Filesystem automation · with a recovery plan

Filesystem changes should either finish or recover.

UndoLang is a crash-safe transaction runtime and tiny DSL for reversible filesystem automation—plan changes, journal intent, verify results, and roll back known failures.

Get started Read the docs

Native binary

Go 1.27 standard library only. No daemon, database, package runtime, or cloud account.

Reversible operations

A small mutation set whose effects, backups, verification, and inverse behavior are understood.

CRC

Durable authority

A framed, synced CRC32C journal—not an in-memory list—drives rollback after a crash.

The program

Readable intent. Explicit boundaries.

A file can contain several named transactions. Running the file executes them in source order; each transaction remains its own rollback boundary.

Language reference

transaction "upgrade" {
  require contains "VERSION" "1"
  copy "release/app" -> "bin/app" overwrite
  write "VERSION" = "2"
  assert contains "VERSION" "2"
}

undo run migration.undo --yes
undo run migration.undo --transaction upgrade --yes

The protocol

Plan before. Recover after.

PLAN → LOCK → PREPARE → JOURNAL → APPLY → VERIFY → COMMIT
　　　　　　　　　　　　　　　 failure ↘ ROLLBACK

Inspect

check validates the complete source. plan describes exact current effects and rollback cost without target mutation.

Execute

Every operation records verified inverse metadata before mutation. Assertions test the final intended state.

Recover

A fresh process validates the journal and resumes reverse rollback. Ambiguous or corrupt state fails closed.

Designed for real work

Migration without mystery.

Application upgrades

Stage a release, replace binaries and configuration, then verify a version marker.

AI-agent refactors

Turn generated filesystem intent into a reviewable JSON plan and an explicit approval boundary.

Local data layouts

Move and rewrite multi-file state while retaining enough prior state to recover supported changes.

Start locally

One command to build.

go build -trimpath -buildvcs=false -o undo ./cmd/undo
./undo check examples/app-upgrade.undo
./undo plan examples/app-upgrade.undo --root ./demo

Honest boundaries

Recoverable is not isolated.

UndoLang does not claim atomic visibility across many files. Platform rename and directory-sync behavior varies. ACLs, ownership, xattrs, sparse allocation, and hard-link identity are outside v1.

Read every limitation →