git for humans.
au for agents.
One command undo.
Every byte your AI coding agent writes — captured, attributed, reversible. Editor-agnostic. Local-first. 3.9 MB Rust binary.
agent-undo on crates.io · v0.0.3 release · Apache-2.0
The shift
Source control assumes a human writer. AI broke that assumption.
git
Versions human intent.
- You commit when you mean to.
- Every change is a deliberate act.
- History reflects what you wanted to keep.
git blametells you which human wrote each line.
au
Records agent action.
- Every byte is captured on write.
- No deliberate act required.
- History reflects what actually happened.
au blametells you which agent wrote each line.
A 5-minute Claude session can produce 200 file writes. git sees zero of them
until you type git add.
au sees all of them, the moment
they hit disk, tagged with the agent that made them.
They're not competitors. They're complements.
Why this exists
Your editor's undo button is broken.
Don't take our word for it. Take it from Cursor's own staff and users, on the record, on their own forum.
“This is a known issue, a bug caused by a conflict between the Agent Review Tab and file editing. Close the Agent Review Tab before the agent makes edits.”
“cursor agent went off the hinges and started deleting my entire app. 90% of my app is gone … I hadn't gotten a chance to push to github yet.”
Cursor's official fix in 2026 is “close the Agent Review Tab.” Claude Code has no first-class undo. Cline's checkpoints are VSCode-bound. There is no editor-agnostic, dead-simple safety net for AI file edits — until now.
Install
One command. Three more, and you're protected.
01
Install
Single 3.9 MB binary. macOS and Linux. Drops au on your PATH.
02
Initialize your project
au init --install-hooks sets up .agent-undo/ and patches your Claude Code settings.
03
Type au oops when you need it
The last burst of agent edits is rolled back, atomically. The undo is itself undoable.
The principle
The agent is an untrusted process.
For 50 years, software engineering ceremony — version control, code review, blame, audit logs — assumed one thing: the writer of the code is a human you can hold accountable. That assumption silently broke when AI agents started writing the majority of new code.
Agents fail in ways human contributors never would. They silently delete tests. They rewrite mocks to make themselves pass. They refactor across boundaries without understanding intent. A bad decision at 14:32:07 is 200 files deep by 14:32:42. None of the tools in your stack — git, your editor, your CI — were designed for that.
Treat AI coding agents the way a security engineer treats any process with write access to your filesystem: assume it will eventually do something wrong, and build the controls that let you recover when it does.
au is the substrate.
Observability, attribution, reversibility — the three primitives the next
decade of agent-aware tooling will be built on.
Questions
Ten things developers ask before they install.
What's the difference between this and git?
git versions human intent — commits are deliberate acts you type on purpose. au records agent action — every byte, the moment it hits disk. They complement each other and you run both. git stays exactly what it is; au fills the gap between commits.Does this replace my editor's undo button?
au is on-disk, editor-agnostic, and survives crashes, restarts, and agent rampages. Your editor sees its own edits; au sees everyone's.Does it work with Cursor, Cline, Aider, Codex, or Continue?
unknown in the agent column.Does it touch my .git directory?
au maintains its own independent content-addressable store under .agent-undo/. If your agent nukes .git itself, au is unaffected and can still roll everything back. This is intentional — the two systems are designed to live alongside each other, not on top of each other.What happens if the daemon isn't running when my agent writes?
au init --install-hooks sets up a per-project daemon that starts automatically, and au doctor tells you at a glance whether it's alive.How much disk does it use?
au gc runs a 7-day cutoff by default and sweeps orphaned blobs. Anything you pin is kept forever.Does my code ever leave my machine?
Can I run it on CI?
au fills the gap in the inner-loop dev environment, where agents move faster than commits. In CI you'd mostly be duplicating what git already does.What's the performance cost?
Is it stable enough to rely on?
crates.io.
Stop archaeologizing
your ~/.claude logs.
Install the binary. Run au init --install-hooks.
Forget about it until your agent does something stupid.