Undo what your coding agent did, shell commands included.
Provenrail is the supervisor for coding agents: one hook, on Claude Code, Codex, Gemini
CLI, Copilot and Cursor. Before every action that can change a file it checkpoints the
working tree into a store outside your repository. Claude Code's own
documentation says its checkpointing "does not track files modified by Bash
commands" (read 9 October 2026). This does.
pr undo last
# A real Claude Code session, told to
# run rm -rf src in a directory
# holding uncommitted files.> rm -rf src# Its own reply: Deleted `src` (untracked, so not
recoverable from git).# Both files came back. Last line
# of the output:$ pr undo last Verified: the working tree now
matches the checkpoint exactly.
What undo does not cover: gitignored files, apart from root-level .env
files; any file over 50 MiB, which is skipped and listed; git history, databases and
anything outside the repository. It works inside git repositories only. Checkpoints are kept for 14 days. Nested repositories and submodules are recorded as a pointer and are never touched by a restore. If a snapshot cannot finish in 10 seconds, checkpoints pause for that project and Provenrail says so; the call still runs.
Details and cost.
Free and MIT. No account, and no Provenrail server in the decision path. Read every rule.
Said plainly, because you are going to install this: only the Claude Code adapter is
driven with a payload captured from the running CLI. The other four are written from
each vendor's published hook contract and are not yet driven against a live
install. The fixture for every host is in the repository and each one says
which it is.
Honest scope: Provenrail sees the tool calls your agent routes through its hooks.
Completeness is never claimed: a process that never calls the hook will not appear.
Anthropic documents that a hook's permissionDecision is ignored in
bypassPermissions mode, so under
--dangerously-skip-permissions the rules record and advise rather than
block. The full limits are below.
What it does
One hook, eight jobs. Each one says what it cannot do.
What you get for running coding agents, in the order you are likely to need it.
Undo pr undo
A checkpoint of the working tree before every action that can change a file, kept
in a shadow git store outside the repository. pr undo lists them with
what each action changed, pr undo last restores, and a full restore
is verified by tree hash. Inside Claude Code it is /guard-undo.
LimitGitignored files are not covered apart from root-level .env files. Files over 50 MiB are skipped and listed. Git history, databases and anything outside the repository are not rewound. Git repositories only. Checkpoints are kept for 14 days. Nested repositories and submodules are recorded as a pointer and are never touched by a restore. If a snapshot cannot finish in 10 seconds, checkpoints pause for that project and Provenrail says so; the call still runs.
Stop pr stop
Refuses every tool call from every agent on the machine until
pr resume. In the plugin it is /guard-stop.
LimitIt reaches agents that run the Provenrail hook, at each one's next tool call. A call already running is not interrupted.
Loop breaker
Puts the next call to a human after the same call, or the same short cycle of one
to three calls, has repeated 8 times back to back. The threshold is measured, not
guessed: across 3,186 real Claude Code sessions and 147,356 tool calls on the
author's machine, 97.1% of sessions never repeated a block at all and 0.47% would
have been questioned.
LimitIt asks rather than blocks, because polling a build is also a run of identical calls. Cycles longer than three calls are not looked for.
File lanes
When two agent sessions work in one checkout, the second is asked before it edits
a file the first wrote in the last 15 minutes.
LimitNot a lock. It sees edits made by file-editing tools, not by shell commands.
Phone remote pr remote setup
Approve or refuse a risky call, and stop or resume every agent, from Telegram (your
own bot) or ntfy (a secret topic). How it works.
LimitThe text of a question passes through the service you chose. It never fails open. On ntfy, anyone who knows the topic name can answer, and so can a program running in your own account; Telegram is the stronger channel. The remote guards against a trusted agent's mistakes while you are away, not against hostile software running as you.
Rules and spend cap
45 default rules that screen where a command points, not which verb it uses; a
day spend cap; a subagent fan-out cap.
Every rule.
LimitA rule matches text, so a command written to defeat a pattern is not caught. The dollar figure is an estimate.
Scan pr scan
What in a repository you just cloned runs or steers an agent without asking:
hooks, MCP servers, folder-open editor tasks, devcontainer and install scripts,
hidden Unicode and HTML comments in instruction files. In the plugin it is
/guard-scan.
LimitIt screens known auto-run surfaces and does not judge the code. "Nothing found" is not "this repository is safe".
Brief pr brief
A review brief of what the agent changed, built from recorded checkpoints and the
guard journal, not from the agent's own summary: net change, files touched and
reverted, shell commands that changed files, sensitive paths (lockfiles,
migrations, auth, CI, agent config), and what was stopped or questioned.
LimitIt states facts and names what to check. It does not claim that tests pass.
Underneath: the signed record
Every decision can be signed into a hash-chained record that anyone can verify
with an open-source tool, in your browser or on the command line.
Verify a real one.
LimitA process that never calls the hook will not appear in it.
Undo
Claude Code rewinds its own edits. A shell command is where work is lost.
A working tree is lost through rm -rf, git checkout ., a
formatter run over the wrong directory, a codemod, a script the agent wrote a
minute ago. So the checkpoint is taken in the one place that sees all of them, the
tool hook, and it is a snapshot of the whole tree rather than of the file the tool
says it will touch.
The store is a separate git object store under ~/.provenrail. Your
project's real .git is never opened or written, so there is nothing
for git status to show. Measured on a 381-file repository: 1.04 s for
the first snapshot, 0.03 s for each one after. The supervisor adds about 8 ms to a
hook call that takes no snapshot (78 ms against 70 ms before, Python 3.9).
What /rewind, git and this undo each bring
back, and how to recover work that is already gone.
What undo does not cover
Gitignored files, apart from root-level .env files.
Files over 50 MiB, which are skipped and listed.
Git history, databases and anything outside the repository.
Anything outside a git repository: it works inside git repositories only.
Anything older than 14 days: checkpoints are kept for 14 days.
Nested repositories and submodules: recorded as a pointer, never touched by a restore.
A snapshot that cannot finish in 10 seconds: checkpoints pause for that project and Provenrail says so; the call still runs.
pr undo
# Every checkpoint, and what each
# action changed$ pr undo# Put the tree back to before the
# most recent action$ pr undo last# Preview checkpoint 12, change
# nothing$ pr undo 12 --diff# .provenrail.json {"undo": {"enabled": true,
"include": [".env", ".env.*"]}}
pr remote
# Your own Telegram bot...$ pr remote setup telegram# ...or an ntfy topic$ pr remote setup ntfy# Questions go to the phone$ pr away# Questions stay on screen$ pr back# Also from the phone$ pr stop$ pr resume
Phone remote
Approve a risky call from your phone.
Approve or refuse a risky call, and stop or resume every agent, from Telegram or
ntfy. No Provenrail server is involved: messages go from your machine to the
channel you chose. On hosts with no approval prompt of their own, such as Codex and
Gemini CLI, a rule that needs a human becomes a real question on the phone instead
of a flat refusal (by design; those two adapters are not yet driven against a live install).
Questions go to the phone when you are away (pr away, or
automatically after 2 minutes idle on macOS) and stay on screen when you are at the
keyboard. It never fails open: no answer, no network, or an ended evaluation leaves
the verdict as it was. On ntfy, anyone who knows the topic name can answer, and so can a program running in your own account; Telegram is the stronger channel. The remote guards against a trusted agent's mistakes while you are away, not against hostile software running as you.
The text of a question, the rule id, the tool name, the project folder name and by
default up to 600 characters of the command, passes through Telegram or the ntfy
server you chose. Exactly what is sent.
The remote is free for 14 days from setup with no account or card; after that
questions stay on your machine unless you buy the
$9 a month plan.
Before you change anything
One command tells you how wide your own sessions spread.
A guard only pays out on a day that has not happened yet. The transcripts of the
work your agents already did are sitting in ~/.claude/projects right
now. pr report reads them, offline, and says what they cost, what
they ran, what they touched, and which of their commands these rules would have
stopped.
uv tool install provenrail && pr report
Nothing to set up, no account, no config file, and no network call. It is useful
the first time you run it, which is the one thing no guard can be. Four flags:
--since for a window, --project to narrow by name,
--json for the versioned machine-readable document, and
--share for the version that is safe to post, which drops the root
path, replaces every project name with a short hash, and reduces each command to
its verb and flags so nothing left in it is an operand.
The dollar figure is estimated at API list price, and notional on Pro and Max
flat-rate plans, where there is no per-token charge at all. It is also a floor.
Over the 49 sessions in the run below where Claude Code had recorded its own
total, this estimate came out about 12 per cent under it. Two known causes are
not modelled because neither is visible in a transcript: fast mode bills Claude
Opus 5 at $10/$50 per million tokens against the standard $5/$25, and web search
bills $10 per 1,000 searches. No multiplier is guessed at to close that gap, so
the number misses low rather than high.
pr report reads Claude Code transcripts. No other agent host is read.
$ pr report --sharePROVENRAIL REPORT 942 sessions across 23 projects, over 31 days,
ran 79,883 tool calls and spent an estimated
$7,863.51.
517 of those would have been stopped: 23 refused,
494 sent to you to approve.
2,163 transcripts, 3.79 GB, 128.0sCOST estimated total $7,863.51
model calls priced 69,573
by model
claude-opus-5 $6,646.54 41,554 calls
claude-sonnet-5 $600.45 15,412 calls
claude-sonnet-4-6 $471.85 11,305 calls
Claude Code recorded its own total for 49 of
these sessions: $5,704.12, against $5,015.01
estimated here for the same ones.
Spend is estimated at API list price, and
notional on Pro and Max flat-rate plans.ACTIVITY tool calls 79,883
bash commands 51,494
files written or edited 7,027 distinctRISK replayed offline through these rules would have been refused 23 0.03%
would have been sent to you 494 0.62%
138 ask production.deploy-command
119 ask access.disarm-the-guard
104 ask destructive.force-remove# One machine on 16 September 2026. This is a run,
# not a benchmark. Run it, and the numbers are yours.
Where the classifier runs
The classifier is part of auto mode. Most unattended runs do not start in auto mode.
Quoted from Anthropic's own documentation, read 16 September 2026. Where the classifier is absent, hooks are still loaded, so a deterministic policy is what is left deciding.
How the agent is started
Built-in starting permission mode
Anthropic's classifier
Provenrail's rules
Interactive session, Pro, Max or Team
auto mode
Runs
Runs
claude -p, the headless and CI entry point
Manual, on every plan
Not in this mode
Runs
The Agent SDK
default
Not in this mode
Runs
Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, Claude Platform on AWS
default
Not in this mode
Runs
Sources, quoted rather than paraphrased. Starting modes and the auto-mode behaviour:
code.claude.com/docs/en/permission-modes.
"For -p, the built-in starting permission mode is Manual on every plan" and
"Without --bare, a -p session runs the hooks in a project's
.claude/settings.json":
code.claude.com/docs/en/headless.
The Agent SDK runs settings-file hooks by default through setting_sources:
code.claude.com/docs/en/agent-sdk/hooks.
A starting mode is a starting point, and anyone can switch modes mid-session.
What auto mode already does, and does well
In an interactive session, Claude Code "runs git status itself before a
command that would discard uncommitted work, such as git reset --hard or
rm -rf", and it "never lets a permissions.allow rule or a
PreToolUse hook that returns 'allow' approve an rm or
rmdir command that targets a critical path". If an interactive session on
Pro, Max or Team is the only place you run agents, you already have most of what a
destructive-command guard sells, free, and did not have to install it.
What it is not is a cost control, and it is not present when the session did not start
in auto mode. Those two gaps are what this product is for.
Limits, stated plainly
Anthropic's hooks documentation says the permissionDecision field on
PreToolUse and PermissionRequest hooks "is ignored in
bypassPermissions mode, when the classifier hasn't finished running
(indicated by pendingClassifier: true), or when the API has denied the
call". So under --dangerously-skip-permissions Provenrail journals the
decision and tells the agent, and does not stop it.
permissions.deny rules are a different mechanism and do block in every
mode; a hook is not one of those, and we will not imply otherwise.
A rule matches text. A command written to defeat a pattern, a delete hidden inside a
script or a one-liner, is not caught. That is a property of every hook of this kind,
this one included. What target resolution buys is precision on the commands agents
actually emit, not immunity to one written to get past it.
One command
A day cap the agent cannot talk its way past.
Print mode has a per-run --max-budget-usd; nothing built
in caps a day across runs and interactive sessions. Provenrail enforces a day cap
before the next tool call.
The hook payload already carries transcript_path. Provenrail reads that
transcript from where it last stopped, prices every new assistant message from its
reported model and token usage, adds the delta to a ledger that survives across hook
processes, and refuses the next tool call once the day is over budget.
pr guard budget 25
There is no default cap, because a cap you did not choose is a claim about your
money. Set one and pr guard status prints what has been spent against
it. Two things this page will never soften: the figure is estimated at API list
price and is notional on Pro and Max flat-rate plans, where there is no per-token
charge to cap; and the transcript is written asynchronously, so the cap stops the
agent within a turn rather than at the exact dollar.
# Arm a cap. Nothing is capped until you choose the number.$ pr guard budget 25 Spend cap: $25 per day, written to .provenrail.json# The session runs. The hook prices the transcript as it grows.> npm test denied budget.day estimated day spend is $25.5000, over the $25.0000 cap,
so this tool call is refused. Stop here and tell the
person what happened rather than working around it.
Spend is estimated at API list price, and notional on
Pro and Max flat-rate plans.
.provenrail.json
# One file at the repo root, reviewed in a pull request {"policy": {"use": ["git-worktree", "destructive",
"secrets", "production"],
"budgets": [{"scope": "day",
"limit_usd": 25}]}}# A delete inside the project runs without a word> rm -rf ./build allowed# A delete that leaves it does not> rm -rf ~/Projects denied destructive.recursive-force-remove
The policy
It screens where a command points, not what it is called.
Nobody has ever lost work to the letters rm -rf. They lost it to what
came after them. rm -rf .next comes back in twelve seconds.
rm -rf ~/ is the end of a laptop. A pattern cannot tell those apart,
because the difference is not in the text, it is in where the text points. So the
rules resolve the target against the working directory the host hands them.
We measured that against one frozen corpus: 36,977 Bash commands pulled from 1,247
real agent sessions, replayed offline in the directory each one actually ran in.
Verb matching interrupted 923 of them. Target resolution interrupts 222. On 40
commands taken from public data-loss reports, it stops 40 of 40. Run the same
measurement over your own transcripts with
python tools/measure_guard.py, which makes no network call.
When a model-based classifier stops something, what survives is a line in a chat log
and a label such as [Data Exfiltration]. Nothing a third party can
recompute. Every Provenrail decision is Ed25519 signed and hash-chained to the one
before it, so a client, an auditor or the other side of a dispute can check it without
trusting the agent, the server, or us. Below is a real record, verified live in your
browser. Flip one character and watch it break.
Verifying the record...
Recomputing every hash, signature, Merkle anchor, and witness cosignature locally.
Runs entirely in your browser via the open-source verifier. Your data never leaves your device, not even to us.
Underneath: how a decision is recorded
Decide, record, check.
Three moving parts, because fewer parts to trust means less to audit.
01Decide
The verdict is computed locally
The hook reads the tool call, resolves its target against your working directory, prices the transcript against your cap, and answers. No network call is in that path, so an unreachable server can never turn a refusal into an allow.
02Record
Each decision links to the last
Allowed, refused or escalated to a human, every decision is signed and carries a hash of the one before it. Reorder or delete one and the chain stops matching. pr guard receipt exports the lot as a portable bundle.
03Check
Anyone can check it without you
The open-source verifier reconstructs the chain offline. A Python implementation and a browser one are held to frozen public conformance vectors in CI, so verification never depends on running our code. An RFC 3161 anchor adds a public authority's time.
Install
Two commands inside Claude Code. One hook on every other host.
The Claude Code plugin is the lead install. It
carries its own dependency-free engine, so 45 rules are armed, and checkpoints, the
loop breaker and file lanes run, on the next tool call with no package, no account
and no config file.
In the plugin the commands are /guard-undo, /guard-stop,
/guard-scan, /guard-status, /guard-card and
/guard-budget.
The CLI commands pr undo, pr stop, pr resume,
pr remote setup, pr away, pr back,
pr scan and pr brief need version 0.6.0. Install it from
GitHub, because the package on PyPI is older and does not have them:
Other hosts, with the same rules and checkpoints:
pr guard install --host codex|gemini|copilot|cursor. Those four adapters
are not yet driven against a live install, as said above.
For headless and CI, pr guard install writes the same hooks into the
project's .claude/settings.json, preserving any hooks already there.
Anthropic's documentation states that "without --bare, a
-p session runs the hooks in a project's
.claude/settings.json", so that one file is the whole CI setup.
# 1. Install and wire the hooks (nothing leaves the box)$ uv tool install provenrail$ pr guard install && pr guard budget 25# 2. Run the agent the way you already run it$ claude -p "upgrade the test suite" denied budget.day (the cap held, no classifier here)# 3. The decisions are signed. Check them yourself.$ pr guard receipt 1 DENIED budget.day$ pr verify guard-receipt.json RESULT: VERIFIED
See it in action
Watch it work, end to end.
Real terminal sessions, no mockups. Every command and every output below is captured verbatim from a live run.
Start here · 25sGuard a coding agentTwo commands, then a delete outside the project is stopped and the decision becomes signed evidence.Tutorial 01 · 16sInstall, record, verifyFour commands: install, pr quickstart, pr demo, pr verify.Tutorial 02 · 20sVerify it yourselfWitnessed verify, then catch a one-byte tamper with a non-zero exit code.
Pricing
Undo, stop and the rules are free.
One paid plan. It buys the phone remote and an outside party's signature on the time.
Free
$0
MIT, forever, no account
Undo with pr undo, pr stop and pr resume, the loop breaker and file lanes
pr scan and pr brief
The rules, 45 armed by default, and day, session and total spend caps
/guard-status, /guard-card and the local decision journal
Signed, hash-chained records and both open-source verifiers, offline or in the browser
One independent RFC 3161 timestamp, free, so you can see what an outside party's receipt looks like on your own run
Nothing that undoes a change, stops an agent or refuses a tool call is behind a payment.
The licence check on the remote is a commercial control in open-source code, not DRM.
We host no agent records. 14-day refund.
No. Checkpoints live in a separate git object store outside the repository, under ~/.provenrail/projects, with its own index. The project's real .git is never opened, written to or asked anything, so there is no stash, commit or ref for git status to show. Restoring checks files out of that store back into the working tree and deletes the ones that did not exist yet.
Files your .gitignore excludes are not checkpointed, apart from root-level .env files. A file over 50 MiB is skipped and listed. Git history, databases and anything outside the repository are not rewound, and undo works inside git repositories only. Nested repositories and submodules are recorded as a pointer, not by content, and are never touched by a restore. Checkpoints are kept for 14 days. If a snapshot cannot finish in 10 seconds, checkpoints pause for that project and Provenrail says so; the call still runs.
No. Rules are evaluated on your machine, and checkpoints, file lanes, loop state and the stop file are stored under ~/.provenrail and never transmitted. Two optional things send something, and only if you set them up: the phone remote sends the text of a question to Telegram or the ntfy server you chose, and anchoring sends a 32-byte fingerprint of your records, never a record.
The call proceeds as if the plugin were not installed, and Provenrail says so once a day instead of staying silent. A broken guard is never allowed to break your session. The one exception runs the other way: an active pr stop is checked first, with a single file check, and nothing that fails afterwards can lift it.
Git holds what you committed. The work an agent deletes is usually uncommitted or untracked, which is exactly what git cannot bring back: in the demo above, the agent itself said the deleted src was untracked, so not recoverable from git. A checkpoint is taken of the whole working tree before the action, and it covers what a shell command changed.
Yes. Set up Telegram with your own bot or ntfy with a secret topic. A question goes to the phone when you are away (pr away, or automatically after 2 minutes idle on macOS) and stays on screen when you are at the keyboard. No answer, no network, or an ended evaluation leaves the verdict as it was, so it never fails open. On ntfy, anyone who knows the topic name can answer, and so can a program running in your own account; Telegram is the stronger channel. The remote guards against a trusted agent's mistakes while you are away, not against hostile software running as you.
Run uv tool install provenrail then pr report. It reads the Claude Code transcripts already in ~/.claude/projects, prices every assistant message from the model and token usage the transcript records, and prints a total per model, per project and per day. It needs no account, no config and no network call. The figure is estimated at API list price, and notional on Pro and Max flat-rate plans, where there is no per-token charge at all, and it is a floor rather than an exact number: fast mode and web search bill extra and neither is visible in a transcript.
Run pr report. Claude Code writes a transcript of every session, and the report reads them offline and says how many sessions ran, over how many projects and days, how many tool calls and bash commands they made, how many distinct files they wrote or edited, which tools they reached for most, and which of their commands the Provenrail rules would have refused or sent to you to approve. Add --share to get a version safe to post, with the root path gone, project names replaced by hashes and every command reduced to its verb and flags.
In an interactive session on Pro, Max or Team it does, and we would rather say so than argue with it. Anthropic's documentation states that Claude Code runs git status itself before a command that would discard uncommitted work, and that it never lets a permissions.allow rule or a PreToolUse hook that returns "allow" approve an rm or rmdir command targeting a critical path. What that classifier does not do is run in claude -p, the Agent SDK, Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry, which start in the permissive default mode, and it does not cap spend anywhere. Hooks run in all of those places.
The PreToolUse payload carries transcript_path. Provenrail reads that transcript from where it last stopped, prices each new assistant message from its reported model and token usage, adds the delta to a local cross-process ledger, and refuses the next tool call once the day cap is crossed. Set one with pr guard budget 25. There is no default cap, because a cap you did not choose is a claim about your money.
In print mode Claude Code has a per-run cap: claude -p --max-budget-usd 5 stops the run once its own cost estimate reaches the amount. That cap is per run and print mode only. Provenrail adds a day, session or total cap shared across runs and interactive sessions, enforced at the next tool call: pr guard budget 25. The figure is estimated at API list price, is notional on Pro and Max flat-rate plans, and the cap lands within a turn rather than at the exact dollar.
Auto mode is the built-in starting permission mode for interactive sessions on Pro, Max and Team. A headless run does not start in it: Anthropic lists claude -p, the Agent SDK, Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry and Claude Platform on AWS as starting in the permissive default mode, with no classifier in front of the tool call. Hooks do run in all of them: without --bare, a -p session runs the hooks in a project's .claude/settings.json, and the Agent SDK runs settings-file hooks by default. A deterministic policy in that hook is what is left deciding in CI and headless.
It is estimated at API list price, and it is notional on Pro and Max flat-rate plans, where there is no per-token charge to cap. The transcript is written asynchronously, so the cap stops the agent within a turn rather than at the exact dollar. A model with no verified rate is reported as unpriced rather than counted as zero, and an unreadable transcript says so once a day instead of reading as $0.00 spent.
The hook runs outside the model's context and the model does not get a vote on the verdict. Two documented limits are on this page rather than in fine print. Anthropic's hooks documentation says the permissionDecision field is ignored in bypassPermissions mode, when the classifier has not finished running, or when the API has denied the call, so under --dangerously-skip-permissions Provenrail records and advises but does not block. And a rule matches text, so a command written to defeat a pattern is not caught, which is a property of every hook of this kind.
A cooperative agent cannot silently alter records once they reach a sink: the hash chain makes any tampering detectable. A hostile agent that never calls the hook will not appear at all. Provenrail detects tampering and deletion of records that were written; it cannot force an uncooperative process to write in the first place. That limitation is a documented part of the threat model, not fine print.
Undo, stop, the loop breaker, file lanes, scan, brief, the rules, the spend cap, the local journal and the verifier are MIT licensed and free, with no account. One paid plan exists at $9 a month: the phone remote, after a 14-day evaluation that needs no account, plus anchored statements, which are unlimited RFC 3161 timestamps from an independent authority on the root of your records. We never receive a record, only a 32-byte fingerprint of one.
Install the verifier with uv tool install provenrail (or pip install provenrail inside a virtualenv), export the decisions with pr guard receipt, then run pr verify guard-receipt.json. The tool recomputes the hash chain, every Ed25519 signature and every anchor locally, trusting neither the agent nor the sink. A second verifier written in JavaScript runs the same algorithm in the browser, and both are held to frozen public conformance vectors in CI.