@shellus/way 0.6.10 → 0.6.12

package/README.md

@@ -39,6 +39,8 @@
 
 定期清理旧快照，防止存储膨胀。
 
+正式 `way gc` 在删除快照前执行普通 `restic unlock`，仅回收 restic 判定失效的锁，不使用 `--remove-all`。解锁失败时停止清理；`--dry-run` 不解锁。活跃锁仍由 restic 保护。
+
 ### 7. 同步不等于备份
 
 同步工具（如 Syncthing）会将误操作实时传播到所有节点。真正的备份必须具备版本历史和回滚能力。
@@ -52,6 +54,7 @@
 - 支持项目级 schedule 配置（不同项目不同频率）
 - 使用 node-cron 实现精确到分钟的调度
 - systemd service 管理常驻进程（自动重启）
+- 支持把本地仓库中各项目的最新快照定期复制到远程仓库
 
 ### 9. 多层冗余原则
 
@@ -68,7 +71,7 @@
 ## 依赖
 
 - Linux x64 独立发行包无需预装 Node.js、npm、Bun 或 restic
-- npm 安装方式需要 Node.js >= 18
+- npm 安装方式需要 Node.js >= 22.12
 - Linux x64 平台内置 [restic](https://restic.net/) 0.18.1，其他平台需自行安装 restic
 
 `way` 查找 restic 的顺序：
@@ -137,6 +140,15 @@ way systemd install
 way systemd status
 ```
 
+Windows 使用系统自带的任务计划程序守护 `way daemon`，不依赖 NSSM 或其他常驻工具：
+
+```powershell
+way windows-service install
+way windows-service status
+```
+
+`windows-service install` 会创建以 `SYSTEM` 身份在开机后运行的原生任务，并配置失败重启；注册和删除任务需要在提升权限的 PowerShell 中执行。任务仅守护 daemon，实际备份频率仍由 `rules.yaml` 的项目级 `schedule` 决定。
+
 ### 4. 手动执行备份
 
 ```bash
@@ -159,6 +171,8 @@ way restore data --host old-host --target /tmp/restore --dry-run  # 从指定 ho
 way restore data --target /tmp/restore --delete     # 删除目标中快照不存在的文件
 way gc                  # 按 retention 策略清理旧快照
 way gc --dry-run        # 模拟清理（不实际删除）
+way replicate           # 执行全部仓库复制任务
+way replicate local-to-s3 --init  # 首次初始化目标仓库并执行复制
 
 # daemon 模式（推荐）
 way daemon              # 启动常驻进程，按配置定时执行
@@ -169,6 +183,12 @@ way systemd show        # 显示 systemd 配置
 way systemd status      # 查看服务状态
 way systemd uninstall   # 卸载服务
 
+# Windows 原生守护任务管理
+way windows-service install    # 注册开机启动、SYSTEM 身份运行的 daemon 守护任务
+way windows-service show       # 显示将要写入的任务与启动脚本
+way windows-service status     # 查看任务状态
+way windows-service uninstall  # 删除任务与启动脚本
+
 # 显式透传 restic（way 只设置环境变量）
 way restic snapshots    # → restic snapshots
 way restic check        # → restic check
@@ -190,9 +210,12 @@ graph LR
     C --> D[node-cron 定时触发]
     D --> E[执行 restic backup]
     E --> F[推送 Uptime Kuma]
+    D --> K[选择各项目最新快照]
+    K --> L[restic copy 到远程仓库]
 
     G[systemd service] --> H[启动 daemon]
     H --> I[进程崩溃自动重启]
+    J[Windows Task Scheduler] --> H
 ```
 
 ---
@@ -221,9 +244,32 @@ WAY_DIR=/path/to/config way restic snapshots
 - **projects.*.hooks**: 项目级备份钩子，支持 `before_backup` 和 `after_backup`
 - **uptime_kuma.push_url**: 全局 Uptime Kuma Push 地址，作为项目未配置通知地址时的回退
 - **projects.*.uptime_kuma.push_url**: 项目级 Uptime Kuma Push 地址，优先于全局地址
+- **replications**: 仓库复制任务，包含源仓库、目标仓库、调度和目标仓库独立保留策略
 - **maintenance**: 维护任务配置（prune、check）
+- **maintenance.prune.uptime_kuma.push_url**: daemon 定时 prune 的 Uptime Kuma Push 地址，未配置时回退到全局地址；prune 成功推送 UP，失败推送带原因的 DOWN
 - **global_excludes**: 全局排除规则
 
+`defaults.retention` 支持两种互斥模式：
+
+- 计数保留：`keep_daily`、`keep_weekly`、`keep_monthly`、`keep_yearly`，按 restic 分组规则保留周期快照。
+- 严格范围保留：`keep_hosts` 与 `max_age_days` 必须同时设置。Way 以执行时的当前时间计算截止点，只保留白名单主机在最近指定天数内的快照；其他快照使用明确 ID 删除。该模式不会使用 restic 相对最新快照计算的 `keep-within` 语义。
+
+两种模式不得混用。严格范围保留示例：
+
+```yaml
+defaults:
+  retention:
+    keep_hosts: [backup-host]
+    max_age_days: 7
+
+maintenance:
+  prune:
+    schedule: "0 4 * * *"
+    retry_lock: "30m"
+```
+
+`maintenance.prune.retry_lock` 会作为 restic 全局 `--retry-lock` 参数传递。正式启用严格范围保留前必须先执行 `way gc --dry-run`，核对输出的保留和删除快照列表。
+
 项目级钩子用于在 restic 备份前后执行一致性快照、校验或清理脚本：
 
 ```yaml
@@ -325,6 +371,8 @@ way backup data_deps
 
 `schedule` 支持 node-cron 字符串或 `false`。`false` 表示不创建自动调度任务，只能通过 `way backup <project>` 或 `way backup` 手动触发。项目未设置 `schedule` 时继承 `defaults.schedule`；如果全局和项目都未设置，则不自动调度。
 
+daemon 的调度心跳最多容忍 5 秒延迟；事件循环短暂阻塞后仍会补执行本轮任务，超过窗口则由 node-cron 报告为 missed execution。
+
 | 格式 | 说明 | 示例 |
 |------|------|------|
 | `"0 */2 * * *"` | 间隔表达式 | 每 2 小时 |
@@ -333,6 +381,27 @@ way backup data_deps
 | `"*/30 * * * *"` | 分钟间隔 | 每 30 分钟 |
 | `false` | 禁用自动调度 | 只手动备份 |
 
+**仓库复制示例**：
+
+```yaml
+replications:
+  local-to-s3:
+    from: local
+    to: s3
+    snapshot_policy: latest-per-project
+    schedule: "30 5 * * *"
+    prune_schedule: "30 6 * * 0"
+    retention:
+      keep_daily: 30
+      keep_weekly: 12
+      keep_monthly: 12
+      keep_yearly: 3
+```
+
+复制任务读取源仓库中所有带 `way:<project>` 标签的快照，每个项目只选择时间最新的一份传给 `restic copy`。因此本地可以高频备份，而远程只接收每日复制时刻的项目最新状态；重复运行会跳过已经复制的源快照。目标仓库的 `prune_schedule` 和 `retention` 独立于默认仓库。
+
+目标仓库第一次使用时执行 `way replicate <name> --init`。该命令通过 `--copy-chunker-params` 继承源仓库的分块参数，再执行首次复制；初始化后日常任务只运行 `way replicate <name>`。复制源当前必须是本地仓库，源与目标可以使用不同的 restic 密码。
+
 #### 排除规则通配符语法
 
 restic 使用 Go 的 filepath.Match 语法：
@@ -357,10 +426,24 @@ repositories:
     path: /backup/repo
     credentials:
       password: your-password  # 直接明文
+
+  s3:
+    type: s3
+    endpoint: s3.example.com
+    bucket: my-backup-bucket
+    region: region-1
+    options:
+      bucket_lookup: dns
+    credentials:
+      password: your-restic-password
+      access_key_id: your-access-key
+      secret_access_key: your-secret-key
 ```
 
 建议设置文件权限：`chmod 600 ~/.way/repositories.yaml`
 
+`repositories.yaml` 和 `rules.yaml` 支持 YAML merge anchor（`<<`）；Way 使用 YAML 1.2 Core Schema 并显式启用 merge tag，不会同时启用 YAML 1.1 的日期自动转换等额外类型。
+
 ## 配置备份
 
 `~/.way/` 目录包含所有配置和凭证，建议整体备份到安全位置：

package/dist/cli.js

@@ -2,22 +2,24 @@
 
 // src/cli.ts
 import { Command } from "commander";
-import fs6 from "fs";
-import path6 from "path";
+import fs8 from "fs";
+import path9 from "path";
 
 // src/core/config.ts
 import fs from "fs";
 import path from "path";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
+var configSchema = yaml.CORE_SCHEMA.withTags(yaml.mergeTag);
 function loadConfig(wayDir, remoteName) {
   const repoFile = path.join(wayDir, "repositories.yaml");
-  const repoConfig = yaml.load(fs.readFileSync(repoFile, "utf8"));
+  const repoConfig = yaml.load(fs.readFileSync(repoFile, "utf8"), { schema: configSchema });
   const repoName = remoteName === "default" ? repoConfig.default : remoteName;
   const repository = repoConfig.repositories[repoName];
   if (!repository) throw new Error(`Repository not found: ${repoName}`);
   const rulesFile = path.join(wayDir, "rules.yaml");
-  const rules = yaml.load(fs.readFileSync(rulesFile, "utf8"));
-  if ("schedule" in rules && "backup" in (rules.schedule || {})) {
+  const rules = yaml.load(fs.readFileSync(rulesFile, "utf8"), { schema: configSchema });
+  const legacySchedule = "schedule" in rules ? rules.schedule : void 0;
+  if (typeof legacySchedule === "object" && legacySchedule !== null && "backup" in legacySchedule) {
     throw new Error("\u68C0\u6D4B\u5230 v0.4.x \u65E7\u914D\u7F6E\u683C\u5F0F\uFF0C\u8BF7\u8FD0\u884C\u8FC1\u79FB\u811A\u672C\uFF1Anpx --yes @shellus/way@latest migrate-to-v0.5.sh \u6216\u624B\u52A8\u53C2\u8003 rules.yaml.example \u66F4\u65B0\u914D\u7F6E");
   }
   return { repository, rules };
@@ -91,19 +93,20 @@ function resolveResticBin(options = {}) {
 }
 
 // src/core/restic.ts
-function buildResticEnv(repo) {
-  const env = {};
+function buildRepositoryLocation(repo) {
   switch (repo.type) {
     case "s3":
-      env.RESTIC_REPOSITORY = `s3:https://${repo.endpoint}/${repo.bucket}`;
-      break;
+      return `s3:https://${repo.endpoint}/${repo.bucket}`;
     case "local":
-      env.RESTIC_REPOSITORY = repo.path;
-      break;
+      return repo.path;
     case "sftp":
-      env.RESTIC_REPOSITORY = `sftp:${repo.host}:${repo.path}`;
-      break;
+      return `sftp:${repo.host}:${repo.path}`;
   }
+}
+function buildResticEnv(repo) {
+  const env = {
+    RESTIC_REPOSITORY: buildRepositoryLocation(repo)
+  };
   if (repo.credentials.password) env.RESTIC_PASSWORD = repo.credentials.password;
   if (repo.credentials.access_key_id) env.AWS_ACCESS_KEY_ID = repo.credentials.access_key_id;
   if (repo.credentials.secret_access_key) env.AWS_SECRET_ACCESS_KEY = repo.credentials.secret_access_key;
@@ -178,6 +181,12 @@ function collectIncludeDirs(paths, includeDirs, options = {}) {
   }
   return Array.from(new Set(matches));
 }
+function normalizeResticPath(value, platform = process.platform) {
+  if (platform !== "win32") return value;
+  const match = value.match(/^([A-Za-z]):[\\/](.*)$/);
+  if (!match) return value.replace(/\\/g, "/");
+  return `/${match[1].toUpperCase()}/${match[2].replace(/\\/g, "/")}`;
+}
 function buildRestoreArgs(name, project, options) {
   const args = [
     "restore",
@@ -186,7 +195,7 @@ function buildRestoreArgs(name, project, options) {
   ];
   if (options.host) args.push(`--host=${options.host}`);
   args.push(`--target=${options.target}`);
-  for (const path7 of project.paths) args.push(`--include=${path7}`);
+  for (const path10 of options.includePaths || project.paths) args.push(`--include=${normalizeResticPath(path10, options.platform)}`);
   if (options.dryRun) args.push("--dry-run");
   if (options.delete) args.push("--delete");
   if (options.verbose) args.push("--verbose=2");
@@ -197,11 +206,24 @@ function buildS3Options(repo) {
   if (repo.options?.bucket_lookup) {
     options.push("-o", `s3.bucket-lookup=${repo.options.bucket_lookup}`);
   }
+  if (repo.region) {
+    options.push("-o", `s3.region=${repo.region}`);
+  }
   return options;
 }
 async function execRestic(args, env, s3Options = []) {
+  await runRestic(args, env, s3Options, false);
+}
+async function execResticCapture(args, env, s3Options = []) {
+  return runRestic(args, env, s3Options, true);
+}
+async function runRestic(args, env, s3Options, capture) {
   try {
-    await execa(resolveResticBin(), [...s3Options, ...args], { env: { ...process.env, ...env }, stdio: "inherit" });
+    const result = await execa(resolveResticBin(), [...s3Options, ...args], {
+      env: { ...process.env, ...env },
+      ...capture ? { stdout: "pipe", stderr: "inherit" } : { stdio: "inherit" }
+    });
+    return typeof result.stdout === "string" ? result.stdout : "";
   } catch (error) {
     if (error.code === "ENOENT") {
       console.error("Error: restic not found. Linux x64 packages include restic; other platforms must install it first.");
@@ -212,11 +234,28 @@ async function execRestic(args, env, s3Options = []) {
   }
 }
 
+// src/core/uptime-kuma.ts
+var MAX_MESSAGE_LENGTH = 200;
+async function notifyUptimeKuma(push, pushUrl) {
+  const msg = push.msg.length > MAX_MESSAGE_LENGTH ? `${push.msg.slice(0, MAX_MESSAGE_LENGTH - 3)}...` : push.msg;
+  const url = `${pushUrl}?status=${push.status}&msg=${encodeURIComponent(msg)}&ping=${push.ping}`;
+  try {
+    const response = await fetch(url);
+    if (response.ok) {
+      console.log(`Uptime Kuma notified: status=${push.status}, ping=${push.ping}ms`);
+    } else {
+      console.error("Uptime Kuma notification failed");
+    }
+  } catch (error) {
+    console.error("Uptime Kuma notification failed:", error);
+  }
+}
+
 // src/commands/backup.ts
 import fs4 from "fs";
 import os from "os";
 import path4 from "path";
-import { execaCommand } from "execa";
+import { execa as execa2 } from "execa";
 async function backup(options) {
   const wayDir = process.env.WAY_DIR || `${process.env.HOME}/.way`;
   const config = loadConfig(wayDir, options.remote);
@@ -300,7 +339,11 @@ async function backup(options) {
   if (failed.length > 0) console.log("Failed:", failed.join(", "));
   if (!dryRun) {
     for (const [pushUrl, result] of groupUptimeKumaResults(projectResults)) {
-      await notifyUptimeKuma(result, pushUrl);
+      await notifyUptimeKuma({
+        status: result.failed.length > 0 ? "down" : "up",
+        msg: `Succeeded: ${result.succeeded.length}, Failed: ${result.failed.length}`,
+        ping: result.duration
+      }, pushUrl);
     }
   }
   return { succeeded, failed, duration };
@@ -377,7 +420,7 @@ async function runProjectHooks(hooks, context) {
       continue;
     }
     console.log(`Running ${context.label} hook for ${context.projectName}: ${normalized.run}`);
-    const subprocess = execaCommand(normalized.run, {
+    const subprocess = execa2(normalized.run, {
       shell: true,
       stdio: "inherit",
       timeout: parseTimeout(normalized.timeout),
@@ -404,25 +447,48 @@ async function runProjectHooks(hooks, context) {
     }
   }
 }
-async function notifyUptimeKuma(result, pushUrl) {
-  const status = result.failed.length > 0 ? "down" : "up";
-  const msg = `Succeeded: ${result.succeeded.length}, Failed: ${result.failed.length}`;
-  const url = `${pushUrl}?status=${status}&msg=${encodeURIComponent(msg)}&ping=${result.duration}`;
-  try {
-    const response = await fetch(url);
-    if (response.ok) {
-      console.log(`Uptime Kuma notified: status=${status}, ping=${result.duration}ms`);
-    } else {
-      console.error("Uptime Kuma notification failed");
-    }
-  } catch (error) {
-    console.error("Uptime Kuma notification failed:", error);
-  }
-}
 
 // src/commands/restore.ts
+import path5 from "path";
+function isWithin(parent, child, pathApi) {
+  const relative = pathApi.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !pathApi.isAbsolute(relative);
+}
+function findCommonParent(paths, pathApi) {
+  let candidate = paths[0];
+  while (!paths.every((item) => isWithin(candidate, item, pathApi))) {
+    const parent = pathApi.dirname(candidate);
+    if (parent === candidate) return candidate;
+    candidate = parent;
+  }
+  return candidate;
+}
+function buildWindowsRestorePlans(project, target, snapshot = "latest") {
+  const pathApi = path5.win32;
+  const groups = /* @__PURE__ */ new Map();
+  for (const sourcePath of project.paths) {
+    const root = pathApi.parse(sourcePath).root.toLowerCase();
+    const paths = groups.get(root) || [];
+    paths.push(sourcePath);
+    groups.set(root, paths);
+  }
+  return Array.from(groups.values()).map((paths) => {
+    const parent = findCommonParent(paths.map((item) => pathApi.dirname(item)), pathApi);
+    const drive = parent[0].toUpperCase();
+    const rest = parent.slice(2).replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+    const snapshotPath = rest ? `/${drive}/${rest}` : `/${drive}`;
+    const includePaths = paths.map((item) => `/${pathApi.relative(parent, item).replace(/\\/g, "/")}`);
+    const targetPath = pathApi.join(target, ...snapshotPath.split("/").filter(Boolean));
+    return {
+      snapshot: `${snapshot}:${snapshotPath}`,
+      target: targetPath,
+      includePaths: Array.from(new Set(includePaths))
+    };
+  });
+}
 async function restore(options) {
   if (!options.target) throw new Error("--target is required");
+  const target = options.target;
   const wayDir = process.env.WAY_DIR || `${process.env.HOME}/.way`;
   const config = loadConfig(wayDir, options.remote);
   const env = buildResticEnv(config.repository);
@@ -440,15 +506,19 @@ async function restore(options) {
     }
     console.log(`=== Restoring: ${projectName} ===`);
     try {
-      const args = buildRestoreArgs(projectName, project, {
-        target: options.target,
-        snapshot: options.snapshot,
-        host: options.host,
-        dryRun: options.dryRun,
-        delete: options.delete,
-        verbose: options.verbose
-      });
-      await execRestic(args, env, s3Options);
+      const plans = process.platform === "win32" && project.paths.every((item) => /^[A-Za-z]:[\\/]/.test(item)) ? buildWindowsRestorePlans(project, target, options.snapshot) : [{ snapshot: options.snapshot, target, includePaths: void 0 }];
+      for (const plan of plans) {
+        const args = buildRestoreArgs(projectName, project, {
+          target: plan.target,
+          snapshot: plan.snapshot,
+          host: options.host,
+          dryRun: options.dryRun,
+          delete: options.delete,
+          verbose: options.verbose,
+          includePaths: plan.includePaths
+        });
+        await execRestic(args, env, s3Options);
+      }
       succeeded.push(projectName);
     } catch (error) {
       console.error(`Failed to restore ${projectName}:`, error);
@@ -463,18 +533,108 @@ async function restore(options) {
 }
 
 // src/commands/gc.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function hasLegacyPolicy(retention) {
+  return [
+    retention.keep_daily,
+    retention.keep_weekly,
+    retention.keep_monthly,
+    retention.keep_yearly
+  ].some((value) => value !== void 0);
+}
+function isStrictPolicy(retention) {
+  return retention.keep_hosts !== void 0 || retention.max_age_days !== void 0;
+}
+function validateStrictPolicy(retention) {
+  if (!retention.keep_hosts?.length) {
+    throw new Error("Strict retention requires at least one defaults.retention.keep_hosts entry");
+  }
+  if (!Number.isFinite(retention.max_age_days) || retention.max_age_days <= 0) {
+    throw new Error("Strict retention requires defaults.retention.max_age_days to be a positive number");
+  }
+  if (hasLegacyPolicy(retention)) {
+    throw new Error("Strict keep_hosts/max_age_days retention cannot be combined with count-based keep_* retention");
+  }
+  const normalizedHosts = retention.keep_hosts.map((host) => host.trim());
+  if (normalizedHosts.some((host) => host.length === 0)) {
+    throw new Error("defaults.retention.keep_hosts cannot contain empty host names");
+  }
+  return { hosts: new Set(normalizedHosts), maxAgeDays: retention.max_age_days };
+}
+function buildSnapshotRetentionPlan(snapshots, retention, now = /* @__PURE__ */ new Date()) {
+  const { hosts, maxAgeDays } = validateStrictPolicy(retention);
+  const cutoff = new Date(now.getTime() - maxAgeDays * DAY_MS);
+  const keep = [];
+  const remove = [];
+  for (const snapshot of snapshots) {
+    const snapshotTime = new Date(snapshot.time);
+    if (Number.isNaN(snapshotTime.getTime())) {
+      throw new Error(`Snapshot ${snapshot.id} has an invalid timestamp: ${snapshot.time}`);
+    }
+    if (hosts.has(snapshot.hostname) && snapshotTime >= cutoff) {
+      keep.push(snapshot);
+    } else {
+      remove.push(snapshot);
+    }
+  }
+  return { cutoff, keep, remove };
+}
+function printSnapshots(label, snapshots) {
+  console.log(`${label} (${snapshots.length}):`);
+  for (const snapshot of snapshots) {
+    console.log(`  ${snapshot.id.slice(0, 8)}  ${snapshot.time}  ${snapshot.hostname}  ${(snapshot.tags || []).join(",") || "-"}`);
+  }
+}
+function buildResticOptions(s3Options, retryLock) {
+  const options = [...s3Options];
+  if (retryLock) options.push(`--retry-lock=${retryLock}`);
+  return options;
+}
+async function executeGc(args, dryRun, env, resticOptions) {
+  if (!dryRun) {
+    console.log("Removing stale repository locks before cleanup...");
+    await execRestic(["unlock"], env, resticOptions);
+  }
+  await execRestic(args, env, resticOptions);
+}
+async function runStrictGc(retention, dryRun, env, resticOptions) {
+  const snapshotsJson = await execResticCapture(["snapshots", "--json", "--no-lock"], env, resticOptions);
+  const snapshots = JSON.parse(snapshotsJson);
+  if (!Array.isArray(snapshots)) throw new Error("restic snapshots --json did not return an array");
+  const plan = buildSnapshotRetentionPlan(snapshots, retention);
+  console.log(`Policy: keep hosts=${retention.keep_hosts.join(",")}, max age=${retention.max_age_days} days, cutoff=${plan.cutoff.toISOString()}`);
+  printSnapshots("Keep snapshots", plan.keep);
+  printSnapshots("Remove snapshots", plan.remove);
+  if (dryRun) {
+    console.log("Dry-run complete; no snapshots or repository data were modified.");
+    return;
+  }
+  if (plan.remove.length === 0) {
+    console.log("No snapshots matched cleanup; prune was skipped.");
+    return;
+  }
+  await executeGc(["forget", "--prune", ...plan.remove.map((snapshot) => snapshot.id)], false, env, resticOptions);
+}
 async function gc(options) {
   const wayDir = process.env.WAY_DIR || `${process.env.HOME}/.way`;
   const config = loadConfig(wayDir, options.remote);
-  const retention = config.rules.defaults?.retention || {};
-  const keepDaily = retention.keep_daily || 7;
-  const keepWeekly = retention.keep_weekly || 4;
-  const keepMonthly = retention.keep_monthly || 6;
-  const keepYearly = retention.keep_yearly;
+  const retention = options.retention ?? config.rules.defaults?.retention ?? {};
+  const dryRun = options.dryRun || false;
   console.log("=== Cleaning snapshots ===");
-  console.log(`Policy: daily=${keepDaily}, weekly=${keepWeekly}, monthly=${keepMonthly}${keepYearly ? `, yearly=${keepYearly}` : ""}`);
   const env = buildResticEnv(config.repository);
-  const s3Options = buildS3Options(config.repository);
+  const resticOptions = buildResticOptions(
+    buildS3Options(config.repository),
+    config.rules.maintenance?.prune?.retry_lock
+  );
+  if (isStrictPolicy(retention)) {
+    await runStrictGc(retention, dryRun, env, resticOptions);
+    return;
+  }
+  const keepDaily = retention.keep_daily ?? 7;
+  const keepWeekly = retention.keep_weekly ?? 4;
+  const keepMonthly = retention.keep_monthly ?? 6;
+  const keepYearly = retention.keep_yearly;
+  console.log(`Policy: daily=${keepDaily}, weekly=${keepWeekly}, monthly=${keepMonthly}${keepYearly !== void 0 ? `, yearly=${keepYearly}` : ""}`);
   const args = [
     "forget",
     "--prune",
@@ -482,23 +642,23 @@ async function gc(options) {
     `--keep-weekly=${keepWeekly}`,
     `--keep-monthly=${keepMonthly}`
   ];
-  if (keepYearly) args.push(`--keep-yearly=${keepYearly}`);
-  if (options.dryRun) args.push("--dry-run");
-  await execRestic(args, env, s3Options);
+  if (keepYearly !== void 0) args.push(`--keep-yearly=${keepYearly}`);
+  if (dryRun) args.push("--dry-run");
+  await executeGc(args, dryRun, env, resticOptions);
 }
 
 // src/commands/systemd.ts
 import { execSync } from "child_process";
 import fs5 from "fs";
-import path5 from "path";
+import path6 from "path";
 function resolveWayCommandPath(options = {}) {
   const env = options.env ?? process.env;
   const argv = options.argv ?? process.argv;
   const execPath = options.execPath ?? process.execPath;
   const whichWay = options.whichWay ?? (() => execSync("which way", { encoding: "utf-8" }).trim());
   if (env.WAY_BIN) return env.WAY_BIN;
-  if (path5.basename(execPath) === "way") return execPath;
-  if (argv[1] && path5.isAbsolute(argv[1])) return argv[1];
+  if (path6.basename(execPath) === "way") return execPath;
+  if (argv[1] && path6.isAbsolute(argv[1])) return argv[1];
   return whichWay();
 }
 async function systemd(options) {
@@ -528,7 +688,7 @@ WantedBy=multi-user.target
     return;
   }
   const systemdDir = "/etc/systemd/system";
-  const servicePath = path5.join(systemdDir, "way-backup.service");
+  const servicePath = path6.join(systemdDir, "way-backup.service");
   if (options.action === "install") {
     fs5.writeFileSync(servicePath, serviceContent);
     execSync("systemctl daemon-reload");
@@ -555,10 +715,243 @@ WantedBy=multi-user.target
   }
 }
 
+// src/commands/windows-service.ts
+import { execFileSync } from "child_process";
+import fs6 from "fs";
+import os2 from "os";
+import path7 from "path";
+var WINDOWS_TASK_NAME = "Way Backup Daemon";
+var WINDOWS_RUNNER_NAME = "way-daemon.cmd";
+function assertWindows(platform) {
+  if (platform !== "win32") throw new Error("windows-service is only available on Windows");
+}
+function assertSafeCmdValue(value, name) {
+  if (/[\r\n\0]/.test(value)) throw new Error(`${name} cannot contain line breaks or NUL bytes`);
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function resolveDaemonLaunch(options = {}) {
+  const env = options.env ?? process.env;
+  const argv = options.argv ?? process.argv;
+  const execPath = options.execPath ?? process.execPath;
+  if (env.WAY_BIN) return { command: env.WAY_BIN, args: ["daemon"] };
+  if (argv[1] && (path7.isAbsolute(argv[1]) || path7.win32.isAbsolute(argv[1]))) {
+    return { command: execPath, args: [argv[1], "daemon"] };
+  }
+  return { command: execPath, args: ["daemon"] };
+}
+function renderWindowsDaemonRunner(wayDir, launch, resticBin) {
+  for (const [name, value] of Object.entries({ wayDir, command: launch.command, resticBin })) {
+    if (value) assertSafeCmdValue(value, name);
+  }
+  for (const arg of launch.args) assertSafeCmdValue(arg, "daemon argument");
+  const setRestic = resticBin ? `set "WAY_RESTIC_BIN=${resticBin}"\r
+` : "";
+  const args = launch.args.map((arg) => `"${arg.replace(/"/g, '""')}"`).join(" ");
+  const command = `"${launch.command.replace(/"/g, '""')}"`;
+  return `@echo off\r
+setlocal\r
+set "WAY_DIR=${wayDir}"\r
+${setRestic}${command} ${args}\r
+`;
+}
+function renderWindowsTaskXml(runnerPath) {
+  assertSafeCmdValue(runnerPath, "runner path");
+  const argumentsValue = `/d /s /c ""${runnerPath}""`;
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo><Description>Way Backup Daemon</Description></RegistrationInfo>
+  <Triggers><BootTrigger><Enabled>true</Enabled><Delay>PT30S</Delay></BootTrigger></Triggers>
+  <Principals><Principal id="Author"><UserId>S-1-5-18</UserId><RunLevel>HighestAvailable</RunLevel></Principal></Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>true</StartWhenAvailable><RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <AllowStartOnDemand>true</AllowStartOnDemand><Enabled>true</Enabled><Hidden>true</Hidden><RunOnlyIfIdle>false</RunOnlyIfIdle><WakeToRun>false</WakeToRun>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit><Priority>7</Priority><RestartOnFailure><Interval>PT1M</Interval><Count>3</Count></RestartOnFailure>
+  </Settings>
+  <Actions Context="Author"><Exec><Command>cmd.exe</Command><Arguments>${xmlEscape(argumentsValue)}</Arguments></Exec></Actions>
+</Task>`;
+}
+function resolveResticPath(env, run) {
+  if (env.WAY_RESTIC_BIN) return env.WAY_RESTIC_BIN;
+  try {
+    return run("where.exe", ["restic.exe"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim().split(/\r?\n/)[0];
+  } catch {
+    return void 0;
+  }
+}
+async function windowsService(options, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  assertWindows(platform);
+  const env = dependencies.env ?? process.env;
+  const run = dependencies.execFileSync ?? execFileSync;
+  const writeFile = dependencies.writeFileSync ?? fs6.writeFileSync;
+  const unlink = dependencies.unlinkSync ?? fs6.unlinkSync;
+  const exists = dependencies.existsSync ?? fs6.existsSync;
+  const makeTempDir = dependencies.mkdtempSync ?? fs6.mkdtempSync;
+  const wayDir = env.WAY_DIR || path7.join(os2.homedir(), ".way");
+  const runnerPath = path7.join(wayDir, WINDOWS_RUNNER_NAME);
+  const launch = resolveDaemonLaunch({ env, argv: dependencies.argv, execPath: dependencies.execPath });
+  const runner = renderWindowsDaemonRunner(wayDir, launch, resolveResticPath(env, run));
+  const taskXml = renderWindowsTaskXml(runnerPath);
+  if (options.action === "show") {
+    console.log(`=== ${WINDOWS_TASK_NAME} ===`);
+    console.log(taskXml);
+    console.log(`=== ${runnerPath} ===`);
+    console.log(runner);
+    return;
+  }
+  if (options.action === "install") {
+    loadConfig(wayDir, options.remote);
+    fs6.mkdirSync(wayDir, { recursive: true });
+    writeFile(runnerPath, runner, { encoding: "utf8" });
+    const tempDir = makeTempDir(path7.join(os2.tmpdir(), "way-windows-service-"));
+    const xmlPath = path7.join(tempDir, "way-backup.xml");
+    try {
+      writeFile(xmlPath, `\uFEFF${taskXml}`, { encoding: "utf16le" });
+      run("schtasks.exe", ["/Create", "/TN", WINDOWS_TASK_NAME, "/XML", xmlPath, "/F"], { stdio: "inherit" });
+      run("schtasks.exe", ["/Run", "/TN", WINDOWS_TASK_NAME], { stdio: "inherit" });
+      console.log("Windows Way daemon task installed and started");
+    } finally {
+      if (exists(xmlPath)) unlink(xmlPath);
+      try {
+        fs6.rmdirSync(tempDir);
+      } catch {
+      }
+    }
+    return;
+  }
+  if (options.action === "uninstall") {
+    try {
+      run("schtasks.exe", ["/End", "/TN", WINDOWS_TASK_NAME], { stdio: "ignore" });
+    } catch {
+    }
+    try {
+      run("schtasks.exe", ["/Delete", "/TN", WINDOWS_TASK_NAME, "/F"], { stdio: "inherit" });
+    } catch {
+    }
+    if (exists(runnerPath)) unlink(runnerPath);
+    console.log("Windows Way daemon task uninstalled");
+    return;
+  }
+  run("schtasks.exe", ["/Query", "/TN", WINDOWS_TASK_NAME, "/FO", "LIST", "/V"], { stdio: "inherit" });
+}
+
 // src/commands/daemon.ts
 import cron from "node-cron";
+
+// src/commands/replicate.ts
+import fs7 from "fs";
+import os3 from "os";
+import path8 from "path";
+function selectLatestProjectSnapshots(snapshots, projectNames) {
+  const selected = /* @__PURE__ */ new Map();
+  for (const snapshot of snapshots) {
+    const snapshotTime = Date.parse(snapshot.time);
+    if (Number.isNaN(snapshotTime)) {
+      throw new Error(`Snapshot ${snapshot.id} has an invalid timestamp: ${snapshot.time}`);
+    }
+    for (const tag of snapshot.tags || []) {
+      if (!tag.startsWith("way:")) continue;
+      const projectName = tag.slice("way:".length);
+      if (!projectNames.includes(projectName)) continue;
+      const current = selected.get(projectName);
+      if (!current || snapshotTime > Date.parse(current.time)) {
+        selected.set(projectName, snapshot);
+      }
+    }
+  }
+  return projectNames.flatMap((projectName) => {
+    const snapshot = selected.get(projectName);
+    return snapshot ? [snapshot.id] : [];
+  });
+}
+function validateReplication(name, replication, sourceType) {
+  if (replication.from === replication.to) {
+    throw new Error(`Replication ${name} must use different source and destination repositories`);
+  }
+  if (sourceType !== "local") {
+    throw new Error(`Replication ${name} source repository must be local`);
+  }
+  if (replication.snapshot_policy && replication.snapshot_policy !== "latest-per-project") {
+    throw new Error(`Replication ${name} has unsupported snapshot_policy: ${replication.snapshot_policy}`);
+  }
+}
+async function withSourcePasswordFile(password, run) {
+  if (!password) throw new Error("Source repository password is required for replication");
+  const tempDir = fs7.mkdtempSync(path8.join(os3.tmpdir(), "way-replication-"));
+  const passwordFile = path8.join(tempDir, "source-password");
+  fs7.writeFileSync(passwordFile, `${password}
+`, { encoding: "utf8", mode: 384 });
+  try {
+    return await run(passwordFile);
+  } finally {
+    fs7.rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+async function replicateOne(wayDir, name, replication, initialize) {
+  const sourceConfig = loadConfig(wayDir, replication.from);
+  const destinationConfig = loadConfig(wayDir, replication.to);
+  validateReplication(name, replication, sourceConfig.repository.type);
+  const sourceEnv = buildResticEnv(sourceConfig.repository);
+  const destinationEnv = buildResticEnv(destinationConfig.repository);
+  const sourceOptions = buildS3Options(sourceConfig.repository);
+  const destinationOptions = buildS3Options(destinationConfig.repository);
+  const snapshots = JSON.parse(
+    await execResticCapture(["snapshots", "--json"], sourceEnv, sourceOptions)
+  );
+  if (!Array.isArray(snapshots)) throw new Error("restic snapshots --json did not return an array");
+  const snapshotIds = selectLatestProjectSnapshots(snapshots, Object.keys(sourceConfig.rules.projects));
+  await withSourcePasswordFile(sourceConfig.repository.credentials.password, async (passwordFile) => {
+    const sourceArguments = [
+      `--from-repo=${buildRepositoryLocation(sourceConfig.repository)}`,
+      `--from-password-file=${passwordFile}`
+    ];
+    if (initialize) {
+      console.log(`Initializing replication destination ${replication.to} from ${replication.from}`);
+      await execRestic(["init", ...sourceArguments, "--copy-chunker-params"], destinationEnv, destinationOptions);
+    }
+    if (snapshotIds.length === 0) {
+      console.log(`No project snapshots available for replication ${name}`);
+      return;
+    }
+    console.log(`Replicating ${snapshotIds.length} latest project snapshots: ${replication.from} -> ${replication.to}`);
+    await execRestic(["copy", ...sourceArguments, ...snapshotIds], destinationEnv, destinationOptions);
+  });
+}
+async function replicate(options = {}) {
+  const wayDir = process.env.WAY_DIR || `${process.env.HOME}/.way`;
+  const defaultConfig = loadConfig(wayDir, "default");
+  const replications = defaultConfig.rules.replications || {};
+  const names = options.names?.length ? options.names : Object.keys(replications);
+  const succeeded = [];
+  const failed = [];
+  const startTime = Date.now();
+  for (const name of names) {
+    const replication = replications[name];
+    if (!replication) {
+      console.error(`Replication not found: ${name}`);
+      failed.push(name);
+      continue;
+    }
+    try {
+      await replicateOne(wayDir, name, replication, options.initialize || false);
+      succeeded.push(name);
+    } catch (error) {
+      console.error(`Failed replication ${name}:`, error);
+      failed.push(name);
+    }
+  }
+  return { succeeded, failed, duration: Date.now() - startTime };
+}
+
+// src/commands/daemon.ts
 var isRunning = false;
 var taskQueue = [];
+var CRON_OPTIONS = {
+  missedExecutionTolerance: 5e3
+};
 function resolveProjectSchedule(project, defaults = {}) {
   if (project.schedule !== void 0) return project.schedule;
   return defaults?.schedule ?? false;
@@ -571,6 +964,24 @@ function assertValidSchedule(schedule, label) {
     throw new Error(`${label} must be a cron expression or false. Use false to disable scheduling.`);
   }
 }
+function resolvePrunePushUrl(rules) {
+  return rules.maintenance?.prune?.uptime_kuma?.push_url || rules.uptime_kuma?.push_url;
+}
+async function runPruneWithNotification(remote, pushUrl) {
+  const startTime = Date.now();
+  try {
+    await gc({ remote, dryRun: false });
+  } catch (error) {
+    if (pushUrl) {
+      const reason = error instanceof Error ? error.message : String(error);
+      await notifyUptimeKuma({ status: "down", msg: `Prune failed: ${reason}`, ping: Date.now() - startTime }, pushUrl);
+    }
+    throw error;
+  }
+  if (pushUrl) {
+    await notifyUptimeKuma({ status: "up", msg: "Prune succeeded", ping: Date.now() - startTime }, pushUrl);
+  }
+}
 function addScheduledBackup(scheduledBackups, schedule, projectName) {
   const projects = scheduledBackups.get(schedule) || [];
   projects.push(projectName);
@@ -610,18 +1021,42 @@ async function daemon(options) {
         console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Running backup: ${projects.join(", ")}`);
         await backup({ remote: options.remote, projects });
       });
-    });
+    }, CRON_OPTIONS);
     console.log(`Scheduled backup for ${projects.join(", ")}: ${schedule}`);
   }
+  for (const [name, replication] of Object.entries(config.rules.replications || {})) {
+    assertValidSchedule(replication.schedule, `replications.${name}.schedule`);
+    if (isEnabledSchedule(replication.schedule)) {
+      cron.schedule(replication.schedule, () => {
+        executeTask(async () => {
+          console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Running replication: ${name}`);
+          const result = await replicate({ names: [name] });
+          if (result.failed.length > 0) throw new Error(`Replication failed: ${result.failed.join(", ")}`);
+        });
+      }, CRON_OPTIONS);
+      console.log(`Scheduled replication ${name}: ${replication.schedule}`);
+    }
+    assertValidSchedule(replication.prune_schedule, `replications.${name}.prune_schedule`);
+    if (isEnabledSchedule(replication.prune_schedule)) {
+      cron.schedule(replication.prune_schedule, () => {
+        executeTask(async () => {
+          console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Running replication prune: ${name}`);
+          await gc({ remote: replication.to, dryRun: false, retention: replication.retention });
+        });
+      }, CRON_OPTIONS);
+      console.log(`Scheduled replication prune ${name}: ${replication.prune_schedule}`);
+    }
+  }
   const pruneSchedule = config.rules.maintenance?.prune?.schedule;
   assertValidSchedule(pruneSchedule, "maintenance.prune.schedule");
   if (isEnabledSchedule(pruneSchedule)) {
+    const prunePushUrl = resolvePrunePushUrl(config.rules);
     cron.schedule(pruneSchedule, () => {
       executeTask(async () => {
         console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Running prune`);
-        await gc({ remote: options.remote, dryRun: false });
+        await runPruneWithNotification(options.remote, prunePushUrl);
       });
-    });
+    }, CRON_OPTIONS);
     console.log(`Scheduled prune: ${pruneSchedule}`);
   }
   const checkSchedule = config.rules.maintenance?.check?.schedule;
@@ -631,7 +1066,7 @@ async function daemon(options) {
       executeTask(async () => {
         console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Running check`);
       });
-    });
+    }, CRON_OPTIONS);
     console.log(`Scheduled check: ${checkSchedule}`);
   }
   process.on("SIGTERM", () => {
@@ -646,7 +1081,7 @@ async function daemon(options) {
 
 // src/cli.ts
 var program = new Command();
-program.name("way").version("0.6.10").description("\u7B56\u7565\u5907\u4EFD\u5DE5\u5177 - \u57FA\u4E8E restic \u7684\u7B56\u7565\u5C01\u88C5").option("--remote <name>", "\u6307\u5B9A\u4ED3\u5E93", "default").addHelpText("after", `
+program.name("way").version("0.6.12").description("\u7B56\u7565\u5907\u4EFD\u5DE5\u5177 - \u57FA\u4E8E restic \u7684\u7B56\u7565\u5C01\u88C5").option("--remote <name>", "\u6307\u5B9A\u4ED3\u5E93", "default").addHelpText("after", `
 \u793A\u4F8B:
   $ way backup                 \u6267\u884C\u6240\u6709\u9879\u76EE\u5907\u4EFD
   $ way backup data            \u53EA\u5907\u4EFD data \u9879\u76EE
@@ -655,6 +1090,7 @@ program.name("way").version("0.6.10").description("\u7B56\u7565\u5907\u4EFD\u5DE
   $ way --remote=oss backup    \u4F7F\u7528 oss \u4ED3\u5E93\u6267\u884C\u5907\u4EFD\uFF08\u5168\u5C40\u9009\u9879\u9700\u653E\u5728\u5B50\u547D\u4EE4\u524D\uFF09
   $ way init                   \u521D\u59CB\u5316 way \u914D\u7F6E\u6587\u4EF6
   $ way gc                     \u6E05\u7406\u65E7\u5FEB\u7167
+  $ way replicate              \u590D\u5236\u5404\u9879\u76EE\u6700\u65B0\u5FEB\u7167\u5230\u8FDC\u7A0B\u4ED3\u5E93
   $ way systemd install        \u5B89\u88C5\u5B9A\u65F6\u4EFB\u52A1
   $ way restic snapshots       \u67E5\u770B\u5FEB\u7167\u5217\u8868
   $ way restic restore abc123 --target /tmp/restore
@@ -669,6 +1105,9 @@ program.name("way").version("0.6.10").description("\u7B56\u7565\u5907\u4EFD\u5DE
 function collectBackupArgs(command) {
   return command.args.filter((a) => a.startsWith("-") && !["--dry-run"].includes(a));
 }
+function resolveRemote(command) {
+  return command.optsWithGlobals().remote;
+}
 var commonHelpText = `
 \u5168\u5C40\u7528\u6CD5:
   way --remote=oss <command> ...  \u6307\u5B9A\u4ED3\u5E93\uFF08\u5168\u5C40\u9009\u9879\u9700\u653E\u5728\u5B50\u547D\u4EE4\u524D\uFF09
@@ -680,22 +1119,22 @@ var commonHelpText = `
 program.command("init").description("\u521D\u59CB\u5316 way \u914D\u7F6E\u6587\u4EF6").addHelpText("after", commonHelpText).action(() => {
   const wayDir = process.env.WAY_DIR || `${process.env.HOME}/.way`;
   const files = ["repositories.yaml", "rules.yaml"];
-  fs6.mkdirSync(wayDir, { recursive: true });
+  fs8.mkdirSync(wayDir, { recursive: true });
   for (const file of files) {
-    const target = path6.join(wayDir, file);
-    if (fs6.existsSync(target)) {
+    const target = path9.join(wayDir, file);
+    if (fs8.existsSync(target)) {
       throw new Error(`${target} already exists, aborting to avoid overwriting existing config.`);
     }
   }
   for (const file of files) {
     const source = resolveExampleConfigPath(file);
-    const target = path6.join(wayDir, file);
-    fs6.copyFileSync(source, target);
+    const target = path9.join(wayDir, file);
+    fs8.copyFileSync(source, target);
     console.log(`Created ${target}`);
   }
 });
 program.command("backup [projects...]").description("\u6309 rules.yaml \u6267\u884C\u5907\u4EFD").option("--dry-run", "\u6A21\u62DF\u5907\u4EFD\uFF08\u4E0D\u5B9E\u9645\u5199\u5165\uFF09").addHelpText("after", commonHelpText).allowUnknownOption().allowExcessArguments().action(async function(projects) {
-  const remote = this.parent.opts().remote;
+  const remote = resolveRemote(this);
   const dryRun = this.opts().dryRun;
   const extraArgs = collectBackupArgs(this);
   const result = await backup({
@@ -707,7 +1146,7 @@ program.command("backup [projects...]").description("\u6309 rules.yaml \u6267\u8
   if (result.failed.length > 0) process.exitCode = 1;
 });
 program.command("restore [projects...]").description("\u6309 rules.yaml \u6062\u590D\u9879\u76EE").requiredOption("--target <dir>", "\u6062\u590D\u76EE\u6807\u76EE\u5F55").option("--snapshot <snapshot>", "\u5FEB\u7167 ID \u6216 latest", "latest").option("--host <host>", "\u53EA\u6062\u590D\u6307\u5B9A host \u7684\u5FEB\u7167").option("--dry-run", "\u6A21\u62DF\u6062\u590D\uFF08\u4E0D\u5B9E\u9645\u5199\u5165\uFF09").option("--delete", "\u5220\u9664\u76EE\u6807\u4E2D\u5FEB\u7167\u4E0D\u5B58\u5728\u7684\u6587\u4EF6").option("-v, --verbose", "\u663E\u793A\u8BE6\u7EC6\u6062\u590D\u8BA1\u5212\uFF08\u4F20\u9012 --verbose=2 \u7ED9 restic\uFF09").addHelpText("after", commonHelpText).action(async function(projects, cmdOptions) {
-  const remote = this.parent.opts().remote;
+  const remote = resolveRemote(this);
   await restore({
     remote,
     projects,
@@ -720,15 +1159,23 @@ program.command("restore [projects...]").description("\u6309 rules.yaml \u6062\u
   });
 });
 program.command("gc").description("\u6E05\u7406\u65E7\u5FEB\u7167").option("--dry-run", "\u6A21\u62DF\u6E05\u7406\uFF08\u4E0D\u5B9E\u9645\u5220\u9664\uFF09").addHelpText("after", commonHelpText).action(async function(cmdOptions) {
-  const remote = this.parent.opts().remote;
+  const remote = resolveRemote(this);
   await gc({ remote, dryRun: cmdOptions.dryRun });
 });
+program.command("replicate [names...]").description("\u6309 rules.yaml \u590D\u5236\u5404\u9879\u76EE\u6700\u65B0\u5FEB\u7167\u5230\u76EE\u6807\u4ED3\u5E93").option("--init", "\u521D\u59CB\u5316\u76EE\u6807\u4ED3\u5E93\u5E76\u7EE7\u627F\u6E90\u4ED3\u5E93 chunker \u53C2\u6570").addHelpText("after", commonHelpText).action(async function(names, cmdOptions) {
+  const result = await replicate({ names, initialize: cmdOptions.init });
+  if (result.failed.length > 0) process.exitCode = 1;
+});
 program.command("systemd <action>").description("\u7BA1\u7406 systemd \u5B9A\u65F6\u4EFB\u52A1 (show|install|uninstall|status)").addHelpText("after", commonHelpText).action(async (action, options, command) => {
-  const remote = command.parent.opts().remote;
+  const remote = resolveRemote(command);
   await systemd({ remote, action });
 });
+program.command("windows-service <action>").description("\u7BA1\u7406 Windows \u539F\u751F\u5F00\u673A\u5B88\u62A4\u4EFB\u52A1 (show|install|uninstall|status)").addHelpText("after", commonHelpText).action(async (action, options, command) => {
+  const remote = resolveRemote(command);
+  await windowsService({ remote, action });
+});
 program.command("daemon").description("\u542F\u52A8\u5E38\u9A7B\u8FDB\u7A0B\uFF0C\u6309\u914D\u7F6E\u5B9A\u65F6\u6267\u884C\u5907\u4EFD").addHelpText("after", commonHelpText).action(async (options, command) => {
-  const remote = command.parent.opts().remote;
+  const remote = resolveRemote(command);
   await daemon({ remote });
 });
 program.command("env").description("\u663E\u793A\u73AF\u5883\u53D8\u91CF").addHelpText("after", commonHelpText).action(() => {
@@ -738,7 +1185,7 @@ program.command("env").description("\u663E\u793A\u73AF\u5883\u53D8\u91CF").addHe
   }
 });
 program.command("restic [args...]").description("\u663E\u5F0F\u900F\u4F20\u7ED9 restic").addHelpText("after", commonHelpText).allowUnknownOption().allowExcessArguments().action(async function(args) {
-  const remote = this.parent.opts().remote;
+  const remote = resolveRemote(this);
   const wayDir = process.env.WAY_DIR || `${process.env.HOME}/.way`;
   const config = loadConfig(wayDir, remote);
   const env = buildResticEnv(config.repository);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shellus/way",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "将备份作为持续运营的项目，而非一次性任务。基于 restic 的策略封装。",
   "type": "module",
   "bin": {
@@ -39,20 +39,18 @@
   },
   "homepage": "https://github.com/shellus/way#readme",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.12.0"
   },
   "dependencies": {
-    "commander": "^14.0.3",
-    "execa": "^9.6.1",
-    "js-yaml": "^4.1.1",
-    "node-cron": "^4.2.1"
+    "commander": "^15.0.0",
+    "execa": "^10.0.1",
+    "js-yaml": "^5.3.0",
+    "node-cron": "^4.6.0"
   },
   "devDependencies": {
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.5.0",
-    "@types/node-cron": "^3.0.11",
+    "@types/node": "^22.20.1",
     "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11"
   }
 }

package/repositories.yaml.example

@@ -15,6 +15,7 @@ repositories:
     type: s3
     endpoint: s3.example.com
     bucket: my-backup-bucket
+    region: region-1
     options:
       bucket_lookup: dns
     credentials:

package/rules.yaml.example

@@ -15,6 +15,9 @@ defaults:
     keep_daily: 7
     keep_weekly: 4
     keep_monthly: 6
+    # 如需按当前时间实行严格范围保留，改用以下两个字段，且不要与上述 keep_* 混用：
+    # keep_hosts: [backup-host]
+    # max_age_days: 7
 
 # Uptime Kuma 全局通知（可选，未配置项目级地址时作为回退）
 uptime_kuma:
@@ -95,9 +98,26 @@ global_excludes:
   - "*.tmp"
   - "*.swp"
 
+# 仓库复制：每天只复制各项目的最新快照，远程仓库使用独立保留策略
+replications:
+  local-to-s3:
+    from: local
+    to: s3
+    snapshot_policy: latest-per-project
+    schedule: "30 5 * * *"
+    prune_schedule: "30 6 * * 0"
+    retention:
+      keep_daily: 30
+      keep_weekly: 12
+      keep_monthly: 12
+      keep_yearly: 3
+
 # 维护任务（可选）
 maintenance:
   prune:
     schedule: "0 4 * * 0"  # 每周日凌晨 4 点清理
+    # retry_lock: "30m"      # 备份仍持有仓库锁时等待，避免立即失败
+    # uptime_kuma:           # 定时 prune 成功推送 UP、失败推送 DOWN；未配置时回退到全局 uptime_kuma
+    #   push_url: "https://uptime.example.com/api/push/prune-placeholder"
   check:
     schedule: false        # 不执行