abtars 0.2.1-alpha.8 → 0.2.1

package/bundle/abtars-cli.js

@@ -2,7 +2,10 @@
  import { createRequire as __bundleCreateRequire } from 'node:module'; import { fileURLToPath as __bundleFileURLToPath } from 'node:url'; import { dirname as __bundleDirname } from 'node:path'; const require = __bundleCreateRequire(import.meta.url); const __chunk_filename = __bundleFileURLToPath(import.meta.url); const __chunk_dirname = __bundleDirname(__chunk_filename);
 import {
   install
-} from "./chunk-4BUOO6WI.js";
+} from "./chunk-KL5QRHHK.js";
+import {
+  rollback
+} from "./chunk-EKHNWFEQ.js";
 import {
   acquireLock,
   atomicSwap,
@@ -16,19 +19,19 @@ import {
   readSentinel,
   writeManifest,
   writeSentinel
-} from "./chunk-RSWUPUNA.js";
+} from "./chunk-WMWI3SJ7.js";
 import {
   restart
-} from "./chunk-URAQLQ2U.js";
+} from "./chunk-F3HMZFIL.js";
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-EX2SRTUE.js";
-import "./chunk-2BY6I4P5.js";
+} from "./chunk-CYSGXNBY.js";
+import "./chunk-GUTRAMK3.js";
 import {
   abtarsHome,
   init_paths
-} from "./chunk-MJ6PHMOK.js";
+} from "./chunk-WW5F2DCO.js";
 import {
   __require
 } from "./chunk-7K2YZTLD.js";
@@ -301,112 +304,203 @@ async function uninstall(opts) {
 
 // src/cli/commands/backup.ts
 init_paths();
-import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, statSync, renameSync, unlinkSync as unlinkSync3, copyFileSync } from "node:fs";
-import { join as join4, dirname } from "node:path";
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, statSync, unlinkSync as unlinkSync3, renameSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { join as join4, dirname, basename } from "node:path";
 import { spawnSync } from "node:child_process";
-var AB_SAVE = ["config", "secret", "tasks", "logo", "workspace", "skills/custom", "skills/self"];
+import { createCipheriv, hkdfSync, randomBytes } from "node:crypto";
 var DEFAULT_PRUNE_DAYS = 7;
-async function backup(outputDir, pruneDays) {
+var ABTARS_EXCLUDE = [
+  "releases",
+  "current",
+  "bin",
+  "app",
+  "app.prev*",
+  "app.staging",
+  "app.broken",
+  "logs",
+  "node_modules",
+  "overflow",
+  "browser-socket",
+  "src",
+  "bridge.lock",
+  "watchdog.lock",
+  "browse-spawn.sock",
+  "manifest.json",
+  "*.sock"
+];
+var ABMIND_EXCLUDE = [
+  "memory/memory.db",
+  "lib",
+  "node_modules",
+  "backups",
+  "*.sock",
+  "*.db-wal",
+  "*.db-shm"
+];
+var CONFIG_DIRS = ["config", "secret", "tasks", "skills", "core", "agents"];
+async function backup(opts = {}) {
   const abHome = abtarsHome();
+  const abmindHome = process.env["ABMIND_HOME"] ?? join4(dirname(abHome), ".abmind");
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const destDir = outputDir ?? join4(dirname(abHome), ".backup-abtars");
+  const destDir = opts.outputDir ?? join4(dirname(abHome), ".backup-abtars");
   mkdirSync(destDir, { recursive: true });
-  const abmindPaths = [
-    join4(dirname(abHome), ".abmind", "lib", "node_modules", "abmind", "dist", "cli", "abmind-backup.js"),
-    join4(dirname(abHome), "workspace", "ab", "abmind", "dist", "cli", "abmind-backup.js")
-  ];
-  const abmindBin = abmindPaths.find((p) => existsSync3(p));
-  let abmResult;
-  if (abmindBin) {
-    abmResult = spawnSync("node", [abmindBin], { encoding: "utf-8", env: { ...process.env } });
+  const isConfig = opts.config === true;
+  const prefix = isConfig ? `abtars-config-${date}` : `abtars-${date}`;
+  const zipExcludes = [];
+  if (isConfig) {
   } else {
-    abmResult = spawnSync("abmind", ["backup"], { encoding: "utf-8", env: { ...process.env } });
-  }
-  if (abmResult.status !== 0) {
-    process.stderr.write(`\u26A0\uFE0F abmind backup failed: ${abmResult.stderr || abmResult.stdout}
-`);
-    return 1;
-  }
-  const abmindBackupsDir = join4(dirname(abHome), ".abmind", "backups");
-  let abmFile;
-  if (existsSync3(abmindBackupsDir)) {
-    const abmFiles = readdirSync2(abmindBackupsDir).filter((f) => f.endsWith(".abm")).sort().reverse();
-    if (abmFiles.length > 0) abmFile = abmFiles[0];
-  }
-  if (abmFile) {
-    const src = join4(abmindBackupsDir, abmFile);
-    const dest = join4(destDir, `abmind-${date}.abm`);
-    renameSync(src, dest);
-    const size = (statSync(dest).size / 1024).toFixed(0);
-    process.stdout.write(`\u2713 abmind-${date}.abm (${size}KB, encrypted)
-`);
-  } else {
-    process.stderr.write(`\u26A0\uFE0F abmind backup produced no .abm file
-`);
-  }
-  const files = [];
-  for (const dir of AB_SAVE) {
-    const abs = join4(abHome, dir);
-    if (existsSync3(abs)) collectDir(abs, dir, files);
-  }
-  if (files.length === 0) {
-    process.stderr.write("Nothing to zip from abtars.\n");
-    return 1;
-  }
-  const tmpDir = join4(process.env["TMPDIR"] ?? "/tmp", `abtars-backup-${Date.now()}`);
-  mkdirSync(tmpDir, { recursive: true });
-  for (const f of files) {
-    const dest = join4(tmpDir, f.zipPath);
-    mkdirSync(dirname(dest), { recursive: true });
-    copyFileSync(f.absPath, dest);
+    for (const ex of ABTARS_EXCLUDE) {
+      zipExcludes.push(`${ex}/*`, ex);
+    }
+    zipExcludes.push("*.db-wal", "*.db-shm", "*.sock");
   }
-  const zipPath = join4(destDir, `abtars-${date}.zip`);
   const has7z = spawnSync("which", ["7z"], { encoding: "utf-8" }).status === 0;
+  const zipExt = has7z ? ".7z" : ".zip";
+  let zipPath = join4(destDir, prefix + zipExt);
   let zipOk;
-  if (has7z) {
-    const r = spawnSync("7z", ["a", zipPath.replace(/\.zip$/, ".7z"), "."], { cwd: tmpDir, encoding: "utf-8" });
-    zipOk = r.status === 0;
+  if (isConfig) {
+    const existingDirs = CONFIG_DIRS.filter((d) => existsSync3(join4(abHome, d)));
+    if (existingDirs.length === 0) {
+      process.stderr.write("Nothing to backup \u2014 no config dirs found\n");
+      return 1;
+    }
+    if (has7z) {
+      const r = spawnSync("7z", ["a", zipPath, ...existingDirs], { cwd: abHome, encoding: "utf-8" });
+      zipOk = r.status === 0;
+    } else {
+      const r = spawnSync("zip", ["-qr", zipPath, ...existingDirs], { cwd: abHome, encoding: "utf-8" });
+      zipOk = r.status === 0;
+    }
   } else {
-    const r = spawnSync("zip", ["-r", zipPath, "."], { cwd: tmpDir, encoding: "utf-8" });
-    zipOk = r.status === 0;
+    if (has7z) {
+      const excludeArgs = ABTARS_EXCLUDE.flatMap((ex) => ["-xr!" + ex]);
+      excludeArgs.push("-xr!*.db-wal", "-xr!*.db-shm", "-xr!*.sock");
+      const r = spawnSync("7z", ["a", zipPath, ".", ...excludeArgs], { cwd: abHome, encoding: "utf-8" });
+      zipOk = r.status === 0;
+    } else {
+      const excludeArgs = ABTARS_EXCLUDE.flatMap((ex) => ["-x", `${ex}/*`, "-x", ex]);
+      excludeArgs.push("-x", "*.db-wal", "-x", "*.db-shm", "-x", "*.sock");
+      const r = spawnSync("zip", ["-qr", zipPath, ".", ...excludeArgs], { cwd: abHome, encoding: "utf-8" });
+      zipOk = r.status === 0;
+    }
+    if (zipOk && existsSync3(abmindHome)) {
+      if (has7z) {
+        const excludeArgs = ABMIND_EXCLUDE.flatMap((ex) => ["-xr!" + ex]);
+        const r = spawnSync("7z", ["a", zipPath, ".", ...excludeArgs], { cwd: abmindHome, encoding: "utf-8" });
+        zipOk = r.status === 0;
+      } else {
+        const excludeArgs = ABMIND_EXCLUDE.flatMap((ex) => ["-x", `${ex}/*`, "-x", ex]);
+        const r = spawnSync("zip", ["-qr", zipPath, "-g", ".", ...excludeArgs], { cwd: abmindHome, encoding: "utf-8" });
+        zipOk = r.status === 0;
+      }
+    }
+    const dbPath = join4(abmindHome, "memory", "memory.db");
+    if (zipOk && existsSync3(dbPath)) {
+      const tmpDb = join4(process.env["TMPDIR"] ?? "/tmp", `abtars-backup-memory-${Date.now()}.db`);
+      const sqliteResult = spawnSync("sqlite3", [dbPath, `.backup '${tmpDb}'`], { encoding: "utf-8" });
+      if (sqliteResult.status === 0 && existsSync3(tmpDb)) {
+        if (has7z) {
+          spawnSync("7z", ["a", zipPath, tmpDb], { encoding: "utf-8" });
+        } else {
+          spawnSync("zip", ["-qj", zipPath, tmpDb], { encoding: "utf-8" });
+        }
+        try {
+          unlinkSync3(tmpDb);
+        } catch {
+        }
+      }
+    }
   }
-  spawnSync("rm", ["-rf", tmpDir]);
   if (!zipOk) {
-    process.stderr.write(`\u26A0\uFE0F zip/7z failed
-`);
+    process.stderr.write("Backup zip failed\n");
     return 1;
   }
-  const actualZip = has7z ? zipPath.replace(/\.zip$/, ".7z") : zipPath;
-  const sizeMb = (statSync(actualZip).size / 1024 / 1024).toFixed(1);
-  process.stdout.write(`\u2713 ${actualZip.split("/").pop()} (${sizeMb}MB, ${files.length} files)
+  if (!isConfig) {
+    const actual = statSync(zipPath).size;
+    if (actual < 1e5) {
+      process.stderr.write(`\u26A0\uFE0F Backup suspiciously small (${actual} bytes)
 `);
-  const maxAge = (pruneDays ?? DEFAULT_PRUNE_DAYS) * 864e5;
-  const now = Date.now();
-  for (const f of readdirSync2(destDir)) {
-    if (!(f.startsWith("abtars-") || f.startsWith("abmind-"))) continue;
-    if (!(f.endsWith(".zip") || f.endsWith(".7z") || f.endsWith(".abm"))) continue;
-    const fPath = join4(destDir, f);
-    try {
-      if (now - statSync(fPath).mtimeMs > maxAge) {
-        unlinkSync3(fPath);
-        process.stdout.write(`  \u{1F5D1} pruned ${f}
+    }
+  }
+  const zipSize = (statSync(zipPath).size / 1024 / 1024).toFixed(1);
+  process.stdout.write(`\u2713 ${basename(zipPath)} (${zipSize}MB)
+`);
+  if (opts.encrypt) {
+    const encPath = zipPath + ".enc";
+    const ok = encryptFile(zipPath, encPath, abmindHome);
+    if (!ok) return 1;
+    unlinkSync3(zipPath);
+    zipPath = encPath;
+    process.stdout.write(`\u2713 encrypted \u2192 ${basename(encPath)}
+`);
+  }
+  if (!isConfig) {
+    const abmResult = runAbmindBackup(abHome, abmindHome);
+    if (abmResult) {
+      const dest = join4(destDir, `abmind-${date}.abm`);
+      renameSync(abmResult, dest);
+      const size = (statSync(dest).size / 1024).toFixed(0);
+      process.stdout.write(`\u2713 abmind-${date}.abm (${size}KB, encrypted)
+`);
+    } else {
+      process.stderr.write("\u26A0\uFE0F abmind backup failed or produced no .abm\n");
+    }
+  }
+  const pruneDays = opts.pruneDays ?? DEFAULT_PRUNE_DAYS;
+  if (pruneDays > 0) {
+    const maxAge = pruneDays * 864e5;
+    const now = Date.now();
+    for (const f of readdirSync2(destDir)) {
+      if (!(f.startsWith("abtars-") || f.startsWith("abmind-"))) continue;
+      if (!(f.endsWith(".zip") || f.endsWith(".7z") || f.endsWith(".abm") || f.endsWith(".enc"))) continue;
+      const fPath = join4(destDir, f);
+      try {
+        if (now - statSync(fPath).mtimeMs > maxAge) {
+          unlinkSync3(fPath);
+          process.stdout.write(`  \u{1F5D1} pruned ${f}
 `);
+        }
+      } catch {
       }
-    } catch {
     }
   }
   return 0;
 }
-function collectDir(dir, prefix, out) {
-  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-    const abs = join4(dir, entry.name);
-    const rel = `${prefix}/${entry.name}`;
-    if (entry.isDirectory()) {
-      collectDir(abs, rel, out);
-    } else if (entry.isFile()) {
-      out.push({ absPath: abs, zipPath: rel });
-    }
+function runAbmindBackup(abHome, abmindHome) {
+  const abmindPaths = [
+    join4(dirname(abHome), "workspace", "ab", "abmind", "dist", "cli", "abmind-backup.js"),
+    join4(abmindHome, "lib", "node_modules", "abmind", "dist", "cli", "abmind-backup.js")
+  ];
+  const abmindBin = abmindPaths.find((p) => existsSync3(p));
+  let result;
+  if (abmindBin) {
+    result = spawnSync("node", [abmindBin], { encoding: "utf-8", env: { ...process.env } });
+  } else {
+    result = spawnSync("abmind", ["backup"], { encoding: "utf-8", env: { ...process.env } });
   }
+  if (result.status !== 0) return null;
+  const backupsDir = join4(abmindHome, "backups");
+  if (!existsSync3(backupsDir)) return null;
+  const abmFiles = readdirSync2(backupsDir).filter((f) => f.endsWith(".abm")).sort().reverse();
+  return abmFiles[0] ? join4(backupsDir, abmFiles[0]) : null;
+}
+function encryptFile(inputPath, outputPath, abmindHome) {
+  const keyPath = join4(abmindHome, "secret", "abmind.key");
+  if (!existsSync3(keyPath)) {
+    process.stderr.write(`\u26A0\uFE0F --encrypt requires ${keyPath}
+`);
+    return false;
+  }
+  const master = Buffer.from(readFileSync2(keyPath, "utf-8").trim(), "hex");
+  const key = Buffer.from(hkdfSync("sha256", master, "", "abtars-backup-v1", 32));
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const input = readFileSync2(inputPath);
+  const encrypted = Buffer.concat([cipher.update(input), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const out = Buffer.concat([iv, encrypted, tag]);
+  writeFileSync(outputPath, out);
+  return true;
 }
 
 // src/cli/commands/onboard.ts
@@ -417,7 +511,7 @@ import { homedir as homedir2 } from "node:os";
 import { fileURLToPath } from "node:url";
 
 // src/components/hints.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync, renameSync as renameSync2 } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync as renameSync2 } from "node:fs";
 import { join as join5 } from "node:path";
 function manifestPath() {
   const home = process.env["ABTARS_HOME"] ?? join5(process.env["HOME"] ?? "", ".abtars");
@@ -427,7 +521,7 @@ function readManifest2() {
   const path = manifestPath();
   if (!existsSync4(path)) return {};
   try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
+    return JSON.parse(readFileSync3(path, "utf-8"));
   } catch {
     return {};
   }
@@ -435,7 +529,7 @@ function readManifest2() {
 function writeManifestAtomic(data) {
   const path = manifestPath();
   const tmp = path + ".tmp";
-  writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
+  writeFileSync2(tmp, JSON.stringify(data, null, 2) + "\n");
   renameSync2(tmp, path);
 }
 function showHintOnce(id, text) {
@@ -488,7 +582,7 @@ async function runInteractive(existing) {
   const { intro, outro, text, select, confirm: confirm2, isCancel, cancel } = await import("./dist-J3T4XVKX.js");
   intro("abtars onboard \u2014 first-time setup");
   const noteEmpty = "press Enter to skip";
-  const { packagePaths: pp, readManifest: rm3 } = await import("./deploy-lib-import-SBKXDD3F.js");
+  const { packagePaths: pp, readManifest: rm3 } = await import("./deploy-lib-import-6VJTYXEG.js");
   const mfPaths = pp("abtars");
   const mf = await rm3(mfPaths.manifest);
   const installMode = mf?.installMode ?? "supervised";
@@ -924,7 +1018,7 @@ async function onboard(opts) {
   }
   if (secrets.length > 0) process.stdout.write(`\u2713 ${secrets.length} secrets \u2192 ${secretDirPath}
 `);
-  const { writeManifest: writeManifest2 } = await import("./deploy-lib-import-SBKXDD3F.js");
+  const { writeManifest: writeManifest2 } = await import("./deploy-lib-import-6VJTYXEG.js");
   const mf = await readManifest(paths.manifest);
   if (mf) await writeManifest2(paths.manifest, { ...mf, installMode: answers.installMode });
   process.stdout.write(`\u2713 install mode: ${answers.installMode}
@@ -1055,8 +1149,8 @@ Next: 'abtars update' to build, then start the bridge.
 `);
     return 0;
   }
-  const { existsSync: existsSync10 } = await import("node:fs");
-  const hasRelease = existsSync10(join6(paths.home, "current"));
+  const { existsSync: existsSync9 } = await import("node:fs");
+  const hasRelease = existsSync9(join6(paths.home, "current"));
   if (!hasRelease) {
     process.stdout.write(`
 Next: run 'abtars update' to stage the release, then start the bridge.
@@ -1076,9 +1170,9 @@ Next: start the bridge
   return 0;
 }
 async function seedDefaultTasks(chatId, abtarsHome4) {
-  const { existsSync: existsSync10 } = await import("node:fs");
+  const { existsSync: existsSync9 } = await import("node:fs");
   const tasksJson = join6(abtarsHome4, "tasks", "tasks.json");
-  if (existsSync10(tasksJson)) {
+  if (existsSync9(tasksJson)) {
     process.stdout.write(`\u2022 tasks.json exists \u2014 skipping default-task seed
 `);
     return;
@@ -1091,7 +1185,7 @@ async function seedDefaultTasks(chatId, abtarsHome4) {
   ];
   let templatePath = null;
   for (const p of candidates) {
-    if (existsSync10(p)) {
+    if (existsSync9(p)) {
       templatePath = p;
       break;
     }
@@ -1147,70 +1241,10 @@ async function seedDefaultTasks(chatId, abtarsHome4) {
   }
 }
 
-// src/cli/commands/rollback.ts
-import { existsSync as existsSync5, renameSync as renameSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join7 } from "node:path";
-async function rollback() {
-  const paths = packagePaths("abtars");
-  const manifest = await readManifest(paths.manifest);
-  if (!existsSync5(paths.appPrev)) {
-    process.stderr.write(`Nothing to roll back to (no app.prev/ found).
-`);
-    return 2;
-  }
-  if (!manifest?.version) {
-    process.stderr.write(`No active release in manifest; nothing to roll back.
-`);
-    return 2;
-  }
-  const release = await acquireLock(paths.lock, "rollback");
-  try {
-    const brokenDir = join7(paths.home, "app.broken");
-    rmSync2(brokenDir, { recursive: true, force: true });
-    renameSync3(paths.app, brokenDir);
-    renameSync3(paths.appPrev, paths.app);
-    rmSync2(brokenDir, { recursive: true, force: true });
-    process.stdout.write(`\u2713 rolled back: app.prev/ \u2192 app/
-`);
-    if (manifest.previousVersion) {
-      await writeManifest(paths.manifest, {
-        ...manifest,
-        version: manifest.previousVersion,
-        commit: manifest.previousCommit,
-        activatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        previousVersion: manifest.version,
-        previousCommit: manifest.commit
-      });
-      process.stdout.write(`\u2713 manifest: ${manifest.version} \u2192 ${manifest.previousVersion}
-`);
-    }
-    const restartTs = Date.now();
-    const { restart: restart2 } = await import("./abtars-restart.js");
-    process.stdout.write(`\u267B\uFE0F Restarting bridge...
-`);
-    await restart2({ cold: true }).catch(() => {
-    });
-    const health = await healthProbe(paths.home, restartTs, 6e4);
-    if (health.healthy) {
-      process.stdout.write(`\u2713 Bridge healthy (PID ${health.pid})
-`);
-    } else {
-      process.stderr.write(`\u26A0\uFE0F Bridge may not have started. Check logs.
-`);
-    }
-    process.stdout.write(`
-Rollback complete.
-`);
-    return 0;
-  } finally {
-    await release();
-  }
-}
-
 // src/cli/commands/status.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join7 } from "node:path";
 async function status() {
   const paths = packagePaths("abtars");
   const manifest = await readManifest(paths.manifest);
@@ -1222,8 +1256,8 @@ Run 'abtars install' to set up.
     );
     return 1;
   }
-  const appExists = existsSync6(paths.app);
-  const appPrevExists = existsSync6(paths.appPrev);
+  const appExists = existsSync5(paths.app);
+  const appPrevExists = existsSync5(paths.appPrev);
   const lines = [
     `abtars status`,
     `  home:          ${paths.home}`,
@@ -1239,7 +1273,7 @@ Run 'abtars install' to set up.
     `  host:          ${manifest.host}`
   ];
   try {
-    const bridgeLock = JSON.parse(readFileSync3(join8(paths.home, "bridge.lock"), "utf-8"));
+    const bridgeLock = JSON.parse(readFileSync4(join7(paths.home, "bridge.lock"), "utf-8"));
     if (bridgeLock.pid) {
       const alive = (() => {
         try {
@@ -1279,16 +1313,16 @@ Run 'abtars install' to set up.
 
 // src/cli/commands/update.ts
 import { hostname } from "node:os";
-import { join as join11 } from "node:path";
-import { readFileSync as readFileSync5, existsSync as existsSync9 } from "node:fs";
+import { join as join10 } from "node:path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync8 } from "node:fs";
 import { copyFile as copyFile2, mkdir as mkdir4, chmod, readdir } from "node:fs/promises";
-import { rmSync as rmSync3, cpSync, readdirSync as readdirSync3, mkdirSync as mkdirSync2 } from "node:fs";
+import { rmSync as rmSync2, cpSync, readdirSync as readdirSync3, mkdirSync as mkdirSync2 } from "node:fs";
 
 // src/cli/update-sources/local.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { copyFile, cp, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { join as join8 } from "node:path";
 var LocalBuildError = class extends Error {
   constructor(message, hint) {
     super(hint ? `${message}
@@ -1350,7 +1384,7 @@ ${upstream} is ahead by ${behind} commit${behind === 1 ? "" : "s"}.`,
   return { commit, branch };
 }
 async function readPackageVersion(repoRoot) {
-  const pkg = JSON.parse(await readFile2(join9(repoRoot, "package.json"), "utf-8"));
+  const pkg = JSON.parse(await readFile2(join8(repoRoot, "package.json"), "utf-8"));
   if (typeof pkg.version !== "string") {
     throw new LocalBuildError("package.json has no version field.");
   }
@@ -1358,13 +1392,13 @@ async function readPackageVersion(repoRoot) {
 }
 function makeLocalBuildSource(opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
-  const isNpmPackage = !existsSync7(join9(repoRoot, ".git"));
+  const isNpmPackage = !existsSync6(join8(repoRoot, ".git"));
   return {
     name: "local",
     async prepare(ctx) {
       if (isNpmPackage) {
-        const bundleDir = join9(repoRoot, "bundle");
-        if (!existsSync7(bundleDir)) {
+        const bundleDir = join8(repoRoot, "bundle");
+        if (!existsSync6(bundleDir)) {
           throw new Error(`No bundle/ found at ${repoRoot}. Run from the abtars npm package or a git checkout.`);
         }
         const pkgVersion2 = await readPackageVersion(repoRoot);
@@ -1372,16 +1406,16 @@ function makeLocalBuildSource(opts = {}) {
         const stagedPath2 = ctx.stagingDir;
         await rm(stagedPath2, { recursive: true, force: true });
         await mkdir2(stagedPath2, { recursive: true });
-        await cp(bundleDir, join9(stagedPath2, "bundle"), { recursive: true });
-        const coreDir = join9(repoRoot, "core");
-        if (existsSync7(coreDir)) await cp(coreDir, join9(stagedPath2, "core"), { recursive: true });
-        const scriptsSrc = join9(repoRoot, "scripts");
-        if (existsSync7(scriptsSrc)) await cp(scriptsSrc, join9(stagedPath2, "scripts"), { recursive: true });
-        const configSrc = join9(repoRoot, "config");
-        if (existsSync7(configSrc)) await cp(configSrc, join9(stagedPath2, "config"), { recursive: true });
-        const manifestSrc = join9(repoRoot, "install-manifest.json");
-        if (existsSync7(manifestSrc)) await copyFile(manifestSrc, join9(stagedPath2, "install-manifest.json"));
-        await writeFile2(join9(stagedPath2, "package.json"), JSON.stringify({ type: "module", name: "abtars", version: version2 }, null, 2) + "\n");
+        await cp(bundleDir, join8(stagedPath2, "bundle"), { recursive: true });
+        const coreDir = join8(repoRoot, "core");
+        if (existsSync6(coreDir)) await cp(coreDir, join8(stagedPath2, "core"), { recursive: true });
+        const scriptsSrc = join8(repoRoot, "scripts");
+        if (existsSync6(scriptsSrc)) await cp(scriptsSrc, join8(stagedPath2, "scripts"), { recursive: true });
+        const configSrc = join8(repoRoot, "config");
+        if (existsSync6(configSrc)) await cp(configSrc, join8(stagedPath2, "config"), { recursive: true });
+        const manifestSrc = join8(repoRoot, "install-manifest.json");
+        if (existsSync6(manifestSrc)) await copyFile(manifestSrc, join8(stagedPath2, "install-manifest.json"));
+        await writeFile2(join8(stagedPath2, "package.json"), JSON.stringify({ type: "module", name: "abtars", version: version2 }, null, 2) + "\n");
         process.stdout.write(`\u2713 staged ${version2} (from npm package)
 `);
         return { version: version2, stagedPath: stagedPath2, commit: null, branch: null, packageLockHash: null, source: "local" };
@@ -1396,14 +1430,14 @@ function makeLocalBuildSource(opts = {}) {
       const stagedPath = ctx.stagingDir;
       await rm(stagedPath, { recursive: true, force: true });
       await mkdir2(stagedPath, { recursive: true });
-      await cp(join9(repoRoot, "bundle"), join9(stagedPath, "bundle"), { recursive: true });
-      const coreSkillsSrc = join9(repoRoot, "core", "skills");
-      if (existsSync7(coreSkillsSrc)) {
-        await cp(coreSkillsSrc, join9(stagedPath, "core", "skills"), { recursive: true });
+      await cp(join8(repoRoot, "bundle"), join8(stagedPath, "bundle"), { recursive: true });
+      const coreSkillsSrc = join8(repoRoot, "core", "skills");
+      if (existsSync6(coreSkillsSrc)) {
+        await cp(coreSkillsSrc, join8(stagedPath, "core", "skills"), { recursive: true });
       }
-      await writeFile2(join9(stagedPath, "package.json"), JSON.stringify({ type: "module", name: "abtars", version }, null, 2) + "\n");
-      await copyFile(join9(repoRoot, "install-manifest.json"), join9(stagedPath, "install-manifest.json"));
-      const packageLockHash = await hashFile(join9(repoRoot, "package-lock.json"));
+      await writeFile2(join8(stagedPath, "package.json"), JSON.stringify({ type: "module", name: "abtars", version }, null, 2) + "\n");
+      await copyFile(join8(repoRoot, "install-manifest.json"), join8(stagedPath, "install-manifest.json"));
+      const packageLockHash = await hashFile(join8(repoRoot, "package-lock.json"));
       return { version, stagedPath, commit, branch, packageLockHash, source: "local" };
     }
   };
@@ -1411,9 +1445,9 @@ function makeLocalBuildSource(opts = {}) {
 
 // src/cli/update-sources/npm.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync4, unlinkSync as unlinkSync4 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5, unlinkSync as unlinkSync4 } from "node:fs";
 import { mkdir as mkdir3, rm as rm2 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join9 } from "node:path";
 var TIMEOUT_MS = 6e4;
 function run(cmd, args, cwd) {
   const r = spawnSync3(cmd, args, { cwd, encoding: "utf-8", timeout: TIMEOUT_MS });
@@ -1423,7 +1457,7 @@ function run(cmd, args, cwd) {
 }
 function readLocalVersion(home) {
   try {
-    const pkg = JSON.parse(readFileSync4(join10(home, "app", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync5(join9(home, "app", "package.json"), "utf-8"));
     return pkg.version ?? null;
   } catch {
     return null;
@@ -1443,9 +1477,9 @@ function makeNpmSource(packageName) {
       await mkdir3(stagedPath, { recursive: true });
       run("npm", ["pack", `${packageName}@${latest}`, "--pack-destination", stagedPath], stagedPath);
       const tgzName = `${packageName}-${latest}.tgz`.replace("@", "").replace("/", "-");
-      const tgzPath = join10(stagedPath, tgzName);
+      const tgzPath = join9(stagedPath, tgzName);
       run("tar", ["-xzf", tgzPath, "--strip-components=1"], stagedPath);
-      if (existsSync8(tgzPath)) unlinkSync4(tgzPath);
+      if (existsSync7(tgzPath)) unlinkSync4(tgzPath);
       run("npm", ["install", "--omit=dev", "--no-audit", "--no-fund"], stagedPath);
       return { version: latest, stagedPath, commit: null, branch: null, packageLockHash: null, source: "npm" };
     }
@@ -1455,7 +1489,7 @@ function makeNpmSource(packageName) {
 // src/cli/commands/update.ts
 function readJsonField2(file, field) {
   try {
-    return JSON.parse(readFileSync5(file, "utf-8"))[field];
+    return JSON.parse(readFileSync6(file, "utf-8"))[field];
   } catch {
     return void 0;
   }
@@ -1483,8 +1517,8 @@ Use --source local (default) or --source npm.
   try {
     cleanStaleStaging(paths.appStaging);
     const cleanupHandler = () => {
-      if (existsSync9(paths.appStaging) && existsSync9(paths.app)) {
-        rmSync3(paths.appStaging, { recursive: true, force: true });
+      if (existsSync8(paths.appStaging) && existsSync8(paths.app)) {
+        rmSync2(paths.appStaging, { recursive: true, force: true });
       }
     };
     process.on("SIGHUP", () => {
@@ -1496,12 +1530,12 @@ Use --source local (default) or --source npm.
       process.exit(143);
     });
     let repoRoot = opts.repoRoot ?? process.cwd();
-    if (!opts.repoRoot && !existsSync9(join11(repoRoot, ".git"))) {
+    if (!opts.repoRoot && !existsSync8(join10(repoRoot, ".git"))) {
       const { realpathSync } = await import("node:fs");
       const scriptPath = realpathSync(process.argv[1] ?? "");
       const { dirname: dirname3 } = await import("node:path");
-      const candidate = join11(dirname3(scriptPath), "..");
-      if (existsSync9(join11(candidate, "bundle"))) repoRoot = candidate;
+      const candidate = join10(dirname3(scriptPath), "..");
+      if (existsSync8(join10(candidate, "bundle"))) repoRoot = candidate;
     }
     const source = opts.source === "npm" ? makeNpmSource("abtars") : makeLocalBuildSource({ repoRoot, allowStale: opts.fromLocal });
     if (opts.fromLocal) {
@@ -1520,14 +1554,14 @@ Use --source local (default) or --source npm.
     process.stdout.write(`\u2713 staged ${staged.version}
 `);
     {
-      const pkgPath = join11(staged.stagedPath, "package.json");
+      const pkgPath = join10(staged.stagedPath, "package.json");
       try {
-        const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
         const externals = { patchright: "^1.59.4", "rettiwt-api": "^4.1.3" };
         pkg.dependencies = { ...pkg.dependencies, ...externals };
         if (pkg.dependencies?.abmind?.startsWith("file:")) delete pkg.dependencies.abmind;
-        const { writeFileSync: writeFileSync2 } = await import("node:fs");
-        writeFileSync2(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+        const { writeFileSync: writeFileSync4 } = await import("node:fs");
+        writeFileSync4(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
         const { execSync } = await import("node:child_process");
         execSync("npm install --omit=dev --ignore-scripts 2>/dev/null", { cwd: staged.stagedPath, timeout: 6e4 });
         process.stdout.write(`\u2713 external deps installed
@@ -1538,8 +1572,8 @@ Use --source local (default) or --source npm.
       }
     }
     await copyAbmind(staged.stagedPath, repoRoot);
-    const entryPoint = join11(staged.stagedPath, "bundle", "abtars.js");
-    if (!existsSync9(entryPoint)) {
+    const entryPoint = join10(staged.stagedPath, "bundle", "abtars.js");
+    if (!existsSync8(entryPoint)) {
       process.stderr.write(`\u274C Entry point not found: ${entryPoint}
 `);
       return 1;
@@ -1547,10 +1581,6 @@ Use --source local (default) or --source npm.
     configSnapshot(paths.config);
     process.stdout.write(`\u2713 config snapshot (3-slot rotation)
 `);
-    atomicSwap(paths.app, paths.appPrev, paths.appStaging);
-    process.stdout.write(`\u2713 atomic swap: app.staging/ \u2192 app/
-`);
-    await postSwapHousekeeping(paths, repoRoot, staged);
     const prior = await readManifest(paths.manifest);
     const sentinelData = {
       version: staged.version,
@@ -1559,6 +1589,10 @@ Use --source local (default) or --source npm.
       status: "pending"
     };
     writeSentinel(paths.home, sentinelData);
+    atomicSwap(paths.app, paths.appPrev, paths.appStaging);
+    process.stdout.write(`\u2713 atomic swap: app.staging/ \u2192 app/
+`);
+    await postSwapHousekeeping(paths, repoRoot, staged);
     await writeManifest(paths.manifest, {
       ...prior ?? emptyManifest("abtars", hostname()),
       version: staged.version,
@@ -1568,7 +1602,9 @@ Use --source local (default) or --source npm.
       activatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       source: "local",
       previousVersion: prior?.version ?? null,
-      previousCommit: prior?.commit ?? null
+      previousCommit: prior?.commit ?? null,
+      installMode: prior?.installMode ?? "supervised",
+      repoRoot
     });
     process.stdout.write(`\u2713 manifest updated
 `);
@@ -1590,18 +1626,18 @@ Use --source local (default) or --source npm.
     }
     process.stderr.write(`\u274C Bridge unhealthy after 60s. Auto-rolling back...
 `);
-    if (!existsSync9(paths.appPrev)) {
-      process.stderr.write(`\u274C No app.prev/ to roll back to. Manual intervention required.
+    if (!existsSync8(paths.appPrev1)) {
+      process.stderr.write(`\u274C No app.prev.1/ to roll back to. Manual intervention required.
 `);
       process.stderr.write(`   Check: ~/.abtars/logs/bridge.log
 `);
       return 2;
     }
-    const brokenDir = join11(paths.home, "app.broken");
-    rmSync3(brokenDir, { recursive: true, force: true });
-    const { renameSync: renameSync4 } = await import("node:fs");
-    renameSync4(paths.app, brokenDir);
-    renameSync4(paths.appPrev, paths.app);
+    const brokenDir = join10(paths.home, "app.broken");
+    rmSync2(brokenDir, { recursive: true, force: true });
+    const { renameSync: renameSync3 } = await import("node:fs");
+    renameSync3(paths.app, brokenDir);
+    renameSync3(paths.appPrev1, paths.app);
     if (prior) {
       await writeManifest(paths.manifest, prior);
     }
@@ -1611,7 +1647,7 @@ Use --source local (default) or --source npm.
     if (rollbackHealth.healthy) {
       process.stderr.write(`\u26A0\uFE0F Rolled back to previous version. Investigate ${brokenDir} for the failure.
 `);
-      rmSync3(brokenDir, { recursive: true, force: true });
+      rmSync2(brokenDir, { recursive: true, force: true });
       return 1;
     }
     process.stderr.write(`\u274C Rollback also failed. Manual intervention required.
@@ -1628,17 +1664,27 @@ Use --source local (default) or --source npm.
 async function copyAbmind(stagedPath, repoRoot) {
   const candidates = [
     process.env["ABMIND_REPO"],
-    join11(repoRoot, "..", "abmind"),
-    join11(process.env["HOME"] ?? "", "abmind")
+    join10(repoRoot, "..", "abmind"),
+    join10(process.env["HOME"] ?? "", "abmind")
   ].filter(Boolean);
   for (const src of candidates) {
-    const distDir = join11(src, "dist");
-    if (existsSync9(distDir)) {
-      const dest = join11(stagedPath, "node_modules", "abmind");
+    const distDir = join10(src, "dist");
+    if (existsSync8(distDir)) {
+      const dest = join10(stagedPath, "bundle", "node_modules", "abmind");
       mkdirSync2(dest, { recursive: true });
-      cpSync(distDir, join11(dest, "dist"), { recursive: true });
-      if (existsSync9(join11(src, "package.json"))) cpSync(join11(src, "package.json"), join11(dest, "package.json"));
-      if (existsSync9(join11(src, "prompts"))) cpSync(join11(src, "prompts"), join11(dest, "prompts"), { recursive: true });
+      cpSync(distDir, join10(dest, "dist"), { recursive: true });
+      if (existsSync8(join10(src, "package.json"))) cpSync(join10(src, "package.json"), join10(dest, "package.json"));
+      if (existsSync8(join10(src, "prompts"))) cpSync(join10(src, "prompts"), join10(dest, "prompts"), { recursive: true });
+      const stalePath = join10(stagedPath, "node_modules", "abmind");
+      if (existsSync8(stalePath)) rmSync2(stalePath, { recursive: true });
+      try {
+        const pkg = JSON.parse(readFileSync6(join10(dest, "package.json"), "utf-8"));
+        const abmindHome = process.env["ABMIND_HOME"] ?? join10(process.env["HOME"] ?? "", ".abmind");
+        mkdirSync2(abmindHome, { recursive: true });
+        const manifest = { version: pkg.version, activatedAt: (/* @__PURE__ */ new Date()).toISOString(), source: "local" };
+        writeFileSync3(join10(abmindHome, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+      } catch {
+      }
       process.stdout.write(`\u2713 abmind copied from ${src}
 `);
       return;
@@ -1648,32 +1694,32 @@ async function copyAbmind(stagedPath, repoRoot) {
 `);
 }
 async function postSwapHousekeeping(paths, repoRoot, _staged) {
-  const { loadManifest } = await import("./install-manifest-QRWID3KZ.js");
+  const { loadManifest } = await import("./install-manifest-KBYD7SAY.js");
   const installManifest = loadManifest(paths.app);
-  const repoScripts = join11(repoRoot, "scripts");
-  const destScripts = join11(paths.home, "scripts");
+  const repoScripts = join10(repoRoot, "scripts");
+  const destScripts = join10(paths.home, "scripts");
   await mkdir4(destScripts, { recursive: true });
   const allScriptFiles = await readdir(repoScripts).catch(() => []);
   const matchesInclude = (name) => installManifest.scripts.include.some((pattern) => name.endsWith(pattern.replace("*", "")));
   const scriptFiles = allScriptFiles.filter(matchesInclude);
   const isExecutable = (name) => name.endsWith(installManifest.scripts.executable.replace("*", ""));
   for (const name of scriptFiles) {
-    await copyFile2(join11(repoScripts, name), join11(destScripts, name));
-    if (isExecutable(name)) await chmod(join11(destScripts, name), 493);
+    await copyFile2(join10(repoScripts, name), join10(destScripts, name));
+    if (isExecutable(name)) await chmod(join10(destScripts, name), 493);
   }
   process.stdout.write(`\u2713 scripts refreshed (${scriptFiles.length} files)
 `);
-  const { writeWrapper } = await import("./install-SH4UVUXQ.js");
+  const { writeWrapper } = await import("./install-FZT43PTH.js");
   await mkdir4(paths.bin, { recursive: true });
   for (const name of installManifest.cliWrappers) {
     await writeWrapper(paths.bin, name, paths.app, false);
   }
   process.stdout.write(`\u2713 wrappers refreshed (${installManifest.cliWrappers.length} files)
 `);
-  const skillsCoreSrc = join11(paths.app, "core", "skills");
-  const skillsCoreDst = join11(paths.home, "skills", "core");
-  if (existsSync9(skillsCoreSrc)) {
-    rmSync3(skillsCoreDst, { recursive: true, force: true });
+  const skillsCoreSrc = join10(paths.app, "core", "skills");
+  const skillsCoreDst = join10(paths.home, "skills", "core");
+  if (existsSync8(skillsCoreSrc)) {
+    rmSync2(skillsCoreDst, { recursive: true, force: true });
     cpSync(skillsCoreSrc, skillsCoreDst, { recursive: true });
     const files = readdirSync3(skillsCoreDst, { recursive: true });
     const count = files.filter((f) => f.endsWith("SKILL.md")).length;
@@ -1681,26 +1727,26 @@ async function postSwapHousekeeping(paths, repoRoot, _staged) {
 `);
   }
   for (const d of ["custom", "downloaded", "self"]) {
-    await mkdir4(join11(paths.home, "skills", d), { recursive: true });
+    await mkdir4(join10(paths.home, "skills", d), { recursive: true });
   }
-  const releaseConfig = join11(paths.app, "config");
-  const destConfig = join11(paths.home, "config");
-  if (existsSync9(releaseConfig)) {
+  const releaseConfig = join10(paths.app, "config");
+  const destConfig = join10(paths.home, "config");
+  if (existsSync8(releaseConfig)) {
     for (const f of readdirSync3(releaseConfig)) {
-      const src = join11(releaseConfig, f);
+      const src = join10(releaseConfig, f);
       if (f.endsWith(".example")) {
-        cpSync(src, join11(destConfig, f));
-        const target = join11(destConfig, f.replace(".example", ""));
-        if (!existsSync9(target)) cpSync(src, target);
+        cpSync(src, join10(destConfig, f));
+        const target = join10(destConfig, f.replace(".example", ""));
+        if (!existsSync8(target)) cpSync(src, target);
       }
     }
-    const defaultTransport = join11(releaseConfig, "transport.default.json");
-    if (existsSync9(defaultTransport)) cpSync(defaultTransport, join11(destConfig, "transport.default.json"));
+    const defaultTransport = join10(releaseConfig, "transport.default.json");
+    if (existsSync8(defaultTransport)) cpSync(defaultTransport, join10(destConfig, "transport.default.json"));
   }
-  const transportJson = join11(paths.home, "config", "transport.json");
-  if (existsSync9(transportJson)) {
+  const transportJson = join10(paths.home, "config", "transport.json");
+  if (existsSync8(transportJson)) {
     try {
-      const tc = JSON.parse(readFileSync5(transportJson, "utf-8"));
+      const tc = JSON.parse(readFileSync6(transportJson, "utf-8"));
       let cleared = false;
       for (const agent of Object.values(tc.agents ?? {})) {
         if (agent.demoted) {
@@ -1719,14 +1765,14 @@ async function postSwapHousekeeping(paths, repoRoot, _staged) {
         }
       }
       if (cleared) {
-        const { writeFileSync: writeFileSync2 } = await import("node:fs");
-        writeFileSync2(transportJson, JSON.stringify(tc, null, 2) + "\n");
+        const { writeFileSync: writeFileSync4 } = await import("node:fs");
+        writeFileSync4(transportJson, JSON.stringify(tc, null, 2) + "\n");
       }
     } catch {
     }
   }
-  const doctorPath = join11(paths.home, "scripts", "doctor.sh");
-  if (existsSync9(doctorPath)) {
+  const doctorPath = join10(paths.home, "scripts", "doctor.sh");
+  if (existsSync8(doctorPath)) {
     process.stdout.write("\n\u{1FA7A} Health check...\n");
     try {
       const { execSync } = await import("node:child_process");
@@ -1736,7 +1782,7 @@ async function postSwapHousekeeping(paths, repoRoot, _staged) {
 `);
     }
   }
-  const { ensureInstallInvariants } = await import("./ensure-invariants-BJIEOSJ2.js");
+  const { ensureInstallInvariants } = await import("./ensure-invariants-3NOBCYWS.js");
   const invariantResults = await ensureInstallInvariants(process.cwd(), paths.home);
   if (invariantResults.length > 0) {
     process.stdout.write(`\u2713 invariants: ${invariantResults.join(", ")}
@@ -1753,7 +1799,7 @@ async function restartBridge(paths) {
   }
   if (mode === "supervised-daemon" || mode === "supervised") {
     process.stdout.write("\n\u267B\uFE0F Restarting bridge via watchdog...\n");
-    const wdLock = join11(paths.home, "watchdog.lock");
+    const wdLock = join10(paths.home, "watchdog.lock");
     const wdPid = readJsonField2(wdLock, "pid");
     if (wdPid && wdPid > 0) {
       try {
@@ -1785,7 +1831,7 @@ function printDryRun(paths, repoRoot, opts) {
   const { spawnSync: spawnSync4 } = __require("node:child_process");
   const commit = spawnSync4("git", ["rev-parse", "--short", "HEAD"], { cwd: repoRoot, encoding: "utf-8" }).stdout?.trim() ?? "?";
   const branch = spawnSync4("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: repoRoot, encoding: "utf-8" }).stdout?.trim() ?? "?";
-  const wdLock = join11(paths.home, "watchdog.lock");
+  const wdLock = join10(paths.home, "watchdog.lock");
   const wdPid = readJsonField2(wdLock, "pid");
   process.stdout.write(`
 Dry run \u2014 no changes will be made.
@@ -1801,7 +1847,7 @@ Dry run \u2014 no changes will be made.
 }
 async function checkForUpdates(home, opts) {
   const repoRoot = opts.repoRoot ?? process.cwd();
-  if (!existsSync9(join11(repoRoot, ".git"))) {
+  if (!existsSync8(join10(repoRoot, ".git"))) {
     process.stderr.write("Not a git repository. --check requires a git checkout.\n");
     return 2;
   }
@@ -1809,7 +1855,7 @@ async function checkForUpdates(home, opts) {
   spawnSync4("git", ["fetch", "--quiet"], { cwd: repoRoot });
   const result = spawnSync4("git", ["rev-list", "--count", "HEAD..origin/dev"], { cwd: repoRoot, encoding: "utf-8" });
   const ahead = parseInt(result.stdout?.trim() ?? "0", 10);
-  const manifest = await readManifest(join11(home, "manifest.json"));
+  const manifest = await readManifest(join10(home, "manifest.json"));
   process.stdout.write(`Current: ${manifest?.version ?? "unknown"} (deployed ${manifest?.activatedAt ?? "never"})
 `);
   if (ahead === 0) {
@@ -1858,8 +1904,8 @@ Usage:
   abtars uninstall [--yes]
   abtars update  [--source local|npm|github] [--from-local]
   abtars rollback [--to <version>]
-  abtars backup
-  abtars restore <file.zip|.7z>
+  abtars backup [--config] [--encrypt] [--output <dir>] [--prune-days N]
+  abtars restore <file.zip|.7z|.abm|.enc> [--config] [--passphrase <p>]
   abtars doctor [<args passed to doctor.sh>...]
   abtars onboard [--non-interactive --accept-risk --telegram-token ... --telegram-chat-id ...]
   abtars restart [--cold]
@@ -1872,6 +1918,20 @@ Usage:
   );
 }
 async function main(argv) {
+  if (argv[0] === "--version" || argv[0] === "-v" || argv[0] === "version") {
+    const { readFileSync: readFileSync7 } = await import("node:fs");
+    const { join: join11, dirname: dirname3 } = await import("node:path");
+    const { fileURLToPath: fileURLToPath2 } = await import("node:url");
+    const here = dirname3(fileURLToPath2(import.meta.url));
+    try {
+      const pkg = JSON.parse(readFileSync7(join11(here, "..", "package.json"), "utf-8"));
+      process.stdout.write(`${pkg.version}
+`);
+    } catch {
+      process.stdout.write("unknown\n");
+    }
+    return 0;
+  }
   const { command, flags } = parseArgs(argv);
   try {
     switch (command) {
@@ -1891,12 +1951,20 @@ async function main(argv) {
           allowAbmindMismatch: flags.get("allow-abmind-mismatch") === true
         });
       case "rollback":
-        return await rollback();
+        return await rollback({ to: typeof flags.get("to") === "string" ? Number(flags.get("to")) : void 0 });
       case "backup":
-        return await backup(typeof flags.get("output") === "string" ? flags.get("output") : void 0);
+        return await backup({
+          config: flags.get("config") === true,
+          encrypt: flags.get("encrypt") === true,
+          outputDir: typeof flags.get("output") === "string" ? flags.get("output") : void 0,
+          pruneDays: typeof flags.get("prune-days") === "string" ? Number(flags.get("prune-days")) : void 0
+        });
       case "restore": {
-        const { restore } = await import("./restore-ROJF22R2.js");
-        return await restore(argv[1] ?? "");
+        const { restore } = await import("./restore-Z6MF54HS.js");
+        return await restore(argv[1] ?? "", {
+          config: flags.get("config") === true,
+          passphrase: typeof flags.get("passphrase") === "string" ? flags.get("passphrase") : void 0
+        });
       }
       case "doctor":
         return await doctor(argv.slice(1).filter((a) => a !== ""));
@@ -1919,15 +1987,15 @@ async function main(argv) {
       case "stop":
         return await stop({ force: flags.get("force") === true });
       case "start": {
-        const { start: startCmd } = await import("./start-CBVKNEAT.js");
+        const { start: startCmd } = await import("./start-4DNURGIY.js");
         return await startCmd();
       }
       case "daemon": {
-        const { daemon: daemonCmd } = await import("./daemon-NPKYZ3CJ.js");
+        const { daemon: daemonCmd } = await import("./daemon-WOQXCKNL.js");
         return await daemonCmd(argv.slice(1));
       }
       case "deps": {
-        const { deps: depsCmd } = await import("./deps-HN6CEXA4.js");
+        const { deps: depsCmd } = await import("./deps-65V7XXG4.js");
         return await depsCmd(argv.slice(1));
       }
       case "logs": {