Your agent just deleted something. Undo it.

What actually happens

A full-permission agent can wipe a home directory, local backups included. An rc-era bug left workspaces looking gone while the files were still there (discussions #9986 and #8357: workspace create failed: gateway/service-unavailable, workspaceController unavailable). A storage version stamp blocks downgrade until you restore a pre-upgrade snapshot.

全权限的 agent 可以连本地备份一起删掉家目录。rc 阶段有工作区看起来消失、文件其实还在的报告（讨论 #9986、#8357）。存储版本戳会挡住降级，除非先恢复升级前快照。

Trust

End-to-end encryption. Keys stay local. The client is open source (packages/core/src/crypto.js). Losing both the passphrase and the recovery code makes the backup unrecoverable. Subscriptions can be refunded within 14 days of the first charge; email support@undohaven.com. See the refund policy.

What can UndoHaven see?

Account id, a display name you choose, a device label you choose or we randomize, snapshot timestamps, the padded total size, and HMAC chunk ids. Not paths, not per-file sizes, not the passphrase. Full answer · Encryption.

Session log gate

dsh-log-gate is a third-party plugin that can skip official session-log upload for projects you choose. It is not an official component. About it

Compared with other approaches

Local-only dsh backup plugins stay on the disk the agent can delete. A git-based DIY copy needs you to remember to commit, and it stores plaintext. UndoHaven's default is an encrypted local snapshot, with an optional off-machine copy. Tools in the takeback or noregret style that undo a single edit are complementary: they are not the same job as a full home snapshot.