backstep 0.1.22 → 0.1.24

package/dist/check.js

@@ -84,7 +84,8 @@ export function check(dir, opts = {}) {
 // do with undo (ones that are broken, or need signing in) aren't Backstep's to list.
 export function printCheck(c, bs = "backstep") {
     const cols = width() - 6;
-    const undoable = [...new Set(c.items.filter((i) => i.level === "undoable").map((i) => i.name))];
+    // Supabase is said once, in the databases line below.
+    const undoable = [...new Set(c.items.filter((i) => i.level === "undoable" && !SUPABASE.test(i.name)).map((i) => i.name))];
     const soon = [...new Set(c.items.filter((i) => i.level === "connect" && FIREBASE.test(i.name)).map((i) => i.name))];
     const supabase = c.items.find((i) => SUPABASE.test(i.name));
     const supabaseLeft = supabase?.level === "connect" || c.suggest.some((s) => s.title === "Connect Supabase");
@@ -92,6 +93,8 @@ export function printCheck(c, bs = "backstep") {
     console.log(`\n  ${white(`What ${(undoKeys().length ? undoKeys() : [DEFAULT_KEY]).map(keyLabel).join(" or ")} can undo`)}`);
     console.log(`    ${pink("✓")} Files Claude edits and commands it runs`);
     console.log(`    ${pink("✓")} Code Claude pushes to GitHub ${dim("(automatic, nothing to connect)")}`);
+    console.log(`    ${pink("✓")} Vercel deploys and env vars Claude adds ${dim("(automatic, through your vercel login)")}`);
+    console.log(`    ${pink("✓")} Supabase and other databases ${dim(supabase?.level === "undoable" ? "(Supabase is connected)" : "(Backstep asks when you open a project that uses one)")}`);
     for (const n of undoable)
         console.log(`    ${pink("✓")} ${n}`);
     for (const n of soon)
@@ -103,10 +106,6 @@ export function printCheck(c, bs = "backstep") {
         console.log(`    ${pink("→")} Or just ask Claude: ${white('"connect Backstep to Supabase"')}`);
         console.log("");
     }
-    else if (!supabase || supabase.level !== "undoable") {
-        console.log(`  ${dim(wrap("Use Supabase? Open your project in Claude Code and Backstep will check for it and offer to connect.", cols, 2))}`);
-        console.log("");
-    }
     if (c.suggest.some((s) => s.title === "Add Firebase")) {
         console.log(`  ${white("Your project uses Firebase")}`);
         console.log(`    ${pink("→")} Ask Claude: ${white('"connect Backstep to Firebase"')}`);

package/dist/cli.js

@@ -9,6 +9,7 @@ import { insideDir, snapshotPaths } from "./adapters/fs.js";
 import { notePushed, snapshotSqlite, snapshotTree } from "./adapters/tree.js";
 import { revertPush } from "./push.js";
 import { ghMade, grantScope, undoGh } from "./github.js";
+import { undoVercel, vercelBefore, vercelMade } from "./vercel.js";
 import { snapshotDb } from "./adapters/dbsnap.js";
 import { dbDirs, firebaseProject, postgresUrls, projectDatabases, projectUses, restKeys, supabaseDirs, unconnected } from "./connect.js";
 import { snapshotFirebase } from "./adapters/firestore.js";
@@ -468,7 +469,9 @@ async function main() {
         // SQLite files in the project, even git-ignored ones, which the project snapshot leaves out.
         const sqlite = tree && touchesSqlite(command) ? snapshotSqlite(a.id, tree.root) : null;
         const extra = { ...(dbs.length ? { dbs } : {}), ...(rests.length ? { rests } : {}), ...(fbs.length ? { fbs } : {}), ...(sqlite?.files.length ? { sqlite } : {}) };
-        const undo = tree ? { ...tree, ...extra } : dbs.length || rests.length || fbs.length ? { adapter: "dbs", dbs, rests, fbs } : null;
+        // A command that could change what's live on Vercel: what's live now, so undo can put it back.
+        const vb = tree && classifyShell(command).reason === "changes Vercel" ? vercelBefore(command, cwd) : [];
+        const undo = tree ? { ...tree, ...extra, ...(vb.length ? { vercelBefore: vb } : {}) } : dbs.length || rests.length || fbs.length ? { adapter: "dbs", dbs, rests, fbs } : null;
         if (undo)
             store.updateAction(a.id, { undo: JSON.stringify(undo) });
         // With its database saved, a command that reaches it is no longer lost to undo.
@@ -498,15 +501,19 @@ async function main() {
     // After a shell command that pushed: notes what it sent (run by the Claude Code mod).
     // Also notes what a gh command made on GitHub, from its output on stdin.
     if (cmd === "shell-end") {
+        const { values, positionals } = parseArgs({ args: rest, options: { cwd: { type: "string" } }, allowPositionals: true });
         const store = new Store();
-        const a = store.getAction(rest[0] ?? "");
+        const a = store.getAction(positionals[0] ?? "");
         const u = a?.undo ? JSON.parse(a.undo) : null;
         const output = process.stdin.isTTY ? "" : readFileSync(0, "utf8");
         if (a && u?.adapter === "tree") {
+            const command = JSON.parse(a.args).command ?? "";
             const pushed = u.git?.remotes ? notePushed(u) : [];
-            const github = ghMade(JSON.parse(a.args).command ?? "", output);
-            if (pushed.length || github.length)
-                store.updateAction(a.id, { undo: JSON.stringify({ ...u, ...(pushed.length ? { pushed } : {}), ...(github.length ? { github } : {}) }) });
+            const github = ghMade(command, output);
+            const vercel = classifyShell(command).reason === "changes Vercel" ? vercelMade(command, values.cwd ?? process.cwd(), output, u.vercelBefore) : [];
+            if (pushed.length || github.length || vercel.length) {
+                store.updateAction(a.id, { undo: JSON.stringify({ ...u, ...(pushed.length ? { pushed } : {}), ...(github.length ? { github } : {}), ...(vercel.length ? { vercel } : {}) }) });
+            }
         }
         return;
     }
@@ -520,6 +527,14 @@ async function main() {
             process.exitCode = 1;
         return;
     }
+    // Takes back something Claude changed on Vercel (the change, as undo reported it, on stdin). The mod runs this after asking.
+    if (cmd === "vercel-undo") {
+        const out = undoVercel(JSON.parse(readFileSync(0, "utf8")));
+        console.log(JSON.stringify(out));
+        if (!out.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (cmd === "gh-undo") {
         const out = undoGh(JSON.parse(readFileSync(0, "utf8")));
         console.log(JSON.stringify(out));

package/dist/shell.js

@@ -2,6 +2,7 @@
 // Reads pass straight through; commands that reach outside the machine can't be
 // taken back, so they're held; everything else gets the project snapshotted.
 import { resolveIn } from "./paths.js";
+import { vercelKind } from "./vercel.js";
 // Programs that only look. A pipeline or chain is a read only if every part is.
 const READ_PROGRAMS = new Set([
     "ls", "ll", "la", "cat", "head", "tail", "less", "more", "grep", "egrep", "fgrep", "rg", "ag", "fd", "find", "tree",
@@ -23,7 +24,7 @@ const OUTBOUND = [
     [/^(npm|pnpm|yarn|bun) (publish|unpublish|deprecate|dist-tag)\b/, "publishes a package"],
     [/^(cargo|gem|twine|poetry|flit) (publish|push|upload)\b/, "publishes a package"],
     [/^gh (pr (create|merge|close|comment|review|edit)|issue (create|close|comment|edit|delete)|release (create|delete|upload)|repo (create|delete|edit)|secret|workflow run|api)\b/, "changes GitHub"],
-    [/^(vercel|netlify|fly|flyctl|heroku|firebase|wrangler|railway|surge)\b(?!.*\s(--version|-v|--help|login|whoami|logs|ls|list)(\s|$))/, "deploys"],
+    [/^(netlify|fly|flyctl|heroku|firebase|wrangler|railway|surge)\b(?!.*\s(--version|-v|--help|login|whoami|logs|ls|list)(\s|$))/, "deploys"],
     [/^(kubectl (apply|delete|create|patch|replace|scale|rollout)|helm (install|upgrade|uninstall|rollback)|terraform (apply|destroy)|pulumi (up|destroy)|aws |gcloud |az )/, "changes cloud resources"],
     [/^docker (push|login)\b/, "pushes an image"],
     [/^(ssh|scp|sftp|rsync .*:\S)/, "runs on another machine"],
@@ -100,9 +101,19 @@ function isRead(part) {
         return true;
     return false;
 }
+// Each part of a command, ready to judge: split on ; && || | and newlines, wrappers dropped.
+export function commandParts(command) {
+    return parts(command).map(strip);
+}
 export function classifyShell(command) {
-    const ps = parts(command).map(strip);
+    const ps = commandParts(command);
     for (const p of ps) {
+        // Vercel: deploys and added variables come back with undo (src/vercel.ts); other changes there don't.
+        const v = vercelKind(p);
+        if (v === "undoable")
+            return { kind: "outbound", reason: "changes Vercel" };
+        if (v === "other")
+            return { kind: "outbound", reason: "changes Vercel in a way Backstep can't undo" };
         for (const [re, reason] of OUTBOUND)
             if (re.test(p))
                 return { kind: "outbound", reason };

package/dist/undo.js

@@ -172,7 +172,8 @@ async function undoOne(store, a, opts = {}) {
             rmSync(snapshotDir(a.id), { recursive: true, force: true });
         const pushed = u.adapter === "tree" && u.pushed?.length ? { root: u.root, pushes: u.pushed } : undefined;
         const github = u.adapter === "tree" && u.github?.length ? u.github : undefined;
-        return { id: a.id, tool: a.tool, ok: true, detail, ...(pushed ? { pushed } : {}), ...(github ? { github } : {}) };
+        const vercel = u.adapter === "tree" && u.vercel?.length ? u.vercel : undefined;
+        return { id: a.id, tool: a.tool, ok: true, detail, ...(pushed ? { pushed } : {}), ...(github ? { github } : {}), ...(vercel ? { vercel } : {}) };
     }
     catch (err) {
         const detail = err instanceof Error ? err.message : String(err);

package/dist/vercel.js

@@ -0,0 +1,223 @@
+// Vercel, through its command line: what Claude changes there with `vercel`,
+// noted so undo can offer to take it back with `vercel` itself, signed in as
+// the person.
+//
+//   a production deploy, promote or rollback → put back the deployment that was live before
+//   a preview deploy                         → delete that deployment
+//   an environment variable added            → remove it again
+//
+// What was live is read just before the command runs (only for commands that
+// can change it), and again after, so undo knows what to put back and can
+// leave things alone if something newer went live since.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { spawnSync } from "./spawn.js";
+import { resolveIn } from "./paths.js";
+import { commandDir, commandParts } from "./shell.js";
+// Options that take a value, so the word after them isn't read as a subcommand.
+const VALUE = new Set([
+    "--cwd", "--scope", "-S", "--token", "-t", "-A", "--local-config", "-Q", "--global-config", "--team", "-T",
+    "--target", "--environment", "-e", "--env", "-b", "--build-env", "-m", "--meta", "--archive", "--regions",
+    "--git-branch", "-p", "--project", "--timeout",
+]);
+// Subcommands that only read, or only change files on this machine (which the project snapshot covers).
+const LOCAL = new Set(["ls", "list", "inspect", "logs", "whoami", "login", "logout", "link", "pull", "build", "dev", "help", "switch", "open", "telemetry", "bisect", "init"]);
+const LISTS = new Set(["ls", "list", "inspect", "pull", "run", "status"]);
+// Not a subcommand: a folder to deploy (`vercel ./site`).
+const PATHLIKE = /^(\.|\/|~|[a-zA-Z]:[\\/])/;
+function parse(part) {
+    const words = (part.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^(["'])(.*)\1$/, "$2"));
+    if (words[0] !== "vercel" && words[0] !== "vc")
+        return null;
+    const pos = [];
+    const flags = new Map();
+    for (let i = 1; i < words.length; i++) {
+        const w = words[i];
+        if (w === "--")
+            break;
+        if (w.startsWith("-") && w.length > 1) {
+            const eq = w.indexOf("=");
+            if (eq > 0)
+                flags.set(w.slice(0, eq), w.slice(eq + 1));
+            else if (VALUE.has(w) && i + 1 < words.length)
+                flags.set(w, words[++i]);
+            else
+                flags.set(w, true);
+        }
+        else
+            pos.push(w);
+    }
+    return { pos, flags };
+}
+const flag = (p, ...names) => names.map((n) => p.flags.get(n)).find((v) => v !== undefined);
+const isDeploy = (p) => p.pos[0] === undefined || p.pos[0] === "deploy" || p.pos[0] === "redeploy" || PATHLIKE.test(p.pos[0]);
+const isProd = (p) => p.flags.has("--prod") || flag(p, "--target", "--environment") === "production";
+// Commands that change which deployment is live.
+const changesLive = (p) => (isDeploy(p) && isProd(p)) || ((p.pos[0] === "promote" || p.pos[0] === "rollback") && !LISTS.has(p.pos[1] ?? ""));
+const isEnvAdd = (p) => p.pos[0] === "env" && p.pos[1] === "add";
+// What a part of a shell command does to Vercel: nothing outside this machine,
+// something Backstep can take back, or something it can't.
+export function vercelKind(part) {
+    const p = parse(part);
+    if (!p)
+        return null;
+    if (p.flags.has("--version") || p.flags.has("-v") || p.flags.has("--help") || p.flags.has("-h") || p.flags.has("--dry"))
+        return "local";
+    const [sub, next] = p.pos;
+    if (sub !== undefined && LOCAL.has(sub))
+        return "local";
+    if (sub === "api")
+        return flag(p, "-X", "--method") === undefined && !p.flags.has("--input") && !p.flags.has("-F") && !p.flags.has("-f") ? "local" : "other";
+    if (sub !== undefined && !isDeploy(p) && LISTS.has(next ?? ""))
+        return "local";
+    // Overwriting a variable loses the old value, which Backstep never saw.
+    if (isEnvAdd(p))
+        return p.flags.has("--force") ? "other" : "undoable";
+    if (isDeploy(p) || changesLive(p))
+        return "undoable";
+    return "other";
+}
+// The folder a part of the command works in, and the Vercel project linked there.
+function folder(p, command, cwd) {
+    const base = commandDir(command, cwd);
+    const c = flag(p, "--cwd");
+    return typeof c === "string" ? resolveIn(c, base) : base;
+}
+function readLink(dir) {
+    const f = join(dir, ".vercel", "project.json");
+    if (!existsSync(f))
+        return null;
+    try {
+        const j = JSON.parse(readFileSync(f, "utf8"));
+        return j.projectId ? { project: j.projectId, team: j.orgId?.startsWith("team_") ? j.orgId : null } : null;
+    }
+    catch {
+        return null;
+    }
+}
+function vercel(dir, args, timeout = 120_000) {
+    const r = spawnSync("vercel", [...args, "--no-color"], { cwd: dir, encoding: "utf8", timeout, env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" }, stdio: ["ignore", "pipe", "pipe"] });
+    return { ok: r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim() };
+}
+const lastLine = (out, or) => out.split("\n").map((l) => l.trim()).filter(Boolean).at(-1) ?? or;
+// The project's name and the deployment live now, from Vercel's API (with the person's own sign-in).
+function liveNow(dir, link) {
+    const r = spawnSync("vercel", ["api", `/v9/projects/${link.project}${link.team ? `?teamId=${link.team}` : ""}`, "--raw"], {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: 20_000,
+        env: { ...process.env, NO_COLOR: "1" },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (r.status !== 0)
+        return null;
+    try {
+        const j = JSON.parse(r.stdout);
+        const t = j.targets?.production;
+        return { name: j.name ?? link.project, live: t?.id && t.url ? { id: t.id, url: t.url } : null };
+    }
+    catch {
+        return null;
+    }
+}
+// Before the command runs: what's live in each project it could change.
+export function vercelBefore(command, cwd) {
+    const out = [];
+    for (const part of commandParts(command)) {
+        const p = parse(part);
+        if (!p || !changesLive(p))
+            continue;
+        const dir = folder(p, command, cwd);
+        if (out.some((b) => b.dir === dir))
+            continue;
+        const link = readLink(dir);
+        const now = link ? liveNow(dir, link) : null;
+        out.push({ dir, link, name: now?.name ?? null, live: now?.live ?? null });
+    }
+    return out;
+}
+// The deployment a deploy made, from what `vercel` printed.
+function deployedUrl(output) {
+    const said = output.match(/\b(?:Preview|Production):\s*(https:\/\/[^\s[\]]+)/);
+    if (said)
+        return said[1];
+    // `vercel` prints the bare deployment URL on stdout; aliases come after "Aliased".
+    const urls = output
+        .split("\n")
+        .filter((l) => !/Aliased|Inspect/i.test(l))
+        .flatMap((l) => l.match(/https:\/\/[a-z0-9-]+\.vercel\.app\b/gi) ?? []);
+    return urls[0] ?? null;
+}
+// After the command ran: what it changed on Vercel that undo can take back.
+export function vercelMade(command, cwd, output, before = []) {
+    const out = [];
+    for (const part of commandParts(command)) {
+        const p = parse(part);
+        if (!p)
+            continue;
+        const dir = folder(p, command, cwd);
+        if (changesLive(p)) {
+            if (out.some((m) => m.kind === "live" && m.dir === dir))
+                continue;
+            // A deploy in a folder that wasn't linked links it as it runs.
+            const link = readLink(dir);
+            const now = link ? liveNow(dir, link) : null;
+            if (!link || !now?.live)
+                continue;
+            const was = before.find((b) => b.dir === dir);
+            // Read before it ran in a linked folder, but Vercel couldn't be reached: no way to know what to put back.
+            if (was?.link && !was.live && was.name === null)
+                continue;
+            const prev = was?.link?.project === link.project ? was.live : null;
+            if (prev?.id === now.live.id)
+                continue;
+            out.push({ kind: "live", dir, project: link.project, team: link.team, name: now.name, before: prev, after: now.live });
+        }
+        else if (isDeploy(p) && !isProd(p)) {
+            const url = deployedUrl(output);
+            if (url && !out.some((m) => m.kind === "preview" && m.url === url))
+                out.push({ kind: "preview", dir, url });
+        }
+        else if (isEnvAdd(p) && !p.flags.has("--force") && /Added Environment Variable/i.test(output)) {
+            const name = p.pos[2];
+            const given = p.pos[3] ?? flag(p, "--environment", "-e");
+            if (!name || typeof given !== "string")
+                continue;
+            const branch = p.pos[4] ?? flag(p, "--git-branch");
+            out.push({ kind: "env", dir, name, envs: given.split(",").map((e) => e.trim()).filter(Boolean), ...(typeof branch === "string" ? { branch } : {}) });
+        }
+    }
+    return out;
+}
+const host = (url) => url.replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+export const describeVercel = (m) => m.kind === "live" ? `the new live version of ${m.name}` : m.kind === "preview" ? `the preview deployment ${host(m.url)}` : `the environment variable ${m.name} (${m.envs.join(", ")})`;
+export function undoVercel(m) {
+    if (m.kind === "preview") {
+        const r = vercel(m.dir, ["remove", host(m.url), "--yes"]);
+        return r.ok ? { ok: true, detail: `deleted the preview deployment ${host(m.url)}` } : { ok: false, detail: `couldn't delete ${host(m.url)}: ${lastLine(r.out, "vercel failed")}` };
+    }
+    if (m.kind === "env") {
+        for (const env of m.envs) {
+            const r = vercel(m.dir, ["env", "rm", m.name, "--environment", env, ...(m.branch ? ["--git-branch", m.branch] : []), "--yes"]);
+            if (!r.ok && !/not found|doesn't exist|does not exist/i.test(r.out))
+                return { ok: false, detail: `couldn't remove ${m.name} from ${env}: ${lastLine(r.out, "vercel failed")}` };
+        }
+        return { ok: true, detail: `removed the environment variable ${m.name} (${m.envs.join(", ")})` };
+    }
+    const now = liveNow(m.dir, { project: m.project, team: m.team });
+    if (!now)
+        return { ok: false, detail: `couldn't reach Vercel to check what's live on ${m.name}` };
+    if (now.live?.id !== m.after.id)
+        return { ok: false, detail: `left ${m.name} alone: a newer deployment went live after Claude's` };
+    if (!m.before) {
+        // Nothing was live before Claude's deploy: taking it back means taking it down.
+        const r = vercel(m.dir, ["remove", m.after.url, "--yes"]);
+        return r.ok ? { ok: true, detail: `deleted the deployment Claude put live on ${m.name} (nothing was live before it)` } : { ok: false, detail: `couldn't delete it: ${lastLine(r.out, "vercel failed")}` };
+    }
+    let r = vercel(m.dir, ["promote", m.before.url, "--yes"], 200_000);
+    if (!r.ok)
+        r = vercel(m.dir, ["rollback", m.before.url, "--yes"], 200_000);
+    return r.ok
+        ? { ok: true, detail: `put back the version of ${m.name} that was live before (${host(m.before.url)})` }
+        : { ok: false, detail: `couldn't put back ${m.name}'s previous version: ${lastLine(r.out, "vercel failed")}` };
+}

package/mod/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "backstep",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Press ctrl+z to rewind everything Claude did in its last turn: file edits, shell commands, and database and tool changes.",
   "types": "./types/index.d.ts",
   "userConfig": {

package/mod/hooks/register.test.tsx

@@ -552,7 +552,7 @@ test('after undoing a turn that pushed, Backstep asks and pushes the undo', { op
   await $.prompt.submit({ text: 'ship it', wait: false, origin: { kind: 'composer' } })
   await $.tool.call({ tool: 'Bash', command: 'git push' })
   // The push is noted once it has run.
-  expect(runs.at(-1)?.argv.slice(3)).toEqual(['shell-end', 'p1'])
+  expect(runs.at(-1)?.argv.slice(3)).toEqual(['shell-end', 'p1', '--cwd', '/repo'])
 
   const ui = await $.ui.mount({ ...BAND, surface: 'terminal' })
   await ui.press({ key: 'undo' })
@@ -948,3 +948,62 @@ test('asking Claude to uninstall asks too, and Keep it removes nothing', { optio
   expect(runs.filter((a) => a.includes('uninstall'))).toHaveLength(0)
   expect(r.result).toBe('Kept Backstep: nothing was removed.')
 })
+
+test('a production deploy Claude made on Vercel is offered back after undo, and Put it back runs vercel-undo', { options: { cli: CLI } }, async ($, on) => {
+  const clock = mock.clock(on, { now: 5000 })
+  const live = { kind: 'live', dir: '/repo', project: 'prj_1', team: 'team_1', name: 'shop', before: { id: 'dpl_old', url: 'shop-old.vercel.app' }, after: { id: 'dpl_new', url: 'shop-new.vercel.app' } }
+  const runs: { argv: string[]; stdin?: string }[] = []
+  const asked: string[] = []
+  const logs: string[] = []
+  on('session.cwd', () => ({ value: '/repo' }))
+  on('session.id', () => ({ value: 's1' }))
+  on('ui.toast', () => ({ value: undefined }))
+  on('ui.log', (_, e) => {
+    logs.push(e.text)
+    return { value: undefined }
+  })
+  on('process.run', (_, e) => {
+    runs.push({ argv: [...e.argv], stdin: e.init?.stdin })
+    const out = e.argv.includes('shell')
+      ? { kind: 'outbound', reason: 'changes Vercel', id: 'v1', undoable: true }
+      : e.argv.includes('undo')
+        ? [{ id: 'v1', tool: 'Bash', ok: true, detail: 'restored index.html', vercel: [live] }]
+        : e.argv.includes('vercel-undo')
+          ? { ok: true, detail: 'put back the version of shop that was live before (shop-old.vercel.app)' }
+          : e.argv.includes('db-check')
+            ? { ask: null }
+            : null
+    return { value: { exitCode: 0, stdout: out ? JSON.stringify(out) : '', stderr: '', isStdoutTruncated: false, isStderrTruncated: false } }
+  })
+  on('tool.call', { tool: 'AskUserQuestion' }, (_, e) => {
+    const questions = (e as unknown as { questions: { question: string }[] }).questions
+    asked.push(questions[0].question)
+    return { result: { questions, answers: { [questions[0].question]: 'Put it back' } } }
+  })
+  on('tool.call', () => ({ result: {}, text: 'Production: https://shop-new.vercel.app [3s]' }))
+  on('prompt.submit', (_, e) => ({ text: e.text, context: e.context }))
+  on('ui.render', ($, e) => {
+    const { Text } = $.ui.resolve(e)
+    return <Text>engine</Text>
+  })
+
+  await $.prompt.submit({ text: 'deploy it', wait: false, origin: { kind: 'composer' } })
+  await $.tool.call({ tool: 'Bash', command: 'vercel --prod --yes' })
+  // What vercel printed is noted once it has run, with the folder it ran in.
+  const end = runs.find((r) => r.argv.includes('shell-end'))
+  expect(end?.argv.slice(3)).toEqual(['shell-end', 'v1', '--cwd', '/repo'])
+  expect(end?.stdin).toContain('shop-new.vercel.app')
+
+  const ui = await $.ui.mount({ ...BAND, surface: 'terminal' })
+  await ui.press({ key: 'undo' })
+  const pressed = ui.press({ key: 'undo' })
+  await clock.advance(1000)
+  await pressed
+  await clock.settle()
+  expect(asked).toEqual(['Claude put a new version of shop live on Vercel. Put back the version that was live before?'])
+  expect(JSON.parse(runs.find((r) => r.argv.includes('vercel-undo'))?.stdin ?? '{}')).toEqual(live)
+  expect(await ui.find({ type: 'Text', text: /on Vercel: put back the version of shop/ })).toBeTruthy()
+  // Offered back, so the deploy isn't listed as not undone.
+  expect(logs.find((l) => l.includes('Backstep undid'))).not.toContain('changes Vercel')
+  await ui.unmount()
+})

package/mod/hooks/register.tsx

@@ -60,6 +60,7 @@ type Outcome = {
   run?: { server: string; tool: string; args: Record<string, unknown>; more?: { tool: string; args: Record<string, unknown> }[]; label?: string }
   pushed?: { root: string; pushes: Pushed[] }
   github?: GhMade[]
+  vercel?: VercelMade[]
 }
 const PUSH = /\bgit\b[^;&|]*\bpush\b/
 // A gh command that makes something on GitHub: noted once it runs, so undo can offer to take it away.
@@ -68,6 +69,23 @@ type GhMade = { kind: 'repo' | 'issue' | 'pr' | 'release'; repo: string; number?
 const describeGh = (g: GhMade) =>
   g.kind === 'repo' ? `the GitHub repository ${g.repo}` : g.kind === 'release' ? `the release ${g.tag} in ${g.repo}` : `${g.kind === 'pr' ? 'pull request' : 'issue'} #${g.number} in ${g.repo}`
 
+// A vercel command: once it runs, what it changed there is noted, so undo can offer to take it back.
+const VERCEL = /(^|[\s;&|(])(npx\s+(-y\s+)?)?(vercel|vc)(\s|$)/
+type VercelMade =
+  | { kind: 'live'; dir: string; project: string; team: string | null; name: string; before: { id: string; url: string } | null; after: { id: string; url: string } }
+  | { kind: 'preview'; dir: string; url: string }
+  | { kind: 'env'; dir: string; name: string; envs: string[]; branch?: string }
+const vercelHost = (url: string) => url.replace(/^https?:\/\//, '').replace(/\/.*$/, '')
+// The question asked after undo, and the answer that takes it back on Vercel.
+function vercelAsk(m: VercelMade): { q: string; yes: string } {
+  if (m.kind === 'live')
+    return m.before
+      ? { q: `Claude put a new version of ${m.name} live on Vercel. Put back the version that was live before?`, yes: 'Put it back' }
+      : { q: `Claude put ${m.name} live on Vercel for the first time. Take it down (delete that deployment)?`, yes: 'Take it down' }
+  if (m.kind === 'preview') return { q: `Claude made a preview deployment on Vercel (${vercelHost(m.url)}). Delete it?`, yes: 'Delete it' }
+  return { q: `Claude added the environment variable ${m.name} on Vercel (${m.envs.join(', ')}). Remove it?`, yes: 'Remove it' }
+}
+
 // Runs a Backstep command that answers with { ok, detail }, however it fails.
 async function jsonRun($: EngineInterface, args: string[], timeoutMs: number, stdin?: string): Promise<{ ok: boolean; detail: string; needs?: string }> {
   const ran = await $.process
@@ -143,6 +161,23 @@ async function offerGithubUndo($: EngineInterface, outcomes: Outcome[]): Promise
   return gone
 }
 
+// Asks, for each thing Claude changed on Vercel in the undone turns, whether to take it back there too.
+async function offerVercelUndo($: EngineInterface, outcomes: Outcome[]) {
+  for (const m of outcomes.flatMap((o) => (o.ok && o.vercel ? o.vercel : []))) {
+    const { q, yes } = vercelAsk(m)
+    const answer = await $.ui.ask(q, { header: 'Backstep', options: [yes, 'Leave it'] }).catch(() => null)
+    if (answer !== yes) {
+      $.ui.log(`${MARK_TEXT} Not undone on Vercel: you chose to leave it.`)
+      continue
+    }
+    const r = await jsonRun($, ['vercel-undo'], 240_000, JSON.stringify(m))
+    await addItem($, { label: `on Vercel: ${r.detail}`, ok: r.ok })
+    $.ui.log(r.ok ? `${MARK_TEXT} On Vercel: ${r.detail}.` : `${MARK_TEXT} Not undone on Vercel: ${r.detail}`)
+    $.ui.toast(r.ok ? `Backstep ${r.detail}.` : `Backstep ${r.detail}`)
+    await update($, note, (n) => (n ? `${n}\n${r.ok ? `On Vercel: ${r.detail}.` : `Vercel was left as it was: ${r.detail}.`}` : n))
+  }
+}
+
 const PUSH_ASK = { yes: 'Push the undo', no: 'Leave it as it is' }
 
 // Undo rewound the code here; this asks before taking it back on GitHub too,
@@ -315,11 +350,12 @@ async function undoLastTurn($: EngineInterface, count = 1) {
   // A push, or something made on GitHub, is offered back below, so it isn't listed as lost.
   const offered = outcomes.some((o) => o.ok && o.pushed)
   const offeredGh = outcomes.some((o) => o.ok && o.github?.length)
+  const offeredVercel = outcomes.some((o) => o.ok && o.vercel?.length)
   // Deleting the repository takes whatever was pushed to it along.
   const offeredRepo = outcomes.some((o) => o.ok && o.github?.some((g) => g.kind === 'repo'))
   const kept = taken
     .flatMap((t) => t.lostItems ?? [])
-    .filter((l) => !((offered || offeredRepo) && /pushes to a remote/.test(l)) && !(offeredGh && /changes GitHub/.test(l)))
+    .filter((l) => !((offered || offeredRepo) && /pushes to a remote/.test(l)) && !(offeredGh && /changes GitHub/.test(l)) && !(offeredVercel && /: changes Vercel$/.test(l)))
     .map((label) => ({ label, ok: false }))
   const items: RewindItem[] = [...undone, ...stopped, ...kept]
   const done = undone.length
@@ -359,8 +395,10 @@ async function undoLastTurn($: EngineInterface, count = 1) {
     )
   }
 
-  // Asked once the band shows what came back: GitHub things first, then pushes.
-  void offerGithubUndo($, outcomes).then((gone) => offerPushUndo($, outcomes, gone.size > 0))
+  // Asked once the band shows what came back: GitHub things first, then pushes, then Vercel.
+  void offerGithubUndo($, outcomes)
+    .then((gone) => offerPushUndo($, outcomes, gone.size > 0))
+    .then(() => offerVercelUndo($, outcomes))
 
   // Reveal the items one by one. The list stays until the person's next
   // message (it's in the conversation too), so nothing is missed.
@@ -867,9 +905,9 @@ export const register: Register = (on, options) => {
         )
       }
       // A push: once it's run, note what it sent, so undo can offer to take it back there.
-      if (plan?.id && (PUSH.test(command) || GH_CREATE.test(command))) {
+      if (plan?.id && (PUSH.test(command) || GH_CREATE.test(command) || VERCEL.test(command))) {
         const r = await next(e)
-        await $.process.run(backstep(['shell-end', plan.id]), { stdin: r.text ?? '' }).catch(() => null)
+        await $.process.run(backstep(['shell-end', plan.id, '--cwd', cwd]), { stdin: r.text ?? '', timeoutMs: 60_000 }).catch(() => null)
         return r
       }
     } else if (tool.startsWith('mcp__')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backstep",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Undo for everything your agents touch: an MCP proxy that makes agent actions reversible.",
   "homepage": "https://getbackstep.com",
   "scripts": {