When to use
Without recovery, one bad action can destroy trust.
Example scenario: IDE agent sends invoice email; 8-second undo toast plus checkpoint restore in chat.
Anatomy
UI pieces that make this pattern recognizable.
- Chronological action list with timestamps and actors
- Per-action Undo or Restore checkpoint
- Time-limited undo for irreversible ops (send, purchase, deploy)
Guidance
Do
- Undo must be faster than re-doing the task manually
- Show what will be reverted before confirming
Avoid
- Do not ship an audit log without any recovery path
- Do not let undo silently fail for external side effects
Limitations
When this pattern adds friction or fails to help.
- Undo cannot retract external side effects (email sent, payment captured)
- Long audit lists without filters are hard to scan after long runs
- Checkpoints increase storage and complexity for builders
Build notes
Implementation hints for engineers shipping the pattern.
- Pair external actions with compensating transactions where possible
- For code agents, bind undo to VCS or checkpoint snapshots
Examples
Annotated screenshots from production products, with designer critique.
Replit Agent
Checkpoint with rollback
Context
After a long agent run, Replit surfaces a checkpoint card summarizing scope (23 messages, 84 actions), a human-readable change title, timestamp, and explicit Rollback here, Changes, and Preview actions—recovery is first-class, not buried in settings.
What works
- Action volume is visible before the user commits to rollback
- Rollback, diff, and preview are peer buttons—not a single destructive default
- Checkpoint title describes outcome in plain language, not file paths only
What to improve
- Per-action undo inside the 84 actions is not exposed on this card
- Rollback impact on env/DB should be summarized before confirm
Takeaway: Dev agents should bind trust to named checkpoints with one-click restore—chat transcripts alone are not an audit trail.
Replit Agent
Per-step action counts in chat
Context
During an Expo/React Native fix, Replit annotates each agent turn with a compact action ledger (e.g. 5 actions, 2 actions, 11 actions) and icon hints for edits, terminal, and reasoning—users can scan what happened before the run ends.
What works
- Action counts chunk long runs into inspectable steps
- Counts sit on the same timeline as narrative agent messages
- Icon strip hints at action types without opening a full log
What to improve
- Counts are not individually undoable from the chip
- Expanding a step to see file-level diffs may take extra clicks
Takeaway: Pair in-run action summaries with checkpoint rollback—users need both mid-run scanability and post-run recovery.