🐕‍🦺 restory

restory records everything your AI coding agent touches, blocks the dangerous stuff, and restores your tree with one command. Local-only.

pip install restory && restory init

Why this exists

AI coding agents (Claude Code, Cursor, Copilot) run as you — with your files, your keys, your shell. A single hallucination or a poisoned file in a repo can rm -rf your home dir or POST your .env to a pastebin. Allowlists don't catch it (CVE-2026-22708), and a container is too heavy for the inner loop.

restory sits between the agent and your machine: it inspects the effect of every command before it runs, records the whole session, and restores it with one keystroke.

What it does

• 🛑 Blocks dangerous effects — secret reads, network exfiltration, mass deletes, git-history nukes, writes outside the repo — before they execute.
• 📼 Records everything — a live, local timeline of every file your agent touched and every command it ran.
• ↩️ One-command restore — restory undo --session snaps your whole working tree back to where the session started.
• 🔒 Local-only — no accounts, no cloud, nothing leaves your machine.

Commands

Install

pip install restory
restory init                 # installs hooks for Claude Code (.claude/settings.json)
restory init --agent gemini  # or for Gemini CLI (.gemini/settings.json)
restory open                 # opens the live timeline at http://127.0.0.1:8765

Works on Windows, macOS, and Linux. Hook-based — no kernel driver, no container.

What restory does NOT do

Being honest, because security tools that overpromise get torn apart:

• It's not a sandbox. A determined attacker with code execution can bypass any command inspection — "argument inspection is theater." restory is defense-in-depth + visibility + instant restore, not a kernel jail.
• It won't catch every obfuscation. It nails the common, high-value danger classes (exfil, mass-delete, secret reads, pipe-to-shell). Novel encodings can slip the classifier — that's what the restore net is for.
• It doesn't replace your judgment. It surfaces what the agent tried and lets you reverse it. You're still the human in the loop.

How it works

restory init installs pre/post tool-use and session-start hooks for your agent (PreToolUse / PostToolUse on Claude Code, the equivalent BeforeTool / AfterTool on Gemini CLI). A thin adapter layer normalizes each agent's hook payload into one canonical shape and formats the decision each agent expects, so the classifier, store, and snapshot logic are shared unchanged across agents. Every tool call the agent makes is classified for blast radius; dangerous effects are blocked with a reason, everything is logged to a local SQLite store, and the working tree is snapshotted to a shadow git repo so undo is exact.

License

MIT