deemkeen

follow up: https://deemkeen.github.io/2025/11/18/git-as-federation-tran...

Thanks for the thoughtful pointers — super helpful.

Where diffwatch is today: it’s a portable directory watcher (fsnotify → inotify/FSEvents/ReadDirectoryChangesW) that coalesces events and renders live unified diffs in a tiny TUI.

What I’m planning based on your suggestions (and others here):

1. Two-tier design

Default (no admin): keep the current directory-watch mode for quick, portable use.

Power mode (attach): diffwatch attach --pid <PID> | --cmd "<…>" to trace a process and its children and feed any touched paths into the same diff UI.

2. Per-OS backends for “attach”

Linux: eBPF/bpftrace when available; fallback to strace -ff -e trace=file for zero extra deps.

macOS: opensnoop / fs_usage (DTrace-based).

Windows: ETW (Kernel File provider) via a tiny helper (e.g., KrabsETW) that streams JSON events.

3. Admin rights caveat

macOS (DTrace) and Windows (ETW kernel) typically require admin. I’ll keep the default dir-watch mode as the “no-admin” path, and document the elevated-rights requirement clearly for “attach”.

4. Normalized event stream

All backends emit a common JSON line: {"ts": "...", "pid": 1234, "op": "create|write|rename|unlink|close", "path": "..."} Then a short stability window (debounce + retry on transient ENOENT) before reading to diff.

5. Scalability & ergonomics

Handle editor/atomic-save tempfiles gracefully.

Respect .gitignore and add --exclude/--include globs.

Guardrails for watch count limits; skip non-regular files; optional --record (NDJSON) and --save-patch.

6. Containers / agents

Nice follow-on: diffwatch attach --cmd ... inside a container (or attach by PID in the container namespace) to confine the blast radius for agent runs.

Ask: I’d love help and pointers to minimal tracer scripts:

A small bpftrace/DTrace snippet that reliably captures opens/writes/renames for a PID(+children).

A tiny Windows ETW consumer example focused on File I/O, filtered by PID, emitting JSON.

Repo: https://github.com/deemkeen/diffwatch I’ll open issues for:

“Attach mode” backends (Linux/macOS/Windows)

.gitignore/globs

Event coalescing + transient ENOENT handling

JSON recording / patch export

If you or anyone wants to collaborate, I’ll tag them good first issue / help wanted and am happy to review PRs quickly. Thanks again for the nudge to go beyond plain FS events — the PID/container “attach” mode should make agent debugging much more robust.

great insights, i'll read up on it and see if it can be useful, thx

it uses the os independant fsnotify lib, it surely has its limits. eBPF is great, but linux only, yeah

diffwatch is kinda general purpoure, besides the agent work you could watch different processes doing stuff in your homedir, for example

I built a simple TUI that shows live unified diffs whenever files change. It’s useful for TDD, debugging config changes, and watching AI/agents touch the filesystem in real time.

Repo: https://github.com/deemkeen/diffwatch

Install:

brew install deemkeen/tap/diffwatch # or go install github.com/deemkeen/diffwatch@latest

Try it quickly:

# start the TUI diffwatch -r . # in another shell: echo "hello" >> demo.txt; sleep 1; echo "world!" >> demo.txt

Why this vs. other watchers? Most watchers tell you that something changed. diffwatch shows what changed, instantly, in a minimal TUI.

Roadmap / looking for feedback: --ignore-from=.gitignore, --word-diff, --context N, export (--record, --save-patch), hooks (--cmd "…")

GIF in the README. Would love feedback, issues, PRs—especially on ignore patterns and diff ergonomics.