v1.0.0

Salvager v1.0.0

First public release of Salvager — a filesystem-level code safety net for AI agents (and the humans working alongside them).

What it is
Salvager is a passive watcher that automatically saves per-file revisions as you (or an agent) work — the JetBrains Local History model, as a single static binary. When something gets broken, you recover it with one command. It's exposed over MCP so an agent can discover its own history and repair its own mistakes, without you in the loop.

The guarantee is structural, not behavioral: the watcher captures everything, so everything is reversible. Recovery never depends on the agent doing the right thing.

Design principles
Radical simplicity and zero configuration — run salvager watch in any project root and it works. Data is readable without the tool: plain ls and cat recover anything by hand from .salvager/. Language-agnostic, self-hostable, no accounts, no cloud, no runtime dependencies.

What's in v1
Passive per-file watcher with ~300 ms debounce and content-hash deduplication
Automatic whole-tree coverage: subtrees that exhaust the OS real-time watch ceiling (kqueue fd cap / inotify watch cap) fall back to a polling sweep — coverage stays complete, never silently partial
--allow-partial as the one explicit escape hatch; Salvager refuses to start with silent gaps otherwise
Reversible restore: every restore first saves the current state as a pre-restore revision, so a restore is itself undoable
Three MCP tools — salvager_list_versions, salvager_get_version, salvager_restore — with a capture-time content signal (lines, line delta, start signature) so an agent can identify the right revision without re-reading objects. No purge or delete is exposed over MCP: the safety net can't be erased by the thing that might break it
Age-based retention (salvager gc)
External, reproducible benchmark harness (bench/) — every performance figure is observed, not asserted

Known limits in v1
Large files are read whole into memory per capture (no streaming hash or size cap yet — multi-MB is fine, hundreds of MB spikes memory). The polling fallback can miss two same-size in-place writes within one tick on coarse-timestamp filesystems (some NFS, FAT); self-heals on the next change. Long-running stability has no known leak but isn't yet validated by a multi-hour soak test. See the README's "Known limits" for the full list.

Platforms
Static binaries for Linux and macOS (amd64 + arm64), built with CGO_ENABLED=0. Windows is best-effort from source. Each binary ships with a SHA-256 checksum.
Licensed under Apache-2.0.