What Time Machine does not do

Safety tools have a habit of overselling. "Never lose work again." "Total peace of mind." The more a tool promises, the less you can tell what it actually covers, and the worse the surprise when it does not.

So here is the opposite: everything Time Machine does not do today. This list also lives in our docs, on the security page, and in a "Not restored" section on every recovery report.

It only restores captured project state

Time Machine saves your project folder. It does not restore databases, deployed versions, emails, payments, or anything else outside that folder. If an agent runs a migration that drops a table, your code comes back and the table does not. Keep real backups of your data. Every save point lists what it did not capture, so you know before you need it.

It does not store .env values

For files like .env, Time Machine saves the key names and a keyed fingerprint, never the values. Files whose name or content looks like a secret are skipped and listed. After a recovery, you set those values again by hand, and the report tells you which ones. Detection uses file names and patterns, so a secret that matches none of them, or one already committed to Git, is saved like any code.

One side effect: checks run with a clean environment. If your test suite needs a secret value to pass, the check may fail in the safe copy even though the code is fine. You can mark keys as plain in config.plain if their values are safe to save.

It is not a container

Checks run in host mode: a separate Git worktree on your own machine, with a clean environment and a time limit. The check runs as you. That is weaker isolation than a container, and every verdict says "host mode" so you never mistake one for the other. Container isolation with Docker, OrbStack or Apple's container tool is Planned.

With network: deny, the check runs inside a sandbox with the network off. If no sandbox is available, the check does not run and the verdict is BLOCKED. The setup step, like npm ci, still has the network, so it can install dependencies.

Its signature is not tamper proof

Save points and verdicts are signed with a key in ~/.timemachine. That catches accidental edits, and edits by tools that do not read the key. It does not stop someone who can read the key file. We say "signed", not "tamper proof".

It does not save everything in your folder

• Files over the size limit, 5 MB by default, are skipped and listed as missing.
• Symbolic links are not saved.
• Installed dependencies like node_modules are not saved. Only the lockfile fingerprint is kept, and the safe copy installs fresh.
• Files ignored by .gitignore are not saved, unless you list them in capture.include.

It does not prove your app is correct

A PASS means your check passed. If the check does not test the thing that broke, a PASS will not catch it. Time Machine is only as strict as the check you give it.

It does not push, merge, deploy or switch

This one is a choice, not a gap. Recover makes a new branch and a recovery copy next to your project. It never switches your folder or your current branch, and it never pushes, merges or deploys. You look first, then you decide.

It does not replace a disk backup

The store lives on the same disk as your project. If the disk dies, both go. Keep a real backup.

It does not trim its own store yet

Files are stored once by content and compressed, so repeats cost nothing. But the store only grows today. You can check it with du -sh ~/.timemachine. Automatic thinning with a size budget is Planned.

It is not on npm yet

The tm command works and is tested, but you build it from source for now. The npm package will be timetm. The web app opens with tm ui from the same source install. It runs on your computer, not on a website.

It does not cover what agents do outside code

Agents now send email, post to Slack and edit documents. Time Machine does not see any of that today. An action connector for Claude and ChatGPT is Planned, and even then it would never claim to unsend an email. It could hold an email before it goes out, or delete a Slack message, and it would say plainly what could not be reversed.

Why write this down

Because the moment you need a tool like this is the worst moment to learn its limits. If you know exactly where Time Machine stops, you can plan around it. If you find a limit that is not on this list, email preston@unvibe.site and it will be added.

Sources

1. Git documentation: git worktree
2. bubblewrap: the Linux sandbox used for network: deny
3. Anthropic: Claude Code checkpointing documentation