Feature status

What Rivet does today, and what it does not do yet. Read the second half before you rely on the first — the gaps are the part worth knowing about.

Accurate as of v1.0.1. Rivet is stable: the CLI surface is frozen under semantic versioning (see the compatibility policy). Stable means the interface will not move under you, not that every limit below has been closed.

What works

Package capture. Detects Arch, Debian/Ubuntu, Fedora/RHEL, openSUSE, NixOS, Void, and macOS, and records selected native packages (Pacman/APT/DNF/Zypper/ XBPS/Homebrew), foreign packages (AUR, MacPorts), nix profile packages, Mac App Store apps, Flatpak applications, Snap packages including classic mode, and portable .AppImage files in conventional home locations.

Configuration capture. Curated groups for KDE Plasma, GNOME, Cinnamon, Xfce, Hyprland, Sway, niri, and i3; Bash, Zsh, Fish, Tmux, Git, Vim, and Neovim dotfiles; Kitty; VS Code; fonts and themes; user scripts. GNOME and Cinnamon also capture and replay their dconf settings through an explicit, reviewable hook command.

Snapshots. Creates a separate Git snapshot repository holding the selected configuration and package manifests; commits happen only when content changes. Snapshots are identified by local time and host, with an anonymous navigation README. Each snapshot also writes readable package lists beneath packages/ (native.txt, foreign.txt, nix.txt, snap.txt, flatpak.txt) plus a Markdown index; the structured data used for restore stays in manifest.toml.

Backends. Git by default, or a local/mounted NAS (fs), an rclone remote (rclone), or a restic repository (restic). Configuring more than one fans each snapshot out to all of them. fs and rclone encrypt every blob with age at rest by default; restic owns its own encryption. See Storage backends.

Review and drift. An interactive [x]/[ ] selection workflow, and rivet status reporting modified (M), newly found (A), and missing (D) files against the last snapshot. The terminal UI puts drift, history, per-file diffs, and the restore plan on one screen.

Secret safety. Known secret locations and common private-key/token signatures are rejected before Git staging, including captured hook output.

Restore. Always produces a plan before any overwrite, from the latest snapshot or an earlier one via restore --revision <git-ref>. Restoring across distro families resolves native packages through the cross-distro package map rather than guessing; --strict-packages narrows that to hand-curated matches only. With --apply --yes, installs approved native, AUR, Nix, Flatpak, and Snap packages, restores AppImages with their executable mode, restores in-root symlinks as symlinks, replays captured hooks, and preserves every replaced home file under ~/.local/state/rivet/rollback/.

Extensibility. rivet track ~/dev/scripts captures arbitrary paths with include/exclude globs, through the same pipeline as a built-in group. Declarative user plugins load from ~/.config/rivet/plugins/*.toml; a plugin’s hook commands are shown alongside the file that authorised them before anything runs. See Tracking & plugins.

Secrets vault. rivet vault add ~/.ssh/config declares a file that is sealed with age into every snapshot and restored to its original location and mode. The private identity stays at ~/.config/rivet/identity.age, optionally passphrase-wrapped, and never enters a snapshot. Multiple recipients allow multi-machine restore; an optional sops store integrates existing SOPS setups. See Secrets vault.

Known limits

Package installation needs sudo and existing tooling. Native package installation, system Flatpak, and Snap installation invoke sudo. AUR restore requires paru or yay to already be installed. Flatpak remotes and snapd must already be configured on the target system.

Interactive package toggles are incomplete. checklist --select offers per-source toggles for Pacman, AUR, AppImage, Snap, and Flatpak only. APT/DNF/Zypper/XBPS/Nix are captured by default on their respective distros with no per-manager toggle yet. Tracked for the selective-restore work.

The generated half of the package map is empty. packagemap/generated.toml ships empty until a maintainer runs rivet-pkgmap-gen against a real Repology export. Only the hand-curated map is populated today, so cross-distro restore resolves fewer packages than the design allows — unmapped packages become warnings, never guessed installs.

--push is Git-only. snapshot --push pushes Git after committing. It has no effect on fs/rclone/restic, which already write directly to their destination during snapshot. Omit it whenever you want to inspect the snapshot repository before publishing. If the configured GitHub repository was deleted, Rivet recreates that same private repository with gh and retries the push once.

At-rest backend encryption is single-recipient. The fs/rclone blob encryption has one recipient and no rotation, unlike the vault, which supports several. Both are built over the same age primitive.

Not implemented yet. No scheduled snapshots, no rollback command, and no capture support for Kate, browsers, SSH/GnuPG, or /etc.

Snapshot deletion is deliberately narrow. snapshot --delete-latest removes only the most recent commit, refuses when the snapshot repository is dirty or that commit is the only one remaining, and never rewrites earlier history.

Next steps

Roadmap for product direction, or the threat model for what Rivet does and does not defend against.