retrace-agent 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sivaji Kandimalla
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,166 @@
-# Temporary Holding Version
+# Retrace
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Ctrl+Z for AI agents. Undo any file or database change your agent makes.**
+
+[![CI](https://github.com/kandimallasivaji9/retrace/actions/workflows/ci.yml/badge.svg)](https://github.com/kandimallasivaji9/retrace/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/retrace-agent)](https://www.npmjs.com/package/retrace-agent)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![MCP](https://img.shields.io/badge/MCP-compatible-purple)](https://modelcontextprotocol.io)
+
+![An agent deletes 412 customers ($64,581/mo of MRR). retrace undo brings every row back.](https://raw.githubusercontent.com/kandimallasivaji9/retrace/main/docs/demo.gif)
+
+*The agent asked first. The human clicked the wrong option. One command fixed it.*
+
+## Try it in 30 seconds
+
+```bash
+npm install -g retrace-agent
+
+# Put Retrace in front of any MCP server
+retrace wrap -- npx -y @modelcontextprotocol/server-filesystem ./project
+```
+
+Your agent works exactly as before. Every change is recorded with its before-state, so when something goes wrong:
+
+```bash
+retrace log            # see what the agent did
+retrace undo --run     # roll back the whole run, newest step first
+```
+
+Prefer not to install? Use `npx -y retrace-agent wrap -- ...` instead.
+
+## Why this exists
+
+- **Agents act on real systems now.** They edit files and run SQL. One bad step, or one wrong click on "approve", can wipe data you need.
+- **Asking first isn't enough.** Good agents confirm before destructive actions. People still approve the wrong thing.
+- **Checkpoints don't cover side effects.** Agent tools can rewind the chat or your code. Nothing rewinds the rows your agent deleted.
+- **No framework to adopt.** Retrace is an MCP server, so it works with the agent you already use.
+
+## What it can undo today
+
+| Target | How | Status |
+|---|---|---|
+| Files (wraps `@modelcontextprotocol/server-filesystem`) | Exact restore of writes, edits, moves, new folders | ✅ |
+| Postgres 18+ (`retrace postgres`) | Row-level undo of `INSERT`, `UPDATE`, `DELETE` | ✅ |
+| GitHub, Slack, Stripe | Compensating actions (close, delete, refund) | Planned |
+
+| Client | Status |
+|---|---|
+| Claude Desktop | ✅ Tested |
+| Claude Code, Cursor, other stdio MCP clients | Should work (standard MCP over stdio). Reports welcome. |
+
+## Features
+
+- **Undo a step or a whole run** with `retrace undo <id>` or `retrace undo --run`.
+- **Dry-run any agent** with `--dry-run`: real diffs and exact row counts, nothing changed.
+- **Catch conflicts.** If a person changed the data after the agent, undo stops instead of overwriting their work.
+- **Block what can't be undone.** `DROP`, `ALTER`, `TRUNCATE`, multi-statement SQL, and writes to tables without a primary key are refused.
+- **Keep a tamper-evident audit log.** Every action is hash-chained in a local SQLite journal; `retrace verify` checks it.
+
+## Postgres
+
+Retrace ships its own Postgres MCP server. Reads work normally, and every write is recorded row by row so it can be undone exactly.
+
+```bash
+retrace postgres --url postgres://localhost/mydb
+```
+
+No database handy? Clone the repo and run `npm run demo-db` for a throwaway Postgres 18 with 500 sample customers (it's the database in the GIF).
+
+```bash
+retrace log
+#  #1  execute  applied  DELETE 412 rows in public.customers
+retrace undo --run
+#  ✓ #1 execute undone
+```
+
+The journal never stores passwords. If your database needs one, set `RETRACE_PG_URL` (or pass `--url`) when you run `retrace undo`.
+
+## Dry run
+
+Not sure what an agent will do? Let it plan first:
+
+```bash
+retrace wrap --dry-run -- npx -y @modelcontextprotocol/server-filesystem ./project
+retrace postgres --dry-run --url postgres://localhost/mydb
+```
+
+The agent gets a preview instead of a real change: a diff for every file write, or "Would DELETE 412 rows" with sample rows for SQL. Nothing is changed. `retrace log` shows the whole plan.
+
+## Use with Claude Desktop
+
+In Claude Desktop, open **Settings → Developer → Edit Config** and add:
+
+```json
+{
+  "mcpServers": {
+    "files": {
+      "command": "npx",
+      "args": ["-y", "retrace-agent", "wrap", "--",
+               "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/you/project"]
+    },
+    "db": {
+      "command": "npx",
+      "args": ["-y", "retrace-agent", "postgres", "--url", "postgres://localhost/mydb"]
+    }
+  }
+}
+```
+
+If Claude Desktop can't find `npx`, use its full path (`which npx`).
+
+## How it works
+
+```mermaid
+flowchart TD
+  A[Your agent] -->|MCP tool call| R
+  subgraph R[Retrace]
+    D[Dry-run / policy<br/>preview, block unsafe calls] --> S[Snapshot<br/>files or rows, before + after]
+    S --> J[Journal<br/>append-only, hash-chained]
+    J --> U[Undo engine<br/>newest first, conflict check]
+  end
+  R --> T[Your files / your Postgres]
+```
+
+- **Files:** before each change, Retrace snapshots the paths the tool call touches. Undo restores those exact bytes.
+- **Postgres:** every write runs with `RETURNING old.*, new.*` (new in Postgres 18), so Retrace records each affected row as it was and as it became, inside the same transaction. Undo rebuilds rows with their real column types and puts them back in one transaction.
+
+## Safety and limits
+
+Retrace is honest about what it can't do:
+
+- **Postgres needs version 18+**, and tables need a primary key.
+- **Cascades and triggers aren't reversed yet.** If a delete cascades to other tables, only the rows the agent deleted come back. `WITH` and `MERGE` statements are blocked for now.
+- **Dry runs don't simulate state.** If the agent "writes" a file during a dry run and then reads it, it sees the original.
+- **Only calls that go through Retrace are tracked.**
+- **Files over 10 MB aren't snapshotted**, and `create_directory` only removes the last folder it created.
+- **Your data stays local.** The journal at `~/.retrace/journal.db` holds before-state snapshots, so treat it like the data it protects.
+
+Overhead: about 1.3 ms per file write at the median (2.3 ms vs 1.1 ms direct, 2 KB writes, 300 calls, Linux).
+
+## Why not just…
+
+| Alternative | Where it wins | Where Retrace helps |
+|---|---|---|
+| Git / file checkpoints | Great for code | Doesn't cover databases |
+| Database backups / PITR | Full recovery | Rolls back *everything*, not just one agent's changes |
+| Approval prompts | Stops many mistakes | People still approve the wrong thing; undo is the backstop |
+
+## Roadmap
+
+- [ ] Approval gate for actions that can't be undone (sending email, payments)
+- [ ] GitHub and Slack adapters
+- [ ] Pluggable adapter API
+- [ ] Web UI for browsing runs
+
+See [open issues](https://github.com/kandimallasivaji9/retrace/issues).
+
+## Contributing
+
+`npm test` runs everything end to end with a real MCP client and a throwaway Postgres; no setup needed. Start with [CONTRIBUTING.md](CONTRIBUTING.md) and the [`good first issue`](https://github.com/kandimallasivaji9/retrace/labels/good%20first%20issue) label.
+
+If Retrace saved you from a bad agent run, a star helps others find it.
+
+## License
+
+[MIT](LICENSE)

package/dist/adapters/filesystem.js

@@ -0,0 +1,23 @@
+import { resolvePath } from "../fs-state.js";
+const READ_ONLY = new Set([
+    "read_file", "read_text_file", "read_media_file", "read_multiple_files",
+    "list_directory", "list_directory_with_sizes", "directory_tree",
+    "search_files", "get_file_info", "list_allowed_directories",
+]);
+const MUTATING = {
+    write_file: (a) => [a.path],
+    edit_file: (a) => (a.dryRun ? [] : [a.path]),
+    create_directory: (a) => [a.path],
+    move_file: (a) => [a.source, a.destination],
+};
+export function classify(tool, args) {
+    if (READ_ONLY.has(tool))
+        return { kind: "read" };
+    const pick = MUTATING[tool];
+    if (!pick)
+        return { kind: "untracked" };
+    const paths = pick(args ?? {})
+        .filter((p) => typeof p === "string" && p.length > 0)
+        .map(resolvePath);
+    return paths.length ? { kind: "tracked", paths } : { kind: "read" };
+}

package/dist/cli.js

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { Command } from "commander";
+import { Journal } from "./journal.js";
+import { startPostgresServer } from "./pg-server.js";
+import { startProxy } from "./proxy.js";
+import { undoEntry, undoRun } from "./undo.js";
+import { VERSION } from "./version.js";
+const program = new Command()
+    .name("retrace")
+    .description("Ctrl+Z for AI agents. Undo any tool call your agent regrets.")
+    .version(VERSION)
+    .enablePositionalOptions();
+const short = (id) => id.slice(0, 8);
+/** Show paths relative to where you run the command, so the log stays readable. */
+function rel(p) {
+    const r = path.relative(process.cwd(), p);
+    return r && !r.startsWith("..") && !path.isAbsolute(r) ? r : p;
+}
+function target(e) {
+    const a = JSON.parse(e.args);
+    if (e.before) {
+        const b = JSON.parse(e.before);
+        if (b?.kind === "postgres") {
+            const pg = b;
+            const tables = Object.values(pg.tables).map((t) => `${t.schema}.${t.name}`).join(", ");
+            return `${pg.command} ${pg.rows.length} row${pg.rows.length === 1 ? "" : "s"} in ${tables}`;
+        }
+    }
+    if (typeof a.sql === "string") {
+        const sql = a.sql.replace(/\s+/g, " ").trim();
+        return sql.length > 70 ? sql.slice(0, 67) + "..." : sql;
+    }
+    if (a.source && a.destination)
+        return `${rel(a.source)} → ${rel(a.destination)}`;
+    if (a.path)
+        return rel(a.path);
+    return e.args.length > 60 ? e.args.slice(0, 57) + "..." : e.args;
+}
+function printEntry(e) {
+    const time = e.ts.slice(11, 19);
+    console.log(`  #${String(e.id).padEnd(5)}${time}  ${e.tool.padEnd(18)}${e.status.padEnd(11)}${target(e)}`);
+}
+function printOutcomes(outcomes) {
+    if (outcomes.length === 0)
+        console.log("Nothing to undo.");
+    let ok = true;
+    for (const o of outcomes) {
+        const mark = { undone: "✓", skipped: "·", conflict: "!", error: "✗" }[o.result];
+        console.log(`${mark} #${o.id} ${o.tool} ${o.result}${o.reason ? `: ${o.reason}` : ""}`);
+        if (o.result === "conflict" || o.result === "error")
+            ok = false;
+    }
+    return ok;
+}
+function findRun(j, id) {
+    const runId = typeof id === "string" ? j.resolveRun(id) : j.lastRunId();
+    if (!runId) {
+        console.error(typeof id === "string" ? `No single run matches "${id}".` : "No runs recorded yet.");
+        process.exit(1);
+    }
+    return runId;
+}
+program
+    .command("wrap")
+    .description("run an MCP server behind Retrace, e.g. retrace wrap -- npx @modelcontextprotocol/server-filesystem ./project")
+    .option("--journal <path>", "journal file (default ~/.retrace/journal.db)")
+    .option("--dry-run", "preview every change; nothing is written (or set RETRACE_DRY_RUN=1)")
+    .argument("<command...>", "the MCP server command to wrap")
+    .passThroughOptions()
+    .action(async (command, opts) => {
+    const [cmd, ...args] = command;
+    const dryRun = !!opts.dryRun || process.env.RETRACE_DRY_RUN === "1";
+    await startProxy(cmd, args, { journal: opts.journal, dryRun });
+});
+program
+    .command("postgres")
+    .description("run Retrace's Postgres MCP server: every INSERT/UPDATE/DELETE is recorded and undoable (Postgres 18+)")
+    .option("--url <url>", "connection string (or set DATABASE_URL)")
+    .option("--dry-run", "run each write in a transaction, report what it would change, then roll back")
+    .option("--journal <path>")
+    .action(async (opts) => {
+    const url = opts.url ?? process.env.DATABASE_URL;
+    if (!url) {
+        console.error("Pass --url postgres://... or set DATABASE_URL.");
+        process.exit(1);
+    }
+    try {
+        await startPostgresServer(url, { journal: opts.journal, dryRun: !!opts.dryRun || process.env.RETRACE_DRY_RUN === "1" });
+    }
+    catch (err) {
+        console.error(`[retrace] ${err.message}`);
+        process.exit(1);
+    }
+});
+program
+    .command("log")
+    .description("show what an agent did")
+    .option("--run <id>", "a specific run (default: latest)")
+    .option("--runs", "list recent runs instead")
+    .option("--journal <path>")
+    .action((opts) => {
+    const j = new Journal(opts.journal);
+    if (opts.runs) {
+        for (const r of j.runs()) {
+            console.log(`${short(r.run_id)}  ${r.started.slice(0, 19).replace("T", " ")}  ${r.actions} actions, ${r.undoable} undoable`);
+        }
+        return;
+    }
+    const runId = findRun(j, opts.run);
+    const entries = j.entries(runId);
+    const dry = entries.length > 0 && entries.every((e) => e.status === "planned");
+    console.log(`Run ${short(runId)} (${entries.length} actions${dry ? ", dry run" : ""})`);
+    entries.forEach(printEntry);
+    if (dry)
+        console.log("\n  Dry run: nothing was changed. Run without --dry-run to apply.");
+    const untracked = entries.filter((e) => e.status === "untracked" || (e.status === "planned" && e.reversibility === "untracked")).length;
+    if (untracked)
+        console.log(`\n  ${untracked} action(s) went to tools Retrace can't undo yet.`);
+});
+program
+    .command("undo")
+    .description("undo one action, or a whole run with --run")
+    .argument("[id]", "action id from `retrace log`")
+    .option("--run [runId]", "undo a whole run, newest step first (default: latest run)")
+    .option("--force", "undo even if something changed after the agent")
+    .option("--url <url>", "Postgres connection string, if the recorded one needs a password")
+    .option("--journal <path>")
+    .action(async (id, opts) => {
+    const j = new Journal(opts.journal);
+    let outcomes;
+    if (opts.run) {
+        outcomes = await undoRun(j, findRun(j, opts.run), { force: opts.force, pgUrl: opts.url });
+    }
+    else if (id) {
+        const e = j.get(Number(id.replace(/^#/, "")));
+        if (!e) {
+            console.error(`No action #${id}.`);
+            process.exit(1);
+        }
+        outcomes = [await undoEntry(j, e, { force: opts.force, pgUrl: opts.url })];
+    }
+    else {
+        console.error("Pass an action id (retrace undo 12) or --run.");
+        process.exit(1);
+    }
+    if (!printOutcomes(outcomes))
+        process.exit(1);
+});
+program
+    .command("verify")
+    .description("check the journal's hash chain for tampering")
+    .option("--journal <path>")
+    .action((opts) => {
+    const result = new Journal(opts.journal).verify();
+    if (result.ok)
+        console.log(`✓ Journal intact (${result.count} actions).`);
+    else {
+        console.error(`✗ Hash chain broken at action #${result.brokenAt}.`);
+        process.exit(1);
+    }
+});
+program.parseAsync();

package/dist/fs-state.js

@@ -0,0 +1,53 @@
+import { promises as fs } from "node:fs";
+import { createHash } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+const MAX_SNAPSHOT_BYTES = 10 * 1024 * 1024;
+export const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+export function resolvePath(p) {
+    if (p === "~" || p.startsWith("~/"))
+        p = path.join(os.homedir(), p.slice(1));
+    return path.resolve(p);
+}
+export async function readState(p, withContent = true) {
+    try {
+        const st = await fs.stat(p);
+        if (st.isDirectory())
+            return { path: p, kind: "dir", hash: "dir" };
+        if (st.size > MAX_SNAPSHOT_BYTES) {
+            return { path: p, kind: "file", hash: `large:${st.size}:${st.mtimeMs}`, tooLarge: true };
+        }
+        const buf = await fs.readFile(p);
+        return {
+            path: p,
+            kind: "file",
+            hash: sha256(buf),
+            content: withContent ? buf.toString("base64") : undefined,
+        };
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { path: p, kind: "absent", hash: "absent" };
+        throw err;
+    }
+}
+/** Put a path back exactly the way a "before" snapshot recorded it. */
+export async function restoreState(s) {
+    if (s.kind === "file") {
+        if (s.tooLarge || s.content === undefined) {
+            throw new Error(`${s.path} was too large to snapshot, can't restore it`);
+        }
+        await fs.mkdir(path.dirname(s.path), { recursive: true });
+        await fs.writeFile(s.path, Buffer.from(s.content, "base64"));
+    }
+    else if (s.kind === "absent") {
+        const current = await readState(s.path, false);
+        if (current.kind === "file")
+            await fs.unlink(s.path);
+        else if (current.kind === "dir")
+            await fs.rmdir(s.path); // only if empty, on purpose
+    }
+    else {
+        await fs.mkdir(s.path, { recursive: true });
+    }
+}

package/dist/journal.js

@@ -0,0 +1,104 @@
+import Database from "better-sqlite3";
+import { createHash } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const GENESIS = "0".repeat(64);
+export const defaultJournalPath = () => process.env.RETRACE_JOURNAL ?? path.join(os.homedir(), ".retrace", "journal.db");
+/** Status is left out on purpose: it changes on undo. Everything the agent did is covered. */
+function entryHash(prev, e) {
+    return createHash("sha256")
+        .update(prev + JSON.stringify([e.run_id, e.step, e.ts, e.tool, e.args, e.reversibility, e.before, e.after, e.is_error]))
+        .digest("hex");
+}
+/** Append-only, hash-chained log of every action an agent took. */
+export class Journal {
+    db;
+    constructor(file = defaultJournalPath()) {
+        mkdirSync(path.dirname(file), { recursive: true });
+        this.db = new Database(file);
+        this.db.pragma("journal_mode = WAL");
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS actions (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        run_id TEXT NOT NULL, step INTEGER NOT NULL, ts TEXT NOT NULL,
+        tool TEXT NOT NULL, args TEXT NOT NULL, reversibility TEXT NOT NULL,
+        before TEXT, after TEXT, is_error INTEGER NOT NULL, status TEXT NOT NULL,
+        prev_hash TEXT NOT NULL, hash TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_actions_run ON actions(run_id, step);
+    `);
+    }
+    record(n) {
+        const insert = this.db.transaction(() => {
+            const last = this.db.prepare("SELECT hash FROM actions ORDER BY id DESC LIMIT 1").get();
+            const prev = last?.hash ?? GENESIS;
+            const { s: step } = this.db
+                .prepare("SELECT COALESCE(MAX(step), 0) + 1 AS s FROM actions WHERE run_id = ?")
+                .get(n.runId);
+            const row = {
+                run_id: n.runId,
+                step,
+                ts: new Date().toISOString(),
+                tool: n.tool,
+                args: JSON.stringify(n.args ?? {}),
+                reversibility: n.reversibility,
+                before: n.before == null ? null : JSON.stringify(n.before),
+                after: n.after == null ? null : JSON.stringify(n.after),
+                is_error: n.isError ? 1 : 0,
+            };
+            const status = n.planned
+                ? "planned"
+                : n.reversibility === "untracked" ? "untracked" : n.isError ? "failed" : "applied";
+            const info = this.db
+                .prepare(`INSERT INTO actions (run_id, step, ts, tool, args, reversibility, before, after, is_error, status, prev_hash, hash)
+                  VALUES (@run_id, @step, @ts, @tool, @args, @reversibility, @before, @after, @is_error, @status, @prev_hash, @hash)`)
+                .run({ ...row, status, prev_hash: prev, hash: entryHash(prev, row) });
+            return Number(info.lastInsertRowid);
+        });
+        return this.get(insert());
+    }
+    get(id) {
+        return this.db.prepare("SELECT * FROM actions WHERE id = ?").get(id);
+    }
+    entries(runId) {
+        return this.db.prepare("SELECT * FROM actions WHERE run_id = ? ORDER BY step").all(runId);
+    }
+    lastRunId() {
+        const r = this.db.prepare("SELECT run_id FROM actions ORDER BY id DESC LIMIT 1").get();
+        return r?.run_id;
+    }
+    /** Accepts a full run id or a unique prefix (like the 8 chars `retrace log` prints). */
+    resolveRun(prefix) {
+        const rows = this.db
+            .prepare("SELECT DISTINCT run_id FROM actions WHERE run_id LIKE ? LIMIT 2")
+            .all(`${prefix}%`);
+        return rows.length === 1 ? rows[0].run_id : undefined;
+    }
+    runs(limit = 10) {
+        return this.db
+            .prepare(`SELECT run_id, COUNT(*) AS actions,
+                  SUM(status IN ('applied','failed')) AS undoable,
+                  MIN(ts) AS started, MAX(ts) AS ended
+                FROM actions GROUP BY run_id ORDER BY MAX(id) DESC LIMIT ?`)
+            .all(limit);
+    }
+    setStatus(id, status) {
+        this.db.prepare("UPDATE actions SET status = ? WHERE id = ?").run(status, id);
+    }
+    /** Walks the hash chain. Any edited or deleted entry breaks it. */
+    verify() {
+        let prev = GENESIS;
+        let count = 0;
+        for (const row of this.db.prepare("SELECT * FROM actions ORDER BY id").iterate()) {
+            if (row.prev_hash !== prev || row.hash !== entryHash(prev, row))
+                return { ok: false, brokenAt: row.id };
+            prev = row.hash;
+            count++;
+        }
+        return { ok: true, count };
+    }
+    close() {
+        this.db.close();
+    }
+}

package/dist/pg-server.js

@@ -0,0 +1,158 @@
+import { randomUUID } from "node:crypto";
+import pg from "pg";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { Journal } from "./journal.js";
+import { displayName, inspectTable, sanitizeUrl, validateDml } from "./pg-util.js";
+import { VERSION } from "./version.js";
+const MAX_TRACKED_ROWS = 100_000;
+const MAX_RESULT_ROWS = 100;
+const DRY = "[retrace dry-run] Nothing was changed.";
+const TOOLS = [
+    {
+        name: "list_tables",
+        description: "List the tables in the database with approximate row counts.",
+        inputSchema: { type: "object", properties: {} },
+    },
+    {
+        name: "describe_table",
+        description: "Show a table's columns, types and primary key.",
+        inputSchema: { type: "object", properties: { table: { type: "string", description: "Table name, optionally schema-qualified" } }, required: ["table"] },
+    },
+    {
+        name: "query",
+        description: `Run a read-only SQL query (SELECT). Returns up to ${MAX_RESULT_ROWS} rows as JSON.`,
+        inputSchema: { type: "object", properties: { sql: { type: "string" } }, required: ["sql"] },
+    },
+    {
+        name: "execute",
+        description: "Run one INSERT, UPDATE or DELETE statement. Retrace records every change so it can be undone. Schema changes (DROP, ALTER, TRUNCATE) are blocked.",
+        inputSchema: { type: "object", properties: { sql: { type: "string" } }, required: ["sql"] },
+    },
+];
+const ok = (text) => ({ content: [{ type: "text", text }] });
+const fail = (text) => ({ content: [{ type: "text", text }], isError: true });
+const plural = (n) => `${n} row${n === 1 ? "" : "s"}`;
+/** Retrace's own Postgres MCP server: reads pass through, every write is journaled and undoable. Needs Postgres 18+. */
+export async function startPostgresServer(url, opts = {}) {
+    const pool = new pg.Pool({ connectionString: url, max: 4 });
+    const { rows: [v] } = await pool.query("SELECT current_setting('server_version_num')::int AS n, current_setting('server_version') AS s");
+    if (v.n < 180000) {
+        throw new Error(`Retrace needs Postgres 18 or newer (this server is ${v.s}). It relies on RETURNING old/new to record changes.`);
+    }
+    const journal = new Journal(opts.journal);
+    const runId = randomUUID();
+    const safeUrl = sanitizeUrl(url);
+    async function execute(sql) {
+        const checked = validateDml(sql);
+        if ("error" in checked)
+            return fail(checked.error);
+        const client = await pool.connect();
+        try {
+            await client.query("BEGIN");
+            await client.query("SET LOCAL statement_timeout = '60s'");
+            const res = await client.query({
+                text: `${checked.sql}\nRETURNING COALESCE(old.tableoid, new.tableoid)::oid AS __t, to_jsonb(old)::text AS __old, to_jsonb(new)::text AS __new`,
+                queryMode: "extended", // one statement only: Postgres rejects "DELETE ...; DROP ..."
+            });
+            const command = res.command;
+            const n = res.rows.length;
+            const tables = {};
+            for (const oid of new Set(res.rows.map((r) => String(r.__t)))) {
+                const info = await inspectTable(client, oid);
+                if (info.pk.length === 0) {
+                    await client.query("ROLLBACK");
+                    return fail(`${displayName(info)} has no primary key, so Retrace can't undo changes to it. Nothing was changed.`);
+                }
+                tables[oid] = info;
+            }
+            if (n > MAX_TRACKED_ROWS) {
+                await client.query("ROLLBACK");
+                return fail(`This would change ${n} rows; Retrace tracks at most ${MAX_TRACKED_ROWS} per statement. Nothing was changed.`);
+            }
+            const where = Object.values(tables).map(displayName).join(", ") || "no table";
+            const label = `${command} ${plural(n)}${n ? ` in ${where}` : ""}`;
+            if (opts.dryRun) {
+                await client.query("ROLLBACK");
+                journal.record({ runId, tool: "execute", args: { sql }, reversibility: "reversible", before: null, after: null, isError: false, planned: true });
+                const sample = res.rows.slice(0, 3).map((r) => `  ${r.__old ?? r.__new}`).join("\n");
+                return ok(`${DRY} Would ${label}.${n ? `\nSample of affected rows:\n${sample}` : ""}`);
+            }
+            await client.query("COMMIT");
+            if (n > 0) {
+                const before = {
+                    kind: "postgres", url: safeUrl, command, tables,
+                    rows: res.rows.map((r) => ({ t: String(r.__t), old: r.__old, new: r.__new })),
+                };
+                journal.record({ runId, tool: "execute", args: { sql }, reversibility: "reversible", before, after: { kind: "postgres", rowCount: n }, isError: false });
+            }
+            return ok(`${label}.`);
+        }
+        catch (err) {
+            await client.query("ROLLBACK").catch(() => { });
+            return fail(`SQL error: ${err.message}. Nothing was changed.`);
+        }
+        finally {
+            client.release();
+        }
+    }
+    async function readOnly(sql, params = []) {
+        const client = await pool.connect();
+        try {
+            await client.query("BEGIN READ ONLY");
+            await client.query("SET LOCAL statement_timeout = '30s'");
+            return (await client.query({ text: sql, values: params, queryMode: "extended" }));
+        }
+        finally {
+            await client.query("ROLLBACK").catch(() => { });
+            client.release();
+        }
+    }
+    const server = new Server({ name: "retrace-postgres", version: VERSION }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const args = (req.params.arguments ?? {});
+        try {
+            switch (req.params.name) {
+                case "list_tables": {
+                    const r = await readOnly(`SELECT n.nspname || '.' || c.relname AS "table", GREATEST(c.reltuples, 0)::bigint AS approx_rows
+            FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+            WHERE c.relkind IN ('r', 'p') AND n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_toast%'
+            ORDER BY 1`);
+                    return ok(JSON.stringify(r.rows, null, 2));
+                }
+                case "describe_table": {
+                    const r = await readOnly(`SELECT a.attname AS column, format_type(a.atttypid, a.atttypmod) AS type, NOT a.attnotnull AS nullable,
+              COALESCE(a.attnum = ANY(i.indkey), false) AS primary_key
+            FROM pg_attribute a LEFT JOIN pg_index i ON i.indrelid = a.attrelid AND i.indisprimary
+            WHERE a.attrelid = $1::regclass AND a.attnum > 0 AND NOT a.attisdropped ORDER BY a.attnum`, [args.table]);
+                    return ok(JSON.stringify(r.rows, null, 2));
+                }
+                case "query": {
+                    const r = await readOnly(args.sql);
+                    const shown = r.rows.slice(0, MAX_RESULT_ROWS);
+                    const more = r.rows.length > MAX_RESULT_ROWS ? `\n(${r.rows.length - MAX_RESULT_ROWS} more rows not shown; add a LIMIT or filter)` : "";
+                    return ok(JSON.stringify(shown, null, 2) + more);
+                }
+                case "execute":
+                    return await execute(args.sql);
+                default:
+                    return fail(`Unknown tool ${req.params.name}`);
+            }
+        }
+        catch (err) {
+            return fail(`Error: ${err.message}`);
+        }
+    });
+    const shutdown = async () => {
+        await pool.end().catch(() => { });
+        journal.close();
+        process.exit(0);
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    server.onclose = shutdown;
+    await server.connect(new StdioServerTransport());
+    process.stderr.write(`[retrace] postgres ${v.s} at ${safeUrl}, run ${runId.slice(0, 8)}${opts.dryRun ? " (DRY RUN: nothing will be changed)" : ""}\n`);
+}

package/dist/pg-undo.js

@@ -0,0 +1,68 @@
+import pg from "pg";
+import { displayName, qualified, quoteIdent as q } from "./pg-util.js";
+/**
+ * Reverses one journaled statement inside a single transaction, newest row first.
+ * Row images are rebuilt with jsonb_populate_record, so every column keeps its real type.
+ */
+export async function undoPostgres(b, urlOverride, force = false) {
+    const client = new pg.Client({ connectionString: urlOverride ?? process.env.RETRACE_PG_URL ?? b.url });
+    try {
+        await client.connect();
+    }
+    catch (err) {
+        return { ok: false, conflict: false, reason: `can't connect to Postgres (${err.message}). Pass --url or set RETRACE_PG_URL.` };
+    }
+    try {
+        await client.query("BEGIN");
+        for (const r of [...b.rows].reverse()) {
+            const info = b.tables[r.t];
+            const tbl = qualified(info);
+            const shown = displayName(info);
+            const rec = (param) => `jsonb_populate_record(NULL::${tbl}, ${param}::jsonb)`;
+            const pk = (alias) => info.pk.map((c) => `${alias}.${q(c)}`).join(", ");
+            const key = (img) => info.pk.map((c) => `${c}=${JSON.parse(img)[c]}`).join(", ");
+            if (!force) {
+                if (r.new !== null) {
+                    const cur = await client.query(`SELECT to_jsonb(t) = $1::jsonb AS same FROM ${tbl} t, ${rec("$1")} n WHERE (${pk("t")}) = (${pk("n")})`, [r.new]);
+                    if (cur.rowCount === 0 || !cur.rows[0].same) {
+                        await client.query("ROLLBACK");
+                        return { ok: false, conflict: true, reason: `${shown} row ${key(r.new)} changed after the agent touched it (use --force to overwrite)` };
+                    }
+                }
+                else {
+                    const cur = await client.query(`SELECT 1 FROM ${tbl} t, ${rec("$1")} o WHERE (${pk("t")}) = (${pk("o")})`, [r.old]);
+                    if (cur.rowCount) {
+                        await client.query("ROLLBACK");
+                        return { ok: false, conflict: true, reason: `${shown} row ${key(r.old)} was re-created after the agent deleted it (use --force to overwrite)` };
+                    }
+                }
+            }
+            if (r.old === null) {
+                // agent inserted it → delete it
+                await client.query(`DELETE FROM ${tbl} t USING ${rec("$1")} n WHERE (${pk("t")}) = (${pk("n")})`, [r.new]);
+            }
+            else if (r.new === null) {
+                // agent deleted it → put it back exactly
+                const cols = info.insertable;
+                if (force)
+                    await client.query(`DELETE FROM ${tbl} t USING ${rec("$1")} o WHERE (${pk("t")}) = (${pk("o")})`, [r.old]);
+                await client.query(`INSERT INTO ${tbl} (${cols.map(q).join(", ")}) OVERRIDING SYSTEM VALUE SELECT ${cols.map((c) => `o.${q(c)}`).join(", ")} FROM ${rec("$1")} o`, [r.old]);
+            }
+            else {
+                // agent updated it → restore old values
+                const cols = info.updatable;
+                await client.query(`UPDATE ${tbl} t SET (${cols.map(q).join(", ")}) = ROW(${cols.map((c) => `o.${q(c)}`).join(", ")})
+           FROM ${rec("$1")} o, ${rec("$2")} n WHERE (${pk("t")}) = (${pk("n")})`, [r.old, r.new]);
+            }
+        }
+        await client.query("COMMIT");
+        return { ok: true };
+    }
+    catch (err) {
+        await client.query("ROLLBACK").catch(() => { });
+        return { ok: false, conflict: false, reason: err.message };
+    }
+    finally {
+        await client.end().catch(() => { });
+    }
+}

package/dist/pg-util.js

@@ -0,0 +1,53 @@
+export const quoteIdent = (s) => `"${s.replace(/"/g, '""')}"`;
+export const qualified = (t) => `${quoteIdent(t.schema)}.${quoteIdent(t.name)}`;
+/** For messages people read: public.customers, not "public"."customers". */
+export const displayName = (t) => `${t.schema}.${t.name}`;
+/** Never store a password in the journal. */
+export function sanitizeUrl(url) {
+    try {
+        const u = new URL(url);
+        u.password = "";
+        return u.toString();
+    }
+    catch {
+        return url.replace(/:\/\/([^:@/]+):[^@/]*@/, "://$1@");
+    }
+}
+export async function inspectTable(client, oid) {
+    const { rows } = await client.query(`SELECT n.nspname AS schema, c.relname AS name,
+       COALESCE((SELECT array_agg(a.attname::text ORDER BY array_position(i.indkey::int2[], a.attnum))
+                 FROM pg_index i JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = ANY(i.indkey)
+                 WHERE i.indrelid = c.oid AND i.indisprimary), '{}') AS pk,
+       COALESCE((SELECT array_agg(a.attname::text ORDER BY a.attnum) FROM pg_attribute a
+                 WHERE a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped AND a.attgenerated = ''), '{}') AS insertable,
+       COALESCE((SELECT array_agg(a.attname::text ORDER BY a.attnum) FROM pg_attribute a
+                 WHERE a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped AND a.attgenerated = ''
+                   AND a.attidentity <> 'a'), '{}') AS updatable
+     FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE c.oid = $1`, [oid]);
+    if (!rows[0])
+        throw new Error(`table ${oid} not found`);
+    return rows[0];
+}
+/**
+ * Only plain INSERT / UPDATE / DELETE get through `execute`.
+ * WITH is blocked because a data-modifying CTE could change tables Retrace can't see.
+ */
+export function validateDml(sql) {
+    const body = sql.trim().replace(/;\s*$/, "");
+    const head = body.replace(/^(\s*--[^\n]*\n|\s*\/\*[\s\S]*?\*\/)*/, "").trimStart().toLowerCase();
+    if (/^(select|show|explain)\b/.test(head))
+        return { error: "Use the query tool for reads. execute is for INSERT, UPDATE and DELETE." };
+    if (/^with\b/.test(head))
+        return { error: "WITH statements aren't supported by execute yet. Write a plain INSERT, UPDATE or DELETE." };
+    if (/^merge\b/.test(head))
+        return { error: "MERGE isn't supported yet. Use INSERT ... ON CONFLICT, UPDATE or DELETE." };
+    if (!/^(insert|update|delete)\b/.test(head)) {
+        return { error: "Blocked by Retrace: only INSERT, UPDATE and DELETE can run. Schema changes (DROP, ALTER, TRUNCATE, CREATE) and other commands aren't allowed." };
+    }
+    const noStrings = body.replace(/'(?:[^']|'')*'/g, "''").replace(/"(?:[^"]|"")*"/g, '""');
+    if (noStrings.includes(";"))
+        return { error: "One statement at a time, please. Nothing was changed." };
+    if (/\breturning\b/i.test(body))
+        return { error: "Remove the RETURNING clause; Retrace adds its own to record the change." };
+    return { sql: body };
+}

package/dist/preview.js

@@ -0,0 +1,89 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { createTwoFilesPatch } from "diff";
+import { readState, resolvePath } from "./fs-state.js";
+const TAG = "[retrace dry-run] Nothing was changed.";
+/** Asks the upstream server which directories it allows, so previews never read outside them. */
+export async function allowedDirectories(upstream) {
+    try {
+        const res = await upstream.callTool({ name: "list_allowed_directories", arguments: {} });
+        const text = (res.content ?? []).filter((c) => c.type === "text").map((c) => c.text).join("\n");
+        const dirs = text.split("\n").map((l) => l.trim()).filter((l) => l.startsWith("/") || /^[A-Za-z]:\\/.test(l));
+        return Promise.all(dirs.map((d) => fs.realpath(d).catch(() => d)));
+    }
+    catch {
+        return [];
+    }
+}
+/** Resolves symlinks on the deepest part of the path that exists. */
+async function realish(p) {
+    let cur = p;
+    const tail = [];
+    for (;;) {
+        try {
+            return path.join(await fs.realpath(cur), ...tail);
+        }
+        catch {
+            const parent = path.dirname(cur);
+            if (parent === cur)
+                return p;
+            tail.unshift(path.basename(cur));
+            cur = parent;
+        }
+    }
+}
+async function isAllowed(p, allowed) {
+    const real = await realish(p);
+    return allowed.some((d) => real === d || real.startsWith(d + path.sep));
+}
+function textOf(res) {
+    return (res?.content ?? []).filter((c) => c.type === "text").map((c) => c.text).join("\n");
+}
+/** Describes what a tool call would do, without doing it. */
+export async function previewCall(upstream, tool, args, plan, allowed) {
+    if (plan.kind !== "tracked") {
+        return `${TAG} Blocked "${tool}": Retrace can't preview this tool yet, so it wasn't run.`;
+    }
+    for (const p of plan.paths) {
+        if (!(await isAllowed(p, allowed)))
+            return `${TAG} Would fail: ${p} is outside the allowed directories.`;
+    }
+    switch (tool) {
+        case "edit_file": {
+            // The filesystem server can preview edits itself and returns a diff.
+            const res = await upstream.callTool({ name: tool, arguments: { ...args, dryRun: true } });
+            return res.isError ? `${TAG} Would fail: ${textOf(res)}` : `${TAG} Planned edit:\n${textOf(res)}`;
+        }
+        case "write_file": {
+            const [p] = plan.paths;
+            const before = await readState(p);
+            if (before.kind === "dir")
+                return `${TAG} Would fail: ${p} is a directory.`;
+            if (before.tooLarge)
+                return `${TAG} Would overwrite ${p} (too large to diff).`;
+            const old = before.kind === "file" ? Buffer.from(before.content, "base64").toString("utf8") : "";
+            const verb = before.kind === "absent" ? "create" : "overwrite";
+            const patch = createTwoFilesPatch(p, p, old, String(args.content ?? ""), verb === "create" ? "(new file)" : "current", "planned");
+            return `${TAG} Would ${verb} ${p}:\n${patch}`;
+        }
+        case "move_file": {
+            const [src, dest] = plan.paths;
+            if ((await readState(src, false)).kind === "absent")
+                return `${TAG} Would fail: ${src} doesn't exist.`;
+            if ((await readState(dest, false)).kind !== "absent")
+                return `${TAG} Would fail: ${dest} already exists.`;
+            return `${TAG} Would move ${src} → ${dest}.`;
+        }
+        case "create_directory": {
+            const [p] = plan.paths;
+            const s = await readState(p, false);
+            if (s.kind === "dir")
+                return `${TAG} ${p} already exists, no change.`;
+            if (s.kind === "file")
+                return `${TAG} Would fail: ${p} is a file.`;
+            return `${TAG} Would create directory ${p}.`;
+        }
+        default:
+            return `${TAG} Would run "${tool}" on ${plan.paths.map(resolvePath).join(", ")}.`;
+    }
+}

package/dist/proxy.js

@@ -0,0 +1,73 @@
+import { randomUUID } from "node:crypto";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { classify } from "./adapters/filesystem.js";
+import { readState } from "./fs-state.js";
+import { Journal } from "./journal.js";
+import { allowedDirectories, previewCall } from "./preview.js";
+import { VERSION } from "./version.js";
+const log = (msg) => process.stderr.write(`[retrace] ${msg}\n`);
+/**
+ * Sits between the agent and a real MCP server.
+ * The agent sees the same tools; every change gets a before/after snapshot in the journal.
+ */
+export async function startProxy(command, args, opts = {}) {
+    const journal = new Journal(opts.journal);
+    const runId = randomUUID();
+    const upstream = new Client({ name: "retrace", version: VERSION });
+    await upstream.connect(new StdioClientTransport({ command, args, env: process.env, stderr: "inherit" }));
+    const upstreamName = upstream.getServerVersion()?.name ?? command;
+    const allowed = opts.dryRun ? await allowedDirectories(upstream) : [];
+    const server = new Server({ name: `retrace(${upstreamName})`, version: VERSION }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async (req) => upstream.listTools(req.params));
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const { name, arguments: toolArgs = {} } = req.params;
+        const plan = classify(name, toolArgs);
+        if (plan.kind === "read")
+            return (await upstream.callTool(req.params));
+        if (opts.dryRun) {
+            const text = await previewCall(upstream, name, toolArgs, plan, allowed);
+            journal.record({
+                runId, tool: name, args: toolArgs,
+                reversibility: plan.kind === "tracked" ? "reversible" : "untracked",
+                before: null, after: null, isError: false, planned: true,
+            });
+            return { content: [{ type: "text", text }] };
+        }
+        if (plan.kind === "untracked") {
+            const result = await upstream.callTool(req.params);
+            journal.record({ runId, tool: name, args: toolArgs, reversibility: "untracked", before: null, after: null, isError: !!result.isError });
+            return result;
+        }
+        const before = await Promise.all(plan.paths.map((p) => readState(p)));
+        let result;
+        let failure;
+        try {
+            result = await upstream.callTool(req.params);
+        }
+        catch (err) {
+            failure = err;
+        }
+        const after = await Promise.all(plan.paths.map((p) => readState(p, false)));
+        // Only journal calls that actually changed something.
+        if (after.some((s, i) => s.hash !== before[i].hash)) {
+            journal.record({ runId, tool: name, args: toolArgs, reversibility: "reversible", before, after, isError: !!failure || !!result?.isError });
+        }
+        if (failure)
+            throw failure;
+        return result;
+    });
+    const shutdown = async () => {
+        await upstream.close().catch(() => { });
+        journal.close();
+        process.exit(0);
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    server.onclose = shutdown;
+    await server.connect(new StdioServerTransport());
+    log(`wrapping ${upstreamName}, run ${runId.slice(0, 8)}${opts.dryRun ? " (DRY RUN: nothing will be changed)" : ""}`);
+}

package/dist/undo.js

@@ -0,0 +1,54 @@
+import { readState, restoreState } from "./fs-state.js";
+import { undoPostgres } from "./pg-undo.js";
+export async function undoEntry(journal, e, opts = {}) {
+    const force = !!opts.force;
+    const base = { id: e.id, step: e.step, tool: e.tool };
+    if (e.status === "undone")
+        return { ...base, result: "skipped", reason: "already undone" };
+    if (e.reversibility !== "reversible" || !e.before || !e.after) {
+        return { ...base, result: "skipped", reason: "not tracked, can't undo" };
+    }
+    const parsed = JSON.parse(e.before);
+    if (!Array.isArray(parsed) && parsed?.kind === "postgres") {
+        const r = await undoPostgres(parsed, opts.pgUrl, force);
+        if (!r.ok)
+            return { ...base, result: r.conflict ? "conflict" : "error", reason: r.reason };
+        journal.setStatus(e.id, "undone");
+        return { ...base, result: "undone" };
+    }
+    const before = parsed;
+    const after = JSON.parse(e.after);
+    // Conflict check: never overwrite a change someone made after the agent.
+    if (!force) {
+        for (const s of after) {
+            const now = await readState(s.path, false);
+            if (now.hash !== s.hash) {
+                return { ...base, result: "conflict", reason: `${s.path} changed after the agent touched it (use --force to overwrite)` };
+            }
+        }
+    }
+    try {
+        for (const s of [...before].reverse())
+            await restoreState(s);
+    }
+    catch (err) {
+        return { ...base, result: "error", reason: err.message };
+    }
+    journal.setStatus(e.id, "undone");
+    return { ...base, result: "undone" };
+}
+/** Undo a whole run, newest step first. Stops at the first conflict so later steps stay consistent. */
+export async function undoRun(journal, runId, opts = {}) {
+    const steps = journal
+        .entries(runId)
+        .filter((e) => e.status === "applied" || e.status === "failed")
+        .reverse();
+    const outcomes = [];
+    for (const e of steps) {
+        const o = await undoEntry(journal, e, opts);
+        outcomes.push(o);
+        if (o.result === "conflict" || o.result === "error")
+            break;
+    }
+    return outcomes;
+}

package/dist/version.js

@@ -0,0 +1 @@
+export const VERSION = "0.2.0";

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "retrace-agent",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Ctrl+Z for AI agents. Undo any file or database change your agent makes, through MCP.",
+  "type": "module",
+  "bin": {
+    "retrace": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "npm run build && node tests/e2e.mjs && node tests/pg.e2e.mjs",
+    "demo-db": "node scripts/demo-db.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "MIT",
+  "author": "Sivaji Kandimalla",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kandimallasivaji9/retrace.git"
+  },
+  "homepage": "https://github.com/kandimallasivaji9/retrace#readme",
+  "bugs": {
+    "url": "https://github.com/kandimallasivaji9/retrace/issues"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "ai-agents",
+    "agent-safety",
+    "undo",
+    "rollback",
+    "postgres",
+    "llm",
+    "claude",
+    "audit-log"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "better-sqlite3": "^11.0.0",
+    "commander": "^12.1.0",
+    "diff": "^8.0.4",
+    "pg": "^8.23.1"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/server-filesystem": "^2.2.0",
+    "@types/better-sqlite3": "^7.6.11",
+    "@types/node": "^20.14.0",
+    "@types/pg": "^8.23.1",
+    "embedded-postgres": "18.4.0-beta.17",
+    "typescript": "^5.5.0"
+  }
+}