@covro/covro 0.2.1-dev.5 → 0.2.1-dev.7

package/README.md

@@ -30,7 +30,8 @@
 ## ✨ What you can do
 
 - 📱 **Step away from your desk. Stay with the task.** Follow tool activity, inspect file changes, handle permission requests, and answer Codex's questions from your computer or phone. Closing the page doesn't cancel the task.
-- 💬 **Start without a project.** Use **新建会话** (New conversation) to start in an automatically assigned directory. Conversations and files stay available after refresh, restart, or archive.
+- 💬 **Start without a project.** Use **New session** to start in an automatically assigned directory. Conversations and files stay available after refresh, restart, or archive.
+- 🌐 **Choose your interface language.** Switch between 简体中文, English, 日本語 and 한국어 without leaving your session. Prompts, replies, tool output and paths remain unchanged. [Localization details](docs/i18n.md).
 - 🗂️ **See every project in one place.** Run independent tasks in parallel and spot which conversations are working, waiting for approval, or ready to read.
 - 💬 **Pick up your Codex CLI conversations.** Browse saved history, resume existing work, or fork a new direction. Rename conversations to find them later and archive them when you're done. View and copy the full Thread ID in conversation details or diagnostics.
 - ⚡ **Open long conversations sooner.** Recent messages appear first; scrolling preloads older history. On this device, cached conversation lists and history pages appear while the server checks for updates. [Loading and cache behavior](docs/session-history.md).
@@ -38,6 +39,7 @@
 - 🔎 **Inspect code changes.** Open Codex’s saved patches for a turn or tool in the same read-only panel. Scroll through all files, inspect line numbers, see the exact words changed within each line, and jump between change blocks. Long diffs start collapsed and render when expanded. File headers stay visible while scrolling so you can collapse the current file.
 - ✍️ **Switch tasks without losing your draft.** Each conversation keeps its own draft, pasted images, and model settings in the current page. Copy or export results when you're done.
 - 🖥️ **Run a command beside your task.** Open **Shell** to execute commands in the selected project's directory, follow stdout/stderr, interrupt a run, and reuse recent commands. The panel uses Codex's configured sandbox, with a ten-minute limit and no interactive input. Closing it keeps the command running. [Capabilities and limits](docs/shell.md).
+- 🛟 **Keep a recovery point.** Open **Backups and recovery** in the sidebar to create a server-side backup, follow its progress and review verified snapshots. Upgrades use the same backup engine. Recovery runs offline through the CLI. [Scope and recovery instructions](docs/backups.md).
 
 Mermaid diagrams render locally after their code fence closes, with automatic light/dark colors. Failed diagrams keep their source; rendering is limited to 50,000 source characters and 500 edges.
 
@@ -51,7 +53,7 @@ Mermaid diagrams render locally after their code fence closes, with automatic li
 
 ## 🚀 Get started
 
-You need **Node.js 24.19 or later in the 24.x line** and an installed, signed-in **Codex CLI**. The interface currently uses Simplified Chinese.
+You need **Node.js 24.19 or later in the 24.x line** and an installed, signed-in **Codex CLI**. The interface supports Simplified Chinese, English, Japanese and Korean. Choose **Language** in the sidebar; the first visit follows your browser preferences, and manual choices are saved on this device.
 
 <!-- codex-compatibility:start -->
 
@@ -105,9 +107,9 @@ pnpm build
 pnpm start -- --config ./config.local.json
 ```
 
-Open **<http://127.0.0.1:8787>** and click **＋** beside **未关联项目** (Unassigned) in the sidebar to send a task without choosing a project.
+Open **<http://127.0.0.1:8787>** and click **＋** beside **Unassigned** in the sidebar to send a task without choosing a project.
 
-To work in a project directory, click **添加项目** (Add project), then choose an existing host directory or **克隆 Git 仓库** (Clone Git repository). For cloning, enter an HTTPS/SSH repository address, an absolute destination on the host, and an optional project name. Git must be available to the service and uses the host’s existing credentials. Follow progress or cancel in the dialog; once imported, open the project and send your first task. [Clone requirements and recovery](docs/project-clone.md).
+To work in a project directory, click **Add project**, then choose an existing host directory or **Clone Git repository**. For cloning, enter an HTTPS/SSH repository address, an absolute destination on the host, and an optional project name. Git must be available to the service and uses the host’s existing credentials. Follow progress or cancel in the dialog; once imported, open the project and send your first task. [Clone requirements and recovery](docs/project-clone.md).
 
 Unassigned conversations use separate directories under `<dataDir>/workspaces/`, allocated on the first send. Their files are retained until you explicitly remove them; archiving does not delete files. See [conversation workspaces](docs/workspaces.md) for directory, recovery, and backup details.
 
@@ -149,6 +151,12 @@ Each release declares its recommended and verified Codex CLI versions. The updat
 
 Automatic installation is off by default. Managed upgrades support **macOS and Linux npm global installations**; source, linked, container, and Windows installations use their original update method. A failed candidate is rolled back before business writes resume; downgrades must pass database compatibility checks. Old backups are retained without automatic rotation.
 
+DB Schema **6** is tracked independently of the application version. Releases declare the schema and the verified backup migration range; an older application cannot open a newer database. See [database compatibility](docs/database.md).
+
+Managed upgrades create and validate a private backup of the Covro database and service configuration before replacing the installation. A failed backup blocks activation. These snapshots do not include Codex history, credentials or project files. See [backup scope](docs/backups.md).
+
+Use `covro backup create`, `covro backup list` and `covro backup verify ID` for manual snapshots. Preview offline recovery with `covro backup restore ID`; stop the service and repeat with `--confirm ID` to apply it. See [recovery instructions](docs/backups.md#manual-backups-and-offline-recovery).
+
 See [distribution and recovery](docs/distribution.md) and [release operations](docs/releases.md) for details.
 
 ## Your computer, your workspace

package/README.zh-CN.md

@@ -31,6 +31,7 @@
 
 - 📱 **离开电脑，也能跟进任务。** 在电脑或手机上查看工具活动与文件变更、处理权限审批、回答 Codex 的问题。关闭页面，任务仍会继续。
 - 💬 **无需项目，也能直接开始。** 点击 **新建会话**，应用自动分配独立目录；刷新、重启或归档后，会话和文件仍保留。
+- 🌐 **选择界面语言。** 支持简体中文、English、日本語和 한국어，会话内即可切换；输入、回复、工具原文和路径保持不变。[多语言说明](docs/i18n.md)。
 - 🗂️ **多个项目，一眼掌握进展。** 让独立任务并行执行，随时看到哪些会话正在工作、等待审批，哪些已有结果可读。
 - 💬 **接着你的 Codex CLI 会话。** 浏览已有历史、恢复工作，或 Fork 一个新方向；为会话命名以便查找，完成后归档。在会话详情或状态诊断中查看、复制完整 Thread ID。
 - ⚡ **更快打开长会话。** 优先显示最近消息，向上滚动时提前加载历史；本机会话列表和历史分片可先显示缓存，再由服务端核对更新。[加载与缓存说明](docs/session-history.md)。
@@ -38,6 +39,7 @@
 - 🔎 **逐行查看代码变更。** 在同一只读预览窗口查看某轮或某工具的 Codex 补丁快照，按顺序连续浏览全部文件，支持行号、行内文字高亮和区块跳转；长 diff 默认折叠，展开后按需渲染，阅读时文件标题栏吸顶，随时收起当前文件。
 - ✍️ **切换任务，草稿还在。** 每个会话分别保留当前页面中的草稿、粘贴图片和模型设置；完成后可以复制或导出结果。
 - 🖥️ **在任务旁运行命令。** 打开 **Shell**，在所选项目目录执行命令、查看实时标准输出和错误输出、中断执行，并复用近期命令。面板沿用 Codex 配置的沙箱，最长运行十分钟，不支持交互输入；关闭面板后命令仍继续运行。[能力与限制](docs/shell.md)。
+- 🛟 **保留可恢复的数据快照。** 从侧栏打开**备份与恢复**，手动创建服务端备份，查看进度和已验证的记录；升级前使用同一套备份能力。恢复通过停服后的 CLI 执行。[范围与恢复步骤](docs/backups.md)。
 
 Mermaid 图表在代码块闭合后于本地渲染，自动适配浅色/深色。渲染失败时保留源码；渲染上限为 50,000 个源码字符、500 条边。
 
@@ -51,7 +53,7 @@ Mermaid 图表在代码块闭合后于本地渲染，自动适配浅色/深色
 
 ## 🚀 开始使用
 
-需要 **Node.js 24.x，版本不低于 24.19**，以及已经安装、登录的 **Codex CLI**。界面目前使用简体中文。
+需要 **Node.js 24.x，版本不低于 24.19**，以及已经安装、登录的 **Codex CLI**。界面支持简体中文、英语、日语和韩语。在侧栏选择「语言」；首次访问按浏览器偏好匹配，手动选择会保存在当前设备。
 
 <!-- codex-compatibility:start -->
 
@@ -149,6 +151,12 @@ covro update --channel dev
 
 自动安装默认关闭。受管升级支持 **macOS 和 Linux 的 npm 全局安装**；源码、链接、容器和 Windows 安装沿用原更新方式。候选版本失败时，会在重新开放业务写入前回滚；降级需通过数据库兼容检查。旧备份会保留，暂不自动轮转。
 
+DB Schema **6** 独立于应用版本管理。发行版声明 Schema 及经过验证的备份迁移范围；旧应用不能打开更新的数据库。详见[数据库兼容规则](docs/database.md)。
+
+受管升级会在替换安装前创建并验证私有备份，覆盖 Covro 数据库与服务配置；备份失败会阻止激活。快照不包含 Codex 历史、凭据或项目文件。详见[备份范围](docs/backups.md)。
+
+使用 `covro backup create`、`covro backup list` 和 `covro backup verify ID` 创建与检查手动备份。先运行 `covro backup restore ID` 预检；停服后加 `--confirm ID` 执行恢复。详见[恢复步骤](docs/backups.md#manual-backups-and-offline-recovery)。
+
 详细说明见[分发与恢复](docs/distribution.md)、[发版操作](docs/releases.md)。
 
 ## 你的电脑，你的工作台

package/dist/backups/factory.js

@@ -0,0 +1,22 @@
+import Database from "better-sqlite3";
+import { packageInfo, paths } from "../cli/paths.js";
+import { databaseCompatibilitySchema } from "../shared/database.js";
+import { readMigrations } from "../server/db/history.js";
+import { runtimeMigrationsFolder } from "../server/db/migrate.js";
+import { BackupStore, backupDirectory } from "./store.js";
+function createBackupStore(config, dataDir, migrationsFolder = runtimeMigrationsFolder) {
+  return new BackupStore({
+    directory: backupDirectory(paths(config).home, dataDir),
+    config,
+    dataDir,
+    appVersion: packageInfo.version,
+    commit: packageInfo.covroCommit,
+    contract: databaseCompatibilitySchema.parse(packageInfo.covroDatabase),
+    migrations: readMigrations(migrationsFolder),
+    Sqlite: Database
+  });
+}
+export {
+  createBackupStore
+};
+//# sourceMappingURL=factory.js.map

package/dist/backups/factory.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/backups/factory.ts"],
+  "sourcesContent": ["import Database from 'better-sqlite3';\nimport { packageInfo, paths } from '../cli/paths.js';\nimport { databaseCompatibilitySchema } from '../shared/database.js';\nimport { readMigrations } from '../server/db/history.js';\nimport { runtimeMigrationsFolder } from '../server/db/migrate.js';\nimport { BackupStore, backupDirectory } from './store.js';\n\nexport function createBackupStore(\n  config: string,\n  dataDir: string,\n  migrationsFolder = runtimeMigrationsFolder,\n) {\n  return new BackupStore({\n    directory: backupDirectory(paths(config).home, dataDir),\n    config,\n    dataDir,\n    appVersion: packageInfo.version,\n    commit: packageInfo.covroCommit,\n    contract: databaseCompatibilitySchema.parse(packageInfo.covroDatabase),\n    migrations: readMigrations(migrationsFolder),\n    Sqlite: Database,\n  });\n}\n"],
+  "mappings": "AAAA,OAAO,cAAc;AACrB,SAAS,aAAa,aAAa;AACnC,SAAS,mCAAmC;AAC5C,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC,SAAS,aAAa,uBAAuB;AAEtC,SAAS,kBACd,QACA,SACA,mBAAmB,yBACnB;AACA,SAAO,IAAI,YAAY;AAAA,IACrB,WAAW,gBAAgB,MAAM,MAAM,EAAE,MAAM,OAAO;AAAA,IACtD;AAAA,IACA;AAAA,IACA,YAAY,YAAY;AAAA,IACxB,QAAQ,YAAY;AAAA,IACpB,UAAU,4BAA4B,MAAM,YAAY,aAAa;AAAA,IACrE,YAAY,eAAe,gBAAgB;AAAA,IAC3C,QAAQ;AAAA,EACV,CAAC;AACH;",
+  "names": []
+}

package/dist/backups/lock.js

@@ -0,0 +1,22 @@
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import lockfile from "proper-lockfile";
+import { AppError } from "../shared/errors.js";
+async function acquireMaintenanceLock(dataDir) {
+  try {
+    const directory = join(dataDir, ".covro-maintenance");
+    await mkdir(directory, { recursive: true, mode: 448 });
+    return await lockfile.lock(directory, {
+      realpath: true,
+      stale: 1e4,
+      update: 2e3,
+      retries: 0
+    });
+  } catch {
+    throw new AppError("MAINTENANCE_BUSY", "\u5DF2\u6709\u5907\u4EFD\u3001\u5347\u7EA7\u6216\u6062\u590D\u6B63\u5728\u5904\u7406\uFF0C\u8BF7\u5B8C\u6210\u540E\u91CD\u8BD5\u3002", 409);
+  }
+}
+export {
+  acquireMaintenanceLock
+};
+//# sourceMappingURL=lock.js.map

package/dist/backups/lock.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/backups/lock.ts"],
+  "sourcesContent": ["import { mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport lockfile from 'proper-lockfile';\nimport { AppError } from '../shared/errors.js';\n\n/** Shared by live manual snapshots, update workers and offline restoration. */\nexport async function acquireMaintenanceLock(dataDir: string) {\n  try {\n    const directory = join(dataDir, '.covro-maintenance');\n    await mkdir(directory, { recursive: true, mode: 0o700 });\n    return await lockfile.lock(directory, {\n      realpath: true,\n      stale: 10_000,\n      update: 2_000,\n      retries: 0,\n    });\n  } catch {\n    throw new AppError('MAINTENANCE_BUSY', '\u5DF2\u6709\u5907\u4EFD\u3001\u5347\u7EA7\u6216\u6062\u590D\u6B63\u5728\u5904\u7406\uFF0C\u8BF7\u5B8C\u6210\u540E\u91CD\u8BD5\u3002', 409);\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,OAAO,cAAc;AACrB,SAAS,gBAAgB;AAGzB,eAAsB,uBAAuB,SAAiB;AAC5D,MAAI;AACF,UAAM,YAAY,KAAK,SAAS,oBAAoB;AACpD,UAAM,MAAM,WAAW,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvD,WAAO,MAAM,SAAS,KAAK,WAAW;AAAA,MACpC,UAAU;AAAA,MACV,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,SAAS,oBAAoB,wIAA0B,GAAG;AAAA,EACtE;AACF;",
+  "names": []
+}

package/dist/backups/manager.js

@@ -0,0 +1,170 @@
+import { setTimeout } from "node:timers/promises";
+import { z } from "zod";
+import { AppError } from "../shared/errors.js";
+import { acquireMaintenanceLock } from "./lock.js";
+import { backupFailure } from "./store.js";
+const backupRequestSchema = z.object({ clientOperationId: z.string().uuid() }).strict();
+const ongoing = (record) => ["waiting", "copying", "verifying"].includes(record.phase);
+class BackupManager {
+  constructor(store, service, options = {}) {
+    this.store = store;
+    this.service = service;
+    this.options = options;
+  }
+  store;
+  service;
+  options;
+  active;
+  abort;
+  task;
+  closed = false;
+  async status() {
+    const records = (await this.store.list()).map(
+      (record) => this.active?.id === record.id ? this.active : ongoing(record) ? {
+        ...record,
+        phase: "interrupted",
+        message: "\u5907\u4EFD\u8FDB\u7A0B\u5DF2\u4E2D\u65AD\uFF0C\u672A\u751F\u6210\u53EF\u6062\u590D\u5FEB\u7167\u3002"
+      } : record
+    );
+    return {
+      directory: this.store.options.directory,
+      schemaVersion: this.store.options.contract.schemaVersion,
+      records,
+      active: this.active,
+      supported: !this.options.unsupportedReason,
+      unsupportedReason: this.options.unsupportedReason
+    };
+  }
+  async start(input) {
+    const { clientOperationId: id } = backupRequestSchema.parse(input);
+    if (this.closed) throw new AppError("BACKUP_UNAVAILABLE", "\u670D\u52A1\u6B63\u5728\u5173\u95ED\u3002", 503);
+    if (this.options.unsupportedReason)
+      throw new AppError("BACKUP_UNAVAILABLE", this.options.unsupportedReason, 409);
+    if (this.active?.id === id || (await this.store.list()).some((record2) => record2.id === id))
+      return this.status();
+    if (this.active) throw new AppError("BACKUP_BUSY", "\u5DF2\u6709\u5907\u4EFD\u6B63\u5728\u5904\u7406\u3002", 409);
+    if (this.service.isInMaintenance()) throw this.service.maintenanceError();
+    const release = await acquireMaintenanceLock(this.store.options.dataDir);
+    if (this.closed) {
+      await release();
+      throw new AppError("BACKUP_UNAVAILABLE", "\u670D\u52A1\u6B63\u5728\u5173\u95ED\u3002", 503);
+    }
+    const abort = new AbortController();
+    const record = {
+      id,
+      phase: "waiting",
+      trigger: "manual",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      path: this.store.path(id),
+      message: "\u7B49\u5F85\u4EFB\u52A1\u3001\u5BA1\u6279\u3001\u8F93\u5165\u53CA\u5F85\u6838\u5BF9\u64CD\u4F5C\u7ED3\u675F"
+    };
+    this.active = record;
+    this.abort = abort;
+    const preparation = this.store.record(record);
+    this.task = (async () => {
+      try {
+        await preparation;
+      } catch {
+        await release();
+        this.active = void 0;
+        this.abort = void 0;
+        return;
+      }
+      await this.run(record, abort, release);
+    })();
+    try {
+      await preparation;
+    } catch (error) {
+      throw new AppError("BACKUP_FAILED", backupFailure(error), 500);
+    }
+    return this.status();
+  }
+  async run(record, abort, release) {
+    let gated = false;
+    try {
+      for (; ; ) {
+        abort.signal.throwIfAborted();
+        if (Date.now() - record.createdAt > (this.options.timeoutMs ?? 30 * 6e4))
+          throw new AppError("BACKUP_TIMEOUT", "\u7B49\u5F85\u5B89\u5168\u70B9\u8D85\u65F6\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002", 409);
+        const result = this.service.prepareUpdate("backup");
+        if (result.ready) {
+          gated = true;
+          break;
+        }
+        if (record.message !== result.reason) {
+          record.message = result.reason ?? "\u7B49\u5F85\u4EFB\u52A1\u7ED3\u675F";
+          record.updatedAt = Date.now();
+          await this.store.record(record);
+        }
+        await setTimeout(this.options.pollMs ?? 250, void 0, { signal: abort.signal });
+      }
+      await this.store.create({
+        id: record.id,
+        trigger: "manual",
+        reserved: true,
+        signal: abort.signal,
+        progress: (next) => {
+          this.active = next;
+        }
+      });
+    } catch (error) {
+      if (this.active?.phase !== "failed" && this.active?.phase !== "cancelled") {
+        record.phase = abort.signal.aborted ? "cancelled" : "failed";
+        record.message = abort.signal.aborted ? "\u5907\u4EFD\u5DF2\u53D6\u6D88\u3002" : error instanceof AppError ? error.message : backupFailure(error);
+        record.updatedAt = Date.now();
+        await this.store.record(record).catch(() => {
+        });
+      }
+    } finally {
+      if (gated) this.service.setMaintenance(false);
+      await release();
+      this.active = void 0;
+      this.abort = void 0;
+    }
+  }
+  async cancel(id) {
+    if (this.active?.id === id) {
+      this.abort?.abort();
+      await this.task;
+    }
+    return this.status();
+  }
+  async verify(id) {
+    if (this.active && !ongoing(this.active)) await this.task;
+    if (this.active) throw new AppError("BACKUP_BUSY", "\u8BF7\u7B49\u5F85\u5F53\u524D\u5907\u4EFD\u5B8C\u6210\u3002", 409);
+    try {
+      await this.store.verify(id);
+      const record = (await this.store.list()).find((entry) => entry.id === id);
+      if (record)
+        await this.store.record({
+          ...record,
+          phase: "succeeded",
+          message: "\u5907\u4EFD\u5DF2\u91CD\u65B0\u9A8C\u8BC1\uFF0C\u5B8C\u6574\u6027\u68C0\u67E5\u901A\u8FC7\u3002",
+          updatedAt: Date.now()
+        });
+    } catch {
+      const record = (await this.store.list()).find((entry) => entry.id === id);
+      if (record)
+        await this.store.record({
+          ...record,
+          phase: "corrupt",
+          message: "\u5907\u4EFD\u635F\u574F\u3001\u4E0D\u5B8C\u6574\u6216\u4E0E\u5F53\u524D\u7248\u672C\u4E0D\u517C\u5BB9\uFF0C\u4E0D\u80FD\u6062\u590D\u3002",
+          updatedAt: Date.now()
+        }).catch(() => {
+        });
+      throw new AppError("BACKUP_INVALID", "\u5907\u4EFD\u635F\u574F\u3001\u4E0D\u5B8C\u6574\u6216\u4E0E\u5F53\u524D\u7248\u672C\u4E0D\u517C\u5BB9\uFF0C\u4E0D\u80FD\u6062\u590D\u3002", 409);
+    }
+    return this.status();
+  }
+  async close() {
+    this.closed = true;
+    this.abort?.abort();
+    await this.task;
+  }
+}
+export {
+  BackupManager,
+  backupRequestSchema
+};
+//# sourceMappingURL=manager.js.map

package/dist/backups/manager.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/backups/manager.ts"],
+  "sourcesContent": ["import { setTimeout } from 'node:timers/promises';\nimport { z } from 'zod';\nimport type { BackupController, BackupRecord, BackupStatus } from '../shared/backups.js';\nimport { AppError } from '../shared/errors.js';\nimport type { GatewayService } from '../server/service.js';\nimport { acquireMaintenanceLock } from './lock.js';\nimport { backupFailure, type BackupStore } from './store.js';\n\nexport const backupRequestSchema = z.object({ clientOperationId: z.string().uuid() }).strict();\nconst ongoing = (record: BackupRecord) =>\n  ['waiting', 'copying', 'verifying'].includes(record.phase);\n\nexport class BackupManager implements BackupController {\n  private active?: BackupRecord;\n  private abort?: AbortController;\n  private task?: Promise<void>;\n  private closed = false;\n  constructor(\n    readonly store: BackupStore,\n    private readonly service: GatewayService,\n    private readonly options: {\n      pollMs?: number;\n      timeoutMs?: number;\n      unsupportedReason?: string;\n    } = {},\n  ) {}\n  async status(): Promise<BackupStatus> {\n    const records = (await this.store.list()).map((record) =>\n      this.active?.id === record.id\n        ? this.active\n        : ongoing(record)\n          ? {\n              ...record,\n              phase: 'interrupted' as const,\n              message: '\u5907\u4EFD\u8FDB\u7A0B\u5DF2\u4E2D\u65AD\uFF0C\u672A\u751F\u6210\u53EF\u6062\u590D\u5FEB\u7167\u3002',\n            }\n          : record,\n    );\n    return {\n      directory: this.store.options.directory,\n      schemaVersion: this.store.options.contract.schemaVersion,\n      records,\n      active: this.active,\n      supported: !this.options.unsupportedReason,\n      unsupportedReason: this.options.unsupportedReason,\n    };\n  }\n  async start(input: { clientOperationId: string }) {\n    const { clientOperationId: id } = backupRequestSchema.parse(input);\n    if (this.closed) throw new AppError('BACKUP_UNAVAILABLE', '\u670D\u52A1\u6B63\u5728\u5173\u95ED\u3002', 503);\n    if (this.options.unsupportedReason)\n      throw new AppError('BACKUP_UNAVAILABLE', this.options.unsupportedReason, 409);\n    if (this.active?.id === id || (await this.store.list()).some((record) => record.id === id))\n      return this.status();\n    if (this.active) throw new AppError('BACKUP_BUSY', '\u5DF2\u6709\u5907\u4EFD\u6B63\u5728\u5904\u7406\u3002', 409);\n    if (this.service.isInMaintenance()) throw this.service.maintenanceError();\n    const release = await acquireMaintenanceLock(this.store.options.dataDir);\n    if (this.closed) {\n      await release();\n      throw new AppError('BACKUP_UNAVAILABLE', '\u670D\u52A1\u6B63\u5728\u5173\u95ED\u3002', 503);\n    }\n    const abort = new AbortController();\n    const record: BackupRecord = {\n      id,\n      phase: 'waiting',\n      trigger: 'manual',\n      createdAt: Date.now(),\n      updatedAt: Date.now(),\n      path: this.store.path(id),\n      message: '\u7B49\u5F85\u4EFB\u52A1\u3001\u5BA1\u6279\u3001\u8F93\u5165\u53CA\u5F85\u6838\u5BF9\u64CD\u4F5C\u7ED3\u675F',\n    };\n    this.active = record;\n    this.abort = abort;\n    const preparation = this.store.record(record);\n    this.task = (async () => {\n      try {\n        await preparation;\n      } catch {\n        await release();\n        this.active = undefined;\n        this.abort = undefined;\n        return;\n      }\n      await this.run(record, abort, release);\n    })();\n    try {\n      await preparation;\n    } catch (error) {\n      throw new AppError('BACKUP_FAILED', backupFailure(error), 500);\n    }\n    return this.status();\n  }\n  private async run(record: BackupRecord, abort: AbortController, release: () => Promise<void>) {\n    let gated = false;\n    try {\n      for (;;) {\n        abort.signal.throwIfAborted();\n        if (Date.now() - record.createdAt > (this.options.timeoutMs ?? 30 * 60_000))\n          throw new AppError('BACKUP_TIMEOUT', '\u7B49\u5F85\u5B89\u5168\u70B9\u8D85\u65F6\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002', 409);\n        const result = this.service.prepareUpdate('backup');\n        if (result.ready) {\n          gated = true;\n          break;\n        }\n        if (record.message !== result.reason) {\n          record.message = result.reason ?? '\u7B49\u5F85\u4EFB\u52A1\u7ED3\u675F';\n          record.updatedAt = Date.now();\n          await this.store.record(record);\n        }\n        await setTimeout(this.options.pollMs ?? 250, undefined, { signal: abort.signal });\n      }\n      await this.store.create({\n        id: record.id,\n        trigger: 'manual',\n        reserved: true,\n        signal: abort.signal,\n        progress: (next) => {\n          this.active = next;\n        },\n      });\n    } catch (error) {\n      if (this.active?.phase !== 'failed' && this.active?.phase !== 'cancelled') {\n        record.phase = abort.signal.aborted ? 'cancelled' : 'failed';\n        record.message = abort.signal.aborted\n          ? '\u5907\u4EFD\u5DF2\u53D6\u6D88\u3002'\n          : error instanceof AppError\n            ? error.message\n            : backupFailure(error);\n        record.updatedAt = Date.now();\n        await this.store.record(record).catch(() => {});\n      }\n    } finally {\n      if (gated) this.service.setMaintenance(false);\n      await release();\n      this.active = undefined;\n      this.abort = undefined;\n    }\n  }\n  async cancel(id: string) {\n    if (this.active?.id === id) {\n      this.abort?.abort();\n      await this.task;\n    }\n    return this.status();\n  }\n  async verify(id: string) {\n    if (this.active && !ongoing(this.active)) await this.task;\n    if (this.active) throw new AppError('BACKUP_BUSY', '\u8BF7\u7B49\u5F85\u5F53\u524D\u5907\u4EFD\u5B8C\u6210\u3002', 409);\n    try {\n      await this.store.verify(id);\n      const record = (await this.store.list()).find((entry) => entry.id === id);\n      if (record)\n        await this.store.record({\n          ...record,\n          phase: 'succeeded',\n          message: '\u5907\u4EFD\u5DF2\u91CD\u65B0\u9A8C\u8BC1\uFF0C\u5B8C\u6574\u6027\u68C0\u67E5\u901A\u8FC7\u3002',\n          updatedAt: Date.now(),\n        });\n    } catch {\n      const record = (await this.store.list()).find((entry) => entry.id === id);\n      if (record)\n        await this.store\n          .record({\n            ...record,\n            phase: 'corrupt',\n            message: '\u5907\u4EFD\u635F\u574F\u3001\u4E0D\u5B8C\u6574\u6216\u4E0E\u5F53\u524D\u7248\u672C\u4E0D\u517C\u5BB9\uFF0C\u4E0D\u80FD\u6062\u590D\u3002',\n            updatedAt: Date.now(),\n          })\n          .catch(() => {});\n      throw new AppError('BACKUP_INVALID', '\u5907\u4EFD\u635F\u574F\u3001\u4E0D\u5B8C\u6574\u6216\u4E0E\u5F53\u524D\u7248\u672C\u4E0D\u517C\u5BB9\uFF0C\u4E0D\u80FD\u6062\u590D\u3002', 409);\n    }\n    return this.status();\n  }\n  async close() {\n    this.closed = true;\n    this.abort?.abort();\n    await this.task;\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAElB,SAAS,gBAAgB;AAEzB,SAAS,8BAA8B;AACvC,SAAS,qBAAuC;AAEzC,MAAM,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO;AAC7F,MAAM,UAAU,CAAC,WACf,CAAC,WAAW,WAAW,WAAW,EAAE,SAAS,OAAO,KAAK;AAEpD,MAAM,cAA0C;AAAA,EAKrD,YACW,OACQ,SACA,UAIb,CAAC,GACL;AAPS;AACQ;AACA;AAAA,EAKhB;AAAA,EAPQ;AAAA,EACQ;AAAA,EACA;AAAA,EAPX;AAAA,EACA;AAAA,EACA;AAAA,EACA,SAAS;AAAA,EAUjB,MAAM,SAAgC;AACpC,UAAM,WAAW,MAAM,KAAK,MAAM,KAAK,GAAG;AAAA,MAAI,CAAC,WAC7C,KAAK,QAAQ,OAAO,OAAO,KACvB,KAAK,SACL,QAAQ,MAAM,IACZ;AAAA,QACE,GAAG;AAAA,QACH,OAAO;AAAA,QACP,SAAS;AAAA,MACX,IACA;AAAA,IACR;AACA,WAAO;AAAA,MACL,WAAW,KAAK,MAAM,QAAQ;AAAA,MAC9B,eAAe,KAAK,MAAM,QAAQ,SAAS;AAAA,MAC3C;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,WAAW,CAAC,KAAK,QAAQ;AAAA,MACzB,mBAAmB,KAAK,QAAQ;AAAA,IAClC;AAAA,EACF;AAAA,EACA,MAAM,MAAM,OAAsC;AAChD,UAAM,EAAE,mBAAmB,GAAG,IAAI,oBAAoB,MAAM,KAAK;AACjE,QAAI,KAAK,OAAQ,OAAM,IAAI,SAAS,sBAAsB,8CAAW,GAAG;AACxE,QAAI,KAAK,QAAQ;AACf,YAAM,IAAI,SAAS,sBAAsB,KAAK,QAAQ,mBAAmB,GAAG;AAC9E,QAAI,KAAK,QAAQ,OAAO,OAAO,MAAM,KAAK,MAAM,KAAK,GAAG,KAAK,CAACA,YAAWA,QAAO,OAAO,EAAE;AACvF,aAAO,KAAK,OAAO;AACrB,QAAI,KAAK,OAAQ,OAAM,IAAI,SAAS,eAAe,0DAAa,GAAG;AACnE,QAAI,KAAK,QAAQ,gBAAgB,EAAG,OAAM,KAAK,QAAQ,iBAAiB;AACxE,UAAM,UAAU,MAAM,uBAAuB,KAAK,MAAM,QAAQ,OAAO;AACvE,QAAI,KAAK,QAAQ;AACf,YAAM,QAAQ;AACd,YAAM,IAAI,SAAS,sBAAsB,8CAAW,GAAG;AAAA,IACzD;AACA,UAAM,QAAQ,IAAI,gBAAgB;AAClC,UAAM,SAAuB;AAAA,MAC3B;AAAA,MACA,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW,KAAK,IAAI;AAAA,MACpB,WAAW,KAAK,IAAI;AAAA,MACpB,MAAM,KAAK,MAAM,KAAK,EAAE;AAAA,MACxB,SAAS;AAAA,IACX;AACA,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,UAAM,cAAc,KAAK,MAAM,OAAO,MAAM;AAC5C,SAAK,QAAQ,YAAY;AACvB,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AACN,cAAM,QAAQ;AACd,aAAK,SAAS;AACd,aAAK,QAAQ;AACb;AAAA,MACF;AACA,YAAM,KAAK,IAAI,QAAQ,OAAO,OAAO;AAAA,IACvC,GAAG;AACH,QAAI;AACF,YAAM;AAAA,IACR,SAAS,OAAO;AACd,YAAM,IAAI,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAAA,IAC/D;AACA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EACA,MAAc,IAAI,QAAsB,OAAwB,SAA8B;AAC5F,QAAI,QAAQ;AACZ,QAAI;AACF,iBAAS;AACP,cAAM,OAAO,eAAe;AAC5B,YAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ,aAAa,KAAK;AAClE,gBAAM,IAAI,SAAS,kBAAkB,wFAAkB,GAAG;AAC5D,cAAM,SAAS,KAAK,QAAQ,cAAc,QAAQ;AAClD,YAAI,OAAO,OAAO;AAChB,kBAAQ;AACR;AAAA,QACF;AACA,YAAI,OAAO,YAAY,OAAO,QAAQ;AACpC,iBAAO,UAAU,OAAO,UAAU;AAClC,iBAAO,YAAY,KAAK,IAAI;AAC5B,gBAAM,KAAK,MAAM,OAAO,MAAM;AAAA,QAChC;AACA,cAAM,WAAW,KAAK,QAAQ,UAAU,KAAK,QAAW,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MAClF;AACA,YAAM,KAAK,MAAM,OAAO;AAAA,QACtB,IAAI,OAAO;AAAA,QACX,SAAS;AAAA,QACT,UAAU;AAAA,QACV,QAAQ,MAAM;AAAA,QACd,UAAU,CAAC,SAAS;AAClB,eAAK,SAAS;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,QAAQ,UAAU,YAAY,KAAK,QAAQ,UAAU,aAAa;AACzE,eAAO,QAAQ,MAAM,OAAO,UAAU,cAAc;AACpD,eAAO,UAAU,MAAM,OAAO,UAC1B,yCACA,iBAAiB,WACf,MAAM,UACN,cAAc,KAAK;AACzB,eAAO,YAAY,KAAK,IAAI;AAC5B,cAAM,KAAK,MAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAChD;AAAA,IACF,UAAE;AACA,UAAI,MAAO,MAAK,QAAQ,eAAe,KAAK;AAC5C,YAAM,QAAQ;AACd,WAAK,SAAS;AACd,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA,EACA,MAAM,OAAO,IAAY;AACvB,QAAI,KAAK,QAAQ,OAAO,IAAI;AAC1B,WAAK,OAAO,MAAM;AAClB,YAAM,KAAK;AAAA,IACb;AACA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EACA,MAAM,OAAO,IAAY;AACvB,QAAI,KAAK,UAAU,CAAC,QAAQ,KAAK,MAAM,EAAG,OAAM,KAAK;AACrD,QAAI,KAAK,OAAQ,OAAM,IAAI,SAAS,eAAe,gEAAc,GAAG;AACpE,QAAI;AACF,YAAM,KAAK,MAAM,OAAO,EAAE;AAC1B,YAAM,UAAU,MAAM,KAAK,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,MAAM,OAAO,EAAE;AACxE,UAAI;AACF,cAAM,KAAK,MAAM,OAAO;AAAA,UACtB,GAAG;AAAA,UACH,OAAO;AAAA,UACP,SAAS;AAAA,UACT,WAAW,KAAK,IAAI;AAAA,QACtB,CAAC;AAAA,IACL,QAAQ;AACN,YAAM,UAAU,MAAM,KAAK,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,MAAM,OAAO,EAAE;AACxE,UAAI;AACF,cAAM,KAAK,MACR,OAAO;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,SAAS;AAAA,UACT,WAAW,KAAK,IAAI;AAAA,QACtB,CAAC,EACA,MAAM,MAAM;AAAA,QAAC,CAAC;AACnB,YAAM,IAAI,SAAS,kBAAkB,8IAA2B,GAAG;AAAA,IACrE;AACA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EACA,MAAM,QAAQ;AACZ,SAAK,SAAS;AACd,SAAK,OAAO,MAAM;AAClB,UAAM,KAAK;AAAA,EACb;AACF;",
+  "names": ["record"]
+}

package/dist/backups/restore.js

@@ -0,0 +1,188 @@
+import { randomUUID, createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { chmod, lstat, mkdir, readFile, rename, rm } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { z } from "zod";
+import { AppError } from "../shared/errors.js";
+import { acquireInstanceLock } from "../server/instance-lock.js";
+import { parseConfig } from "../server/config.js";
+import { migrateSqlite } from "../server/db/history.js";
+import { copyDurable, readJson, saveJson, syncDirectory } from "../updates/files.js";
+import { acquireMaintenanceLock } from "./lock.js";
+const fileNames = ["app.sqlite", "app.sqlite-wal", "app.sqlite-shm", "config.json"];
+const journalSchema = z.object({
+  id: z.string().uuid(),
+  backupId: z.string(),
+  phase: z.enum(["prepared", "replacing", "committed", "rolledBack"]),
+  originals: z.array(
+    z.object({ name: z.enum(fileNames), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict()
+  ).max(4)
+}).strict();
+const journalPath = (store) => join(store.options.directory, "restore.json");
+const stagePath = (store, id) => join(store.options.dataDir, `.covro-restore-${id}`);
+const configStage = (store, id) => join(dirname(store.options.config), `.covro-restore-${id}.tmp`);
+async function hash(path) {
+  const info = await lstat(path);
+  if (!info.isFile() || info.isSymbolicLink())
+    throw new Error("Recovery file is not a regular file");
+  const digest = createHash("sha256");
+  for await (const chunk of createReadStream(path)) digest.update(chunk);
+  return digest.digest("hex");
+}
+async function assertNoPendingRestore(directory) {
+  const value = await readJson(join(directory, "restore.json"));
+  if (value === void 0) return;
+  const journal = journalSchema.parse(value);
+  if (["prepared", "replacing"].includes(journal.phase))
+    throw new AppError(
+      "RESTORE_PENDING",
+      "\u4E0A\u6B21\u6062\u590D\u5C1A\u672A\u5B8C\u6210\uFF0C\u62D2\u7EDD\u5F00\u653E\u5199\u5165\uFF1B\u8BF7\u8FD0\u884C covro backup repair\u3002",
+      503
+    );
+}
+async function restoreOriginals(store, journal) {
+  const directory = stagePath(store, journal.id);
+  for (const file of journal.originals)
+    if (await hash(join(directory, "original", file.name)) !== file.sha256)
+      throw new Error("Recovery copy checksum mismatch");
+  for (const name of fileNames) {
+    const target = name === "config.json" ? store.options.config : join(store.options.dataDir, name);
+    const original = journal.originals.find((file) => file.name === name);
+    if (original) {
+      await copyDurable(join(directory, "original", name), target);
+      await chmod(target, 384);
+    } else await rm(target, { force: true });
+  }
+  await rm(configStage(store, journal.id), { force: true });
+  await saveJson(journalPath(store), { ...journal, phase: "rolledBack" });
+}
+async function previewRestore(store, id) {
+  const manifest = await store.verify(id);
+  if (resolve(manifest.configPath) !== resolve(store.options.config) || resolve(manifest.dataDir) !== resolve(store.options.dataDir))
+    throw new AppError(
+      "RESTORE_INSTANCE_MISMATCH",
+      "\u6B64\u5907\u4EFD\u5C5E\u4E8E\u5176\u4ED6\u914D\u7F6E\u6216\u6570\u636E\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u5F53\u524D\u5B9E\u4F8B\u3002",
+      409
+    );
+  const config = parseConfig(
+    JSON.parse(await readFile(join(store.path(id), "config.json"), "utf8")),
+    store.options.config
+  );
+  if (config.dataDir !== resolve(store.options.dataDir))
+    throw new AppError("RESTORE_CONFIG_MISMATCH", "\u5907\u4EFD\u914D\u7F6E\u4F1A\u5207\u6362\u6570\u636E\u76EE\u5F55\uFF0C\u62D2\u7EDD\u6062\u590D\u3002", 409);
+  return {
+    backupId: id,
+    appVersion: manifest.appVersion,
+    backupSchema: manifest.schemaVersion,
+    targetSchema: store.options.contract.schemaVersion,
+    overwrite: [store.options.config, join(store.options.dataDir, "app.sqlite")],
+    warning: "\u5C06\u8986\u76D6\u670D\u52A1\u914D\u7F6E\u53CA Covro \u5E94\u7528\u6570\u636E\uFF0C\u4E22\u5F03\u5907\u4EFD\u4E4B\u540E\u7684\u5E94\u7528\u6570\u636E\uFF1BCodex \u5386\u53F2\u4E0E\u9879\u76EE\u6587\u4EF6\u4E0D\u53C2\u4E0E\u6062\u590D\u3002",
+    confirmation: `covro backup restore ${id} --confirm ${id} --config ${JSON.stringify(store.options.config)}`
+  };
+}
+async function restoreBackup(store, id, confirm) {
+  const preview = await previewRestore(store, id);
+  if (confirm === void 0) return { ...preview, restored: false };
+  if (confirm !== id)
+    throw new AppError("RESTORE_CONFIRMATION", "\u786E\u8BA4\u503C\u5FC5\u987B\u4E0E\u5F85\u6062\u590D\u7684\u5907\u4EFD ID \u5B8C\u5168\u4E00\u81F4\u3002", 400);
+  const releaseInstance = await acquireInstanceLock(store.options.dataDir);
+  let releaseMaintenance;
+  let journal;
+  try {
+    releaseMaintenance = await acquireMaintenanceLock(store.options.dataDir);
+    await assertNoPendingRestore(store.options.directory);
+    await previewRestore(store, id);
+    const operation = randomUUID();
+    const directory = stagePath(store, operation);
+    await mkdir(join(directory, "original"), { recursive: true, mode: 448 });
+    const originals = [];
+    for (const name of fileNames) {
+      const source = name === "config.json" ? store.options.config : join(store.options.dataDir, name);
+      try {
+        await hash(source);
+        await copyDurable(source, join(directory, "original", name));
+        await chmod(join(directory, "original", name), 384);
+        originals.push({ name, sha256: await hash(join(directory, "original", name)) });
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    await copyDurable(join(store.path(id), "app.sqlite"), join(directory, "app.sqlite"));
+    const staged = new store.options.Sqlite(join(directory, "app.sqlite"));
+    try {
+      migrateSqlite(staged, store.options.migrations);
+      staged.pragma("journal_mode = DELETE");
+      if (staged.pragma("integrity_check", { simple: true }) !== "ok" || staged.pragma("foreign_key_check").length)
+        throw new Error("Staged migration failed integrity check");
+    } finally {
+      staged.close();
+    }
+    await chmod(join(directory, "app.sqlite"), 384);
+    await copyDurable(join(store.path(id), "config.json"), configStage(store, operation));
+    await chmod(configStage(store, operation), 384);
+    journal = { id: operation, backupId: id, phase: "prepared", originals };
+    await saveJson(journalPath(store), journal);
+    journal.phase = "replacing";
+    await saveJson(journalPath(store), journal);
+    for (const name of ["app.sqlite-wal", "app.sqlite-shm"])
+      await rm(join(store.options.dataDir, name), { force: true });
+    await rename(join(directory, "app.sqlite"), join(store.options.dataDir, "app.sqlite"));
+    await rename(configStage(store, operation), store.options.config);
+    await syncDirectory(store.options.dataDir);
+    await syncDirectory(dirname(store.options.config));
+    await saveJson(journalPath(store), { ...journal, phase: "committed" });
+    return {
+      ...preview,
+      restored: true,
+      recoveryCopy: directory,
+      message: "\u6062\u590D\u5B8C\u6210\uFF0C\u670D\u52A1\u4FDD\u6301\u505C\u6B62\uFF1B\u8FD0\u884C covro start \u542F\u52A8\u3002"
+    };
+  } catch (error) {
+    if (journal) {
+      try {
+        await restoreOriginals(store, journal);
+      } catch {
+        throw new AppError(
+          "RESTORE_PENDING",
+          "\u6062\u590D\u5931\u8D25\u4E14\u539F\u6570\u636E\u5C1A\u672A\u6062\u590D\uFF0C\u5DF2\u4FDD\u7559\u73B0\u573A\uFF1B\u8BF7\u8FD0\u884C covro backup repair\u3002",
+          500
+        );
+      }
+    }
+    if (!journal && error instanceof AppError) throw error;
+    throw new AppError(
+      "RESTORE_FAILED",
+      "\u6062\u590D\u672A\u5B8C\u6210\uFF0C\u539F\u6570\u636E\u5DF2\u4FDD\u7559\uFF1B\u8BF7\u68C0\u67E5\u78C1\u76D8\u3001\u6743\u9650\u53CA\u5907\u4EFD\u540E\u91CD\u8BD5\u3002",
+      500
+    );
+  } finally {
+    await releaseMaintenance?.();
+    await releaseInstance();
+  }
+}
+async function repairRestore(store) {
+  const releaseInstance = await acquireInstanceLock(store.options.dataDir);
+  let releaseMaintenance;
+  try {
+    releaseMaintenance = await acquireMaintenanceLock(store.options.dataDir);
+    const journal = journalSchema.parse(await readJson(journalPath(store)));
+    if (["committed", "rolledBack"].includes(journal.phase))
+      return { repaired: false, phase: journal.phase };
+    await restoreOriginals(store, journal);
+    return {
+      repaired: true,
+      phase: "rolledBack",
+      message: "\u5DF2\u6062\u590D\u6062\u590D\u64CD\u4F5C\u524D\u7684\u6587\u4EF6\uFF0C\u670D\u52A1\u4FDD\u6301\u505C\u6B62\u3002"
+    };
+  } finally {
+    await releaseMaintenance?.();
+    await releaseInstance();
+  }
+}
+export {
+  assertNoPendingRestore,
+  previewRestore,
+  repairRestore,
+  restoreBackup
+};
+//# sourceMappingURL=restore.js.map

package/dist/backups/restore.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/backups/restore.ts"],
+  "sourcesContent": ["import { randomUUID, createHash } from 'node:crypto';\nimport { createReadStream } from 'node:fs';\nimport { chmod, lstat, mkdir, readFile, rename, rm } from 'node:fs/promises';\nimport { dirname, join, resolve } from 'node:path';\nimport { z } from 'zod';\nimport { AppError } from '../shared/errors.js';\nimport { acquireInstanceLock } from '../server/instance-lock.js';\nimport { parseConfig } from '../server/config.js';\nimport { migrateSqlite } from '../server/db/history.js';\nimport { copyDurable, readJson, saveJson, syncDirectory } from '../updates/files.js';\nimport { acquireMaintenanceLock } from './lock.js';\nimport { type BackupStore } from './store.js';\n\nconst fileNames = ['app.sqlite', 'app.sqlite-wal', 'app.sqlite-shm', 'config.json'] as const;\nconst journalSchema = z\n  .object({\n    id: z.string().uuid(),\n    backupId: z.string(),\n    phase: z.enum(['prepared', 'replacing', 'committed', 'rolledBack']),\n    originals: z\n      .array(\n        z.object({ name: z.enum(fileNames), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict(),\n      )\n      .max(4),\n  })\n  .strict();\ntype Journal = z.infer<typeof journalSchema>;\nconst journalPath = (store: BackupStore) => join(store.options.directory, 'restore.json');\nconst stagePath = (store: BackupStore, id: string) =>\n  join(store.options.dataDir, `.covro-restore-${id}`);\nconst configStage = (store: BackupStore, id: string) =>\n  join(dirname(store.options.config), `.covro-restore-${id}.tmp`);\nasync function hash(path: string) {\n  const info = await lstat(path);\n  if (!info.isFile() || info.isSymbolicLink())\n    throw new Error('Recovery file is not a regular file');\n  const digest = createHash('sha256');\n  for await (const chunk of createReadStream(path)) digest.update(chunk);\n  return digest.digest('hex');\n}\nexport async function assertNoPendingRestore(directory: string) {\n  const value = await readJson(join(directory, 'restore.json'));\n  if (value === undefined) return;\n  const journal = journalSchema.parse(value);\n  if (['prepared', 'replacing'].includes(journal.phase))\n    throw new AppError(\n      'RESTORE_PENDING',\n      '\u4E0A\u6B21\u6062\u590D\u5C1A\u672A\u5B8C\u6210\uFF0C\u62D2\u7EDD\u5F00\u653E\u5199\u5165\uFF1B\u8BF7\u8FD0\u884C covro backup repair\u3002',\n      503,\n    );\n}\nasync function restoreOriginals(store: BackupStore, journal: Journal) {\n  const directory = stagePath(store, journal.id);\n  for (const file of journal.originals)\n    if ((await hash(join(directory, 'original', file.name))) !== file.sha256)\n      throw new Error('Recovery copy checksum mismatch');\n  for (const name of fileNames) {\n    const target =\n      name === 'config.json' ? store.options.config : join(store.options.dataDir, name);\n    const original = journal.originals.find((file) => file.name === name);\n    if (original) {\n      await copyDurable(join(directory, 'original', name), target);\n      await chmod(target, 0o600);\n    } else await rm(target, { force: true });\n  }\n  await rm(configStage(store, journal.id), { force: true });\n  await saveJson(journalPath(store), { ...journal, phase: 'rolledBack' });\n}\nexport async function previewRestore(store: BackupStore, id: string) {\n  const manifest = await store.verify(id);\n  if (\n    resolve(manifest.configPath) !== resolve(store.options.config) ||\n    resolve(manifest.dataDir) !== resolve(store.options.dataDir)\n  )\n    throw new AppError(\n      'RESTORE_INSTANCE_MISMATCH',\n      '\u6B64\u5907\u4EFD\u5C5E\u4E8E\u5176\u4ED6\u914D\u7F6E\u6216\u6570\u636E\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u5F53\u524D\u5B9E\u4F8B\u3002',\n      409,\n    );\n  const config = parseConfig(\n    JSON.parse(await readFile(join(store.path(id), 'config.json'), 'utf8')),\n    store.options.config,\n  );\n  if (config.dataDir !== resolve(store.options.dataDir))\n    throw new AppError('RESTORE_CONFIG_MISMATCH', '\u5907\u4EFD\u914D\u7F6E\u4F1A\u5207\u6362\u6570\u636E\u76EE\u5F55\uFF0C\u62D2\u7EDD\u6062\u590D\u3002', 409);\n  return {\n    backupId: id,\n    appVersion: manifest.appVersion,\n    backupSchema: manifest.schemaVersion,\n    targetSchema: store.options.contract.schemaVersion,\n    overwrite: [store.options.config, join(store.options.dataDir, 'app.sqlite')],\n    warning:\n      '\u5C06\u8986\u76D6\u670D\u52A1\u914D\u7F6E\u53CA Covro \u5E94\u7528\u6570\u636E\uFF0C\u4E22\u5F03\u5907\u4EFD\u4E4B\u540E\u7684\u5E94\u7528\u6570\u636E\uFF1BCodex \u5386\u53F2\u4E0E\u9879\u76EE\u6587\u4EF6\u4E0D\u53C2\u4E0E\u6062\u590D\u3002',\n    confirmation: `covro backup restore ${id} --confirm ${id} --config ${JSON.stringify(store.options.config)}`,\n  };\n}\n/** Offline only: gateway startup, explicit migrations and restore all share the instance lock. */\nexport async function restoreBackup(store: BackupStore, id: string, confirm?: string) {\n  const preview = await previewRestore(store, id);\n  if (confirm === undefined) return { ...preview, restored: false as const };\n  if (confirm !== id)\n    throw new AppError('RESTORE_CONFIRMATION', '\u786E\u8BA4\u503C\u5FC5\u987B\u4E0E\u5F85\u6062\u590D\u7684\u5907\u4EFD ID \u5B8C\u5168\u4E00\u81F4\u3002', 400);\n  const releaseInstance = await acquireInstanceLock(store.options.dataDir);\n  let releaseMaintenance: (() => Promise<void>) | undefined;\n  let journal: Journal | undefined;\n  try {\n    releaseMaintenance = await acquireMaintenanceLock(store.options.dataDir);\n    await assertNoPendingRestore(store.options.directory);\n    await previewRestore(store, id); // Revalidate after obtaining exclusive ownership.\n    const operation = randomUUID();\n    const directory = stagePath(store, operation);\n    await mkdir(join(directory, 'original'), { recursive: true, mode: 0o700 });\n    const originals: Journal['originals'] = [];\n    for (const name of fileNames) {\n      const source =\n        name === 'config.json' ? store.options.config : join(store.options.dataDir, name);\n      try {\n        await hash(source);\n        await copyDurable(source, join(directory, 'original', name));\n        await chmod(join(directory, 'original', name), 0o600);\n        originals.push({ name, sha256: await hash(join(directory, 'original', name)) });\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      }\n    }\n    await copyDurable(join(store.path(id), 'app.sqlite'), join(directory, 'app.sqlite'));\n    const staged = new store.options.Sqlite(join(directory, 'app.sqlite'));\n    try {\n      migrateSqlite(staged, store.options.migrations);\n      staged.pragma('journal_mode = DELETE');\n      if (\n        staged.pragma('integrity_check', { simple: true }) !== 'ok' ||\n        (staged.pragma('foreign_key_check') as unknown[]).length\n      )\n        throw new Error('Staged migration failed integrity check');\n    } finally {\n      staged.close();\n    }\n    await chmod(join(directory, 'app.sqlite'), 0o600);\n    await copyDurable(join(store.path(id), 'config.json'), configStage(store, operation));\n    await chmod(configStage(store, operation), 0o600);\n    journal = { id: operation, backupId: id, phase: 'prepared', originals };\n    await saveJson(journalPath(store), journal);\n    journal.phase = 'replacing';\n    await saveJson(journalPath(store), journal);\n    for (const name of ['app.sqlite-wal', 'app.sqlite-shm'])\n      await rm(join(store.options.dataDir, name), { force: true });\n    await rename(join(directory, 'app.sqlite'), join(store.options.dataDir, 'app.sqlite'));\n    await rename(configStage(store, operation), store.options.config);\n    await syncDirectory(store.options.dataDir);\n    await syncDirectory(dirname(store.options.config));\n    await saveJson(journalPath(store), { ...journal, phase: 'committed' });\n    return {\n      ...preview,\n      restored: true as const,\n      recoveryCopy: directory,\n      message: '\u6062\u590D\u5B8C\u6210\uFF0C\u670D\u52A1\u4FDD\u6301\u505C\u6B62\uFF1B\u8FD0\u884C covro start \u542F\u52A8\u3002',\n    };\n  } catch (error) {\n    if (journal) {\n      try {\n        await restoreOriginals(store, journal);\n      } catch {\n        throw new AppError(\n          'RESTORE_PENDING',\n          '\u6062\u590D\u5931\u8D25\u4E14\u539F\u6570\u636E\u5C1A\u672A\u6062\u590D\uFF0C\u5DF2\u4FDD\u7559\u73B0\u573A\uFF1B\u8BF7\u8FD0\u884C covro backup repair\u3002',\n          500,\n        );\n      }\n    }\n    if (!journal && error instanceof AppError) throw error;\n    throw new AppError(\n      'RESTORE_FAILED',\n      '\u6062\u590D\u672A\u5B8C\u6210\uFF0C\u539F\u6570\u636E\u5DF2\u4FDD\u7559\uFF1B\u8BF7\u68C0\u67E5\u78C1\u76D8\u3001\u6743\u9650\u53CA\u5907\u4EFD\u540E\u91CD\u8BD5\u3002',\n      500,\n    );\n  } finally {\n    await releaseMaintenance?.();\n    await releaseInstance();\n  }\n}\nexport async function repairRestore(store: BackupStore) {\n  const releaseInstance = await acquireInstanceLock(store.options.dataDir);\n  let releaseMaintenance: (() => Promise<void>) | undefined;\n  try {\n    releaseMaintenance = await acquireMaintenanceLock(store.options.dataDir);\n    const journal = journalSchema.parse(await readJson(journalPath(store)));\n    if (['committed', 'rolledBack'].includes(journal.phase))\n      return { repaired: false, phase: journal.phase };\n    await restoreOriginals(store, journal);\n    return {\n      repaired: true,\n      phase: 'rolledBack',\n      message: '\u5DF2\u6062\u590D\u6062\u590D\u64CD\u4F5C\u524D\u7684\u6587\u4EF6\uFF0C\u670D\u52A1\u4FDD\u6301\u505C\u6B62\u3002',\n    };\n  } finally {\n    await releaseMaintenance?.();\n    await releaseInstance();\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,kBAAkB;AACvC,SAAS,wBAAwB;AACjC,SAAS,OAAO,OAAO,OAAO,UAAU,QAAQ,UAAU;AAC1D,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,SAAS;AAClB,SAAS,gBAAgB;AACzB,SAAS,2BAA2B;AACpC,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAS,aAAa,UAAU,UAAU,qBAAqB;AAC/D,SAAS,8BAA8B;AAGvC,MAAM,YAAY,CAAC,cAAc,kBAAkB,kBAAkB,aAAa;AAClF,MAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,OAAO,EAAE,KAAK,CAAC,YAAY,aAAa,aAAa,YAAY,CAAC;AAAA,EAClE,WAAW,EACR;AAAA,IACC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,EAC3F,EACC,IAAI,CAAC;AACV,CAAC,EACA,OAAO;AAEV,MAAM,cAAc,CAAC,UAAuB,KAAK,MAAM,QAAQ,WAAW,cAAc;AACxF,MAAM,YAAY,CAAC,OAAoB,OACrC,KAAK,MAAM,QAAQ,SAAS,kBAAkB,EAAE,EAAE;AACpD,MAAM,cAAc,CAAC,OAAoB,OACvC,KAAK,QAAQ,MAAM,QAAQ,MAAM,GAAG,kBAAkB,EAAE,MAAM;AAChE,eAAe,KAAK,MAAc;AAChC,QAAM,OAAO,MAAM,MAAM,IAAI;AAC7B,MAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe;AACxC,UAAM,IAAI,MAAM,qCAAqC;AACvD,QAAM,SAAS,WAAW,QAAQ;AAClC,mBAAiB,SAAS,iBAAiB,IAAI,EAAG,QAAO,OAAO,KAAK;AACrE,SAAO,OAAO,OAAO,KAAK;AAC5B;AACA,eAAsB,uBAAuB,WAAmB;AAC9D,QAAM,QAAQ,MAAM,SAAS,KAAK,WAAW,cAAc,CAAC;AAC5D,MAAI,UAAU,OAAW;AACzB,QAAM,UAAU,cAAc,MAAM,KAAK;AACzC,MAAI,CAAC,YAAY,WAAW,EAAE,SAAS,QAAQ,KAAK;AAClD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACJ;AACA,eAAe,iBAAiB,OAAoB,SAAkB;AACpE,QAAM,YAAY,UAAU,OAAO,QAAQ,EAAE;AAC7C,aAAW,QAAQ,QAAQ;AACzB,QAAK,MAAM,KAAK,KAAK,WAAW,YAAY,KAAK,IAAI,CAAC,MAAO,KAAK;AAChE,YAAM,IAAI,MAAM,iCAAiC;AACrD,aAAW,QAAQ,WAAW;AAC5B,UAAM,SACJ,SAAS,gBAAgB,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,SAAS,IAAI;AAClF,UAAM,WAAW,QAAQ,UAAU,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI;AACpE,QAAI,UAAU;AACZ,YAAM,YAAY,KAAK,WAAW,YAAY,IAAI,GAAG,MAAM;AAC3D,YAAM,MAAM,QAAQ,GAAK;AAAA,IAC3B,MAAO,OAAM,GAAG,QAAQ,EAAE,OAAO,KAAK,CAAC;AAAA,EACzC;AACA,QAAM,GAAG,YAAY,OAAO,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD,QAAM,SAAS,YAAY,KAAK,GAAG,EAAE,GAAG,SAAS,OAAO,aAAa,CAAC;AACxE;AACA,eAAsB,eAAe,OAAoB,IAAY;AACnE,QAAM,WAAW,MAAM,MAAM,OAAO,EAAE;AACtC,MACE,QAAQ,SAAS,UAAU,MAAM,QAAQ,MAAM,QAAQ,MAAM,KAC7D,QAAQ,SAAS,OAAO,MAAM,QAAQ,MAAM,QAAQ,OAAO;AAE3D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACF,QAAM,SAAS;AAAA,IACb,KAAK,MAAM,MAAM,SAAS,KAAK,MAAM,KAAK,EAAE,GAAG,aAAa,GAAG,MAAM,CAAC;AAAA,IACtE,MAAM,QAAQ;AAAA,EAChB;AACA,MAAI,OAAO,YAAY,QAAQ,MAAM,QAAQ,OAAO;AAClD,UAAM,IAAI,SAAS,2BAA2B,0GAAqB,GAAG;AACxE,SAAO;AAAA,IACL,UAAU;AAAA,IACV,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS;AAAA,IACvB,cAAc,MAAM,QAAQ,SAAS;AAAA,IACrC,WAAW,CAAC,MAAM,QAAQ,QAAQ,KAAK,MAAM,QAAQ,SAAS,YAAY,CAAC;AAAA,IAC3E,SACE;AAAA,IACF,cAAc,wBAAwB,EAAE,cAAc,EAAE,aAAa,KAAK,UAAU,MAAM,QAAQ,MAAM,CAAC;AAAA,EAC3G;AACF;AAEA,eAAsB,cAAc,OAAoB,IAAY,SAAkB;AACpF,QAAM,UAAU,MAAM,eAAe,OAAO,EAAE;AAC9C,MAAI,YAAY,OAAW,QAAO,EAAE,GAAG,SAAS,UAAU,MAAe;AACzE,MAAI,YAAY;AACd,UAAM,IAAI,SAAS,wBAAwB,8GAAyB,GAAG;AACzE,QAAM,kBAAkB,MAAM,oBAAoB,MAAM,QAAQ,OAAO;AACvE,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,yBAAqB,MAAM,uBAAuB,MAAM,QAAQ,OAAO;AACvE,UAAM,uBAAuB,MAAM,QAAQ,SAAS;AACpD,UAAM,eAAe,OAAO,EAAE;AAC9B,UAAM,YAAY,WAAW;AAC7B,UAAM,YAAY,UAAU,OAAO,SAAS;AAC5C,UAAM,MAAM,KAAK,WAAW,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzE,UAAM,YAAkC,CAAC;AACzC,eAAW,QAAQ,WAAW;AAC5B,YAAM,SACJ,SAAS,gBAAgB,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,SAAS,IAAI;AAClF,UAAI;AACF,cAAM,KAAK,MAAM;AACjB,cAAM,YAAY,QAAQ,KAAK,WAAW,YAAY,IAAI,CAAC;AAC3D,cAAM,MAAM,KAAK,WAAW,YAAY,IAAI,GAAG,GAAK;AACpD,kBAAU,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,KAAK,WAAW,YAAY,IAAI,CAAC,EAAE,CAAC;AAAA,MAChF,SAAS,OAAO;AACd,YAAK,MAAgC,SAAS,SAAU,OAAM;AAAA,MAChE;AAAA,IACF;AACA,UAAM,YAAY,KAAK,MAAM,KAAK,EAAE,GAAG,YAAY,GAAG,KAAK,WAAW,YAAY,CAAC;AACnF,UAAM,SAAS,IAAI,MAAM,QAAQ,OAAO,KAAK,WAAW,YAAY,CAAC;AACrE,QAAI;AACF,oBAAc,QAAQ,MAAM,QAAQ,UAAU;AAC9C,aAAO,OAAO,uBAAuB;AACrC,UACE,OAAO,OAAO,mBAAmB,EAAE,QAAQ,KAAK,CAAC,MAAM,QACtD,OAAO,OAAO,mBAAmB,EAAgB;AAElD,cAAM,IAAI,MAAM,yCAAyC;AAAA,IAC7D,UAAE;AACA,aAAO,MAAM;AAAA,IACf;AACA,UAAM,MAAM,KAAK,WAAW,YAAY,GAAG,GAAK;AAChD,UAAM,YAAY,KAAK,MAAM,KAAK,EAAE,GAAG,aAAa,GAAG,YAAY,OAAO,SAAS,CAAC;AACpF,UAAM,MAAM,YAAY,OAAO,SAAS,GAAG,GAAK;AAChD,cAAU,EAAE,IAAI,WAAW,UAAU,IAAI,OAAO,YAAY,UAAU;AACtE,UAAM,SAAS,YAAY,KAAK,GAAG,OAAO;AAC1C,YAAQ,QAAQ;AAChB,UAAM,SAAS,YAAY,KAAK,GAAG,OAAO;AAC1C,eAAW,QAAQ,CAAC,kBAAkB,gBAAgB;AACpD,YAAM,GAAG,KAAK,MAAM,QAAQ,SAAS,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7D,UAAM,OAAO,KAAK,WAAW,YAAY,GAAG,KAAK,MAAM,QAAQ,SAAS,YAAY,CAAC;AACrF,UAAM,OAAO,YAAY,OAAO,SAAS,GAAG,MAAM,QAAQ,MAAM;AAChE,UAAM,cAAc,MAAM,QAAQ,OAAO;AACzC,UAAM,cAAc,QAAQ,MAAM,QAAQ,MAAM,CAAC;AACjD,UAAM,SAAS,YAAY,KAAK,GAAG,EAAE,GAAG,SAAS,OAAO,YAAY,CAAC;AACrE,WAAO;AAAA,MACL,GAAG;AAAA,MACH,UAAU;AAAA,MACV,cAAc;AAAA,MACd,SAAS;AAAA,IACX;AAAA,EACF,SAAS,OAAO;AACd,QAAI,SAAS;AACX,UAAI;AACF,cAAM,iBAAiB,OAAO,OAAO;AAAA,MACvC,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,WAAW,iBAAiB,SAAU,OAAM;AACjD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,qBAAqB;AAC3B,UAAM,gBAAgB;AAAA,EACxB;AACF;AACA,eAAsB,cAAc,OAAoB;AACtD,QAAM,kBAAkB,MAAM,oBAAoB,MAAM,QAAQ,OAAO;AACvE,MAAI;AACJ,MAAI;AACF,yBAAqB,MAAM,uBAAuB,MAAM,QAAQ,OAAO;AACvE,UAAM,UAAU,cAAc,MAAM,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC;AACtE,QAAI,CAAC,aAAa,YAAY,EAAE,SAAS,QAAQ,KAAK;AACpD,aAAO,EAAE,UAAU,OAAO,OAAO,QAAQ,MAAM;AACjD,UAAM,iBAAiB,OAAO,OAAO;AACrC,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF,UAAE;AACA,UAAM,qBAAqB;AAC3B,UAAM,gBAAgB;AAAA,EACxB;AACF;",
+  "names": []
+}