@wuyaos/pi-sync 1.1.0 → 1.2.0

package/extensions/sync/restore.ts

@@ -2,100 +2,136 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { timestampForBackup } from "../_shared/json-io";
-import { copyRecursiveSync, listArchiveEntries, runTar, validateArchiveEntries } from "./archive";
-import {
-  AGENT_DIR,
-  AGENT_ROOT_MARKDOWN_FILES,
-  AGENT_SKILLS_DIR,
-  MEMORY_MARKDOWN_FILES,
-  SESSIONS_DIR,
-  ensureDir,
-  type SyncConfig,
-} from "./config";
+import { copyRecursiveSync, listArchiveEntries, runTar, validateArchiveEntries, validateArchiveEntryTypes } from "./archive";
+import { AGENT_DIR, AGENT_SKILLS_DIR, SESSIONS_DIR, ensureDir } from "./config";
 
 async function extractToTemp(archivePath: string, prefix: string): Promise<string> {
   const tempDir = path.join(os.tmpdir(), `${prefix}_${Date.now()}`);
   ensureDir(tempDir);
   validateArchiveEntries(await listArchiveEntries(archivePath));
-  await runTar(["-x", "-f", archivePath, "-C", tempDir]);
+  await validateArchiveEntryTypes(archivePath);
+  await runTar(["-x", "--no-same-owner", "--no-same-permissions", "-f", archivePath, "-C", tempDir]);
   return tempDir;
 }
 
-function backupAndCopyFile(src: string, dest: string): void {
-  ensureDir(path.dirname(dest));
-  if (fs.existsSync(dest) && fs.statSync(dest).isFile()) fs.copyFileSync(dest, `${dest}.bak-${timestampForBackup()}`);
-  fs.copyFileSync(src, dest);
-}
-
-export function getRestorePlan(entries: string[], config: SyncConfig): string[] {
-  const has = (name: string) => entries.some((entry) => entry === name || entry.startsWith(`${name}/`));
-  const plan: string[] = [];
-  if (has("config")) plan.push(config.backupProviders ? "Config files will be overwritten after timestamped .bak copies are created." : "Config files are present but skipped by current settings.");
-  if (has("skills")) plan.push(config.backupSkills ? "Pi skills will be replaced after a timestamped directory backup." : "Pi skills are present but skipped by current settings.");
-  if (has("extensions")) plan.push(config.backupExtensions ? "Extensions will be merged after a timestamped directory backup." : "Extensions are present but skipped by current settings.");
-  if (has("sessions")) plan.push(config.backupSessions ? "Sessions will be merged into ~/.pi/agent/sessions/." : "Sessions are present but skipped by current settings.");
-  if (has("memory")) plan.push(config.backupMemory ? "Durable memory markdown files will be restored after .bak copies." : "Memory files are present but skipped by current settings.");
-  if (has("agent-skills")) plan.push(config.backupAgentSkills ? "~/.agents/skills will be replaced after moving the current directory to a backup." : "Shared skills are present but skipped by current settings.");
-  return plan.length ? plan : ["No restorable content was found in this archive."];
+function assertSafeRestoreParent(root: string, destination: string): void {
+  const relative = path.relative(root, path.dirname(destination));
+  if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Restore destination escapes root: ${destination}`);
+  let current = root;
+  for (const segment of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, segment);
+    if (!fs.existsSync(current)) continue;
+    const stats = fs.lstatSync(current);
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+      throw new Error(`Unsafe restore parent rejected: ${current}`);
+    }
+  }
 }
 
-export async function extractConfigZip(archivePath: string, config: SyncConfig): Promise<string[]> {
-  const tempDir = await extractToTemp(archivePath, "pi_config_extract");
-  const restored: string[] = [];
-  try {
-    const root = path.join(tempDir, "config", "root");
-    if (config.backupProviders && fs.existsSync(root)) {
-      const allowedMd = new Set<string>(AGENT_ROOT_MARKDOWN_FILES);
-      for (const name of fs.readdirSync(root)) {
-        const src = path.join(root, name);
-        if (!fs.statSync(src).isFile() || (!name.endsWith(".json") && !allowedMd.has(name))) continue;
-        backupAndCopyFile(src, path.join(AGENT_DIR, name));
-        restored.push(`Config: ${name}`);
+function copyExtractedTree(source: string, destination: string, root: string): number {
+  const sourceStats = fs.lstatSync(source);
+  if (sourceStats.isSymbolicLink() || (!sourceStats.isFile() && !sourceStats.isDirectory())) {
+    throw new Error(`Unsafe extracted entry rejected: ${source}`);
+  }
+  assertSafeRestoreParent(root, destination);
+  if (sourceStats.isDirectory()) {
+    if (fs.existsSync(destination)) {
+      const destinationStats = fs.lstatSync(destination);
+      if (destinationStats.isSymbolicLink() || !destinationStats.isDirectory()) {
+        throw new Error(`Unsafe restore destination rejected: ${destination}`);
       }
+    } else {
+      fs.mkdirSync(destination, { recursive: true });
     }
-    const sub = path.join(tempDir, "config", "sub");
-    if (config.backupProviders && fs.existsSync(sub)) {
-      const dest = path.join(AGENT_DIR, "config");
-      if (fs.existsSync(dest)) copyRecursiveSync(dest, path.join(AGENT_DIR, `config-backup-${timestampForBackup()}`));
-      copyRecursiveSync(sub, dest);
-      restored.push("Config directory");
+    let copied = 0;
+    for (const child of fs.readdirSync(source)) {
+      copied += copyExtractedTree(path.join(source, child), path.join(destination, child), root);
     }
-    const extensions = path.join(tempDir, "extensions");
-    if (config.backupExtensions && fs.existsSync(extensions)) {
-      const dest = path.join(AGENT_DIR, "extensions");
-      if (fs.existsSync(dest)) copyRecursiveSync(dest, path.join(AGENT_DIR, `extensions-backup-${timestampForBackup()}`));
-      copyRecursiveSync(extensions, dest);
-      restored.push("Extensions");
+    return copied;
+  }
+  if (fs.existsSync(destination)) {
+    const destinationStats = fs.lstatSync(destination);
+    if (destinationStats.isSymbolicLink() || !destinationStats.isFile()) {
+      throw new Error(`Unsafe restore destination rejected: ${destination}`);
     }
-    return restored;
-  } finally { fs.rmSync(tempDir, { recursive: true, force: true }); }
+  }
+  ensureDir(path.dirname(destination));
+  fs.copyFileSync(source, destination);
+  return 1;
 }
 
-export async function extractMemoryZip(archivePath: string): Promise<string[]> {
-  const tempDir = await extractToTemp(archivePath, "pi_memory_extract");
-  const destDir = path.join(AGENT_DIR, "pi-hermes-memory");
-  const restored: string[] = [];
+/** Merge an archive created by createPiAgentZip into ~/.pi/agent. */
+export async function extractPiAgentZip(archivePath: string, targetDir = AGENT_DIR): Promise<string[]> {
+  const tempDir = await extractToTemp(archivePath, "pi_agent_extract");
+  const target = path.resolve(targetDir);
   try {
-    for (const name of MEMORY_MARKDOWN_FILES) {
-      const src = path.join(tempDir, "memory", name);
-      if (!fs.existsSync(src)) continue;
-      backupAndCopyFile(src, path.join(destDir, name));
-      restored.push(name);
+    fs.mkdirSync(target, { recursive: true });
+    const targetStats = fs.lstatSync(target);
+    if (targetStats.isSymbolicLink() || !targetStats.isDirectory()) {
+      throw new Error(`Pi agent restore target is not a safe directory: ${target}`);
     }
-    return restored;
+    let fileCount = 0;
+    for (const name of fs.readdirSync(tempDir)) {
+      fileCount += copyExtractedTree(path.join(tempDir, name), path.join(target, name), target);
+    }
+    if (fileCount === 0) throw new Error("Pi backup archive contained no files.");
+    return [`Pi agent: ${fileCount} file(s) merged`];
   } finally { fs.rmSync(tempDir, { recursive: true, force: true }); }
 }
 
-export async function extractAgentSkillsZip(archivePath: string): Promise<string[]> {
+export function getRestorePlan(entries: string[]): string[] {
+  if (entries.some((entry) => entry === "settings.json" || entry === "models.json" || entry === "AGENTS.md")) {
+    return ["Pi agent files will be merged; excluded install/session/state directories remain untouched."];
+  }
+  if (entries.some((entry) => entry === "agent-skills" || entry.startsWith("agent-skills/"))) {
+    return ["Shared skills will replace ~/.agents/skills after the current directory is moved to a timestamped backup."];
+  }
+  if (entries.some((entry) => entry === "sessions" || entry.startsWith("sessions/"))) {
+    return ["Session files will be merged into ~/.pi/agent/sessions/."];
+  }
+  return ["Archive files will be merged into their destination."];
+}
+
+export async function extractAgentSkillsZip(archivePath: string, targetDir = AGENT_SKILLS_DIR): Promise<string[]> {
   const tempDir = await extractToTemp(archivePath, "pi_agent_skills_extract");
+  const target = path.resolve(targetDir);
+  const parent = path.dirname(target);
+  const name = path.basename(target);
+  const staging = path.join(parent, `.${name}-restore-${process.pid}-${Date.now()}`);
+  const backup = path.join(parent, `${name}-backup-${timestampForBackup()}`);
+  let previousMoved = false;
   try {
     const source = path.join(tempDir, "agent-skills");
     if (!fs.existsSync(source)) throw new Error("Archive does not contain agent-skills/.");
-    const backup = path.join(os.homedir(), ".agents", `skills-backup-${timestampForBackup()}`);
-    if (fs.existsSync(AGENT_SKILLS_DIR)) fs.renameSync(AGENT_SKILLS_DIR, backup);
-    copyRecursiveSync(source, AGENT_SKILLS_DIR);
-    return [`Shared skills; previous directory moved to ${backup}`];
-  } finally { fs.rmSync(tempDir, { recursive: true, force: true }); }
+    ensureDir(parent);
+    // Complete the potentially fallible recursive copy before touching the
+    // current skills directory. Staging shares the target filesystem so the
+    // final rename is atomic.
+    copyRecursiveSync(source, staging);
+    if (fs.existsSync(target)) {
+      if (fs.existsSync(backup)) throw new Error(`Skills backup destination already exists: ${backup}`);
+      fs.renameSync(target, backup);
+      previousMoved = true;
+    }
+    try {
+      fs.renameSync(staging, target);
+    } catch (error) {
+      if (previousMoved && !fs.existsSync(target) && fs.existsSync(backup)) {
+        try {
+          fs.renameSync(backup, target);
+        } catch (rollbackError) {
+          console.error(`[pi-sync] Failed to roll back shared skills restore: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+        }
+      }
+      throw error;
+    }
+    return previousMoved
+      ? [`Shared skills restored; previous directory moved to ${backup}`]
+      : ["Shared skills restored"];
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  }
 }
 
 export async function extractSessionsArchiveZip(archivePath: string): Promise<string[]> {
@@ -103,38 +139,8 @@ export async function extractSessionsArchiveZip(archivePath: string): Promise<st
   try {
     const source = path.join(tempDir, "sessions");
     if (!fs.existsSync(source)) throw new Error("Archive does not contain sessions/.");
-    copyRecursiveSync(source, SESSIONS_DIR);
-    return ["Session archive merged"];
-  } finally { fs.rmSync(tempDir, { recursive: true, force: true }); }
-}
-
-export async function extractLegacyZip(archivePath: string, config: SyncConfig): Promise<string[]> {
-  const tempDir = await extractToTemp(archivePath, "pi_sync_extract");
-  const restored: string[] = [];
-  try {
-    const configDir = path.join(tempDir, "config");
-    if (config.backupProviders && fs.existsSync(configDir)) {
-      for (const name of fs.readdirSync(configDir)) {
-        const src = path.join(configDir, name);
-        if (fs.statSync(src).isFile()) { backupAndCopyFile(src, path.join(AGENT_DIR, name)); restored.push(`Config: ${name}`); }
-      }
-    }
-    const skills = path.join(tempDir, "skills");
-    if (config.backupSkills && fs.existsSync(skills)) {
-      const dest = path.join(AGENT_DIR, "skills"), backup = path.join(AGENT_DIR, `skills-backup-${timestampForBackup()}`);
-      if (fs.existsSync(dest)) fs.renameSync(dest, backup);
-      copyRecursiveSync(skills, dest);
-      restored.push("Skills");
-    }
-    const extensions = path.join(tempDir, "extensions");
-    if (config.backupExtensions && fs.existsSync(extensions)) {
-      const dest = path.join(AGENT_DIR, "extensions");
-      if (fs.existsSync(dest)) copyRecursiveSync(dest, path.join(AGENT_DIR, `extensions-backup-${timestampForBackup()}`));
-      copyRecursiveSync(extensions, dest);
-      restored.push("Extensions");
-    }
-    const sessions = path.join(tempDir, "sessions");
-    if (config.backupSessions && fs.existsSync(sessions)) { copyRecursiveSync(sessions, SESSIONS_DIR); restored.push("Sessions"); }
-    return restored;
+    fs.mkdirSync(SESSIONS_DIR, { recursive: true });
+    const fileCount = copyExtractedTree(source, SESSIONS_DIR, SESSIONS_DIR);
+    return [`Session archive merged: ${fileCount} file(s)`];
   } finally { fs.rmSync(tempDir, { recursive: true, force: true }); }
 }

package/extensions/sync/webdav.ts

@@ -1,21 +1,18 @@
 import { type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { fetchWithTimeout } from "../_shared/fetch-utils";
 import { resolvePassword, type SyncConfig } from "./config";
 
 export const WEBDAV_FETCH_TIMEOUT_MS = 120_000;
-export const WEBDAV_CONFIG_DIR = "config/";
-export const WEBDAV_MEMORY_DIR = "memory/";
-export const WEBDAV_AGENT_SKILLS_DIR = "agent-skills/";
-export const WEBDAV_SESSIONS_DIR = "sessions/";
+export const WEBDAV_PI_BACKUP_DIR = "backup/pi/";
+export const WEBDAV_AGENT_SKILLS_DIR = "backup/skills/";
+export const WEBDAV_SESSIONS_ARCHIVE_DIR = "backup/sessions/";
 
 export const ensureTrailingSlash = (url: string): string => url.endsWith("/") ? url : `${url}/`;
 export const webdavDirBase = (config: SyncConfig, remoteDir: string): string => ensureTrailingSlash(config.webdavUrl) + remoteDir.replace(/^\/+/, "");
-export const configWebdavBase = (config: SyncConfig): string => webdavDirBase(config, WEBDAV_CONFIG_DIR);
-export const memoryWebdavBase = (config: SyncConfig): string => webdavDirBase(config, WEBDAV_MEMORY_DIR);
-export const agentSkillsWebdavBase = (config: SyncConfig): string => webdavDirBase(config, WEBDAV_AGENT_SKILLS_DIR);
-export const sessionsWebdavBase = (config: SyncConfig): string => webdavDirBase(config, WEBDAV_SESSIONS_DIR);
 export const webdavAuth = (config: SyncConfig): string => "Basic " + Buffer.from(`${config.webdavUser}:${resolvePassword(config.webdavPass)}`).toString("base64");
 
 export async function webdavList(url: string, auth: string, ctx: ExtensionContext, filter?: (name: string) => boolean): Promise<string[]> {
@@ -39,14 +36,32 @@ export async function webdavList(url: string, auth: string, ctx: ExtensionContex
 }
 
 export async function webdavPutFile(localPath: string, remoteUrl: string, auth: string, ctx: ExtensionContext): Promise<void> {
-  const response = await fetchWithTimeout(remoteUrl, { method: "PUT", headers: { Authorization: auth, "Content-Type": "application/octet-stream" }, body: fs.readFileSync(localPath) }, WEBDAV_FETCH_TIMEOUT_MS, ctx.signal);
-  if (!response.ok) throw new Error(`WebDAV PUT HTTP ${response.status}: ${response.statusText}`);
+  const stream = fs.createReadStream(localPath);
+  try {
+    const response = await fetchWithTimeout(remoteUrl, {
+      method: "PUT",
+      headers: { Authorization: auth, "Content-Type": "application/octet-stream" },
+      body: stream as unknown as BodyInit,
+      // Node fetch requires this for a streaming request body.
+      duplex: "half",
+    } as RequestInit, WEBDAV_FETCH_TIMEOUT_MS, ctx.signal);
+    if (!response.ok) throw new Error(`WebDAV PUT HTTP ${response.status}: ${response.statusText}`);
+  } finally {
+    stream.destroy();
+  }
 }
 
 export async function webdavGetFile(remoteUrl: string, destPath: string, auth: string, ctx: ExtensionContext): Promise<void> {
   const response = await fetchWithTimeout(remoteUrl, { method: "GET", headers: { Authorization: auth } }, WEBDAV_FETCH_TIMEOUT_MS, ctx.signal);
   if (!response.ok) throw new Error(`WebDAV GET HTTP ${response.status}: ${response.statusText}`);
-  fs.writeFileSync(destPath, Buffer.from(await response.arrayBuffer()));
+  if (!response.body) throw new Error("WebDAV GET returned an empty response body");
+  const tempPath = `${destPath}.part-${process.pid}-${Date.now()}`;
+  try {
+    await pipeline(Readable.fromWeb(response.body as never), fs.createWriteStream(tempPath), { signal: ctx.signal });
+    fs.renameSync(tempPath, destPath);
+  } finally {
+    fs.rmSync(tempPath, { force: true });
+  }
 }
 
 export async function webdavMkcol(url: string, auth: string, ctx: ExtensionContext): Promise<void> {
@@ -59,11 +74,17 @@ export async function listWebdavDir(remoteDir: string, config: SyncConfig, ctx:
   catch (error) { if (error instanceof Error && /HTTP 404/.test(error.message)) return []; throw error; }
 }
 
+/** Process-level cache of already-ensured WebDAV directory URLs, avoids repeated MKCOL storms. */
+const ensuredDirs = new Set<string>();
+
 export async function ensureWebdavDirectory(remoteDir: string, config: SyncConfig, ctx: ExtensionContext): Promise<string> {
   let current = ensureTrailingSlash(config.webdavUrl);
   for (const segment of remoteDir.split("/").filter(Boolean)) {
     current += `${encodeURIComponent(segment)}/`;
-    await webdavMkcol(current, webdavAuth(config), ctx);
+    if (!ensuredDirs.has(current)) {
+      await webdavMkcol(current, webdavAuth(config), ctx);
+      ensuredDirs.add(current);
+    }
   }
   return current;
 }

package/package.json

@@ -1,8 +1,14 @@
 {
   "name": "@wuyaos/pi-sync",
-  "version": "1.1.0",
-  "description": "WebDAV config sync for Pi coding agent — backup/restore models, settings, skills, extensions, and selected session projects",
-  "keywords": ["pi-package", "webdav", "sync", "backup", "coding-agent"],
+  "version": "1.2.0",
+  "description": "WebDAV archive backup and restore for Pi agent data, shared skills, and per-project sessions",
+  "keywords": [
+    "pi-package",
+    "webdav",
+    "sync",
+    "backup",
+    "coding-agent"
+  ],
   "repository": {
     "type": "git",
     "url": "https://github.com/wuyaos/pi-packages.git",
@@ -13,7 +19,7 @@
   },
   "files": [
     "extensions",
-    "docs",
+    "!extensions/**/*.test.ts",
     "pi-bootstrap.ps1",
     "README.md",
     "README.zh-CN.md",
@@ -25,7 +31,9 @@
   },
   "homepage": "https://github.com/wuyaos/pi-packages#readme",
   "pi": {
-    "extensions": ["./extensions/sync"],
+    "extensions": [
+      "./extensions/sync"
+    ],
     "image": "https://img.shields.io/badge/pi-sync-WebDAV-blue"
   },
   "peerDependencies": {

package/pi-bootstrap.ps1

@@ -1,17 +1,14 @@
 # pi-bootstrap.ps1
-# Pull the latest Pi config backup from WebDAV onto a new machine.
+# Restore the latest trusted Pi agent archive from WebDAV on a new Windows machine.
 #
-# Usage:
-#   .\pi-bootstrap.ps1 -WebdavUrl "https://your-webdav.example/dav/Pi" -User "your-user" -Pass "your-app-password"
+# Security: this bootstrap helper does not run pi-sync's TypeScript archive path/link
+# validation. Use it only with a trusted WebDAV endpoint and archives you trust.
 #
-# Or set env vars (recommended):
-#   $env:PI_WEBDAV_URL  = "https://your-webdav.example/dav/Pi"
+# Recommended usage:
+#   $env:PI_WEBDAV_URL  = "https://your-webdav.example/dav/pi"
 #   $env:PI_WEBDAV_USER = "your-user"
 #   $env:PI_WEBDAV_PASS = "your-app-password"
 #   .\pi-bootstrap.ps1
-#
-# Security: never commit real credentials. Prefer app-specific passwords
-# and store them only in env vars / your password manager.
 
 param(
     [string]$WebdavUrl = $env:PI_WEBDAV_URL,
@@ -23,91 +20,53 @@ $ErrorActionPreference = "Stop"
 
 if (-not $WebdavUrl -or -not $User -or -not $Pass) {
     Write-Host "Usage: .\pi-bootstrap.ps1 -WebdavUrl <url> -User <user> -Pass <pass>" -ForegroundColor Red
-    Write-Host "Or set PI_WEBDAV_URL, PI_WEBDAV_USER, PI_WEBDAV_PASS env vars" -ForegroundColor Yellow
+    Write-Host "Or set PI_WEBDAV_URL, PI_WEBDAV_USER, PI_WEBDAV_PASS." -ForegroundColor Yellow
     exit 1
 }
 
 $WebdavUrl = $WebdavUrl.TrimEnd('/')
+$backupUrl = "$WebdavUrl/backup/pi"
 $pair = "${User}:${Pass}"
 $auth = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
 $headers = @{ Authorization = "Basic $auth"; Depth = "1" }
 
-Write-Host "[1/5] Listing backups on WebDAV..." -ForegroundColor Cyan
-$resp = Invoke-RestMethod -Uri $WebdavUrl -Method PROPFIND -Headers $headers -ContentType "application/xml"
-
-# Parse XML for filenames
-$files = ([regex]'<d:href>([^<]+)</d:href>').Matches($resp) |
-    ForEach-Object { $_.Groups[1].Value } |
-    Where-Object { $_ -match 'pi_sync_backup_.*\.zip$' } |
+Write-Host "[1/5] Listing Pi archives on WebDAV..." -ForegroundColor Cyan
+$resp = Invoke-RestMethod -Uri "$backupUrl/" -Method PROPFIND -Headers $headers -ContentType "application/xml"
+$hrefPattern = [regex]'(?i)<(?:[A-Za-z0-9_-]+:)?href>([^<]+)</(?:[A-Za-z0-9_-]+:)?href>'
+$files = $hrefPattern.Matches([string]$resp) |
+    ForEach-Object { [Uri]::UnescapeDataString($_.Groups[1].Value) } |
+    Where-Object { $_ -match 'pi_agent_.*\.tar\.xz$' } |
     Sort-Object -Descending
 
 if ($files.Count -eq 0) {
-    Write-Host "No backups found on WebDAV!" -ForegroundColor Red
+    Write-Host "No Pi archives found under backup/pi/." -ForegroundColor Red
     exit 1
 }
 
-$latest = $files[0]
-$name = [System.IO.Path]::GetFileName($latest)
-Write-Host "[2/5] Latest backup: $name" -ForegroundColor Green
-
-$tempZip = "$env:TEMP\$name"
-Write-Host "[3/5] Downloading..." -ForegroundColor Cyan
-Invoke-WebRequest -Uri "$WebdavUrl/$name" -Headers @{ Authorization = "Basic $auth" } -OutFile $tempZip
+$name = [System.IO.Path]::GetFileName($files[0])
+Write-Host "[2/5] Latest archive: $name" -ForegroundColor Green
 
-$tempDir = "$env:TEMP\pi_restore_$(Get-Date -Format 'yyyyMMddHHmmss')"
+$tempArchive = Join-Path $env:TEMP $name
+$tempDir = Join-Path $env:TEMP "pi_restore_$(Get-Date -Format 'yyyyMMddHHmmss')"
 New-Item -ItemType Directory -Force -Path $tempDir | Out-Null
 
-Write-Host "[4/5] Extracting..." -ForegroundColor Cyan
-tar -xf $tempZip -C $tempDir
+try {
+    Write-Host "[3/5] Downloading..." -ForegroundColor Cyan
+    Invoke-WebRequest -Uri "$backupUrl/$name" -Headers @{ Authorization = "Basic $auth" } -OutFile $tempArchive
 
-$agentDir = "$env:USERPROFILE\.pi\agent"
-$backupSuffix = "bak-$(Get-Date -Format 'yyyyMMddHHmmss')"
-
-# Restore config
-if (Test-Path "$tempDir\config") {
-    Write-Host "  → Restoring config files..." -ForegroundColor Yellow
-    Get-ChildItem "$tempDir\config" | ForEach-Object {
-        $dest = Join-Path $agentDir $_.Name
-        if (Test-Path $dest) {
-            Copy-Item $dest "$dest.$backupSuffix"
-            Write-Host "    Backup: $($_.Name) → $($_.Name).$backupSuffix"
-        }
-        Copy-Item $_.FullName $dest -Force
-        Write-Host "    Restored: $($_.Name)" -ForegroundColor Green
-    }
-}
+    Write-Host "[4/5] Extracting..." -ForegroundColor Cyan
+    tar -xf $tempArchive -C $tempDir
+    if ($LASTEXITCODE -ne 0) { throw "tar extraction failed with exit code $LASTEXITCODE" }
 
-# Restore skills
-if (Test-Path "$tempDir\skills") {
-    Write-Host "  → Restoring skills..." -ForegroundColor Yellow
-    $skillsDest = "$agentDir\skills"
-    if (Test-Path $skillsDest) {
-        Rename-Item $skillsDest "skills-$backupSuffix"
-        Write-Host "    Backup: skills → skills-$backupSuffix"
+    $agentDir = Join-Path $env:USERPROFILE ".pi\agent"
+    New-Item -ItemType Directory -Force -Path $agentDir | Out-Null
+    Get-ChildItem -LiteralPath $tempDir -Force | ForEach-Object {
+        Copy-Item -LiteralPath $_.FullName -Destination $agentDir -Recurse -Force
     }
-    Copy-Item "$tempDir\skills" $skillsDest -Recurse
-    Write-Host "    Skills restored" -ForegroundColor Green
-}
 
-# Restore extensions
-if (Test-Path "$tempDir\extensions") {
-    Write-Host "  → Restoring extensions..." -ForegroundColor Yellow
-    $extDest = "$agentDir\extensions"
-    if (Test-Path $extDest) {
-        Rename-Item $extDest "extensions-$backupSuffix"
-        Write-Host "    Backup: extensions → extensions-$backupSuffix"
-    }
-    Copy-Item "$tempDir\extensions" $extDest -Recurse
-    Write-Host "    Extensions restored" -ForegroundColor Green
+    Write-Host "[5/5] Pi agent archive restored to $agentDir" -ForegroundColor Green
+    Write-Host "Next: install/update packages from settings.json, then restart Pi." -ForegroundColor Cyan
+} finally {
+    Remove-Item $tempArchive -Force -ErrorAction SilentlyContinue
+    Remove-Item $tempDir -Recurse -Force -ErrorAction SilentlyContinue
 }
-
-# Cleanup
-Remove-Item $tempZip -Force -ErrorAction SilentlyContinue
-Remove-Item $tempDir -Recurse -Force -ErrorAction SilentlyContinue
-
-Write-Host "[5/5] Done! Pi config restored to $agentDir" -ForegroundColor Green
-Write-Host ""
-Write-Host "Next steps:" -ForegroundColor Cyan
-Write-Host "  1. Restart Pi (or /reload)"
-Write-Host "  2. Run: pi update --extensions  (to install packages from settings.json)"
-Write-Host "  3. /sync pull  (to pull future updates)"