RELEASE — V0.3.0 · SEPTEMBER 2026

Varn: Local Filesystem Checkpointing and Safe Rollback for AI Agents and Automated Tools

Capture a known state, see exactly what changed, restore it safely — entirely offline, coexisting with Git, with machine-readable output for agents.

curl -fsSL https://raw.githubusercontent.com/flawme/varn/main/install.sh | sh

Linux · macOS · Windows — x86_64 and aarch64 · MIT OR Apache-2.0 · read the docs

The install script covers Linux and macOS. On Windows, grab the binary from the releases page or use cargo install — see installation.

1Highlights

Safety checkpoint before every restore

Restore captures the current state first, so even a bad restore can be undone with one command.

Conflict detection with explicit confirmation

Files modified or added since the checkpoint are flagged. Varn never silently overwrites or deletes.

Hash-verified, all-or-nothing execution

Every object is re-verified against its SHA-256 before touching the disk, and a pre-flight check confirms all objects exist before anything is modified.

Concurrency hardening (new in v0.3.0)

Two real race conditions found by the regression suite — predictable temp-file names in the object store and cache saves — are fixed with unique per-write names.

2How a rollback works

1. Plan

Compare the target snapshot with the current filesystem; enumerate every action and conflict.

2. Confirm

Conflicts require explicit confirmation — or the --yes flag.

3. Execute

Capture a safety checkpoint, then restore contents, links, and metadata.

4. Verify

Re-scan and confirm the filesystem matches the snapshot — content, kind, targets, permissions, mtimes.

varn init
varn checkpoint "before changes"
# ... make changes ...
varn diff <checkpoint-id>
varn restore <checkpoint-id>

Listing 1 — A working session: checkpoint, observe, roll back.

3Evaluation

Varn's numbers are engineering facts, not model scores: the size of the test suite, the breadth of the regression tree, and the guarantees the restore engine makes. All figures below are from the v0.3.0 repository.

Metric	Value	Notes
Test suite	442 tests, all platforms	Full suite runs on every commit
Regression tree	114+ named tests	One named test per field-reported bug, organized by OS
Platforms in CI	3 runners	ubuntu-latest, windows-latest, macos-latest on every commit
Field-tested	Windows 11 / NTFS	ACL, attribute, junction, and long-path regressions fixed in 0.2.x–0.3.0
Network calls	0	No telemetry, no accounts, no cloud

4Security hardening

The restore engine assumes an adversarial filesystem. Defenses, each tied to a named vulnerability class:

Symlink escape

Every ancestor directory is checked before any write, so a planted symlink cannot redirect it outside the managed root (CVE-2026-71556 class).

Hard-link aliasing

Hard-link targets are verified not to be symlinks, preventing inode aliasing of external files (CVE-2026-32232 class).

Object tampering

Content is re-hashed after leaving the store and before touching the disk — corrupted objects are caught before they overwrite user data.

Partial restores

A pre-flight check confirms every referenced object exists before anything is modified — a restore can fail, but it cannot fail halfway.

5Availability

Free and open source under MIT OR Apache-2.0. Prebuilt binaries for Linux, macOS, and Windows (x86_64, aarch64) on every release; the install script auto-detects the platform. Full command reference, ignore-pattern syntax, JSON output samples, and the safety model are on the documentation page.

Source and release archives: github.com/flawme/varn.

REFERENCES

Changelog — v0.3.0 release notes. github.com/flawme/varn/blob/main/CHANGELOG.md
Safety model — guarantees and the restore pipeline. github.com/flawme/varn/blob/main/docs/safety.md
Architecture — internals and design decisions. github.com/flawme/varn/blob/main/docs/architecture.md
Install script. raw.githubusercontent.com/flawme/varn/main/install.sh