Private Repo: checkpoints an AI agent cannot lose
A checkpoint before the agent starts and one after it stops, encrypted on your machine, stored in your own Google Drive. HookGet holds an opaque id, a count and one health word — and could not read your code if it wanted to.
In short
- Zero knowledge, literally: your source, your
.git, your paths, your commit messages, your encryption key and your Drive login never leave your machine. - Checkpoints include uncommitted work — captured through a throwaway Git index, so your own index, HEAD and branches are never touched.
- Every checkpoint is a
git bundle. Restore needs your key and your storage; it does not need us. - Restore only ever writes into a new, empty directory. A recovery cannot destroy the work you were trying to save.
- Bring your own Drive, so the bytes are on a plan you already pay for. Free protects one repository on one machine, with manual checkpoints and 30 days of history.
Where this is, on 21 August 2026. The control plane is live: the
dashboard screen, the API and the MCP tools all run in production. The agent is written, tested
end to end — checkpoint, crash recovery, restore — and is not on npm yet, so
npx will not find it until it is published. If you want it before then, say so and
we will send it. We would rather publish this sentence than a page that implies otherwise.
The line, and exactly what is on each side of it
Never leaves your machine
- Your source filesevery byte, in the working tree you already have
- The
.gitdirectoryobjects, refs, branches, history - Commit messages and diffswhat changed and why you said it changed
- File and folder pathsincluding the ones whose names are the secret
- The repository keyAES-256, generated locally, stored in the OS keychain
- Your Google Drive loginthe OAuth token, held by the agent, never transmitted
Everything HookGet stores
repository_id repo_8Fq2c1a hash the agent derived on your machinehealth_code drive_unreachableone of six words. Not a log linelast_checkpoint_at 2026-08-26T09:14Zwhen, not whatcommit_count 38how many, not whichencrypted_bytes 4 812 004the size of the ciphertextencrypted_pack_hash sha256:9c1f…of the encrypted bundle, not the sourcestorage_object_id drive:1aB…an id in YOUR Drive. We cannot open it
What one AI agent run looks like
-
09:12
Before the agent startsWorking tree packed, encrypted, uploaded. 4.8 MB.
pre_ai - 09:12 The agent runsRefactor across 41 files. No checkpoint is taken mid-run — a half-finished state is not a state worth returning to.
-
09:31
After the agent stopsSecond checkpoint. Now you have both, and you can diff them locally.
post_ai -
09:34
You decideKeep it, or restore 09:12 into a fresh directory. Restore never writes over a working tree.
local
When something breaks
| What fails | What happens | What you do |
|---|---|---|
| HookGet is unreachable | The checkpoint is packed, encrypted and uploaded as usual; only the report waits in a local journal | Nothing. resume reports it when the connection is back |
| Google Drive is unreachable | The encrypted bundle waits in a local spool and the repository shows drive_unreachable | Nothing is lost; the next run uploads the spooled bundle |
| The upload dies at 90% | The resumable session is journalled, and the next run asks Drive what it already holds | Nothing — it continues from that byte, not from zero |
| The machine dies | Every checkpoint is in your Drive, encrypted | Restore on a new machine with your recovery key and import-key |
| You lose the recovery key and the machine | The bundles are unreadable — by you and by us | Nothing we can do. This is the trade-off, and it is stated at init |
What using it looks like
# once per repository
hookget-private-repo init --storage drive --label "Work laptop"
# a checkpoint, by hand
hookget-private-repo checkpoint
# the pair around an agent run (Personal and up)
hookget-private-repo checkpoint --reason pre_ai
claude # …or any agent that rewrites your files
hookget-private-repo checkpoint --reason post_ai
# a restore, into a NEW directory, always
hookget-private-repo restore cp_9f21… ../recoveredEvery command is also a JSON command (--json), because the agent is
meant to be wrapped: a Git hook, a pre-run step in your agent harness, a scheduled job. And
status prints the whole of what leaves your machine, every time you ask it, rather
than making you take our word for it from a page like this one.
Where the bytes live is your decision. Google Drive is the default because
most people already have one. --storage local:/path points the agent at any folder
instead — an external disk, a NAS mount, or the folder your Drive, Dropbox or OneDrive client
already syncs. Same encryption, same restore, no OAuth token anywhere.
Questions
Can HookGet read my code?
No, and not as a policy — as an arithmetic fact. The bundle is encrypted on your machine with AES-256-GCM under a key generated on your machine and held in your operating system's keystore. That key is never transmitted, and the bundle is stored in your Google Drive. HookGet holds a hash of the ciphertext and an object id in a Drive it cannot open. If a court order arrived tomorrow demanding your source, the complete answer we could give is the right-hand column of the diagram above.
What happens if I lose the key?
Your backups become unreadable — by you as well as by us. That is the trade-off you
are buying and the agent says it in those words, on screen, at init, and prints
the recovery key once so you can put it somewhere else. Any product that offers zero
knowledge and account recovery is offering one of the two.
Does it interfere with my Git repository?
It cannot. A checkpoint is built in a throwaway index file, so your index, your HEAD,
your branches and your working tree are untouched — there is a test that asserts exactly
that, byte for byte, before and after. Uncommitted work is included, which
is the point: the state worth restoring is the one you had a minute before the agent started,
not the last time you remembered to commit. Files your .gitignore excludes stay
excluded.
What if HookGet is down when I need a checkpoint?
The checkpoint still happens. Pack, encrypt and upload all run locally against your own
storage; HookGet is told afterwards, and if it cannot be reached the report waits in a local
journal for hookget-private-repo resume. The control plane can be behind reality
and never ahead of it — a repository we show as protected always is.
And if HookGet disappears entirely?
You still have everything. Each checkpoint is a git bundle, encrypted with
your key, in your Drive. hookget-private-repo restore --object drive:… works with
the control plane switched off, and a bundle is a file git itself can clone from
with no tool of ours involved at all.
I commit fifty thousand times a month. Is that a problem?
No, because the server never sees a commit. The agent coalesces bursts into checkpoints and reports a manifest — a repository doing 50,000 commits reports tens or hundreds of rows, not fifty thousand, and the counters are BIGINT with an idempotent write path, so a retried report cannot bill you twice. There is a test that pushes 50,000 commits through one manifest and asserts exactly that.
Is this a replacement for GitHub?
No. It is a safety net under the machine you actually work on — the one place your uncommitted work exists. Keep pushing to whatever remote you use; this protects the hours between pushes, and specifically the hours an AI agent is rewriting files.