REWIND
live

Your coding agent has a shell. This is the record of what it did with it.

Rewind is a governance and forensics layer for autonomous coding agents. Every tool call, prompt and file change is captured through machine policy the observed user cannot disable, secrets are stripped before anything is stored, destructive commands that escape the project directory are flagged, and the whole history is searchable in plain English with citations back to the evidence.

Open dashboard Set it up

Why this exists

A coding agent is not a chatbot. It holds a shell, a filesystem and your credentials, and it acts without a human reading each step. The interesting failures are not bad answers — they are a rm -rf that resolved somewhere unexpected, a credential written into a file, a change to a deploy script nobody reviewed.

Those actions leave almost no trace. A terminal scrollback disappears, and the agent's own transcript lives on the machine that produced it, controlled by the person being audited. Neither is evidence.

Rewind puts the record somewhere the observed user does not control, keeps it whether or not anyone was watching, and makes it answerable months later.

What it does

01 Evidence a record that holds up
Complete capture
Every tool call, including subagents, with the raw payload kept verbatim. Session lifecycle, prompts, arguments, results, failures and timings.
Attribution
Each change is grouped under the prompt that caused it, keyed on the agent's own prompt id rather than arrival order — hooks are fire-and-forget and do arrive out of order.
Machine policy
Hooks install at the OS policy path. Removing them takes admin rights on the machine, not a setting inside the app.
Zero install
One settings file. No binary, no daemon, no agent process to keep alive or be killed.
02 Detection rules, not vibes
Boundary rule
A deletion whose target resolves outside the project boundary flags the session, naming the path and the boundary it escaped. Commands are split on &&, ; and || first, sudo and env prefixes stripped, ~ and .. resolved — so a destructive command hidden behind a benign one is still seen.
Effect extraction
Files written and edited, deletions, moves, pushes to remotes, and remote scripts piped into a shell — each recorded as a discrete effect against the event that caused it.
Review workflow
A flag can be acknowledged with a reason, and is then no longer red — but it is never cleared. A flag you can erase is a flag an auditor cannot trust.
03 Investigation answers, with receipts
Ask
Plain-English questions over every captured session — "when did anything get deleted outside a repo?" Every answer cites the sessions it came from, and each citation is a link to the evidence.
Answer verification
Every file path in an answer is checked against the captured records before display. A mistyped path and an invented one look identical to a reader, so unmatched paths raise a visible warning rather than being quietly trusted.
File history
Every session that ever touched a given path, in order — blast radius for when something breaks and you need to know what has been changing it.
Session summaries
Each session summarized and classified by intent, and each diff labelled in plain English, by models running in your own Cloudflare account. Always marked as inference — it never turns a row red, because a rule and a guess must not look the same.
04 Data protection capture is not a free pass
Redaction at ingest
Provider API keys, tokens, JWTs, PEM private keys, credentials in URLs and Authorization headers are stripped before anything is written — not filtered at display time. The unredacted value never reaches storage.
Split credentials
The token on observed machines is write-only: it can post events and cannot read a single one. Reading requires a separate credential that never leaves the operator. A compromised endpoint machine cannot become a way to read the audit trail.
Gated by default
Dashboard and every query API sit behind a login. Nothing about captured data is public.
Abuse limits
Query and login endpoints are rate limited, counted centrally rather than per-edge-node so the limit is real rather than decorative.
05 Operations it has to survive contact with use
Retention
Ended sessions age out on a nightly schedule. Storage has a hard ceiling, and an audit trail that quietly fills up stops recording — which is the worst way for this to fail.
Export
The entire store streams out as NDJSON. A record with no way out of the system is a liability, not an archive.
Visible gaps
When enrichment fails or older records were dropped, the interface says so. A gap that looks like completeness is worse than an obvious hole.
Runs on the free tier
Workers, Durable Objects and Workers AI, entirely within Cloudflare's free allowances. Every limit fails closed with an error — nothing silently accrues a bill.

How it works

Claude Code ──hooks──▶ Worker ──▶ Durable Object (SQLite) │ │ redact · extract · detect Workers AI │ summaries · intent · Ask ▼ │ Dashboard ◀─────────────────────┘

Hooks fire on session lifecycle and every tool call. The Worker authenticates the event, strips secrets, extracts effects, runs the detection rule, and appends the event and its effects in a single transaction. Enrichment happens afterwards and never blocks capture — if the model is slow or unavailable, the record is unaffected.

Setup

01
Deploy the Worker
cd dashboard && npm run build cd ../worker && npx wrangler deploy
02
Set both credentials
npx wrangler secret put REWIND_INGEST_TOKEN # write-only, goes on machines npx wrangler secret put REWIND_TOKEN # read, stays with you

Keep these separate. The ingest token will sit in a file on every observed machine; it must not be able to read anything back.

03
Install the policy on machines to observe
./hooks/install.sh https://your-worker.workers.dev <ingest-token>

This renders the settings file and prints the sudo cp that installs it at /Library/Application Support/ClaudeCode/managed-settings.json. It stops there deliberately — read the file before it becomes machine policy.

Restart Claude Code afterwards. Managed policy settings are read at startup and do not hot-reload. An already-open session captures nothing, which is the single easiest way to think Rewind is broken when it isn't.
04
Or explore it without touching a machine
./scripts/seed.sh https://your-worker.workers.dev <ingest-token>

Replays a realistic session ending in a flagged deletion, so the dashboard, detection and Ask can all be exercised on their own.

Security posture

Against the observed user
Hooks come from machine policy; disabling them needs admin rights, not an app setting. Capture continues whether or not anyone is watching.
Against a compromised endpoint
The credential on that machine is write-only. It cannot read a single captured session, so one compromised laptop does not expose the fleet's history.
Against accidental secret capture
Known credential shapes are stripped in the ingest path, before persistence. Recording everything must not mean hoarding everyone's keys.
Against silent failure
Failed enrichment, dropped older records and unverifiable answers are all shown as such. The system is designed to look incomplete when it is.

What it does not claim