Skip to content
NS360

W-04 · Developer tooling · macOS desktop · Rust core on Tauri v2

GitAegisA Git client that refuses to run without a way back.

A macOS Git client that writes a recovery capsule before any destructive operation, and refuses to proceed if it can’t.
gitaegis.com
The GitAegis website: “Git, with a working undo.”, above a screenshot of the app’s operation preview.

01The problem

Developers trust Git clients with their work, yet one wrong reset or force push can destroy it. Safety has to be a property of the architecture, not a confirmation dialog.

A Git client for macOS built around one rule: before a destructive operation runs, the repository’s state is written to disk. That means refs, index, staged and working changes, untracked files and any operation in progress.

If that capsule cannot be written, the operation is refused, not waved through with a warning. For anything that could remove or rewrite work, the full plan is on screen before a single command runs: its risk level, preconditions, the exact Git commands and the way back.

The product is just as deliberate about the other side, and states plainly where its recovery stops.

02What makes it hard

The engineering inside GitAegis.

  1. 01

    Fail closed

    For any operation that can destroy work, the checkpoint is written before the first Git command, and a failed write stops the operation outright. No control in the interface can override it.

  2. 02

    Every change is a transaction

    Each plan carries its intent, risk level, preconditions, exact commands, a checkpoint matched to the risk, a graded rehearsal where Git allows one, and a rollback plan. Results are checked against the plan and journalled.

  3. 03

    Interruptions without guesswork

    An operation cut short by a crash is flagged for review on the next launch, with its capsule and the commands it managed to run intact. It is never silently rolled back or assumed complete.

  4. 04

    A narrow trust boundary

    The React and TypeScript interface has no filesystem or process access and reaches the Rust core only through a fixed set of typed commands.

  5. 05

    Hostile repositories, safe subprocesses

    A cleared subprocess environment and pinned configuration stop settings in a cloned repository (such as core.fsmonitor, pagers and external diff tools) from launching programs.

  6. 06

    Distribution you can verify

    Signed, notarized universal builds at immutable, checksummed URLs. The updater installs nothing until the user confirms and the signature verifies.

03In the product

GitAegis operation preview for a hard reset: intent, effect on the working tree, the recovery capsule to be written and a confirm button.
Operation preview: intent, effect, capsule and the way back.
GitAegis restore dialog: choosing which parts of a recovery capsule to restore (refs, index, staged and working-tree changes, and operation state), with integrity re-verified before anything is written.
Restore exactly the parts you choose.
GitAegis workspace: a unified diff of an edited file beside the branch list and the commit panel.
The everyday workspace: staging, diffs and commits.

Captures of the live product and its website, cropped and scaled only.

Practices involved

Where this sits in what we do.

Start a conversation

Have a product with a hard problem inside it?

Tell us what it has to do, and what keeps going wrong.

Start a project