Inspiration

AI agents now edit our files, run shell commands, send emails and click around our computers for us. Each tool keeps its own half-memory of what it did, or none at all. When an agent rewrites half your project or deletes the wrong folder, there's no single place to see what happened, and no reliable way back.

I kept thinking about Fabrice Bellard, who built FFmpeg and QEMU. They're small, sharp tools that everything else stands on. AI doesn't need another brain. It needs a primitive underneath it that makes every brain accountable: a record you can trust, and an undo that always works.

What it does

Trail is undo for everything AI does on your computer.

One timeline for every agent. Every change lands on one timeline: which agent did it, when, the prompt that asked for it, and the exact diff. One-command undo. trail undo reverses the latest change; run it again to keep walking back. trail undo takes back one specific change. Undo never overwrites work you did afterwards, and an undo can itself be undone. Deleted files come back, inside git or not. trail watch add ~/Documents keeps a copy of any folder and records every change from any app or AI, connected or not. trail deleted lists what's gone, and trail restore brings back a file or a whole folder. Honest about what can't be undone. A file diff can't unsend an email. Actions like that are labelled can't be undone and come with a recovery step ("follow up with the recipient", "look in Drive's trash"). History that can't be faked. Every entry is hash-chained to the one before and signed with an Ed25519 key. If anyone edits, deletes or reorders a past record, trail verify points to exactly where.

It connects to Claude Code natively through hooks, wraps any other CLI (Codex, Aider, Gemini) with one line, and the watcher covers everything else.

How we built it

Trail is a single Go binary with zero dependencies (standard library only), built for Windows, macOS and Linux. Everything stays local.

The format comes first. SPEC.md defines the ledger: an append-only JSONL file where each entry's id is the SHA-256 of its exact bytes, signed with Ed25519 and chained to the previous id. Anything that follows the spec can read, verify or display a Trail timeline. Content-addressed storage. Every file version is stored once, compressed and keyed by its hash, so undo and restore always have the exact "before". Integrations. Claude Code hooks snapshot before and after each tool call and record the prompt as the "why". Shell wrappers cover other CLIs. A polling folder watcher covers any app. It keeps a first copy of each file, rescans with an index so unchanged files are only checked, groups bursts of writes into one entry, and skips changes a connected tool already recorded. A line diff from scratch (Myers' algorithm) for readable, colored diffs in the terminal.

Challenges we ran into

Never breaking the host tool. A recorder that crashes your agent is worse than none. The hooks always exit cleanly, log failures to a file, and stay silent. Undo that doesn't destroy work. If you edited a file after the agent did, a naive undo would wipe your edit. Trail detects that, names who changed it, and stops unless you force it. Even then it saves what it overwrites. Knowing before a delete happens. The OS reports a change after it happens, when the old version is already gone. The watcher solves this by keeping a first copy of every file up front. Not recording things twice when a hooked agent and the watcher both see the same change. Personal: I was accepted to CalHacks twice and couldn't attend either time because of passport and visa timing. I'm submitting remotely from Ahmedabad, India, because I'd rather ship than sit it out.

Accomplishments that we're proud of

Tamper detection that works: editing, deleting or reordering any past entry, or swapping a saved file, is caught by trail verify. Tested with real Claude Code sessions, 40 agents writing at the same time, and an "agent" deleting a folder outside git, which came back with one command. The v0.2 features came straight from people replying to the launch post. One asked whether it catches deleted files outside git; another said a file diff can't undo a sent email. Both are in this release.

What we learned

Trust is a product feature. Making something tamper-evident is honest and achievable; "unhackable" isn't. And the best way to know what a tool needs is to ship it and listen.

What I built before vs. during CalHacks

To be transparent: Trail v0.1 (the signed ledger, undo, and Claude Code integration) was built and posted on Oct 9. During CalHacks I built v0.2:

trail watch with background autostart on all three OSes deleted-file recovery outside git (deleted / restore / history) recovery labels for actions that can't be undone de-duplication between the watcher and connected tools

What's next for Trail

Knowing which app made each change in watched folders A guard that pauses an agent before it reads secrets or deletes many files Keeping the signing key in the OS keychain or secure chip The timeline app: scroll back through everything your AIs did, and tap to undo