Fahid Digital Ventures LLC · Makers of GitAegis
Recovery should be a property of the tool.
Every developer who has used Git long enough has the same story with different details: a reset --hard one commit too far, a force push over a colleague’s branch, a rebase that ate an afternoon. Then the same recovery ritual: dig through git reflog, hope nothing collected the object, paste a SHA you are not certain about.
That ritual is the problem. It puts the safety net inside the operator’s head, at exactly the moment the operator is stressed and moving fast. GitAegis moves it into the tool: the snapshot is taken before the operation runs, and the operation is refused if the snapshot cannot be taken.
Fahid Digital Ventures LLC · No ads · No data sales · No telemetry to resell
The thesis, stated plainly
Git is not missing an undo. Git keeps a remarkable amount of history and, if you know where to look, an astonishing amount of it is recoverable.
The problem is who is expected to do the looking.
Most Git clients treat recovery as an advanced topic: a reflog viewer buried three menus deep, or an “undo” that quietly means “move a ref back and hope nothing else mattered.” The staged hunks were never captured. The untracked file you had not added yet was never an object. The half-finished rebase state was never written down anywhere you can reach.
So the client’s undo works when you were lucky and fails when you were not, and there is no way to tell which case you are in until you try.
A client that runs destructive commands on your behalf owes you a snapshot taken before it runs them, a plain statement of what that snapshot contains, and an honest boundary around what it cannot put back.
# the ritual, after a reset --hard one commit too fargit reflog3f1a2b9 HEAD@{0}: reset: moving to HEAD~1b7e4c2d HEAD@{1}: commit: wip9d21c44 HEAD@{2}: checkout: moving from maingit checkout b7e4c2d# the commit is back, if you picked the right line.# the staged hunks, the untracked file and the# half-finished rebase were never in here at all.
The engineering principles that govern the codebase
Not a values page. These are constraints enforced in the code and in the release gate, and each one has a consequence you can see in the product.
Never ship a surface that does not work.
No placeholder screens, no buttons wired to nothing, no “coming soon” panel inside the app. If a capability is not finished, the surface for it does not exist yet. A feature either works against a real repository or it is not in the build.Every mutation is a transaction.
No mutating operation runs as a bare command. Each carries an intent, a risk level, preconditions, the exact commands it will execute, a checkpoint, a rehearsal, and a rollback plan. Dangerous actions open the Operation Preview drawer, and no control in the shipped interface can waive the checkpoint.The interface never reaches past the typed contract.
The React interface has no filesystem access and cannot spawn a process. It reaches the Rust core only through the typedAegisClientcontract: a fixed set of commands with typed arguments and no generic escape hatch. There is no fixture-data mode and no demonstration mode: if the core is unavailable, the interface says so and stops rather than rendering state it does not have.No hard-coded interface strings.
Every piece of user-facing text resolves through the string catalogue. A small rule with a large effect: it forces every message to be reviewed as content rather than dropped in as a debug line, and it keeps terminology consistent across five modes.The object-destroying Git commands are not implemented.
git gc,git pruneandgit reflog expiredestroy exactly the objects a recovery tool exists to protect. They are not behind a confirmation and not behind an advanced toggle. No path in the product runs them. External diff and merge tools are never run either, in any mode.One precision, because you will see the word in the journal:
git remote pruneandgit worktree prunedo run. The first deletes remote-tracking refs, the second deletes stale worktree registrations. Neither deletes an object.State the limit next to the claim.
Recovery has a boundary. Rebase state is not restored from a capsule. Config is captured as evidence but not restored..gitattributescontent filters cannot be wholesale disabled. Bisect and a conflictedstash applyhave no generic resume. Those sentences appear in the product, in the documentation, and on this website, in the same paragraph as the capability they qualify.
The trust boundary
React interface, in the system webview
No filesystem access. Cannot spawn a process.
The typed AegisClient contract
A fixed command set with typed arguments. No generic escape hatch.
The Rust core
Plans, capsules, the Operation Journal, the Flight Recorder.
Your system Git
Your binary, your credentials, your SSH keys, your remotes.
Nothing crosses the contract line. Every capability the interface has is a command on that list, which is why an unfinished capability has no surface: there is nothing for it to call.
What GitAegis will not claim
A shield that promises to stop everything is not a shield, it is a marketing line. The boundary is the feature.
What GitAegis can put back
- If a recovery capsule was taken, you can roll the operation back.
- If a Flight Recorder event captured a state hash, you can roll back to that state.
- If any reflog entry, ref, branch, stash, or capsule references a commit, Lost Work can recover it.
- Outside those, it cannot, and GitAegis says so instead of pretending otherwise.
And one thing we will never say
There is no “guaranteed recovery” claim anywhere in this product, and there never will be. Where recovery stops, the product says so, on the page, in the documentation, and in the app at the moment it matters.
The company
Fahid Digital Ventures LLC builds and licenses developer software. GitAegis is what it builds. Fahid Mohammad founded it and writes it.
You will not find a headcount, a funding announcement or a founding-date milestone on this page. None of them would tell you anything about whether the product puts your work back, which is the only question this site is trying to answer.
How this is paid for
Software licences, and today there is nothing to buy. The macOS edition is free, there is no checkout, and no plan can be purchased.
There are no advertisements in the product or on this site. Your repository contents, your metadata and your usage are never sold, brokered or licensed to anyone. There is no telemetry to resell either. Local Git work stays on your machine, and an optional account connection is limited to the account features you choose.
If the incentives ever pull against the product, this is the sentence to hold us to: the only thing Fahid Digital Ventures LLC will sell is a licence to use GitAegis.
Get in touch
Five mailboxes, each with an owner. Pick the one that matches what you need and you reach someone who can answer it.
Product support
support@gitaegis.comInstallation, a Git that GitAegis will not accept, a repository behaving strangely, a crash, or a recovery that did not go the way you expected. Attach a support bundle if you can. It turns most of a diagnosis into a five-minute read.
Licensing and procurement
sales@gitaegis.comThere is nothing to buy today. The macOS edition is free and there is no checkout. Write here about volume licensing, purchase orders, or a vendor security questionnaire and you will get an answer in writing rather than a call.
Vulnerability reports
security@gitaegis.comReport a security issue here rather than through support and never in a public issue tracker. Include what you did, what you observed, and how to reproduce it. No published PGP key exists yet, so send plain text and leave out anything you would not want in an inbox.
Privacy and data
privacy@gitaegis.comQuestions about what the product records and what this site records. The free macOS edition links no HTTP client, so for most readers the honest answer is that there is nothing held about you to access, export or delete.
Press and media
press@gitaegis.comFact checks, interview requests, and permission questions about the brand assets. If a fact on this site is wrong, this is the fastest way to have it corrected.
Everything else
Not sure which of the five it is? The contact form routes by subject and tells you which mailbox it reached.
Free edition · No account required
A recovery capsule before every risky Git operation.
You see the exact commands before they run, and the operation is refused if the capsule cannot be written.
Requires Git 2.38.0 or newer, already installed.
Every risky operation, in this order
- Previewthe exact commands, shown before anything runs
- Capsulerefs, index, staged and working changes, untracked files, operation state: written to disk first
- Executethe commands as shown, or not at all
- Journalplan, commands, capsule id, outcome