@flame0510/project-aether 1.6.2 → 1.8.0

package/lib/agent-images.ts

@@ -226,6 +226,13 @@ export async function remoteSupportedVersions(): Promise<string[] | null> {
 /**
  * Runs `docker <args>`, streaming output lines; rejects with the last error line.
  *
+ * A signal that is already aborted rejects before anything is spawned: an `abort`
+ * listener added to an aborted signal never fires, so the process would otherwise run
+ * to completion even though its caller has been cancelled.
+ *
+ * Lines are reassembled across output chunks — a chunk can end mid-line — and `\r` is
+ * treated as a line break too, since docker redraws progress with it.
+ *
  * `env` is for container environment on `docker run`: each name is inserted as `-e KEY`
  * right after the subcommand, and the value reaches docker through its own
  * environment, so secrets stay out of the process table.
@@ -235,6 +242,10 @@ export function runDocker(
   opts: { onLine?: (line: string) => void; signal?: AbortSignal; timeoutMs: number; env?: Record<string, string> },
 ): Promise<void> {
   return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(new Error(`docker ${args[0]} aborted`));
+      return;
+    }
     const envNames = Object.keys(opts.env ?? {});
     const argv = envNames.length ? [args[0], ...envNames.flatMap((k) => ['-e', k]), ...args.slice(1)] : args;
     const child = spawn('docker', argv, {
@@ -243,17 +254,28 @@ export function runDocker(
     });
     let lastError = '';
     let firstError = '';
-    const onData = (isErr: boolean) => (chunk: Buffer) => {
-      for (const line of chunk.toString().split(/\r?\n/)) {
-        if (!line.trim()) continue;
-        if (isErr) {
-          // Docker prints the cause first and "Run 'docker run --help' …" last; keep
-          // both ends so the rejection can carry the cause, not the usage pointer.
-          firstError ||= line.trim();
-          lastError = line.trim();
-        }
-        opts.onLine?.(line);
+    const emit = (line: string, isErr: boolean) => {
+      if (!line.trim()) return;
+      if (isErr) {
+        // Docker prints the cause first and "Run 'docker run --help' …" last; keep
+        // both ends so the rejection can carry the cause, not the usage pointer.
+        firstError ||= line.trim();
+        lastError = line.trim();
       }
+      opts.onLine?.(line);
+    };
+    // The unfinished tail of the last chunk, per stream, completed by the next one.
+    const pending = { out: '', err: '' };
+    const onData = (isErr: boolean) => (chunk: Buffer) => {
+      const key = isErr ? 'err' : 'out';
+      const parts = (pending[key] + chunk.toString()).split(/\r\n|\n|\r/);
+      pending[key] = parts.pop() ?? '';
+      for (const line of parts) emit(line, isErr);
+    };
+    const flush = () => {
+      emit(pending.out, false);
+      emit(pending.err, true);
+      pending.out = pending.err = '';
     };
     child.stdout.on('data', onData(false));
     child.stderr.on('data', onData(true));
@@ -271,6 +293,7 @@ export function runDocker(
       reject(err);
     });
     child.on('close', (code) => {
+      flush();
       clearTimeout(timer);
       opts.signal?.removeEventListener('abort', kill);
       if (code === 0) resolve();
@@ -281,8 +304,9 @@ export function runDocker(
 
 /**
  * Pull `<registry>:<version>` and tag it `openclaw-agent-base:<version>`. The registry
- * reference is removed afterwards (an untag, the layers stay), so local images list
- * under the version tag only.
+ * reference is removed afterwards, so local images list under the version tag only: after
+ * a successful tag that is an untag (the layers stay); when the tag failed or was
+ * cancelled it is the image's only name, and the pulled image is deleted with it.
  */
 export async function pullAgentImage(
   version: string,
@@ -291,8 +315,13 @@ export async function pullAgentImage(
   if (!isSupportedVersion(version)) throw new Error(`OpenClaw ${version} is not supported by this Rev4a`);
   const remote = `${registryRepository()}:${version}`;
   await runDocker(['pull', remote], { ...opts, timeoutMs: PULL_TIMEOUT_MS });
-  await runDocker(['tag', remote, localImageRef(version)], { ...opts, timeoutMs: 30_000 });
-  await runDocker(['rmi', remote], { timeoutMs: 30_000 }).catch(() => {});
+  try {
+    await runDocker(['tag', remote, localImageRef(version)], { ...opts, timeoutMs: 30_000 });
+  } finally {
+    // Also when the tag failed or was cancelled: left behind, the registry reference
+    // is a full image under a name neither the listing nor retention looks at.
+    await runDocker(['rmi', remote], { timeoutMs: 30_000 }).catch(() => {});
+  }
 }
 
 /**

package/lib/buildAgentImage.ts

@@ -11,8 +11,9 @@
  * instead — development without registry access. Any other version cannot be built
  * from here, so its download fails.
  *
- * One download at a time (in-process lock). Output goes to
- * /tmp/rev4a-download-<timestamp>.log so it survives page refreshes and modal closes.
+ * One download at a time (in-process lock). Docker's output also goes to
+ * /tmp/rev4a-download-<timestamp>.log (mode 0600, kept 24 h) for diagnosis — nothing in the
+ * UI reads it; the banner gets its percent and status line from `getDownloadProgress()`.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -26,6 +27,36 @@ const BUILD_TIMEOUT_MS = 60 * 60 * 1000;
 /** The version being downloaded; `pending` while the default version is being resolved. */
 let downloadingVersion: string | null = null;
 let downloadLogPath: string | null = null;
+/** Owns the running pull/build process; `cancelDownload()` aborts it. One at a time, like the download itself. */
+let downloadController: AbortController | null = null;
+/** `docker pull` layer ids seen, by state — the source of the real percent below. */
+const pullLayers = new Map<string, 'pending' | 'done'>();
+/** Set once a layer starts transferring: from then on the layer list is complete. */
+let pullTransferStarted = false;
+let downloadPercent: number | null = null;
+/** The latest line of docker's output, shown under the percent (or alone when there is none). */
+let downloadMessage: string | null = null;
+
+export interface DownloadOutcome {
+  version: string;
+  result: 'succeeded' | 'failed' | 'canceled';
+  source?: 'present' | 'registry' | 'build';
+  message: string;
+  at: number;
+}
+
+/**
+ * The last download's outcome, same idea as `finished` in lib/cold-backup.ts: a client
+ * that was not mounted for the live `downloading: true → false` transition (navigated
+ * away, reloaded, opened the page late) would otherwise see nothing at all once the
+ * download is done — this is what it reads instead. Overwritten by the next download,
+ * never cleared on its own; the client decides how long "recently" still means something.
+ */
+let lastDownloadResult: DownloadOutcome | null = null;
+
+export function getLastDownloadResult(): DownloadOutcome | null {
+  return lastDownloadResult;
+}
 
 /** Checks if a download is already running (in-process flag only). */
 export function getIsDownloading(): boolean {
@@ -36,6 +67,63 @@ export function getDownloadingVersion(): string | null {
   return downloadingVersion === 'pending' ? null : downloadingVersion;
 }
 
+/** Real progress from `docker pull`'s own per-layer lines; `percent` is null until it can be computed (see `trackPullLayer`). */
+export function getDownloadProgress(): { percent: number | null; message: string | null } {
+  return { percent: downloadPercent, message: downloadMessage };
+}
+
+/**
+ * Cancel the running download, if any: the docker process is killed, or never started
+ * when the cancel arrives first (`runDocker` refuses an already-aborted signal). The
+ * download rejects with a distinct 'canceled' error so the caller can tell it apart from
+ * a real failure. Returns false when nothing is running.
+ */
+export function cancelDownload(): boolean {
+  if (!downloadController) return false;
+  downloadController.abort();
+  return true;
+}
+
+/**
+ * Whether the last finished download ended as cancelled. Derived from its recorded
+ * outcome, not from the request: a cancel that arrives after the image is already tagged
+ * changes nothing, and must not make a successful download read as cancelled.
+ */
+export function wasDownloadCanceled(): boolean {
+  return lastDownloadResult?.result === 'canceled';
+}
+
+/**
+ * Track `docker pull`'s per-layer lines to compute a real percent: the fraction of
+ * layers finished. A layer is finished at `Pull complete` (downloaded *and* extracted) or
+ * `Already exists` — not at `Download complete`, which still has the extraction ahead.
+ *
+ * Not byte-exact (layers differ in size and run in parallel), and deliberately withheld
+ * until the first layer starts transferring: docker lists every layer up front, and a
+ * percent computed before the list is complete jumps high on a cached first layer and
+ * then falls (99 → 50 → 33 → 25 was reproduced). It also never goes down, and stays
+ * below 100 — completion is reported by the download's outcome, not by a percent.
+ */
+function trackPullLayer(line: string): void {
+  const m = /^([0-9a-f]{12}):\s+(.+)$/.exec(line.trim());
+  if (!m) return;
+  const [, id, state] = m;
+  if (/^(Pulling fs layer|Waiting)/.test(state)) {
+    if (!pullLayers.has(id)) pullLayers.set(id, 'pending');
+  } else if (/^(Pull complete|Already exists)/.test(state)) {
+    pullLayers.set(id, 'done');
+  } else if (/^(Downloading|Verifying Checksum|Download complete|Extracting)/.test(state)) {
+    if (!pullLayers.has(id)) pullLayers.set(id, 'pending');
+    pullTransferStarted = true;
+  } else {
+    return;
+  }
+  if (!pullTransferStarted || pullLayers.size === 0) return;
+  const done = [...pullLayers.values()].filter((v) => v === 'done').length;
+  const percent = Math.min(99, Math.round((done / pullLayers.size) * 100));
+  downloadPercent = Math.max(downloadPercent ?? 0, percent);
+}
+
 function appendLog(msg: string): void {
   if (!downloadLogPath) return;
   try {
@@ -96,53 +184,101 @@ export async function downloadAgentImage(opts: DownloadOptions = {}): Promise<Do
   if (!dockerAvailable()) throw new Error('Docker is not available — please install Docker and try again');
   if (downloadingVersion !== null) throw new Error('A download is already in progress');
   downloadingVersion = opts.version ?? 'pending';
+  pullLayers.clear();
+  pullTransferStarted = false;
+  downloadPercent = null;
+  downloadMessage = null;
   downloadLogPath = `/tmp/rev4a-download-${Date.now()}.log`;
+  try {
+    // Owner-only, and 'wx' refuses a path that already exists (a planted file or link).
+    fs.writeFileSync(downloadLogPath, '', { mode: 0o600, flag: 'wx' });
+  } catch {
+    downloadLogPath = null;
+  }
+
+  // Owns the child process for this run. A caller's own signal (the setup wizard's SSE
+  // stream closing) aborts it too, same as cancelDownload() — both end up here, so
+  // `signal.aborted` below is the one place that tells "stopped" from "failed".
+  const controller = new AbortController();
+  downloadController = controller;
+  const onCallerAbort = () => controller.abort();
+  if (opts.signal?.aborted) controller.abort();
+  else opts.signal?.addEventListener('abort', onCallerAbort, { once: true });
+  const { signal } = controller;
+  // Between awaits a cancel can arrive with no process to kill yet; stop at the next step.
+  const stopIfCanceled = () => { if (signal.aborted) throw new Error('canceled'); };
 
   try {
     const version = opts.version ?? (await defaultDownloadVersion());
+    stopIfCanceled();
     if (!isSupportedVersion(version)) throw new Error(`OpenClaw ${version} is not supported by this Rev4a`);
     downloadingVersion = version;
 
-    if (await localVersionExists(version)) {
+    const present = await localVersionExists(version);
+    stopIfCanceled();
+    if (present) {
       event('complete', `OpenClaw ${version} image already downloaded`);
+      lastDownloadResult = { version, result: 'succeeded', source: 'present', message: `OpenClaw ${version} image already downloaded`, at: Date.now() };
       return { version, source: 'present' };
     }
 
     event('status', `Downloading OpenClaw ${version} image…`);
     try {
       await pullAgentImage(version, {
-        signal: opts.signal,
+        signal,
         onLine: (line) => {
           appendLog(line);
+          downloadMessage = line;
+          trackPullLayer(line);
           if (/Download|Extract|Pull/.test(line)) opts.onEvent?.(JSON.stringify({ type: 'progress', message: line }));
         },
       });
       event('complete', `OpenClaw ${version} image downloaded`);
+      lastDownloadResult = { version, result: 'succeeded', source: 'registry', message: `OpenClaw ${version} image downloaded`, at: Date.now() };
       return { version, source: 'registry' };
     } catch (e) {
       appendLog(`Registry download failed: ${(e as Error).message}`);
-      if (opts.signal?.aborted || dockerfileVersion() !== version) {
+      if (signal.aborted) throw new Error('canceled');
+      if (dockerfileVersion() !== version) {
         throw new Error(`Could not download OpenClaw ${version}: ${(e as Error).message}`);
       }
     }
 
     event('log', 'Registry download failed, building the image locally…');
+    downloadPercent = null;
+    stopIfCanceled();
     await runDocker(
       ['build', '--build-arg', `OPENCLAW_VERSION=${version}`, '-t', localImageRef(version), '--progress=plain', DOCKERFILE_DIR],
       {
-        signal: opts.signal,
+        signal,
         timeoutMs: BUILD_TIMEOUT_MS,
         onLine: (line) => {
           appendLog(line);
+          downloadMessage = line;
           if (line.startsWith('#')) opts.onEvent?.(JSON.stringify({ type: 'step', message: line }));
         },
       },
     );
     event('complete', `OpenClaw ${version} image built locally`);
+    lastDownloadResult = { version, result: 'succeeded', source: 'build', message: `OpenClaw ${version} image built locally`, at: Date.now() };
     return { version, source: 'build' };
+  } catch (e) {
+    const version = downloadingVersion === 'pending' ? (opts.version ?? 'unknown') : downloadingVersion;
+    if (signal.aborted) {
+      lastDownloadResult = { version, result: 'canceled', message: `OpenClaw ${version} download canceled`, at: Date.now() };
+      throw new Error('canceled');
+    }
+    lastDownloadResult = { version, result: 'failed', message: (e as Error).message, at: Date.now() };
+    throw e;
   } finally {
+    opts.signal?.removeEventListener('abort', onCallerAbort);
     downloadingVersion = null;
     downloadLogPath = null;
+    downloadController = null;
+    pullLayers.clear();
+    pullTransferStarted = false;
+    downloadPercent = null;
+    downloadMessage = null;
     cleanupOldLogs();
   }
 }

package/lib/db-bootstrap.mjs

@@ -91,16 +91,6 @@ export function initializeRev4aDb(dbPath) {
       updated_at INTEGER
     );
 
-  CREATE TABLE IF NOT EXISTS system_metrics (
-      ts INTEGER PRIMARY KEY,
-      cpu_percent REAL,
-      ram_used_mb INTEGER,
-      ram_total_mb INTEGER,
-      disk_used_gb REAL,
-      disk_total_gb REAL,
-      load_avg_1m REAL
-    );
-
     CREATE TABLE IF NOT EXISTS alert_state (
       alert_key TEXT PRIMARY KEY,
       kind TEXT NOT NULL,
@@ -114,7 +104,6 @@ export function initializeRev4aDb(dbPath) {
     CREATE INDEX IF NOT EXISTS idx_events_session ON events(session_id, ts);
     CREATE INDEX IF NOT EXISTS idx_sessions_updated ON sessions(updated_at);
     CREATE INDEX IF NOT EXISTS idx_sessions_started ON sessions(started_at);
-    CREATE INDEX IF NOT EXISTS idx_metrics_ts ON system_metrics(ts);
     CREATE INDEX IF NOT EXISTS idx_tool_calls_session ON tool_calls(session_id, ts);
     CREATE INDEX IF NOT EXISTS idx_alert_state_updated ON alert_state(updated_at);
   `);

package/lib/metrics-db.ts

@@ -0,0 +1,48 @@
+// Read access to the machine metrics database (daemon.js writes it).
+import fs from 'fs';
+import path from 'path';
+import Database from 'better-sqlite3';
+import { DB_PATH } from './db';
+
+/** Next to events.db, as daemon.js places it; its own file so the event log stays clean. */
+export const METRICS_DB_PATH = path.join(path.dirname(DB_PATH), 'metrics.db');
+
+/**
+ * Open the metrics database read-only, or null when there is nothing to read yet: no file
+ * (first start, or a daemon that never ran) or a file without the daemon's tables (it
+ * failed right after creating it). The daemon owns the schema.
+ */
+export function openMetricsDb(): Database.Database | null {
+  if (!fs.existsSync(METRICS_DB_PATH)) return null;
+  const db = new Database(METRICS_DB_PATH, { readonly: true, fileMustExist: true });
+  try {
+    const tables = db
+      .prepare("SELECT COUNT(*) AS n FROM sqlite_master WHERE type = 'table' AND name IN ('system_metrics', 'system_disks')")
+      .get() as { n: number };
+    if (tables.n === 2) return db;
+  } catch (e) {
+    db.close();
+    throw e;
+  }
+  db.close();
+  return null;
+}
+
+/**
+ * Seconds-since-epoch of the newest sample, or null when there is none. `available` is
+ * false when there is no metrics database to read, `error` when it could not be read.
+ * Never throws: a broken metrics.db must not fail a caller about something else.
+ */
+export function latestMetricSample(): { available: boolean; ts: number | null; error?: string } {
+  let db: Database.Database | null = null;
+  try {
+    db = openMetricsDb();
+    if (!db) return { available: false, ts: null };
+    const row = db.prepare('SELECT MAX(ts) AS latest FROM system_metrics').get() as { latest: number | null };
+    return { available: true, ts: row.latest };
+  } catch (e) {
+    return { available: false, ts: null, error: (e as Error).message };
+  } finally {
+    db?.close();
+  }
+}

package/lib/patterns/sessionPresentation.ts

@@ -27,11 +27,13 @@ export function shortLabel(sessionId: string): string {
   return sessionId.slice(0, 14);
 }
 
+// The two Italian patterns match prompt prefixes stored in older sessions' data; they
+// are matched, never shown, so they stay as they are.
 function stripTaskBoilerplate(value: string): string {
   return value
     .replace(/^\[Subagent Task\]\s*/i, '')
-    .replace(/^Task richiesto da .*?:\s*/i, '')
-    .replace(/^Sei [^.\n]+\.\s*/i, '')
+    .replace(/^Task richiesto da .*?:\s*/i, '') // lang-ok: matches stored prompt text
+    .replace(/^Sei [^.\n]+\.\s*/i, '') // lang-ok: matches stored prompt text
     .replace(/^Begin\.?\s*/i, '')
     .trim();
 }

package/lib/rev4a-auth.d.ts

@@ -4,3 +4,4 @@ export function requireAuthIfConfigured(request: Request): Promise<NextResponse
 export function getPassword(): string;
 export function getJwtSecret(): string;
 export function isConfigured(): boolean;
+export function secretEquals(supplied: unknown, expected: unknown): boolean;

package/lib/rev4a-auth.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { jwtVerify } from "jose";
 import * as fs from "fs";
+import { createHash, timingSafeEqual } from "crypto";
 import { ENV_FILE } from "@/lib/rev4a-paths";
 
 // ---------------------------------------------------------------------------
@@ -61,14 +62,17 @@ export async function requireAuthJWT(request) {
     } catch { /* fall through to bearer */ }
   }
 
-  const expectedToken = process.env.REV4A_TOKEN || process.env.NEXT_PUBLIC_REV4A_TOKEN || "";
+  // Only the server-side variable: anything named NEXT_PUBLIC_* is inlined into the
+  // browser bundle by Next.js, so accepting one here would hand the API token to every
+  // visitor of the dashboard the moment an operator set it.
+  const expectedToken = process.env.REV4A_TOKEN || "";
   // Without this guard an unset token would make `Bearer ` match an empty
   // expected value. HTTP header normalisation already strips the trailing
   // space so it isn't reachable in practice — the guard makes that safety
   // explicit instead of dependent on it.
   if (expectedToken) {
     const auth = request.headers.get("authorization");
-    if (auth === `Bearer ${expectedToken}`) return null;
+    if (auth && secretEquals(auth, `Bearer ${expectedToken}`)) return null;
   }
 
   return unauthorized();
@@ -82,3 +86,15 @@ export async function requireAuthIfConfigured(request) {
   if (!isConfigured()) return null;
   return requireAuthJWT(request);
 }
+
+/**
+ * Compare a supplied secret with the expected one in constant time. Both are hashed to
+ * a fixed length first, so neither the content nor the length of the expected value
+ * leaks through how long the comparison takes. (The provider gateway's own check in
+ * app/api/provider/auth.ts compares the raw bytes after a length guard instead.)
+ */
+export function secretEquals(supplied, expected) {
+  if (typeof supplied !== "string" || typeof expected !== "string" || !expected) return false;
+  const digest = (value) => createHash("sha256").update(value, "utf8").digest();
+  return timingSafeEqual(digest(supplied), digest(expected));
+}

package/next.config.mjs

@@ -1,7 +1,15 @@
+// Extra hostnames or IPs allowed to reach the dev server (`next dev` only — no effect on
+// a production build), e.g. a LAN address when opening the dashboard from another device.
+// Comma-separated, without scheme or port; none by default.
+const extraDevOrigins = (process.env.REV4A_DEV_ORIGINS ?? '')
+  .split(',')
+  .map((origin) => origin.trim())
+  .filter(Boolean);
+
 const nextConfig = {
   reactStrictMode: true,
   serverExternalPackages: ['better-sqlite3'],
-  allowedDevOrigins: ['187.77.156.41', '127.0.0.1', 'localhost', 'rev4a.srv1490011.hstgr.cloud'],
+  allowedDevOrigins: ['127.0.0.1', 'localhost', ...extraDevOrigins],
 };
 
 export default nextConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flame0510/project-aether",
-  "version": "1.6.2",
+  "version": "1.8.0",
   "description": "Rev4a — Revolution for Agents. OpenClaw agent fleet orchestrator.",
   "keywords": [
     "openclaw",
@@ -52,10 +52,10 @@
   "scripts": {
     "dev": "next dev -p 3720",
     "build": "next build",
+    "typecheck": "tsc --noEmit",
     "start": "rev4a serve",
     "start:all": "rev4a serve",
     "refresh:pricing": "node scripts/refresh-model-pricing.mjs",
-    "smoke:db-bootstrap": "node scripts/smoke-db-bootstrap.mjs",
     "postinstall": "node bin/postinstall.js",
     "check:language": "node scripts/check-language.mjs",
     "info:suggest": "node scripts/model-info-suggest.mjs",

package/scripts/backup.sh

@@ -1,66 +1,60 @@
 #!/usr/bin/env bash
-# backup.sh — Backup Rev4a data to a tar.gz archive
+# backup.sh — archive Rev4a's own data directory
 #
 # Usage:
-#   sudo bash scripts/backup.sh                     # backup to ./backups/
-#   sudo bash scripts/backup.sh /path/to/backups    # custom directory
+#   bash scripts/backup.sh                    # archive into ~/rev4a-backups/
+#   bash scripts/backup.sh /path/to/backups   # custom destination
 #
-# What it backs up:
-#   - data/*.db (events, credentials, lineage)
-#   - data/provider-keys.json
-#   - data/agents-token.json
-#   - models.config.json
-#   - .env (credentials and configuration)
+# What it archives: the whole Rev4a data directory — $REV4A_DATA_DIR when set,
+# otherwise ~/.config/rev4a (the same rule as lib/rev4a-paths.ts). That is `.env`
+# (secrets and configuration), everything under `data/` (events.db, metrics.db and
+# credentials.db with their -wal/-shm files, provider-keys.json, agents-token.json, model
+# overrides, the update log) and `shared/` (shared skills and rules). New files there are included
+# automatically.
 #
-# Does NOT back up:
-#   - node_modules (can be reinstalled)
-#   - .next build cache (can be rebuilt)
+# Not included: agent volumes (the cold backups in the dashboard cover those), the
+# installed package, node_modules, .next.
+#
+# The archive holds every Rev4a secret in plain text: it is created with mode 0600, and a
+# destination directory the script creates gets mode 0700 (an existing one is left as it
+# is). Keep a copy off the machine, stored securely.
+# For a fully consistent database copy, stop Rev4a first (`systemctl stop rev4a`);
+# a copy taken while it runs is normally fine, since SQLite keeps its WAL alongside.
 set -euo pipefail
 
-# Resolve script directory
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REV4A_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-BACKUP_DIR="${1:-${REV4A_ROOT}/backups}"
-
-mkdir -p "$BACKUP_DIR"
-
-TS=$(date -u +%Y%m%d-%H%M%S)
-ARCHIVE="${BACKUP_DIR}/rev4a-backup-${TS}.tar.gz"
-
-echo "Backing up Rev4a data..."
-echo "  Source: ${REV4A_ROOT}"
-echo "  Target: ${ARCHIVE}"
+DATA_DIR="${REV4A_DATA_DIR:-${HOME}/.config/rev4a}"
+BACKUP_DIR="${1:-${HOME}/rev4a-backups}"
 
-cd "$REV4A_ROOT"
+if [[ ! -d "$DATA_DIR" ]]; then
+  echo "Error: Rev4a data directory not found: $DATA_DIR" >&2
+  echo "Set REV4A_DATA_DIR if Rev4a keeps its data elsewhere." >&2
+  exit 1
+fi
+if [[ ! -f "$DATA_DIR/.env" && ! -d "$DATA_DIR/data" ]]; then
+  echo "Error: $DATA_DIR has neither .env nor data/ — refusing to archive an unrelated directory." >&2
+  exit 1
+fi
 
-# Restrict permissions during archive creation
 umask 077
-
-# Create tar with only the files we care about
-tar -czf "$ARCHIVE" \
-  --exclude='node_modules' \
-  --exclude='.next' \
-  --exclude='.git' \
-  --exclude='backups' \
-  data/*.db \
-  data/*.db-shm \
-  data/*.db-wal \
-  data/provider-keys.json 2>/dev/null || true \
-  data/agents-token.json 2>/dev/null || true \
-  models.config.json 2>/dev/null || true \
-  .env 2>/dev/null || true
-
-echo ""
-echo "=============================================="
-echo "  Backup complete!"
-echo "=============================================="
-echo ""
-echo "  Archive: ${ARCHIVE}"
-echo "  Size:    $(du -h "$ARCHIVE" | cut -f1)"
-echo ""
+mkdir -p "$BACKUP_DIR"
+# The archive must not end up inside what it archives. Both paths are compared once they
+# exist and with symlinks resolved, so a relative or linked destination cannot slip past.
+case "$(cd "$BACKUP_DIR" && pwd -P)/" in
+  "$(cd "$DATA_DIR" && pwd -P)/"*) echo "Error: the destination is inside the data directory." >&2; exit 1 ;;
+esac
+
+ARCHIVE="${BACKUP_DIR}/rev4a-backup-$(date -u +%Y%m%d-%H%M%S).tar.gz"
+echo "Backing up Rev4a data"
+echo "  Source: $DATA_DIR"
+echo "  Target: $ARCHIVE"
+
+# noclobber: a second backup in the same second fails instead of overwriting the first.
+set -o noclobber
+tar -C "$DATA_DIR" -czf - . > "$ARCHIVE"
+set +o noclobber
 chmod 600 "$ARCHIVE"
-echo "  WARNING: This archive contains plain-text credentials (.env)."
-echo "  Store it securely (encrypted at rest recommended)."
+
 echo ""
-echo "  To restore: sudo bash scripts/restore.sh ${ARCHIVE}"
-echo "=============================================="
+echo "Backup complete: $(tar -tzf "$ARCHIVE" | grep -vc '/$') files, $(du -h "$ARCHIVE" | cut -f1)"
+echo "It contains plain-text secrets (.env, keys, credentials): keep a copy off this machine, stored securely."
+echo "To restore: bash scripts/restore.sh $ARCHIVE"