agent-undo
Source control for the code your agent wrote

git for humans.
au for agents.

4 MB Rust binary · agent-undo on crates.io · Apache-2.0

~/my-project
$ au oops
⚠ claude-code · 14:32 · 5 files
src/auth.rs (-87)
src/middleware.rs (-23)
src/lib.rs (-4)
tests/auth.rs (deleted)
Cargo.toml (-2)
Roll back? [Y/n]

The shift

Source control assumed a human writer.
AI broke the assumption.

git

Versions human intent.

  • You commit when you mean to.
  • Every change is a deliberate act.
  • History reflects what you wanted to keep.
  • git blame tells you which human wrote each line.

au

Records agent action.

  • Every byte is captured on write.
  • No deliberate act required.
  • History reflects what actually happened.
  • au blame tells you which agent wrote each line.

Not a replacement. A second system, running alongside.

Why this exists

Your editor's undo
is broken.

“This is a known issue, a bug caused by a conflict between the Agent Review Tab and file editing. Close the Agent Review Tab before the agent makes edits.”
deanrie, Cursor staff · Jan 16, 2026 · forum.cursor.com
“cursor agent went off the hinges and started deleting my entire app. 90% of my app is gone … I hadn't gotten a chance to push to github yet.”
Jonneal3 · May 27, 2025 · forum.cursor.com

Install

One command.
No account. No telemetry.

download release binary

The principle

The agent is
an untrusted process.

Every piece of engineering ceremony — commits, review, blame, audit — assumed one thing: the writer of the code is a human you can hold accountable.

That assumption broke. Agents silently delete tests, rewrite mocks to pass, refactor across boundaries without understanding intent. A bad decision at 14:32:07 is 200 files deep by 14:32:42.

Treat AI coding agents the way a security engineer treats any process with write access: assume it will eventually do something wrong, and build the controls that let you recover.

au is the substrate. Observability, attribution, reversibility — the three primitives the next decade of agent-aware tooling will be built on.

Read the full essay

Questions

Seven things developers ask
before they install.

How is this different from git?
git versions intent — commits are deliberate acts. au records action — every byte, the moment it hits disk. You run both.
Does it replace my editor's undo?
No. Editor undo is in-memory and editor-bound. au is on-disk, editor-agnostic, and survives crashes, restarts, and agent rampages.
Does it work with Cursor, Cline, Aider, Codex?
Yes. A zero-config heuristic watches every filesystem write regardless of source. Hooks add perfect attribution when the agent exposes one — Claude Code today, Cursor/Cline/Aider via adapters shipping in v0.1.
Does it touch my .git directory?
Never. au maintains its own store under .agent-undo/. If your agent nukes .git itself, au is unaffected and can still roll everything back.
What if the daemon isn't running when my agent writes?
You miss those events. No daemon, no capture. au init --install-hooks sets up a per-project daemon that starts automatically. au doctor tells you at a glance whether it's alive.
How much disk does it use?
Content-addressable and deduped — usually under 100 MB on an active project. au gc runs a 7-day cutoff by default and sweeps orphaned blobs.
Can I run it on CI?
You can, but it's built for local use. CI is already good at capturing state via commits and artifacts. au fills the gap in the inner-loop dev environment, where agents move faster than your commit cadence.

Stop archaeologizing
your ~/.claude logs.

Install the binary. Run au init --install-hooks. Forget about it until your agent does something stupid.

Read the source