{"_id":"@agent-undo/core","_rev":"2-cb6bb1abbba1c6c8165f95f62e4e4479","name":"@agent-undo/core","dist-tags":{"latest":"0.2.0"},"versions":{"0.1.0":{"name":"@agent-undo/core","version":"0.1.0","keywords":["ai","agents","undo","rollback","mcp","model-context-protocol","time-machine","reversible","autonomous-agents","claude"],"license":"MIT","_id":"@agent-undo/core@0.1.0","maintainers":[{"name":"tathagatmaitray","email":"tathagatmaitray@gmail.com"}],"bin":{"undo-mcp":"dist/mcp.js"},"dist":{"shasum":"3768bb54ee30d3b4bdac1a27f6bd2ee1f3bdfb02","tarball":"https://registry.npmjs.org/@agent-undo/core/-/core-0.1.0.tgz","fileCount":9,"integrity":"sha512-/AIyMBO8Qsd/1QHqf1N1bceb4XpBTDx7YOqzLiwZjNnzDXYXreejSwopzQO1L8tNgJx/8mmfgMVH8qVrFkWttw==","signatures":[{"sig":"MEYCIQD0azkJVX+sG23olvQm17+3QSiXYWq3lIVJ7Upv9JRDGwIhAMThvqHPdSkG5IdckZaTb/88Q/PLrxkEzpJ54jFLagwn","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":23338},"main":"dist/index.js","type":"module","types":"dist/index.d.ts","engines":{"node":">=18"},"exports":{".":"./dist/index.js"},"gitHead":"cc4e90ba72c9a83b7886c5016f104e6b595f9684","scripts":{"mcp":"tsx src/mcp.ts","demo":"tsx demo/demo.ts","test":"tsx demo/mcp-smoke.ts","build":"tsc","build:engine":"npm run build --workspace @agent-undo/engine","prepublishOnly":"npm run build"},"_npmUser":{"name":"tathagatmaitray","email":"tathagatmaitray@gmail.com"},"workspaces":["crates/undo-napi"],"_npmVersion":"10.8.2","description":"Ctrl-Z for AI agents. A universal time machine that records every side effect an autonomous agent produces — file writes, shell commands, git state, HTTP mutations — and reverses them with one command.","directories":{},"_nodeVersion":"20.20.2","dependencies":{"zod":"^3.23.8","@agent-undo/engine":"0.1.0","@modelcontextprotocol/sdk":"^1.12.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.19.0","typescript":"^5.6.0","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/core_0.1.0_1781369421879_0.7232835143067458","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@agent-undo/core","version":"0.2.0","description":"Ctrl-Z for AI agents. A universal time machine that records every side effect an autonomous agent produces — file writes, shell commands, git state, HTTP mutations — and reverses them with one command.","type":"module","license":"MIT","keywords":["ai","agents","undo","rollback","mcp","model-context-protocol","time-machine","reversible","autonomous-agents","claude"],"bin":{"undo-mcp":"dist/mcp.js"},"main":"dist/index.js","types":"dist/index.d.ts","exports":{".":"./dist/index.js"},"engines":{"node":">=18"},"publishConfig":{"access":"public"},"workspaces":["crates/undo-napi"],"scripts":{"build:engine":"npm run build --workspace @agent-undo/engine","build":"tsc","mcp":"tsx src/mcp.ts","demo":"tsx demo/demo.ts","test":"tsx demo/mcp-smoke.ts && tsx demo/compensate-test.ts && tsx demo/email-test.ts && tsx demo/reversal-test.ts","prepublishOnly":"npm run build"},"dependencies":{"@agent-undo/engine":"0.2.0","@modelcontextprotocol/sdk":"^1.12.0","zod":"^3.23.8"},"devDependencies":{"@types/node":"^22.0.0","tsx":"^4.19.0","typescript":"^5.6.0"},"_id":"@agent-undo/core@0.2.0","gitHead":"11e8674dd0724c5e14b686523da65bb889ef045f","_nodeVersion":"20.20.2","_npmVersion":"10.8.2","dist":{"integrity":"sha512-ZZztko0mKstS9HMzM0+vep/hQL/ptcAOQoE3agaV4Pr33eswtJFXKV07S/uVBJE3h8o3+q9auvoaa+jxooorsQ==","shasum":"1044b475aaafb2c9ce346baae39d32b34ad67f8d","tarball":"https://registry.npmjs.org/@agent-undo/core/-/core-0.2.0.tgz","fileCount":17,"unpackedSize":42450,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDtj8SuA5ZovZKqGHxL0a3Ln6/aX58lO3vKKCuUelbC3gIgfC+RHn8/ed42Fix4NFnLYjZo8PFfPY3xg5GXSNdMXD8="}]},"_npmUser":{"name":"tathagatmaitray","email":"tathagatmaitray@gmail.com"},"directories":{},"maintainers":[{"name":"tathagatmaitray","email":"tathagatmaitray@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/core_0.2.0_1781393792985_0.39240505164263184"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-13T16:50:21.707Z","modified":"2026-06-13T23:36:33.292Z","0.1.0":"2026-06-13T16:50:22.017Z","0.2.0":"2026-06-13T23:36:33.150Z"},"license":"MIT","keywords":["ai","agents","undo","rollback","mcp","model-context-protocol","time-machine","reversible","autonomous-agents","claude"],"description":"Ctrl-Z for AI agents. A universal time machine that records every side effect an autonomous agent produces — file writes, shell commands, git state, HTTP mutations — and reverses them with one command.","maintainers":[{"name":"tathagatmaitray","email":"tathagatmaitray@gmail.com"}],"readme":"<p align=\"center\">\n  <img src=\"docs/banner.svg\" alt=\"undo — Ctrl-Z for AI agents\" width=\"620\">\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/tathagat22/agent-undo/actions/workflows/ci.yml\"><img src=\"https://github.com/tathagat22/agent-undo/actions/workflows/ci.yml/badge.svg\" alt=\"CI\"></a>\n  <a href=\"https://www.npmjs.com/package/@agent-undo/core\"><img src=\"https://img.shields.io/npm/v/@agent-undo/core?label=npm&color=cb3837\" alt=\"npm\"></a>\n  <a href=\"https://crates.io/crates/undo-core\"><img src=\"https://img.shields.io/crates/v/undo-core?label=crates.io&color=e6a141\" alt=\"crates.io\"></a>\n  <a href=\"LICENSE\"><img src=\"https://img.shields.io/badge/license-MIT-6366f1\" alt=\"MIT\"></a>\n  <a href=\"https://tathagat22.github.io/agent-undo/\"><img src=\"https://img.shields.io/badge/docs-site-22d3ee\" alt=\"docs\"></a>\n</p>\n\n<p align=\"center\"><b>When you let an AI agent loose on your machine, <code>undo</code> records every change it makes to the real world and lets you reverse all of it with one command.</b></p>\n\n---\n\nThe thing stopping people from running agents in full-auto isn't intelligence — it's **fear**. An agent edits 15 files, deletes a folder, runs a migration, sends an email, fires off an API call. If it screws up, the files are *maybe* recoverable. The deleted folder, the DB row, the sent email, the network call? **No undo exists anywhere.**\n\n`undo` is that undo. Act freely, because everything is reversible.\n\n```console\n$ undo watch                       # arm it — now any agent's changes are reversible\n\n  ... agent wipes a secret, deletes auth.ts, dumps junk, POSTs a charge ...\n\n$ undo diff                        # see exactly what it did\n$ undo rollback                    # rewind all of it\n  ✓ rewound to cp001\n```\n\n## Works with any AI agent\n\n`undo` is **not tied to any model, vendor, or IDE.** Every agent does one thing in common — it changes files on disk — so undo meets it at whichever layer is convenient:\n\n| Your setup | Turn it on | Covers |\n|---|---|---|\n| **Anything** — Cursor, Copilot, Windsurf, Aider, custom scripts, even you | `undo watch` | Snapshots, then watches the filesystem. Reversible no matter what made the change. |\n| **Any CLI agent** | `undo run -- <agent-cmd>` | Wraps the command; snapshots first, reversible after. |\n| **Any MCP client** | add the [MCP server](#mcp-server) | The agent calls `undo_checkpoint` / `undo_track` / `undo_rollback` itself. |\n| **Claude Code** | `undo protect` | Native PreToolUse hook — auto-checkpoints every session, zero effort. |\n\n## Install\n\nThe **CLI** works on macOS, Linux, and Windows — no Node required:\n\n```bash\ncargo install undo-core            # via crates.io (installs the `undo` binary)\nbrew install tathagat22/tap/undo   # via Homebrew\ncurl -fsSL https://raw.githubusercontent.com/tathagat22/agent-undo/main/packaging/install.sh | sh\n```\n\nThe **MCP server** (for MCP clients like Cursor / Claude):\n\n```bash\nnpx -y @agent-undo/core\n```\n\n## What it reverses\n\nOne consistent model — record a change with its inverse, replay the inverse on rollback — across every domain. Anything that touches the outside world is **dry-run gated**: undo shows you what it *would* do and never fires blindly.\n\n### 📁 Files — byte-perfect, crash-safe\nCreate / modify / delete / directories / symlinks / permissions, all restored exactly. A content-addressed blob store means even large and binary files come back byte-for-byte. Plus **redo**, and **selective** per-file revert.\n\n```bash\nundo rollback              # rewind everything since the checkpoint\nundo revert src/auth.ts    # ...or just one file\nundo redo                  # ...changed your mind\n```\n\n### 🔍 `undo diff` — review before you trust\nA PR-style view of exactly what the agent changed, built from undo's own before-snapshots:\n\n```diff\n src/auth.ts  modified  +2 -2\n  -const KEY = \"prod-secret\"\n  +const KEY = \"\"\n src/new.ts   new  +1 -0\n  +export const added = true\n 2 file(s) changed, +3 -2\n```\n\n### 🌐 Network calls — actually reversed\nWhen the agent records a mutation with a **compensator** (the request that reverses it), undo runs it:\n\n```\nagent: POST /v1/charges          → records a refund as the compensator\nundo_compensate                  → preview: \"WOULD send the refund\"\nundo_compensate execute=true     → fires it, most-recent-first\n```\n\n### ✉️ Email — honest hold-and-release\nNo tool can recall a *delivered* email — the recipient has a copy nothing can touch. So undo does the one honest thing that works: it **holds the email as a draft** that has gone nowhere.\n\n```\nundo_email_stage    to=… subject=… body=…   # held, NOT sent\nundo_email_cancel                            # delete the draft → it never existed\nundo_email_release                           # ...or actually deliver it\n```\n\n**Before release:** cancel is a true unsend. **After delivery:** it's gone, and undo says so plainly — the most it can do then is trash *your* copy. We don't pretend to reach into other people's inboxes.\n\n### ☁️ Cloud & databases — any tool\nundo doesn't hardcode AWS or Postgres. The agent records the **command that reverses** what it did, and undo runs it (dry-run gated):\n\n```\nundo_record_reversal  description=\"created S3 bucket assets-prod\"  command=\"aws s3 rb s3://assets-prod --force\"\nundo_record_reversal  description=\"ran migration 042\"             command=\"psql $DB -f rollback_042.sql\"\nundo_compensate execute=true\n```\n\nWorks with **any** cloud, database, or CLI. (For DB `UPDATE`/`DELETE`, you record the inverse — undo runs what you give it.)\n\n## CLI\n\n```\nundo init                      set up undo in this directory\nundo checkpoint [label]        mark a point you can rewind to\nundo track <path>...           capture a path before the agent changes it\nundo status                    what's changed since the last checkpoint\nundo diff                      a PR-style diff of everything the agent changed\nundo rollback [checkpoint]     rewind everything since a checkpoint\nundo revert <path>             selectively undo just one file\nundo redo                      undo the last rollback\nundo watch                     snapshot + watch the filesystem (any agent)\nundo run -- <command>          snapshot, then run any command reversibly\nundo protect / unprotect       install / remove the Claude Code auto-capture hook\n```\n\n## MCP server\n\nAdd to your MCP client's config (e.g. `.mcp.json`):\n\n```json\n{ \"mcpServers\": { \"undo\": { \"command\": \"npx\", \"args\": [\"-y\", \"@agent-undo/core\"] } } }\n```\n\n**16 tools:** `undo_init` · `undo_checkpoint` · `undo_track` · `undo_status` · `undo_diff` · `undo_log` · `undo_rollback` · `undo_revert` · `undo_redo` · `undo_record_http` · `undo_record_reversal` · `undo_compensate` · `undo_email_stage` · `undo_email_release` · `undo_email_cancel` · `undo_email_pending`\n\n## Architecture\n\nA polyglot system with a real native boundary:\n\n```\n┌─────────────────────────────┐\n│  TypeScript  (agent surface) │   MCP server · compensation · email · reversals\n├─────────────────────────────┤   ↕ NAPI-RS (in-process, no subprocess)\n│  Rust  (the engine)          │   Effect · Journal · blob store · rollback · diff\n│   crates/undo-core           │   + the standalone `undo` CLI\n└─────────────────────────────┘\n```\n\nRust owns the part that touches your filesystem and has to be fast and trustworthy; TypeScript owns the agent-facing surface; NAPI-RS bridges them in-process.\n\n## Why you can trust it\n\nA universal undo is only worth anything if it's correct under pressure:\n\n- **Crash-safe** — journal/state written write-temp-then-rename (atomic on POSIX).\n- **Rollback integrity** — if any step fails, the journal is left intact and it's safe to retry; never reports success while leaving files unrestored.\n- **Concurrency-safe** — an exclusive lock, so an agent and a human can't corrupt the journal.\n- **Sandboxed** — refuses paths outside the project, never captures `.undo`, auto-gitignores snapshots so secrets aren't committed.\n\nThis is tested, not asserted: unit tests per property, a **property test** that runs dozens of randomized mutation sequences and asserts byte-for-byte round-trips, a **concurrency test** that hammers one journal from many threads, and Node suites that drive real HTTP/Gmail/command reversals against mock servers. The engine suite runs in CI on **Linux, macOS, and Windows**.\n\n> **Platform note:** the engine is verified on all three OSes. On Windows, content + structure + mtime restore exactly; unix permission bits and symlink fidelity are POSIX-only (they no-op rather than fail).\n\n## License\n\nMIT © Tathagat Maitray\n","readmeFilename":"README.md"}