backstep 0.1.4 → 0.1.6

package/README.md

@@ -8,8 +8,8 @@ Undo for everything your agents touch. Backstep sits between your agent (Claude
 - **Supabase:** `execute_sql` and `apply_migration` snapshot the tables they change, over a connection to the project's database. Backstep never connects it on its own: when Claude Code opens a project that uses Supabase and isn't connected, it asks (Connect, Not now, or Don't ask for this project). Connect uses a connection string in the project's `.env` files, the local `supabase start` database, or a Supabase sign-in (`supabase login`, `SUPABASE_ACCESS_TOKEN`, or an access token you give Backstep once), with which the project gets a temporary database login that Backstep renews as it runs out. You can also ask Claude to "connect Backstep to Supabase" any time. Deleted rows, dropped tables and migrations, including the migration's history row, all come back. Works for the claude.ai Supabase connector and a local Supabase MCP server alike.
 - **Firebase:** before a change, Backstep reads what's there through the Firebase MCP server itself, and undoes through it too, so there's nothing to set up. Firestore documents updated, deleted or added; Realtime Database writes; Remote Config publishes (rolled back to the version before); and users enabled or disabled.
 - **claude.ai connectors and servers Claude Code signs in to:** Backstep can't sit in front of these, so the Claude Code mod watches their calls instead. Calls with an undo rule are undone through Claude Code's own connection.
-- **Database commands Claude runs** (`supabase db push`, `supabase migration up`, `supabase db reset`, `psql`, `prisma migrate`, `drizzle-kit push`, seed scripts…): in a project whose Supabase database is connected, the whole database is noted before the command runs, and ctrl+z puts it back in one transaction: rows, new tables dropped, dropped or altered tables rebuilt with their constraints, indexes, foreign keys, row level security policies, triggers and grants, sequence counters, and the migration history. Copies sit in a `backstep` schema in the same database; the newest 10 per database are kept. On a very big database it keeps every table's structure and the migration history, and rows smallest-table-first up to a budget (`BACKSTEP_DB_SNAPSHOT_MB`, default 250); undo names any table whose rows it couldn't bring back. Functions, views, types and extensions aren't restored.
-- **Code Claude pushed:** ctrl+z rewinds the commits locally, then asks whether to undo them on GitHub (or any remote) too. Yes pushes one new commit that undoes Claude's, made in a temporary worktree: no force push, no rewritten history, so it works on protected branches and for teammates who already pulled. Newer commits that clash, or a rewritten branch, stop it. A branch Claude created is deleted instead, if nobody has added to it. It uses the project's own git sign-in, so there's nothing to connect.
+- **Database commands Claude runs** (`supabase db push`, `supabase migration up`, `supabase db reset`, `psql`, `prisma migrate`, `drizzle-kit push`, seed scripts…): in a project whose Supabase database is connected, the whole database is noted before the command runs, and ctrl+u puts it back in one transaction: rows, new tables dropped, dropped or altered tables rebuilt with their constraints, indexes, foreign keys, row level security policies, triggers and grants, sequence counters, and the migration history. Copies sit in a `backstep` schema in the same database; the newest 10 per database are kept. On a very big database it keeps every table's structure and the migration history, and rows smallest-table-first up to a budget (`BACKSTEP_DB_SNAPSHOT_MB`, default 250); undo names any table whose rows it couldn't bring back. Functions, views, types and extensions aren't restored.
+- **Code Claude pushed:** ctrl+u rewinds the commits locally, then asks whether to undo them on GitHub (or any remote) too. Yes pushes one new commit that undoes Claude's, made in a temporary worktree: no force push, no rewritten history, so it works on protected branches and for teammates who already pulled. Newer commits that clash, or a rewritten branch, stop it. A branch Claude created is deleted instead, if nobody has added to it. It uses the project's own git sign-in, so there's nothing to connect.
 - **Things that can't be undone** (sending email, payments, deploys, `ALTER TABLE`…) run as normal and are marked in the journal, so you know what an undo didn't cover.
 - **Anything else, by rule:** a rules file maps a tool to its opposite (`create_issue` → close the issue, `send_message` → retract it), filled in from the call and its result. See [Undo rules](#undo-rules).
 - **Conflicts:** undoing an action first undoes any later action that touched the same file or table, so nothing gets silently thrown away.
@@ -20,7 +20,7 @@ Undo for everything your agents touch. Backstep sits between your agent (Claude
 npx backstep setup
 ```
 
-This installs Backstep, adds its Claude Code mod, binds **ctrl+z** to undo everything Claude did in its last turn, and puts the MCP servers you've already added to Claude Code behind Backstep, so their changes can be undone too. If you use Supabase, it asks for your database's connection string (Enter skips; you can ask Claude to connect it later). Restart Claude Code afterwards. Needs Node 22.13+ and Claude Code.
+This installs Backstep, adds its Claude Code mod, binds **ctrl+u** to undo everything Claude did in its last turn, and puts the MCP servers you've already added to Claude Code behind Backstep, so their changes can be undone too. If you use Supabase, it asks for your database's connection string (Enter skips; you can ask Claude to connect it later). Restart Claude Code afterwards. Needs Node 22.13+ and Claude Code.
 
 Servers in a repo's shared `.mcp.json` that you've approved get a wrapped copy for that project only; the repo's file is never edited. Remote servers that Claude Code signs in to stay as they are, and the mod watches their calls instead. Servers you add later are wrapped the next time Claude Code starts. `backstep unwrap` puts every server back the way it was and stops new ones being wrapped.
 
@@ -53,7 +53,7 @@ With Claude Code: `claude mcp add files -- backstep wrap --name files -- <the se
 | `--rules <file>` | undo rules (or set `BACKSTEP_RULES`) |
 | `--pg <url>` | the Postgres database the wrapped server writes to. Enables database undo. Without it, SQL writes are recorded but can't be undone. |
 
-The undo key is ⌘Z and ctrl+z on a Mac (⌘Z where the terminal passes it on, as Ghostty, Kitty and WezTerm do; Terminal.app and iTerm2 keep ⌘Z for their own menu) and ctrl+z elsewhere. The first press asks "Undo Claude's last turn?" above the prompt and a second press within 5 seconds undoes, so a stray press does nothing. Change the key whenever you like: ask Claude ("change my Backstep undo key to ctrl+u"), or run `backstep key ctrl+u`. The line above the prompt is always there, even with nothing to undo, because the key only reaches Backstep while it's on screen; otherwise ctrl+z would fall through to the terminal and suspend Claude Code.
+The undo key is ctrl+u (not ctrl+z: Claude Code suspends itself on ctrl+z in a terminal before anything else sees the key, so it can't be used). The first press asks "Undo Claude's last turn?" above the prompt and a second press within 5 seconds undoes, so a stray press does nothing. Change the key whenever you like: ask Claude ("change my Backstep undo key to ctrl+q"), or run `backstep key ctrl+q`. The line above the prompt is always there, even with nothing to undo, because the key only reaches Backstep while it's on screen; otherwise a press would do nothing.
 
 Backstep checks npm for a newer version as each Claude Code session starts and asks before updating (Update, Not now, or Skip this version; `backstep update` does it by hand, `BACKSTEP_UPDATE_CHECK=0` turns the check off).
 
@@ -76,7 +76,7 @@ For tools Backstep can't snapshot, a rule names the tool that undoes them. `{{ar
 ] }
 ```
 
-`server` is optional and matches `--name`. For claude.ai connectors and servers Claude Code signs in to, put rules in `~/.backstep/rules.json`; `server` is the name as it appears in tool names (`claude_ai_Notion`), and pressing ctrl+z runs the opposite call through Claude Code. A rule overrides the built-in guess, so a `send_message` with a retract rule is undoable. The undo runs through a live `backstep wrap` of that server; if none is running, the dashboard tells you to start it, and any running copy with the same `--name` picks up the request. `examples/rules.json` has GitHub rules as a starting point. Check the tool and argument names against your server's version.
+`server` is optional and matches `--name`. For claude.ai connectors and servers Claude Code signs in to, put rules in `~/.backstep/rules.json`; `server` is the name as it appears in tool names (`claude_ai_Notion`), and pressing ctrl+u runs the opposite call through Claude Code. A rule overrides the built-in guess, so a `send_message` with a retract rule is undoable. The undo runs through a live `backstep wrap` of that server; if none is running, the dashboard tells you to start it, and any running copy with the same `--name` picks up the request. `examples/rules.json` has GitHub rules as a starting point. Check the tool and argument names against your server's version.
 
 ## How it decides
 
@@ -101,7 +101,7 @@ Everything is journaled to `~/.backstep/journal.db` (SQLite, mode 0600; override
 - Undoing a table restore runs `DELETE` and then re-inserts rows, so foreign keys from other tables pointing at deleted rows can block it. The undo then fails cleanly inside a transaction.
 - `--pg` must point at the same database the wrapped server uses.
 - The dashboard only accepts requests from this machine. The journal stores the `--pg` URL so undo works later.
-- Remote servers that need an OAuth login can't be wrapped; they're watched from Claude Code instead, so their undo works with ctrl+z but not from the dashboard.
+- Remote servers that need an OAuth login can't be wrapped; they're watched from Claude Code instead, so their undo works with ctrl+u but not from the dashboard.
 - Shell snapshots cover the project folder (the git repository, or the folder Claude Code runs in). Files outside it, and ignored folders like `node_modules`, aren't saved: undo restores `package.json` and the lockfile, and you re-run the install.
 - Shell commands are judged before they run by what they look like, so a script that pushes or deploys from inside is snapshotted, not held.
 

package/dist/cli.js

@@ -53,7 +53,7 @@ function envHeaders() {
 }
 const HELP = `backstep: undo for everything your agents touch
 
-  backstep setup               install the Claude Code mod, bind ctrl+z to undo Claude's last turn,
+  backstep setup               install the Claude Code mod, bind ctrl+u to undo Claude's last turn,
                                and put your MCP servers behind Backstep
   backstep unwrap              take your MCP servers back out from behind Backstep
   backstep connect [supabase|firebase] [<access-token>|<connection-string>] [--project <ref>] [--dir <folder>] [--json]

package/dist/keys.js

@@ -1,17 +1,17 @@
 // The key that undoes Claude's last turn, in Claude Code's ~/.claude/keybindings.json.
 // The mod's undo button borrows a keybinding action only the diff panel uses
 // (mod buttons can't have actions of their own yet), and whatever key is bound
-// to it, in Global and Chat, presses the button. ctrl+z by default; the person
+// to it, in Global and Chat, presses the button. ctrl+u by default (ctrl+z can't
+// be: Claude Code suspends itself on it before any binding sees it); the person
 // can ask Claude for another, which runs `backstep key <key>`.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 export const UNDO_ACTION = "app:cycleDiffBase";
-export const DEFAULT_KEY = "ctrl+z";
-// A Mac gets ⌘Z too, where the terminal passes it on (Ghostty, Kitty, WezTerm,
-// Claude Code's desktop app); Terminal.app and iTerm2 keep ⌘Z for their own
-// Edit menu, so ctrl+z stays bound alongside it.
-export const defaultKeys = () => (process.platform === "darwin" ? ["cmd+z", DEFAULT_KEY] : [DEFAULT_KEY]);
+export const DEFAULT_KEY = "ctrl+u";
+// Bound by Backstep before it knew Claude Code suspends on it; moved to the default on update.
+export const OLD_KEY = "ctrl+z";
+export const defaultKeys = () => [DEFAULT_KEY];
 const CONTEXTS = ["Global", "Chat"];
 // Claude Code never hands these to anything else.
 const RESERVED = new Set(["ctrl+c", "ctrl+d", "ctrl+m", "ctrl+i", "ctrl+h", "ctrl+[", "ctrl+\\"]);
@@ -44,6 +44,8 @@ export function normalizeKey(raw) {
         throw new Error(`"${raw}" on its own would type a letter. Use a modifier, like ctrl+${last}`);
     if (RESERVED.has(key))
         throw new Error(`Claude Code keeps ${key} for itself. Pick another, like ctrl+u`);
+    if (key === OLD_KEY || key === "ctrl+shift+z")
+        throw new Error(`Claude Code suspends itself on ${key} in a terminal, before Backstep sees it. Pick another, like ctrl+u`);
     return key;
 }
 // Binds undo to `keys` (one, or several) and unbinds the old ones. Refuses a key that does something else, unless it was undo's.
@@ -86,3 +88,19 @@ export function setUndoKey(raw) {
 export function keyLabel(k) {
     return k.startsWith("cmd+") ? `⌘${k.slice(4).toUpperCase()}` : k;
 }
+// As setup runs: keeps a key the person picked, binds ctrl+u on a first
+// install, and moves an install that had ctrl+z onto it. Returns a problem to
+// show, or "".
+export function ensureUndoKey() {
+    const keys = undoKeys();
+    if (keys.length && !keys.includes(OLD_KEY))
+        return "";
+    const rest = keys.filter((k) => k !== OLD_KEY);
+    try {
+        setUndoKey(rest.length ? rest : defaultKeys());
+        return "";
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : String(err);
+    }
+}

package/dist/setup.js

@@ -3,7 +3,7 @@ import { cpSync, readFileSync, rmSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homeDir } from "./store.js";
-import { defaultKeys, keyLabel, setUndoKey, undoKey, undoKeys } from "./keys.js";
+import { defaultKeys, ensureUndoKey, keyLabel, undoKeys } from "./keys.js";
 import { createInterface } from "node:readline/promises";
 import { autoWrap, wrapServers } from "./servers.js";
 import { check, printCheck } from "./check.js";
@@ -29,18 +29,6 @@ function keepCopy() {
     cpSync(dirname(ROOT), modules, { recursive: true });
     return { root: join(modules, "backstep"), onPath: false };
 }
-// Keeps a key the person picked; on a first install binds ⌘Z and ctrl+z on a Mac, ctrl+z elsewhere.
-function bindUndoKey() {
-    if (undoKey())
-        return "";
-    try {
-        setUndoKey(defaultKeys());
-        return "";
-    }
-    catch (err) {
-        return err instanceof Error ? err.message : String(err);
-    }
-}
 const WHERE = `In Supabase, open your project, press Connect at the top, and copy the URI under
 "Direct connection" (or "Session pooler" if your network has no IPv6). Put your
 database password in place of [YOUR-PASSWORD].`;
@@ -80,7 +68,7 @@ export async function setup() {
     if (!r.ok)
         throw new Error(`claude plugin install failed:\n${r.out}`);
     // Only a problem is worth a line here; the summary below says the rest.
-    const bound = bindUndoKey();
+    const bound = ensureUndoKey();
     if (bound)
         console.log(`  ${white("!")} ${bound}`);
     // Wrap last, so a failed install never leaves servers pointing at a Backstep that isn't there.
@@ -89,7 +77,7 @@ export async function setup() {
     // What's covered and what isn't, said once here and kept up to date by `backstep status`.
     const key = (undoKeys().length ? undoKeys() : defaultKeys()).map(keyLabel).join(" or ");
     console.log(`\n  ${pink("✓")} ${white("Backstep is ready.")} Restart Claude Code, then press ${white(key)} after any turn to undo it.`);
-    console.log(dim(`    Want a different key? Just ask Claude: "change my Backstep undo key to ctrl+u"`));
+    console.log(dim(`    Want a different key? Just ask Claude: "change my Backstep undo key to ctrl+q"`));
     printCheck(check(process.cwd()), bs);
     if (telemetryOn()) {
         console.log(dim("  Sends an anonymous install count. Turn it off with BACKSTEP_TELEMETRY=0.\n"));

package/dist/undo.js

@@ -111,7 +111,7 @@ async function undoInverse(store, a, u) {
 // Claude Code reports back how the call went with `backstep settle`.
 function undoEngine(store, a, u, opts) {
     if (!opts.viaClaudeCode) {
-        return { id: a.id, tool: a.tool, ok: false, detail: `undo this with ctrl+z in Claude Code: only it is connected to ${u.server}` };
+        return { id: a.id, tool: a.tool, ok: false, detail: `undo this from Claude Code (ctrl+u): only it is connected to ${u.server}` };
     }
     if (!store.transition(a.id, a.status, "undo_requested")) {
         return { id: a.id, tool: a.tool, ok: false, detail: "this action changed while undoing; try again" };

package/dist/update.js

@@ -51,17 +51,39 @@ export function skipVersion(v) {
     mkdirSync(homeDir(), { recursive: true });
     writeFileSync(file(), JSON.stringify({ ...settings(), skipVersion: v }, null, 2) + "\n");
 }
+// What went wrong, in a line a person can act on: npm's own reason, not its
+// pointer to a log file.
+export function npmReason(out) {
+    if (/ETARGET|notarget|No matching version/i.test(out))
+        return "npm hasn't finished publishing it yet. Try again in a few minutes";
+    if (/ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ETIMEDOUT|network/i.test(out))
+        return "couldn't reach npm. Check your internet connection";
+    if (/EACCES|permission denied/i.test(out))
+        return "npm wasn't allowed to install it (a permissions problem with npm's global folder)";
+    const lines = out.split("\n").map((l) => l.trim()).filter((l) => l && !/complete log of this run|^npm (error|ERR!)\s*$/i.test(l));
+    return (lines.find((l) => /^backstep:/.test(l)) ?? lines.findLast((l) => /error/i.test(l)) ?? lines.at(-1) ?? "npx failed").replace(/^(backstep:|npm (error|ERR!))\s*/i, "");
+}
+const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 // The new version's setup puts its own copy in place, points Claude Code's mod
-// at it and re-wraps servers, exactly as a fresh install would.
-export function runUpdate(v) {
-    const r = spawnSync("npx", ["-y", `backstep@${v}`, "setup"], {
-        encoding: "utf8",
-        timeout: 5 * 60 * 1000,
-        env: { ...process.env, NO_COLOR: "1", BACKSTEP_TELEMETRY: "0" },
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    if (r.status === 0)
-        return { ok: true, detail: `updated to ${v}` };
-    const why = `${r.stderr ?? ""}${r.stdout ?? ""}`.trim().split("\n").filter(Boolean).at(-1) ?? "npx failed";
-    return { ok: false, detail: why.replace(/^backstep: /, "") };
+// at it and re-wraps servers, exactly as a fresh install would. npm is asked
+// online, never from its cache, which can be older than a version just
+// published; and asked again for a while if it still hasn't heard of it.
+export function runUpdate(v, tries = 4) {
+    let out = "";
+    for (let i = 0; i < tries; i++) {
+        if (i)
+            pause(15_000);
+        const r = spawnSync("npx", ["-y", "--prefer-online", `backstep@${v}`, "setup"], {
+            encoding: "utf8",
+            timeout: 5 * 60 * 1000,
+            env: { ...process.env, NO_COLOR: "1", BACKSTEP_TELEMETRY: "0" },
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        if (r.status === 0)
+            return { ok: true, detail: `updated to ${v}` };
+        out = `${r.stderr ?? ""}\n${r.stdout ?? ""}`;
+        if (!/ETARGET|notarget|No matching version/i.test(out))
+            break;
+    }
+    return { ok: false, detail: npmReason(out) };
 }

package/mod/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "backstep",
-  "version": "0.1.0",
+  "version": "0.1.6",
   "description": "Press ctrl+z to rewind everything Claude did in its last turn: file edits, shell commands, and database and tool changes.",
   "types": "./types/index.d.ts",
   "userConfig": {

package/mod/hooks/register.test.tsx

@@ -119,7 +119,7 @@ test('a change that cannot be undone stops the rewind and says so', { options: {
   expect(prompts).toHaveLength(1)
 })
 
-test('with nothing to undo the band still holds the key, so ctrl+z never suspends Claude Code', async ($, on) => {
+test('with nothing to undo the band still holds the key, and a press says there is nothing to undo', async ($, on) => {
   engine(on, { exitCode: 0, stdout: '[]' })
   const toasts: string[] = []
   on('ui.toast', (_, e) => {
@@ -502,7 +502,7 @@ test('asking Claude to change the undo key rebinds it and relabels the band', {
   const runs: string[][] = []
   on('process.run', (_, e) => {
     runs.push([...e.argv])
-    const stdout = e.argv.includes('key') ? JSON.stringify({ ok: true, key: 'ctrl+u', previous: 'ctrl+z' }) : '[]'
+    const stdout = e.argv.includes('key') ? JSON.stringify({ ok: true, key: 'ctrl+q', previous: 'ctrl+u' }) : '[]'
     return { value: { exitCode: 0, stdout, stderr: '', isStdoutTruncated: false, isStderrTruncated: false } }
   })
   on('ui.toast', () => ({ value: undefined }))
@@ -510,11 +510,11 @@ test('asking Claude to change the undo key rebinds it and relabels the band', {
     const { Text } = $.ui.resolve(e)
     return <Text>engine</Text>
   })
-  const r = await $.tool.call({ tool: 'mcp__backstep__undo_key', key: 'Ctrl + U' } as never)
-  expect(runs[0].slice(3)).toEqual(['key', 'Ctrl + U', '--json'])
-  expect(r.result).toBe('Undo is now ctrl+u (it was ctrl+z). It works right away.')
+  const r = await $.tool.call({ tool: 'mcp__backstep__undo_key', key: 'Ctrl + Q' } as never)
+  expect(runs[0].slice(3)).toEqual(['key', 'Ctrl + Q', '--json'])
+  expect(r.result).toBe('Undo is now ctrl+q (it was ctrl+u). It works right away.')
   const ui = await $.ui.mount({ ...BAND, surface: 'terminal' })
-  expect((await ui.find({ type: 'Button', key: 'undo' }))?.text).toBe('ctrl+u to undo')
+  expect((await ui.find({ type: 'Button', key: 'undo' }))?.text).toBe('ctrl+q to undo')
   await ui.unmount()
 })
 
@@ -528,7 +528,7 @@ test('one press only asks; it lets go after a few seconds, or on cancel, and und
 
   await ui.press({ key: 'undo' })
   expect((await ui.find({ type: 'Text', text: /Undo Claude's last turn\?/ }))).toBeTruthy()
-  expect((await ui.find({ type: 'Button', key: 'undo' }))?.text).toBe('ctrl+z again to undo')
+  expect((await ui.find({ type: 'Button', key: 'undo' }))?.text).toBe('ctrl+u again to undo')
   await clock.advance(6000)
   expect((await ui.find({ type: 'Text', text: /Last turn/ }))).toBeTruthy()
 
@@ -541,9 +541,9 @@ test('one press only asks; it lets go after a few seconds, or on cancel, and und
   await ui.unmount()
 })
 
-test('on a Mac the band names both keys', { options: { cli: CLI } }, async ($, on) => {
+test('with two keys bound the band names both', { options: { cli: CLI } }, async ($, on) => {
   on('process.run', (_, e) => {
-    const stdout = e.argv.includes('key') ? JSON.stringify({ key: 'cmd+z', keys: ['cmd+z', 'ctrl+z'] }) : '[]'
+    const stdout = e.argv.includes('key') ? JSON.stringify({ key: 'ctrl+u', keys: ['ctrl+u', 'ctrl+q'] }) : '[]'
     return { value: { exitCode: 0, stdout, stderr: '', isStdoutTruncated: false, isStderrTruncated: false } }
   })
   const logs: string[] = []
@@ -559,8 +559,8 @@ test('on a Mac the band names both keys', { options: { cli: CLI } }, async ($, o
     return <Text>engine</Text>
   })
   await $.session.start({ cwd: '/repo', surface: 'terminal', hasPerson: true } as never)
-  expect(logs[0]).toContain('press ⌘Z / ctrl+z to undo')
+  expect(logs[0]).toContain('press ctrl+u / ctrl+q to undo')
   const ui = await $.ui.mount({ ...BAND, surface: 'terminal' })
-  expect((await ui.find({ type: 'Button', key: 'undo' }))?.text).toBe('⌘Z / ctrl+z to undo')
+  expect((await ui.find({ type: 'Button', key: 'undo' }))?.text).toBe('ctrl+u / ctrl+q to undo')
   await ui.unmount()
 })

package/mod/hooks/register.tsx

@@ -1,6 +1,6 @@
 // Backstep for Claude Code: snapshot every file Claude is about to change,
 // and the whole project before each shell command, and rewind its whole last
-// turn with one key (ctrl+z) and a short animation above the prompt. Database
+// turn with one key (ctrl+u) and a short animation above the prompt. Database
 // and tool changes made through servers wrapped by `backstep wrap`, and
 // Supabase changes over a connected database, rewind with it, by the turn's
 // time window.
@@ -18,7 +18,7 @@ const CONFIRM_MS = 5000
 
 // The engine has no keybinding actions of its own for plugins yet, so the undo
 // button borrows one that only the diff panel handles; ~/.claude/keybindings.json
-// binds ctrl+z to it everywhere else.
+// binds ctrl+u to it everywhere else.
 const UNDO_ACTION = 'app:cycleDiffBase'
 const EDIT_TOOLS = new Set(['Edit', 'Write', 'NotebookEdit'])
 const KEEP_TURNS = 30
@@ -276,7 +276,7 @@ type ShellPlan = { kind: 'read' | 'write' | 'outbound'; reason?: string; id?: st
 // Set from the plugin's options each time the module registers.
 let cli = 'backstep'
 // The keys bound to undo, read as a session starts and when the person changes them.
-let undoKeys = ['ctrl+z']
+let undoKeys = ['ctrl+u']
 const keyLabel = (k: string) => (k.startsWith('cmd+') ? `⌘${k.slice(4).toUpperCase()}` : k)
 const keysLabel = () => undoKeys.map(keyLabel).join(' / ')
 
@@ -320,7 +320,7 @@ async function wrapNewServers($: EngineInterface, cwd: string) {
 
 // As a session starts: connects what the project's own settings allow, then
 // says what Claude reaches that Backstep could undo once connected, so nobody
-// presses ctrl+z expecting it to come back.
+// presses undo expecting it to come back.
 async function checkCoverage($: EngineInterface, cwd: string) {
   // Supabase is only ever noticed here, never connected: that's the person's
   // call. Firebase is added once someone is signed in to it.
@@ -403,7 +403,7 @@ async function offerUpdate($: EngineInterface) {
   if (answer !== UPDATE.yes) return
   $.ui.toast(`Updating Backstep to ${u.latest}…`)
   const done = await $.process
-    .run(backstep(['update', '--version', u.latest, '--json']), { timeoutMs: 300_000 })
+    .run(backstep(['update', '--version', u.latest, '--json']), { timeoutMs: 600_000 })
     .catch((err: unknown) => ({ exitCode: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) }))
   let r: { ok: boolean; detail: string } = { ok: false, detail: (done.stderr || 'it failed').trim().split('\n').at(-1) ?? 'it failed' }
   try {
@@ -419,13 +419,13 @@ const KEY = 'mcp__backstep__undo_key'
 const KEY_TOOL = {
   name: 'undo_key',
   description:
-    "Change the key that undoes Claude's last turn with Backstep (⌘Z and ctrl+z on a Mac, ctrl+z elsewhere, unless the user changed it). " +
+    "Change the key that undoes Claude's last turn with Backstep (ctrl+u unless the user changed it; ctrl+z can't be used, Claude Code suspends on it). " +
     'Use it when the user asks to change, rebind or pick a different Backstep or undo shortcut. ' +
     'Keys are written like ctrl+u, cmd+z (⌘ on a Mac; most Mac terminals keep ⌘ keys for themselves, so pair it with a ctrl key), meta+z (Option) or ctrl+shift+z. ' +
     'Several keys can share undo: separate them with commas. It takes effect right away, no restart.',
   inputSchema: {
     type: 'object',
-    properties: { key: { type: 'string', description: 'the new key, like ctrl+u, or several separated by commas, like "cmd+z, ctrl+z"' } },
+    properties: { key: { type: 'string', description: 'the new key, like ctrl+u, or several separated by commas, like "ctrl+u, ctrl+q"' } },
     required: ['key'],
   },
 }
@@ -452,7 +452,7 @@ const CONNECT = 'mcp__backstep__connect'
 const CONNECT_TOOL = {
   name: 'connect',
   description:
-    "Connect Backstep (the undo for this session's changes) to the services the project uses, so changes Claude makes to them can be undone with ctrl+z. " +
+    "Connect Backstep (the undo for this session's changes) to the services the project uses, so changes Claude makes to them can be undone with ctrl+u. " +
     'Use it when the user asks to connect Backstep, or to make their database or Firebase undoable. ' +
     "Supabase: finds the database's connection string in the project's .env files or its local `supabase start` database. " +
     'When it reports it needs a sign-in, tell the user how to make an access token (it says where), ask them to paste it, then call this again with connection_string. ' +
@@ -640,7 +640,7 @@ export const register: Register = (on, options) => {
 
     // Idle: a quiet line naming what one press would take back. It's always
     // there, because the button has to be on screen for the key to reach it;
-    // without it, ctrl+z falls through to the terminal and suspends Claude Code.
+    // with nothing to undo, a press says so rather than doing nothing.
     return (
       <Box>
         <Text color="success">↺ </Text>

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "backstep",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Undo for everything your agents touch: an MCP proxy that makes agent actions reversible.",
   "scripts": {
     "dev": "node src/cli.ts",
     "ui": "node --disable-warning=ExperimentalWarning src/cli.ts ui",
     "demo": "node --disable-warning=ExperimentalWarning examples/demo-db.ts",
-    "build": "tsc -p tsconfig.json && cp src/ui/index.html dist/ui/index.html && chmod +x dist/cli.js",
+    "build": "tsc -p tsconfig.json && cp src/ui/index.html dist/ui/index.html && chmod +x dist/cli.js && node -e \"const f='mod/.claude-plugin/plugin.json',p=JSON.parse(require('fs').readFileSync(f));p.version=require('./package.json').version;require('fs').writeFileSync(f,JSON.stringify(p,null,2)+'\\\\n')\"",
     "test": "node --disable-warning=ExperimentalWarning --test test/*.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },