Design spike: opt-in rewind for providers without native support #111

Status — still open (reviewed 2026-08-22)

Unchanged on current main (e8a5f1cc): Claude Code is still the only provider with native_rewind: true (crates/agent/src/lib.rs:89); Codex, pi, OpenCode and ACP agents remain at false.

Context

Rewind currently works only for Claude Code (TurnCheckpoint emitted in claude.rs; RewindMode in crates/agent/src/lib.rs:812). Codex, pi, OpenCode and all ACP agents have zero rewind — pi/OpenCode return stub warnings. #62 deliberately removed harness-level git checkpoints in favor of provider-native fidelity, so this is a re-open with narrower scope, not a revert.

Why now

Rewind/undo is a signature safety feature and Claude Desktop ships it prominently (per-prompt checkpoints, 30-day retention). 3 of 4 native providers lacking it is a visible parity gap.

Sketch (spike, not build)

• Opt-in (default OFF) working-tree snapshot provider behind the same RewindMode API, active only where native_rewind == false — Claude's native path stays untouched.
• Spike answers: snapshot mechanism (git stash-like refs vs shadow index), disk cost, retention, interaction with user's own git operations, and whether the fix!: replace harness checkpoints with provider-native rewind #62 concerns can be met. If they can't, close with a written verdict.

Effort: L · Risk: MED (snapshotting user git state is exactly what #62 backed away from — the opt-in scoping is the point of the spike)

Verdict — closed won't-build (2026-08-22)

The spike ran as an investigation of the current plumbing, the #60/#62 history, and three candidate snapshot mechanisms (per-turn refs in the user repo, a shadow GIT_DIR, copy-based snapshots). Conclusion: do not build harness-side snapshot rewind.

1. Conversation parity is unreachable without provider support. The provider owns its conversation state; tcode folds and truncates locally only after a provider-confirmed rewind (RewindCompleted → crates/core/src/session.rs). Codex's thread/rollback is deprecated and conversation-only; pi and OpenCode have nothing. Any opt-in snapshot provider therefore delivers files-only undo — a materially different feature than the rewind the issue title promises, and one that still requires broadening both the UI gate (crates/ui/src/store/mod.rs) and runtime gate (crates/runtime/src/app/lifecycle.rs) plus per-adapter checkpoint emission.
2. The acceptable mechanism still re-imports the perf: keep the send path off the main thread's disk and git #60/fix!: replace harness checkpoints with provider-native rewind #62 burden. A shadow GIT_DIR avoids hidden refs/objects in the user's repository (the fix!: replace harness checkpoints with provider-native rewind #62 pollution concern), but restore still overwrites the shared worktree under the user's feet, per-send pre-turn capture returns to the send path (perf: keep the send path off the main thread's disk and git #60's UI stalls came from exactly this), and the shadow store needs its own retention, GC, crash-orphan recovery, and ignored-file policy. That is the operational machinery perf: keep the send path off the main thread's disk and git #60/fix!: replace harness checkpoints with provider-native rewind #62 deliberately removed after it caused stuck sends and gigabytes of loose objects.
3. Worktree isolation is the better answer and already exists. A session in worktree mode gets a dedicated branch where git itself is the rewind mechanism — visible, standard, and free of attribution ambiguity. Finishing Worktree isolation follow-ups: ignored files, merge-back, and orchestrate children #121 (merge-back UX, orchestrate children) delivers the safety story this spike was reaching for, without new snapshot infrastructure.

Revisit only if a non-Claude provider ships a native checkpoint/rewind API worth bridging (Caps::native_rewind is ready for it).