backstep 0.1.13 → 0.1.16

package/dist/adapters/fs.js

@@ -24,6 +24,13 @@ function sizeOf(p, budget) {
     return total;
 }
 // Returns null when a path is too large to copy; the caller then can't promise undo.
+// Whether a path sits in the folder Claude Code has open. Edits elsewhere belong to
+// other projects: Backstep never records them, so undo here can never touch them.
+export function insideDir(path, dir) {
+    const p = resolvePath(path, dir);
+    const d = resolve(dir).replace(/\/$/, "");
+    return p === d || p.startsWith(d + "/");
+}
 export function snapshotPaths(actionId, paths, cwd) {
     const dir = snapshotDir(actionId);
     const seen = new Set();

package/dist/cli.js

@@ -5,7 +5,7 @@ import { runProxy } from "./proxy.js";
 import { startUi } from "./ui/server.js";
 import { Store, snapshotDir } from "./store.js";
 import { pruneDatabaseCopies, undoAction, undoRun, undoSince } from "./undo.js";
-import { snapshotPaths } from "./adapters/fs.js";
+import { insideDir, snapshotPaths } from "./adapters/fs.js";
 import { notePushed, snapshotSqlite, snapshotTree } from "./adapters/tree.js";
 import { revertPush } from "./push.js";
 import { ghMade, grantScope, undoGh } from "./github.js";
@@ -24,8 +24,16 @@ import { autoWrap, printChanges, unwrapServers, wrapServers } from "./servers.js
 import { disconnectSupabase, dismissSupabase, firebaseConn, postgresUrl, restKey } from "./supabase.js";
 // The Supabase projects a shell command could change: those in the folder it
 // works in (or a level or two below), when the command is one that reaches a database.
+// A command that `cd`s into another project is out of scope: only the open folder is tracked.
+function scopedDir(command, cwd) {
+    const d = commandDir(command, cwd);
+    return insideDir(d, cwd) ? d : null;
+}
 function reachedProjects(command, cwd) {
-    const dirs = supabaseDirs(commandDir(command, cwd));
+    const at = scopedDir(command, cwd);
+    if (!at)
+        return [];
+    const dirs = supabaseDirs(at);
     return touchesDatabase(command) || touchesSupabase(command, dirs.length > 0) ? dirs : [];
 }
 // Every database a shell command could change, by folder: Supabase, other Postgres, Firebase.
@@ -33,7 +41,8 @@ function reachedDatabases(command, cwd) {
     const out = [];
     for (const d of reachedProjects(command, cwd))
         out.push({ dir: d, service: "supabase" });
-    for (const d of dbDirs(commandDir(command, cwd))) {
+    const at = scopedDir(command, cwd);
+    for (const d of at ? dbDirs(at) : []) {
         const u = projectUses(d);
         if (u.postgres && (touchesDatabase(command) || touchesSupabase(command, true)))
             out.push({ dir: d, service: "postgres" });
@@ -307,10 +316,17 @@ async function main() {
             args: sep === -1 ? rest : rest.slice(0, sep),
             options: { session: { type: "string" }, tool: { type: "string" }, cwd: { type: "string" } },
         });
-        const paths = sep === -1 ? [] : rest.slice(sep + 1);
-        if (!values.session || !values.tool || paths.length === 0) {
+        const asked = sep === -1 ? [] : rest.slice(sep + 1);
+        if (!values.session || !values.tool || asked.length === 0) {
             throw new Error("usage: backstep snap --session <id> --tool <name> [--cwd <dir>] -- <paths...>");
         }
+        // Claude Code names the folder it has open: a file in another project is left out entirely.
+        const scope = values.cwd;
+        const paths = scope ? asked.filter((p) => insideDir(p, scope)) : asked;
+        if (paths.length === 0) {
+            console.log(JSON.stringify({ outside: true, undoable: false }));
+            return;
+        }
         const store = new Store();
         const run = store.sessionRun("claude-code", `session:${values.session}`);
         const a = store.addAction({
@@ -464,8 +480,9 @@ async function main() {
     }
     // Takes away something Claude made on GitHub (the thing, as undo reported it, on stdin). The mod runs this after asking.
     // Gets the person's OK on GitHub for another gh permission: code on the clipboard, approval page opened.
+    // The code is printed on a line of its own straight away, so the mod can show it; the answer is the last line.
     if (cmd === "gh-auth") {
-        const out = await grantScope(rest[0] ?? "");
+        const out = await grantScope(rest[0] ?? "", (code) => console.log(JSON.stringify({ code, url: "https://github.com/login/device" })));
         console.log(JSON.stringify(out));
         if (!out.ok)
             process.exitCode = 1;
@@ -540,11 +557,12 @@ async function main() {
                 until: { type: "string" },
                 json: { type: "boolean", default: false },
                 "via-claude-code": { type: "boolean", default: false },
+                session: { type: "string" },
             },
         });
         const store = new Store();
         const outcomes = values.since
-            ? await undoSince(store, Number(values.since), values.until ? Number(values.until) : undefined, { viaClaudeCode: values["via-claude-code"] })
+            ? await undoSince(store, Number(values.since), values.until ? Number(values.until) : undefined, { viaClaudeCode: values["via-claude-code"], session: values.session })
             : values.run
                 ? await undoRun(store, values.run)
                 : await undoAction(store, positionals[0] ?? "");

package/dist/github.js

@@ -80,8 +80,9 @@ function openPage(url) {
 // Gives gh's sign-in another permission (like delete_repo) with GitHub's own
 // approval page: the one-time code is put on the clipboard and the page opened,
 // so the person only pastes it and approves. Resolves once GitHub says yes,
-// or no, or nine minutes pass (Claude Code gives a command ten).
-export function grantScope(scope) {
+// or no, or nine minutes pass (Claude Code gives a command ten). `onCode` hears
+// the code as soon as gh prints it, so it can be shown while GitHub waits.
+export function grantScope(scope, onCode) {
     return new Promise((resolve) => {
         // gh would open the page too; Backstep already does, so gh's browser is told to do nothing.
         const env = { ...process.env, NO_COLOR: "1", GH_BROWSER: process.platform === "win32" ? "cmd /c exit" : "true" };
@@ -96,6 +97,7 @@ export function grantScope(scope) {
                 shown = true;
                 copy(code);
                 openPage(DEVICE);
+                onCode?.(code);
                 // gh waits for Enter before it would open the page itself; it's already open.
                 child.stdin.write("\n");
             }

package/dist/undo.js

@@ -201,9 +201,21 @@ export async function undoRun(store, runId) {
 // Everything any agent did in a window of time: what one turn of a chat did,
 // across Claude's own edits and every server wrapped by Backstep.
 export async function undoSince(store, since, until = Date.now(), opts = {}) {
-    const inWindow = store.db
+    let inWindow = store.db
         .prepare("SELECT * FROM actions WHERE created_at >= ? AND created_at <= ? ORDER BY created_at, seq")
         .all(since, until);
+    if (opts.session) {
+        const mine = `session:${opts.session}`;
+        const commands = new Map();
+        inWindow = inWindow.filter((a) => {
+            if (!commands.has(a.run_id))
+                commands.set(a.run_id, store.getRun(a.run_id)?.command);
+            const command = commands.get(a.run_id);
+            // Another session's run: never ours to undo. Servers wrapped by `backstep wrap`
+            // record under their own runs and stay included, as before.
+            return !(command?.startsWith("session:") && command !== mine);
+        });
+    }
     return undoAll(store, inWindow.filter(undoable), opts);
 }
 async function undoAll(store, actions, opts = {}) {

package/mod/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "backstep",
-  "version": "0.1.13",
+  "version": "0.1.16",
   "description": "Press ctrl+z to rewind everything Claude did in its last turn: file edits, shell commands, and database and tool changes.",
   "types": "./types/index.d.ts",
   "userConfig": {

package/mod/hooks/register.test.tsx

@@ -60,6 +60,39 @@ test('an edit is snapshotted and the band offers to undo the turn', { options: {
   }
 })
 
+test('edits outside the open folder are never tracked', { options: { cli: CLI } }, async ($, on) => {
+  mock.clock(on, { now: 5000 })
+  const { runs } = engine(on, { exitCode: 0, stdout: '[]' })
+
+  await $.prompt.submit({ text: 'fix the other project', wait: false, origin: { kind: 'composer' } })
+  await $.tool.call({ tool: 'Write', file_path: '/other-project/src/new.ts', content: 'x' })
+  await $.tool.call({ tool: 'Edit', file_path: '/repo-sibling/a.ts', old_string: 'a', new_string: 'b' })
+  await $.tool.call({ tool: 'Edit', file_path: '/repo/../other-project/a.ts', old_string: 'a', new_string: 'b' })
+
+  expect(runs.filter((r) => r.includes('snap'))).toEqual([])
+  const ui = await $.ui.mount({ ...BAND, surface: 'terminal' })
+  expect((await ui.find({ type: 'Text', text: /nothing to undo yet/ }))?.text).toBeTruthy()
+  await ui.unmount()
+})
+
+test('a long last turn stays on one line with a fixed gap after the logo', { options: { cli: CLI } }, async ($, on) => {
+  mock.clock(on, { now: 5000 })
+  engine(on, { exitCode: 0, stdout: '[]' }, { kind: 'write', undoable: true })
+
+  await $.prompt.submit({ text: 'scrap that, lets try making the whole thing much longer than fits', wait: false, origin: { kind: 'composer' } })
+  for (const f of ['a', 'b', 'c']) await $.tool.call({ tool: 'Edit', file_path: `/repo/src/${f}.ts`, old_string: 'a', new_string: 'b' })
+  for (let i = 0; i < 8; i++) await $.tool.call({ tool: 'Bash', command: `touch x${i}` })
+
+  const ui = await $.ui.mount({ ...BAND, props: { ...BAND.props, bodyColumns: 60 }, surface: 'terminal' })
+  const line = await ui.find({ type: 'Text', text: /Last turn/ })
+  // No leading space to be trimmed on a wrap: the gap is the logo box's own margin.
+  expect(line?.text).toMatch(/^Last turn:/)
+  expect(line?.props.wrap).toBe('truncate-end')
+  expect(await ui.find({ type: 'Box', props: { flexShrink: 0, marginRight: 1 } })).toBeTruthy()
+  expect(await ui.find({ type: 'Button', key: 'undo' })).toBeTruthy()
+  await ui.unmount()
+})
+
 test('pressing undo rewinds the turn and tells Claude on the next prompt', { options: { cli: CLI } }, async ($, on) => {
   const clock = mock.clock(on, { now: 5000 })
   const { runs, prompts } = engine(on, {
@@ -75,7 +108,7 @@ test('pressing undo rewinds the turn and tells Claude on the next prompt', { opt
   const pressed = ui.press({ key: 'undo' })
   await clock.settle()
   expect((await ui.find({ type: 'Text', text: /Rewinding/ }))?.text).toBeTruthy()
-  expect(runs.at(-1)).toEqual(['node', '--disable-warning=ExperimentalWarning', CLI, 'undo', '--since', '5000', '--json', '--via-claude-code'])
+  expect(runs.at(-1)).toEqual(['node', '--disable-warning=ExperimentalWarning', CLI, 'undo', '--since', '5000', '--session', 's1', '--json', '--via-claude-code'])
 
   await clock.advance(1000)
   await pressed
@@ -141,7 +174,8 @@ test('with nothing to undo the band still holds the key, and a press says there
 
   const ui = await $.ui.mount({ ...BAND, surface: 'terminal' })
   expect((await ui.find({ type: 'Text', text: /nothing to undo yet/ }))).toBeTruthy()
-  // The mark: the front triangle in the terminal's own color, the one behind in the logo's pink.
+  // The gap after the mark is its own fixed margin, so a long line can't squeeze it away.
+  expect((await ui.find({ type: 'Text', text: /nothing to undo yet/ }))?.text).toMatch(/^Backstep is on/)  // The mark: the front triangle in the terminal's own color, the one behind in the logo's pink.
   expect((await ui.find({ type: 'Text', text: '◀', props: { color: '#ee7bb6' } }))).toBeTruthy()
   await ui.press({ key: 'undo' })
   expect(toasts[0]).toContain('Nothing to undo yet')
@@ -666,7 +700,7 @@ test('when the last turn only committed and pushed, undo offers to take back the
   await clock.advance(1000)
   await pressed
   // Both turns: everything since the first one started.
-  expect(runs.find((r) => r.includes('undo'))?.slice(3)).toEqual(['undo', '--since', '5000', '--json', '--via-claude-code'])
+  expect(runs.find((r) => r.includes('undo'))?.slice(3)).toEqual(['undo', '--since', '5000', '--session', 's1', '--json', '--via-claude-code'])
   await ui.unmount()
 })
 
@@ -723,13 +757,25 @@ test('a GitHub repository Claude created is offered for deletion after undo, and
             runs.filter((r) => r.argv.includes('gh-undo')).length === 1
             ? { ok: false, needs: 'delete_repo', detail: 'GitHub needs your OK before bzells11/taskflow can be deleted' }
             : { ok: true, detail: 'deleted the repository bzells11/taskflow' }
-          : e.argv.includes('gh-auth')
-            ? { ok: true, detail: 'GitHub approved it' }
           : e.argv.includes('db-check')
             ? { ask: null }
             : null
     return { value: { exitCode: 0, stdout: out ? JSON.stringify(out) : '', stderr: '', isStdoutTruncated: false, isStderrTruncated: false } }
   })
+  // GitHub's approval: the code comes first, then the answer once the person approves (when `approve` is called).
+  let approve = () => {}
+  const approved = new Promise<void>((resolve) => (approve = resolve))
+  let codeShown: Promise<void> = Promise.resolve()
+  let gotCode = () => {}
+  codeShown = new Promise<void>((resolve) => (gotCode = resolve))
+  on('process.spawn', async function* (_, e) {
+    runs.push({ argv: [...e.argv] })
+    yield { stream: 'stdout' as const, text: '{"code":"ABCD-1234","url":"https://github.com/login/device"}\n' }
+    gotCode()
+    await approved
+    yield { stream: 'stdout' as const, text: '{"ok":true,"detail":"GitHub approved it"}\n' }
+    return { value: { code: 0, signal: null } }
+  })
   on('tool.call', { tool: 'AskUserQuestion' }, (_, e) => {
     const questions = (e as unknown as { questions: { question: string }[] }).questions
     asked.push(questions[0].question)
@@ -753,7 +799,17 @@ test('a GitHub repository Claude created is offered for deletion after undo, and
   const pressed = ui.press({ key: 'undo' })
   await clock.advance(1000)
   await pressed
+  await codeShown
+  await clock.settle()
+  // While GitHub waits, the band says it's a step to take and shows the code, not a failure.
+  expect(await ui.find({ type: 'Text', text: /One more step to delete the GitHub repository bzells11\/taskflow/ })).toBeTruthy()
+  expect(await ui.find({ type: 'Text', text: 'ABCD-1234' })).toBeTruthy()
+  // The push went to the repository being deleted, so it isn't listed as not undone.
+  expect(await ui.find({ type: 'Text', text: /Not undone/ })).toBeFalsy()
+  approve()
   await clock.settle()
+  expect(await ui.find({ type: 'Text', text: 'ABCD-1234' })).toBeFalsy()
+  expect(await ui.find({ type: 'Text', text: /on GitHub: deleted the repository bzells11\/taskflow/ })).toBeTruthy()
   expect(asked).toEqual(['Claude created the GitHub repository bzells11/taskflow. Delete it on GitHub too?'])
   expect(JSON.parse(runs.find((r) => r.argv.includes('gh-undo'))?.stdin ?? '{}')).toEqual(repo)
   // Missing permission: GitHub's OK is fetched by Backstep itself, then the delete is tried again.
@@ -762,7 +818,7 @@ test('a GitHub repository Claude created is offered for deletion after undo, and
     'gh-auth delete_repo',
     'gh-undo',
   ])
-  expect(logs.find((l) => l.includes('opened the approval page and copied the code'))).toBeTruthy()
+  expect(logs.find((l) => l.includes('paste the code ABCD-1234 on the GitHub page'))).toBeTruthy()
   expect(logs.find((l) => l.includes('On GitHub: deleted the repository'))).toBeTruthy()
   // The repository is gone, so its push isn't asked about.
   expect(runs.some((r) => r.argv.includes('revert-push'))).toBe(false)

package/mod/hooks/register.tsx

@@ -7,7 +7,7 @@
 import { atom, read, update } from 'claude-code'
 import type { EngineInterface, Register } from 'claude-code'
 
-import type { Rewind, RewindItem, Turn } from '../types'
+import type { GithubCode, Rewind, RewindItem, Turn } from '../types'
 
 const turns = atom({ plugin: 'backstep', key: 'turns' } as const, [] as Turn[])
 const rewind = atom({ plugin: 'backstep', key: 'rewind' } as const, null as Rewind | null)
@@ -16,6 +16,8 @@ const armed = atom({ plugin: 'backstep', key: 'armed' } as const, null as number
 // The keys bound to undo, read as a session starts and when the person changes
 // them. Kept in state, not a variable, so the band redraws with the new key.
 const keys = atom({ plugin: 'backstep', key: 'keys' } as const, ['ctrl+u'] as string[])
+// The one-time code GitHub's approval page wants, on the band while GitHub waits.
+const githubCode = atom({ plugin: 'backstep', key: 'githubCode' } as const, null as GithubCode | null)
 // Backstep's mark, as on the logo: the front rewind triangle in the terminal's
 // own black or white, the one behind it in the logo's pink.
 const PINK = '#ee7bb6'
@@ -80,6 +82,39 @@ async function jsonRun($: EngineInterface, args: string[], timeoutMs: number, st
 
 const ghUndo = ($: EngineInterface, g: GhMade) => jsonRun($, ['gh-undo'], 120_000, JSON.stringify(g))
 
+// Gets GitHub's OK for one more gh permission. The CLI prints the one-time code
+// on a line of its own as soon as GitHub gives it, so the band shows it while
+// GitHub waits; the answer is its last line.
+async function ghAuth($: EngineInterface, scope: string, what: string): Promise<{ ok: boolean; detail: string }> {
+  let out = ''
+  try {
+    const child = $.process.spawn({ argv: backstep(['gh-auth', scope]) })
+    for await (const { stream, text } of child) {
+      if (stream !== 'stdout') continue
+      out += text
+      const code = out.match(/"code":"([A-Z0-9]{4}-[A-Z0-9]{4})"/)?.[1]
+      if (code && !(await read($, githubCode))) {
+        await update($, githubCode, () => ({ code, what }))
+        $.ui.log(`${MARK_TEXT} One more step to ${what}: paste the code ${code} on the GitHub page that just opened, then press Authorize. (It's already copied, so ⌘V / Ctrl+V works.)`)
+      }
+    }
+  } catch (err) {
+    out += `\n${JSON.stringify({ ok: false, detail: err instanceof Error ? err.message : String(err) })}`
+  } finally {
+    await update($, githubCode, () => null)
+  }
+  try {
+    return JSON.parse(out.trim().split('\n').at(-1) ?? '') as { ok: boolean; detail: string }
+  } catch {
+    return { ok: false, detail: "GitHub didn't answer" }
+  }
+}
+
+// Adds a line to the band's list once something offered after the rewind is settled.
+async function addItem($: EngineInterface, item: RewindItem) {
+  await update($, rewind, (r) => (r ? { ...r, items: [...r.items, item], shown: r.shown + 1 } : r))
+}
+
 // Asks, for each thing Claude made on GitHub in the undone turns, whether to take it away there too.
 // Returns the repositories deleted, whose pushes then need no undo of their own.
 async function offerGithubUndo($: EngineInterface, outcomes: Outcome[]): Promise<Set<string>> {
@@ -96,12 +131,12 @@ async function offerGithubUndo($: EngineInterface, outcomes: Outcome[]): Promise
     let r = await ghUndo($, g)
     // gh's sign-in needs one more permission: get it on GitHub's own page, then try again.
     if (!r.ok && r.needs) {
-      $.ui.toast("GitHub needs your OK first. Backstep opened GitHub in your browser and copied the code: paste it there and press Authorize.", { timeoutMs: 15_000 })
-      $.ui.log(`${MARK_TEXT} GitHub needs your OK first: Backstep opened the approval page and copied the code to your clipboard. Paste it and press Authorize.`)
-      const granted = await jsonRun($, ['gh-auth', r.needs], 600_000)
+      $.ui.toast('One more step: paste the code shown above the prompt on the GitHub page that just opened, then press Authorize.', { timeoutMs: 15_000 })
+      const granted = await ghAuth($, r.needs, `${yes === 'Close it' ? 'close' : 'delete'} ${describeGh(g)}`)
       r = granted.ok ? await ghUndo($, g) : { ok: false, detail: `GitHub didn't give the OK (${granted.detail}), so ${describeGh(g)} is still there` }
     }
     if (r.ok && g.kind === 'repo') gone.add(g.repo)
+    await addItem($, r.ok ? { label: `on GitHub: ${r.detail}`, ok: true } : { label: `on GitHub: ${r.detail}`, ok: false })
     $.ui.log(r.ok ? `${MARK_TEXT} On GitHub: ${r.detail}.` : `${MARK_TEXT} Not undone on GitHub: ${r.detail}`)
     $.ui.toast(r.ok ? `Backstep ${r.detail}.` : `Backstep ${r.detail}`)
   }
@@ -148,6 +183,19 @@ async function offerPushUndo($: EngineInterface, outcomes: Outcome[], repoGone =
 // The first press asks, right there above the prompt; a second press within a
 // few seconds undoes. A dialog would take the band off screen, and with it the
 // key, which would then suspend Claude Code in a terminal.
+// Whether a file path is inside the folder this session has open.
+function within(path: string, cwd: string): boolean {
+  const abs = path.startsWith('/') ? path : `${cwd}/${path}`
+  const parts: string[] = []
+  for (const seg of abs.split('/')) {
+    if (seg === '..') parts.pop()
+    else if (seg && seg !== '.') parts.push(seg)
+  }
+  const p = '/' + parts.join('/')
+  const d = cwd.replace(/\/+$/, '')
+  return p === d || p.startsWith(d + '/')
+}
+
 async function pressUndo($: EngineInterface) {
   if (await read($, rewind)) return
   const target = (await read($, turns)).findLast(hasWork)
@@ -183,7 +231,7 @@ async function undoLastTurn($: EngineInterface, count = 1) {
   const cwd = await $.session.cwd()
   const short = (p: string) => (p.startsWith(cwd + '/') ? p.slice(cwd.length + 1) : p)
   const [ran] = await Promise.all([
-    $.process.run(backstep(['undo', '--since', String(target.startedAt), '--json', '--via-claude-code'])).catch((err: unknown) => ({
+    $.process.run(backstep(['undo', '--since', String(target.startedAt), '--session', await $.session.id(), '--json', '--via-claude-code'])).catch((err: unknown) => ({
       exitCode: 1,
       stdout: '',
       stderr: err instanceof Error ? err.message : String(err),
@@ -237,9 +285,11 @@ async function undoLastTurn($: EngineInterface, count = 1) {
   // A push, or something made on GitHub, is offered back below, so it isn't listed as lost.
   const offered = outcomes.some((o) => o.ok && o.pushed)
   const offeredGh = outcomes.some((o) => o.ok && o.github?.length)
+  // Deleting the repository takes whatever was pushed to it along.
+  const offeredRepo = outcomes.some((o) => o.ok && o.github?.some((g) => g.kind === 'repo'))
   const kept = taken
     .flatMap((t) => t.lostItems ?? [])
-    .filter((l) => !(offered && /pushes to a remote/.test(l)) && !(offeredGh && /changes GitHub/.test(l)))
+    .filter((l) => !((offered || offeredRepo) && /pushes to a remote/.test(l)) && !(offeredGh && /changes GitHub/.test(l)))
     .map((label) => ({ label, ok: false }))
   const items: RewindItem[] = [...undone, ...stopped, ...kept]
   const done = undone.length
@@ -675,9 +725,11 @@ export const register: Register = (on, options) => {
     if (EDIT_TOOLS.has(tool)) {
       const input = e as { file_path?: string; notebook_path?: string }
       const path = input.file_path ?? input.notebook_path
-      if (path) {
+      const cwd = await $.session.cwd()
+      // Only the open folder is tracked: an edit in another project is never
+      // recorded, so undoing here can never delete or roll back files there.
+      if (path && within(path, cwd)) {
         const t = await current($)
-        const cwd = await $.session.cwd()
         const sid = await $.session.id()
         // A failed snapshot never blocks the edit; it just won't be undoable.
         const snap = await $.process
@@ -741,20 +793,44 @@ export const register: Register = (on, options) => {
   on('ui.render', { component: 'AbovePrompt' }, async ($, e, next) => {
     if (e.props.hasSurvey) return next(e)
     const { Box, Button, Text } = $.ui.resolve(e)
+    // The logo keeps its own box with a fixed gap after it: a space inside the
+    // text next to it gets trimmed when a long line wraps, crushing the two together.
+    const mark = () => (
+      <Box flexShrink={0} marginRight={1}>
+        <Text bold>◀</Text>
+        <Text color={PINK} bold>◀</Text>
+      </Box>
+    )
     const r = await read($, rewind)
 
     if (r?.phase === 'running') {
       return (
         <Box>
-          <Text bold>◀</Text>
-          <Text color={PINK} bold>◀</Text>
-          <Text bold> Rewinding </Text>
+          {mark()}
+          <Text bold>Rewinding </Text>
           <Text>{bar(r.frame)}</Text>
           <Text dimColor> undoing the last turn…</Text>
         </Box>
       )
     }
 
+    const waiting = await read($, githubCode)
+    // GitHub is waiting on the person: the code, big and plain, says this is a step to take, not a failure.
+    const step = waiting ? (
+      <Box flexDirection="column" marginTop={r ? 1 : 0}>
+        <Box>
+          {mark()}
+          <Text color="warning" bold>{`One more step to ${waiting.what}:`}</Text>
+        </Box>
+        <Text>{'   Paste this code on the GitHub page that just opened, then press Authorize:'}</Text>
+        <Box>
+          <Text>{'   '}</Text>
+          <Text color={PINK} bold>{waiting.code}</Text>
+          <Text dimColor>{'  (already copied: ⌘V / Ctrl+V)'}</Text>
+        </Box>
+      </Box>
+    ) : null
+
     if (r) {
       const tone = r.phase === 'failed' ? 'error' : r.phase === 'empty' ? 'warning' : undefined
       const glyph = r.phase === 'failed' ? '✗' : r.phase === 'empty' ? '!' : '✓'
@@ -782,10 +858,13 @@ export const register: Register = (on, options) => {
               {i.label}
             </Text>
           ))}
+          {step}
         </Box>
       )
     }
 
+    if (step) return step
+
     const { target, before } = await undoTargets($)
     const label = (await read($, keys)).map(keyLabel).join(' / ')
     if (target && (await read($, armed)) !== null) {
@@ -800,9 +879,8 @@ export const register: Register = (on, options) => {
         return (
           <Box flexDirection="column">
             <Box>
-              <Text bold>◀</Text>
-              <Text color={PINK} bold>◀</Text>
-              <Text color="warning" bold>{' That turn only saved and pushed to git.'}</Text>
+              {mark()}
+              <Text color="warning" bold>{'That turn only saved and pushed to git.'}</Text>
             </Box>
             <Text dimColor>{`   Undo it and the turn before it${quoted(before, 50)}?`}</Text>
             <Box>
@@ -823,9 +901,8 @@ export const register: Register = (on, options) => {
       return (
         <Box flexDirection="column">
           <Box>
-            <Text bold>◀</Text>
-            <Text color={PINK} bold>◀</Text>
-            <Text color="warning" bold>{" Undo Claude's last turn?"}</Text>
+            {mark()}
+            <Text color="warning" bold>{"Undo Claude's last turn?"}</Text>
           </Box>
           <Text dimColor>{`   ${quoted(target, 50).trim() || 'That turn'} · ${summary(target)}`}</Text>
           <Box>
@@ -845,13 +922,16 @@ export const register: Register = (on, options) => {
     // with nothing to undo, a press says so rather than doing nothing.
     return (
       <Box>
-        <Text bold>◀</Text>
-        <Text color={PINK} bold>◀</Text>
-        <Text> </Text>
-        <Text dimColor>{target ? `Last turn:${quoted(target, 28)} · ${summary(target)}  ` : 'Backstep is on · nothing to undo yet  '}</Text>
-        <Button key="undo" action={UNDO_ACTION} plain dimColor onPress={() => void pressUndo($)}>
-          {`${label} to undo`}
-        </Button>
+        {mark()}
+        {/* One line: a long summary is cut short so the key to press always shows. */}
+        <Box flexShrink={1} minWidth={0}>
+          <Text dimColor wrap="truncate-end">{target ? `Last turn:${quoted(target, 28)} · ${summary(target)}` : 'Backstep is on · nothing to undo yet'}</Text>
+        </Box>
+        <Box flexShrink={0} marginLeft={2}>
+          <Button key="undo" action={UNDO_ACTION} plain dimColor onPress={() => void pressUndo($)}>
+            {`${label} to undo`}
+          </Button>
+        </Box>
       </Box>
     )
   })

package/mod/types/index.d.ts

@@ -29,10 +29,14 @@ export type Rewind = {
   message: string
 }
 
+// GitHub waiting on the person's OK for one more permission: the one-time code to paste, and what it's for.
+export type GithubCode = { code: string; what: string }
+
 declare module 'claude-code' {
   interface PluginState {
     // armed: when the undo key was first pressed; a second press within a few seconds undoes.
     // keys: the keys bound to undo, kept here so the band redraws when they change.
-    backstep: { turns: Turn[]; rewind: Rewind | null; note: string | null; armed: number | null; keys: string[] }
+    // githubCode: the code GitHub's approval page wants, shown on the band until GitHub answers.
+    backstep: { turns: Turn[]; rewind: Rewind | null; note: string | null; armed: number | null; keys: string[]; githubCode: GithubCode | null }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backstep",
-  "version": "0.1.13",
+  "version": "0.1.16",
   "description": "Undo for everything your agents touch: an MCP proxy that makes agent actions reversible.",
   "scripts": {
     "dev": "node src/cli.ts",