two minutes than you can review in an afternoon.\n\nWhen an agent claims: *\"Done! Refactored the billing module and all tests pass.\"* — humans are left with three questions:\n\n1. **What actually happened?**\n2. **Did it actually work, or did the agent just say it did?**\n3. **Where do I actually need to look?**\n\nWTF gives you the answers in under a second.\n\nMost agent diffs are dominated by lockfiles, minified bundles, snapshots, and generated boilerplate.\n\nWTF separates mechanical churn from code that actually deserves human attention:\n\n```\n  3,812 changed lines\n          ↓\n         WTF\n          ↓\n  94 meaningful lines to review (97.5% compressed)\n```\n\nYou review what matters. WTF accounts for the rest.\n\n| Standard Tooling | What Happens with Coding Agents | How WTF Solves It | \n|---|---|---|\n| **`git status`** | Lists modified files, but treats a 2,000-line lockfile the same as an auth timeout modification. | **Separates signal from churn** : Classifies mechanical lines vs. meaningful lines deserving human review. | \n| **`git diff`** | Floods your terminal with generated boilerplate, snapshots, and minified bundles. | **Focuses human attention** : Automatically highlights high-risk patterns (auth, DB migrations, env vars, debug leftovers). | \n| **Agent Claims** | Believes the agent when it claims *\"refactored billing module and all tests pass\"* . | **Verifies independently** : Flags skipped or disabled tests (`test.skip` ) and generates an unforgeable local execution receipt (`wtf verify` ). | \n\nNo installation required:\n\n```\nnpx agent-wtf\n```\n\nOr install globally:\n\n```\nnpm install -g agent-wtf\n```\n\n| Command | What it does | \n|---|---|\n| `wtf` | See what changed and what needs attention in your working tree (~50ms). | \n| `wtf init-agent` | Automatically configure your repository for autonomous agent self-auditing. | \n| `wtf verify` | Discover and run your tests/builds to produce an independently verified receipt. | \n| `wtf show` | View exact diff snippets and line evidence for every finding. | \n| `wtf --json` | Machine-readable evidence schema ( `wtf/0.1` ) for coding agents. | \n\nRun this once in any repository:\n\n```\nnpx agent-wtf init-agent\n```\n\nThis automatically configures your repository's agent rules (`AGENTS.md`, `CLAUDE.md`, `.cursorrules`, and `.github/copilot-instructions.md`).\n\nFrom that moment on, whenever Claude Code, Cursor, Copilot, or Cline works in your repo, the agent autonomously:\n\n1. **Runs WTF** before declaring completion.\n2. **Catches shortcuts** : Detects its own skipped tests (`test.skip` ), debug leftovers (`console.log` ), and schema risks.\n3. **Executes tests** : Runs`wtf verify` to independently validate your test suite.\n4. **Hands you proof** : Attaches the unforgeable verification receipt directly to its final reply before you review.\n\n*(To view the markdown template without modifying files, pass `npx agent-wtf init-agent --print`).*\n\nWTF is designed to inspect machine-generated changes, so it treats repository content as untrusted input.\n\n- **No code uploads** : Zero code or diffs ever leave your machine.\n- **No telemetry** : Works completely offline with zero tracking or background pings.\n- **No account or API key** : No signup, no LLM tokens, no monthly bill.\n- **No required AI model** : Fast, local deterministic analysis.\n- **No shell-based Git commands** : Direct binary spawning (`shell: false` ) with baseline Git configuration overrides.\n- **Repository filesystem containment** : Enforces realpath containment to prevent symlinks from escaping the repository.\n- **Terminal control-sequence sanitization** : Strips ANSI cursor escapes, OSC sequences, and Unicode Bidi controls.\n- **Zero runtime npm dependencies** : Pure ESM package with 0 runtime dependencies, reducing third-party supply-chain exposure.\n\nNormal `wtf` analysis does not intentionally execute project code.\n\n`wtf verify` is different: it runs your project’s verification commands locally with your user permissions and is not sandboxed. Only use it on code you trust to execute.\n\nSee [SECURITY.md](https://github.com/LinusInnovator/wtf/blob/main/SECURITY.md) for details.\n\nWTF is an evidence ledger, not an oracle.\n\nWe strictly avoid fabricated confidence scores (e.g. \"87% safe\" or \"clean code guarantee\"). Instead, WTF categorizes facts into four strict evidence tiers:\n\n- **`REPORTED`** : What something claims happened (e.g., an agent summary).\n- **`OBSERVED`** : What WTF directly confirmed in the Git diff (e.g., session timeout altered,`.env` introduced).\n- **`VERIFIED`** : What WTF independently executed and validated (e.g., test runner exited code 0).\n- **`UNKNOWN`** : What available evidence cannot prove (e.g., tests exist but have not been run).\n\nWTF does not claim to catch every bug or replace human judgment. It eliminates the blind spots between what the machine claimed and what the machine actually did.\n\n```\ngit clone https://github.com/LinusInnovator/wtf.git\ncd wtf\nnpm install\nnpm run build\nnpm test\nnpm run gauntlet\n```\n\nBuilt by [@LinusInnovator](https://github.com/LinusInnovator). Explored in depth at [Great Delights](https://great.delights.pro/ai-patterns).", "url": "https://wpnews.pro/news/show-hn-wtf-auto-check-what-your-coding-agent-changed", "canonical_source": "https://github.com/LinusInnovator/wtf", "published_at": "2026-09-20 10:05:59+00:00", "updated_at": "2026-09-20 10:23:31.137515+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools"], "entities": ["WTF", "agent-wtf", "Claude Code", "Cursor", "GitHub Copilot", "Codex", "Aider", "Cline"], "alternates": {"html": "https://wpnews.pro/news/show-hn-wtf-auto-check-what-your-coding-agent-changed", "markdown": "https://wpnews.pro/news/show-hn-wtf-auto-check-what-your-coding-agent-changed.md", "text": "https://wpnews.pro/news/show-hn-wtf-auto-check-what-your-coding-agent-changed.txt", "jsonld": "https://wpnews.pro/news/show-hn-wtf-auto-check-what-your-coding-agent-changed.jsonld"}}