backstep 0.1.9 → 0.1.13

package/README.md

@@ -10,7 +10,11 @@ Undo for everything your agents touch. Backstep sits between your agent (Claude
 - **claude.ai connectors and servers Claude Code signs in to:** Backstep can't sit in front of these, so the Claude Code mod watches their calls instead. Calls with an undo rule are undone through Claude Code's own connection.
 - **Database commands Claude runs** (`supabase db push`, `supabase migration up`, `supabase db reset`, `psql`, `prisma migrate`, `drizzle-kit push`, seed scripts…): in a project whose Supabase database is connected, the whole database is noted before the command runs, and ctrl+u puts it back in one transaction: rows, new tables dropped, dropped or altered tables rebuilt with their constraints, indexes, foreign keys, row level security policies, triggers and grants, sequence counters, and the migration history. Copies sit in a `backstep` schema in the same database; the newest 10 per database are kept. On a very big database it keeps every table's structure and the migration history, and rows smallest-table-first up to a budget (`BACKSTEP_DB_SNAPSHOT_MB`, default 250); undo names any table whose rows it couldn't bring back. Functions, views, types and extensions aren't restored.
 - **Supabase through its web API** (curl to `/rest/v1`, seed and app scripts using supabase-js): Backstep finds Supabase projects in the folder Claude Code opened or a level or two below, and the first time Claude is about to change one that isn't connected, it asks before the command runs. Connect uses the project's own `SUPABASE_URL` and service role key from its `.env`, no password: every table's rows are saved on this machine before each such command (smallest first, up to the size budget), and ctrl+u removes rows added since and writes back the old ones. Table changes need the database itself connected (password or access token).
+- **Any Postgres database** (Neon, Railway, Render, AWS, a local one) named in the project's `.env` (`DATABASE_URL` and the like): Backstep asks once, then saves the whole database before Claude's database commands (`psql`, `prisma migrate`, `drizzle-kit push`, seed and app scripts) and puts it back on undo, the same way as Supabase.
+- **SQLite files** in the project (`dev.db`, `*.sqlite`), git-ignored ones included: copied before commands that could change them and restored on undo; a database file made since is removed.
+- **Firebase data changed outside its MCP server** (`firebase firestore:delete`, `firebase database:set`, firebase-admin scripts, curl to Firestore): Backstep asks once and connects with the project's service account key (or gcloud's application default login). Before such a command, Firestore's documents (top-level collections first, then subcollections, up to the size budget) and the Realtime Database are saved; undo deletes documents added since, writes back changed or deleted ones, and puts the Realtime Database back.
 - **Code Claude pushed:** ctrl+u rewinds the commits locally, then asks whether to undo them on GitHub (or any remote) too. Yes pushes one new commit that undoes Claude's, made in a temporary worktree: no force push, no rewritten history, so it works on protected branches and for teammates who already pulled. Newer commits that clash, or a rewritten branch, stop it. A branch Claude created is deleted instead, if nobody has added to it. It uses the project's own git sign-in, so there's nothing to connect.
+- **Things Claude makes on GitHub with `gh`** (a repository, an issue, a pull request, a release): after undo, Backstep asks whether to take each one away there too (delete the repository or release, close the pull request, delete or close the issue), using your own gh sign-in. Deleting a repository needs gh's `delete_repo` permission; if it's missing, Backstep says how to grant it.
 - **Things that can't be undone** (sending email, payments, deploys, `ALTER TABLE`…) run as normal and are marked in the journal, so you know what an undo didn't cover.
 - **Anything else, by rule:** a rules file maps a tool to its opposite (`create_issue` → close the issue, `send_message` → retract it), filled in from the call and its result. See [Undo rules](#undo-rules).
 - **Conflicts:** undoing an action first undoes any later action that touched the same file or table, so nothing gets silently thrown away.

package/dist/adapters/firestore.js

@@ -0,0 +1,160 @@
+// Firebase undo for shell commands (`firebase firestore:delete`, `firebase
+// database:set`, scripts using firebase-admin, curl to Firestore), signed in
+// with the project's service account or Google's application default login.
+// Before such a command, Firestore's documents (top-level collections first,
+// then subcollections, up to the size budget) and the Realtime Database's tree
+// are kept on this machine; undo deletes documents added since and writes the
+// old ones back, and puts the Realtime Database back as it was.
+import { createSign } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { snapshotDir } from "../store.js";
+const FIRESTORE = () => process.env.BACKSTEP_FIRESTORE_API ?? "https://firestore.googleapis.com/v1";
+const TOKEN_URL = () => process.env.BACKSTEP_GOOGLE_TOKEN_URL ?? "https://oauth2.googleapis.com/token";
+const SCOPES = "https://www.googleapis.com/auth/datastore https://www.googleapis.com/auth/firebase.database https://www.googleapis.com/auth/userinfo.email";
+const budget = () => Number(process.env.BACKSTEP_DB_SNAPSHOT_MB ?? 250) * 1024 * 1024;
+const MAX_DOCS = 50_000;
+const b64 = (s) => Buffer.from(s).toString("base64url");
+export async function accessToken(creds) {
+    let body;
+    if (creds.type === "service_account") {
+        const now = Math.floor(Date.now() / 1000);
+        const head = b64(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+        const claims = b64(JSON.stringify({ iss: creds.client_email, scope: SCOPES, aud: TOKEN_URL(), iat: now, exp: now + 3600 }));
+        const sig = createSign("RSA-SHA256").update(`${head}.${claims}`).sign(creds.private_key);
+        body = new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: `${head}.${claims}.${b64(sig)}` });
+    }
+    else {
+        body = new URLSearchParams({ grant_type: "refresh_token", client_id: creds.client_id, client_secret: creds.client_secret, refresh_token: creds.refresh_token });
+    }
+    const r = await fetch(TOKEN_URL(), { method: "POST", body, signal: AbortSignal.timeout(20_000) });
+    if (!r.ok)
+        throw new Error(`Google refused the Firebase sign-in (${r.status})`);
+    return (await r.json()).access_token;
+}
+export const loadCreds = (file) => JSON.parse(readFileSync(file, "utf8"));
+async function call(token, url, init = {}) {
+    const r = await fetch(url, {
+        ...init,
+        headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init.headers },
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!r.ok && r.status !== 404)
+        throw new Error(`Firebase said ${r.status}: ${(await r.text()).slice(0, 200)}`);
+    return r;
+}
+const root = (project) => `${FIRESTORE()}/projects/${project}/databases/(default)/documents`;
+async function collectionIds(token, parent) {
+    const out = [];
+    let pageToken;
+    do {
+        const r = await call(token, `${parent}:listCollectionIds`, { method: "POST", body: JSON.stringify({ pageSize: 300, ...(pageToken ? { pageToken } : {}) }) });
+        if (r.status === 404)
+            return out;
+        const j = (await r.json());
+        out.push(...(j.collectionIds ?? []));
+        pageToken = j.nextPageToken;
+    } while (pageToken);
+    return out;
+}
+async function documents(token, project, path) {
+    const out = [];
+    let pageToken;
+    do {
+        const r = await call(token, `${root(project)}/${path}?pageSize=300${pageToken ? `&pageToken=${encodeURIComponent(pageToken)}` : ""}`);
+        if (r.status === 404)
+            return out;
+        const j = (await r.json());
+        out.push(...(j.documents ?? []).map((d) => ({ name: d.name, fields: d.fields ?? {} })));
+        pageToken = j.nextPageToken;
+    } while (pageToken);
+    return out;
+}
+const docPath = (project, name) => name.slice(name.indexOf("/documents/") + 11);
+export async function snapshotFirebase(actionId, conn) {
+    const token = await accessToken(loadCreds(conn.credsFile));
+    const dir = join(snapshotDir(actionId), "firebase");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const out = { adapter: "firebase", project: conn.project, collections: [], skipped: [], rtdb: null };
+    let spent = 0;
+    let count = 0;
+    // Top-level collections first, then deeper ones, so a big database keeps the most important first.
+    const queue = (await collectionIds(token, root(conn.project))).map((c) => c);
+    while (queue.length) {
+        const path = queue.shift();
+        const docs = await documents(token, conn.project, path);
+        const data = JSON.stringify(docs);
+        if (spent + data.length > budget() || count + docs.length > MAX_DOCS) {
+            out.skipped.push(path);
+            continue;
+        }
+        spent += data.length;
+        count += docs.length;
+        const file = join(dir, `${out.collections.length}.json`);
+        writeFileSync(file, data, { mode: 0o600 });
+        out.collections.push({ path, file });
+        for (const d of docs)
+            for (const sub of await collectionIds(token, d.name.startsWith("http") ? d.name : `${FIRESTORE()}/${d.name}`))
+                queue.push(`${docPath(conn.project, d.name)}/${sub}`);
+    }
+    if (conn.rtdb) {
+        const r = await call(token, `${conn.rtdb.replace(/\/$/, "")}/.json`);
+        if (r.ok) {
+            const tree = await r.text();
+            if (spent + tree.length <= budget()) {
+                const file = join(dir, "rtdb.json");
+                writeFileSync(file, tree, { mode: 0o600 });
+                out.rtdb = { url: conn.rtdb, file };
+            }
+            else
+                out.skipped.push("the Realtime Database");
+        }
+    }
+    return out;
+}
+const same = (a, b) => JSON.stringify(a.fields ?? {}) === JSON.stringify(b.fields ?? {});
+export async function undoFirebase(u, credsFile) {
+    const token = await accessToken(loadCreds(credsFile));
+    const writes = [];
+    const log = [];
+    const kept = new Set(u.collections.map((c) => c.path));
+    // Top-level collections Claude made since: their documents go.
+    for (const c of await collectionIds(token, root(u.project))) {
+        if (kept.has(c) || u.skipped.includes(c))
+            continue;
+        const docs = await documents(token, u.project, c);
+        for (const d of docs)
+            writes.push({ delete: d.name });
+        if (docs.length)
+            log.push(`removed ${docs.length} documents from the new collection ${c}`);
+    }
+    for (const c of u.collections) {
+        const was = JSON.parse(readFileSync(c.file, "utf8"));
+        const now = await documents(token, u.project, c.path);
+        const before = new Map(was.map((d) => [d.name, d]));
+        const after = new Map(now.map((d) => [d.name, d]));
+        const del = now.filter((d) => !before.has(d.name));
+        const put = was.filter((d) => !after.has(d.name) || !same(after.get(d.name), d));
+        for (const d of del)
+            writes.push({ delete: d.name });
+        for (const d of put)
+            writes.push({ update: { name: d.name, fields: d.fields ?? {} } });
+        const parts = [put.length ? `put back ${put.length} documents` : "", del.length ? `removed ${del.length} new documents` : ""].filter(Boolean);
+        if (parts.length)
+            log.push(`${c.path}: ${parts.join(", ")}`);
+    }
+    for (let i = 0; i < writes.length; i += 500) {
+        await call(token, `${root(u.project)}:commit`, { method: "POST", body: JSON.stringify({ writes: writes.slice(i, i + 500) }) });
+    }
+    if (u.rtdb && existsSync(u.rtdb.file)) {
+        const was = readFileSync(u.rtdb.file, "utf8");
+        const now = await (await call(token, `${u.rtdb.url.replace(/\/$/, "")}/.json`)).text();
+        if (now !== was) {
+            await call(token, `${u.rtdb.url.replace(/\/$/, "")}/.json`, { method: "PUT", body: was });
+            log.push("put the Realtime Database back as it was");
+        }
+    }
+    for (const s of u.skipped)
+        log.push(`couldn't put back ${s}: it was too big to copy`);
+    return log.length ? log.join("\n") : "nothing had changed in Firebase";
+}

package/dist/adapters/tree.js

@@ -4,11 +4,103 @@
 // is noted. Git stores only what changed, so this stays fast on big projects.
 // Undo puts the folder and the git state back the way they were.
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { homeDir, snapshotDir } from "../store.js";
+const SQLITE_BUDGET = () => Number(process.env.BACKSTEP_DB_SNAPSHOT_MB ?? 250) * 1024 * 1024;
+const SKIP_DIRS = /^(node_modules|\.git|\.next|\.nuxt|\.turbo|\.cache|dist|build|out|coverage|\.venv|venv|__pycache__)$/;
+function isSqlite(path) {
+    try {
+        const fd = openSync(path, "r");
+        const head = Buffer.alloc(16);
+        readSync(fd, head, 0, 16, 0);
+        closeSync(fd);
+        return head.toString("latin1") === "SQLite format 3\0";
+    }
+    catch {
+        return false;
+    }
+}
+// SQLite database files in a project, four folders deep at most.
+export function sqliteFiles(root) {
+    const out = [];
+    const walk = (dir, depth) => {
+        let entries = [];
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const p = join(dir, e.name);
+            if (e.isDirectory()) {
+                if (depth > 0 && !SKIP_DIRS.test(e.name))
+                    walk(p, depth - 1);
+            }
+            else if (/\.(db|sqlite3?|db3)$/i.test(e.name) && isSqlite(p))
+                out.push(p);
+        }
+    };
+    walk(root, 4);
+    return out;
+}
+export function snapshotSqlite(actionId, root) {
+    const dir = join(snapshotDir(actionId), "sqlite");
+    const files = [];
+    const skipped = [];
+    let spent = 0;
+    for (const path of sqliteFiles(root)) {
+        // A database's write-ahead log goes with it.
+        for (const p of [path, `${path}-wal`, `${path}-shm`]) {
+            if (!existsSync(p)) {
+                if (p === path)
+                    files.push({ path, copy: null });
+                continue;
+            }
+            const size = statSync(p).size;
+            if (spent + size > SQLITE_BUDGET()) {
+                if (p === path)
+                    skipped.push(path);
+                continue;
+            }
+            spent += size;
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+            const copy = join(dir, `${files.length}`);
+            copyFileSync(p, copy);
+            files.push({ path: p, copy });
+        }
+    }
+    return { files, ...(skipped.length ? { budgetSkipped: skipped } : {}) };
+}
+function undoSqlite(u, root) {
+    const lines = [];
+    const had = new Set(u.files.map((f) => f.path));
+    for (const f of u.files) {
+        if (f.copy) {
+            copyFileSync(f.copy, f.path);
+            if (!f.path.endsWith("-wal") && !f.path.endsWith("-shm"))
+                lines.push(`restored the database ${f.path}`);
+        }
+    }
+    // Write-ahead logs made since would replay newer writes over the restored file.
+    for (const f of u.files) {
+        for (const side of ["-wal", "-shm"])
+            if (!f.path.endsWith(side) && !had.has(f.path + side) && existsSync(f.path + side))
+                rmSync(f.path + side);
+    }
+    for (const p of sqliteFiles(root)) {
+        if (had.has(p))
+            continue;
+        rmSync(p);
+        lines.push(`removed the new database ${p}`);
+    }
+    for (const p of u.budgetSkipped ?? [])
+        lines.push(`couldn't put back the database ${p}: it was too big to copy`);
+    return lines;
+}
 const TIMEOUT_MS = 20_000;
 // Too big to copy and rebuilt by a command anyway. A project's own .gitignore is honoured too.
 const EXCLUDE = ["node_modules/", ".venv/", "venv/", "__pycache__/", ".next/", ".nuxt/", ".turbo/", ".cache/", ".DS_Store"];
@@ -53,7 +145,10 @@ function shadowFor(root) {
         mkdirSync(gitDir, { recursive: true, mode: 0o700 });
         git(["init", "--bare", "--quiet", gitDir], { cwd: root });
         mkdirSync(join(gitDir, "info"), { recursive: true });
-        writeFileSync(join(gitDir, "info", "exclude"), EXCLUDE.join("\n") + "\n");
+        // Backstep's own folder, when it sits inside the project, holds the live journal: never snapshotted.
+        const own = relative(root, resolve(homeDir()));
+        const skipOwn = own && !own.startsWith("..") && !isAbsolute(own) ? [`/${own}/`] : [];
+        writeFileSync(join(gitDir, "info", "exclude"), [...EXCLUDE, ...skipOwn].join("\n") + "\n");
         writeFileSync(join(gitDir, "description"), `Backstep snapshots of ${root}\n`);
     }
     return gitDir;
@@ -146,6 +241,8 @@ export function undoTree(u, actionId) {
         // The diff reads from the snapshot to now: A was made since, so it's removed.
         lines.push(`${status === "A" ? "removed" : "restored"} ${join(root, path)}`);
     }
+    if (u.sqlite)
+        lines.push(...undoSqlite(u.sqlite, root));
     if (u.git) {
         const now = tryGit(["for-each-ref", "--format=%(refname)", "refs/heads", "refs/tags"], root) ?? "";
         for (const name of now.split("\n").filter(Boolean)) {

package/dist/cli.js

@@ -6,26 +6,42 @@ import { startUi } from "./ui/server.js";
 import { Store, snapshotDir } from "./store.js";
 import { pruneDatabaseCopies, undoAction, undoRun, undoSince } from "./undo.js";
 import { snapshotPaths } from "./adapters/fs.js";
-import { notePushed, snapshotTree } from "./adapters/tree.js";
+import { notePushed, snapshotSqlite, snapshotTree } from "./adapters/tree.js";
 import { revertPush } from "./push.js";
+import { ghMade, grantScope, undoGh } from "./github.js";
 import { snapshotDb } from "./adapters/dbsnap.js";
-import { projectConnected, projectDatabases, restKeys, supabaseDirs } from "./connect.js";
+import { dbDirs, firebaseProject, postgresUrls, projectDatabases, projectUses, restKeys, supabaseDirs, unconnected } from "./connect.js";
+import { snapshotFirebase } from "./adapters/firestore.js";
 import { snapshotRest } from "./adapters/rest.js";
 const PUSH = /\bgit\b[^;&|]*\bpush\b/;
-import { classifyShell, commandDir, supabaseTarget, touchesDatabase, touchesSupabase } from "./shell.js";
+import { classifyShell, commandDir, supabaseTarget, touchesDatabase, touchesFirebase, touchesSqlite, touchesSupabase } from "./shell.js";
 import { watchEnd, watchStart } from "./watch.js";
 import { sendActive } from "./telemetry.js";
 import { readFileSync, rmSync } from "node:fs";
 import { loadRules } from "./rules.js";
 import { setup } from "./setup.js";
 import { autoWrap, printChanges, unwrapServers, wrapServers } from "./servers.js";
-import { disconnectSupabase, dismissSupabase, restKey, supabaseDismissed } from "./supabase.js";
+import { disconnectSupabase, dismissSupabase, firebaseConn, postgresUrl, restKey } from "./supabase.js";
 // The Supabase projects a shell command could change: those in the folder it
 // works in (or a level or two below), when the command is one that reaches a database.
 function reachedProjects(command, cwd) {
     const dirs = supabaseDirs(commandDir(command, cwd));
     return touchesDatabase(command) || touchesSupabase(command, dirs.length > 0) ? dirs : [];
 }
+// Every database a shell command could change, by folder: Supabase, other Postgres, Firebase.
+function reachedDatabases(command, cwd) {
+    const out = [];
+    for (const d of reachedProjects(command, cwd))
+        out.push({ dir: d, service: "supabase" });
+    for (const d of dbDirs(commandDir(command, cwd))) {
+        const u = projectUses(d);
+        if (u.postgres && (touchesDatabase(command) || touchesSupabase(command, true)))
+            out.push({ dir: d, service: "postgres" });
+        if (u.firebase && touchesFirebase(command, true))
+            out.push({ dir: d, service: "firebase" });
+    }
+    return out;
+}
 import { connect } from "./connect.js";
 import { check, printCheck } from "./check.js";
 import { logo } from "./look.js";
@@ -178,11 +194,12 @@ async function main() {
             },
         });
         const [service, given] = positionals;
-        if (service && service !== "supabase" && service !== "firebase")
-            throw new Error(`can't connect "${service}": Backstep connects supabase and firebase`);
+        if (service && service !== "supabase" && service !== "firebase" && service !== "postgres") {
+            throw new Error(`can't connect "${service}": Backstep connects supabase, postgres and firebase`);
+        }
         // "Don't ask for this project", from the question the Claude Code mod asks.
         if (values.dismiss) {
-            dismissSupabase(values.dir ?? process.cwd());
+            dismissSupabase(values.dir ?? process.cwd(), service ?? "supabase");
             return;
         }
         const opts = {
@@ -356,7 +373,31 @@ async function main() {
         const dbs = [];
         const rests = [];
         const missed = [];
-        for (const d of reachedProjects(command, cwd)) {
+        const fbs = [];
+        for (const { dir: d, service } of reachedDatabases(command, cwd)) {
+            if (service === "postgres") {
+                for (const url of postgresUrls(d).filter((u) => postgresUrl(u))) {
+                    try {
+                        dbs.push(await snapshotDb(a.id, url));
+                    }
+                    catch (err) {
+                        missed.push(err instanceof Error ? err.message : String(err));
+                    }
+                }
+                continue;
+            }
+            if (service === "firebase") {
+                const conn = firebaseConn(firebaseProject(d) ?? "");
+                if (conn) {
+                    try {
+                        fbs.push(await snapshotFirebase(a.id, conn));
+                    }
+                    catch (err) {
+                        missed.push(err instanceof Error ? err.message : String(err));
+                    }
+                }
+                continue;
+            }
             const urls = await projectDatabases(d, supabaseTarget(command));
             for (const url of urls) {
                 try {
@@ -376,12 +417,14 @@ async function main() {
                 }
             }
         }
-        const extra = { ...(dbs.length ? { dbs } : {}), ...(rests.length ? { rests } : {}) };
-        const undo = tree ? { ...tree, ...extra } : dbs.length || rests.length ? { adapter: "dbs", dbs, rests } : null;
+        // SQLite files in the project, even git-ignored ones, which the project snapshot leaves out.
+        const sqlite = tree && touchesSqlite(command) ? snapshotSqlite(a.id, tree.root) : null;
+        const extra = { ...(dbs.length ? { dbs } : {}), ...(rests.length ? { rests } : {}), ...(fbs.length ? { fbs } : {}), ...(sqlite?.files.length ? { sqlite } : {}) };
+        const undo = tree ? { ...tree, ...extra } : dbs.length || rests.length || fbs.length ? { adapter: "dbs", dbs, rests, fbs } : null;
         if (undo)
             store.updateAction(a.id, { undo: JSON.stringify(undo) });
         // With its database saved, a command that reaches it is no longer lost to undo.
-        const saved = dbs.length + rests.length;
+        const saved = dbs.length + rests.length + fbs.length;
         const kind = plan.kind === "outbound" && saved && /database|request/.test(plan.reason ?? "") ? "write" : plan.kind;
         if (kind !== plan.kind)
             store.updateAction(a.id, { kind: "reversible", reason: null });
@@ -400,22 +443,41 @@ async function main() {
         const sep = rest.indexOf("--");
         const { values } = parseArgs({ args: sep === -1 ? rest : rest.slice(0, sep), options: { cwd: { type: "string" } } });
         const command = sep === -1 ? "" : rest.slice(sep + 1).join(" ");
-        const ask = reachedProjects(command, values.cwd ?? process.cwd()).find((d) => !projectConnected(d) && !supabaseDismissed(d));
-        console.log(JSON.stringify({ ask: ask ?? null }));
+        const ask = reachedDatabases(command, values.cwd ?? process.cwd()).find((r) => unconnected(r.dir).includes(r.service));
+        console.log(JSON.stringify({ ask: ask?.dir ?? null, service: ask?.service ?? null }));
         return;
     }
     // After a shell command that pushed: notes what it sent (run by the Claude Code mod).
+    // Also notes what a gh command made on GitHub, from its output on stdin.
     if (cmd === "shell-end") {
         const store = new Store();
         const a = store.getAction(rest[0] ?? "");
         const u = a?.undo ? JSON.parse(a.undo) : null;
-        if (a && u?.adapter === "tree" && u.git?.remotes) {
-            const pushed = notePushed(u);
-            if (pushed.length)
-                store.updateAction(a.id, { undo: JSON.stringify({ ...u, pushed }) });
+        const output = process.stdin.isTTY ? "" : readFileSync(0, "utf8");
+        if (a && u?.adapter === "tree") {
+            const pushed = u.git?.remotes ? notePushed(u) : [];
+            const github = ghMade(JSON.parse(a.args).command ?? "", output);
+            if (pushed.length || github.length)
+                store.updateAction(a.id, { undo: JSON.stringify({ ...u, ...(pushed.length ? { pushed } : {}), ...(github.length ? { github } : {}) }) });
         }
         return;
     }
+    // Takes away something Claude made on GitHub (the thing, as undo reported it, on stdin). The mod runs this after asking.
+    // Gets the person's OK on GitHub for another gh permission: code on the clipboard, approval page opened.
+    if (cmd === "gh-auth") {
+        const out = await grantScope(rest[0] ?? "");
+        console.log(JSON.stringify(out));
+        if (!out.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (cmd === "gh-undo") {
+        const out = undoGh(JSON.parse(readFileSync(0, "utf8")));
+        console.log(JSON.stringify(out));
+        if (!out.ok)
+            process.exitCode = 1;
+        return;
+    }
     // Puts an undo of code Claude pushed on the remote, as a new commit. The push, as undo reported it, comes on stdin.
     if (cmd === "revert-push") {
         const { values } = parseArgs({ args: rest, options: { root: { type: "string" } } });