arbella 0.1.1 → 0.1.3

package/dist/index.js

@@ -195,6 +195,15 @@ function toolHomeDir(tool) {
       return path2.join(homeDir(), ".cursor");
   }
 }
+function appUserConfigRoot(targetOS, userHome, env = {}) {
+  if (targetOS === "darwin") {
+    return path2.join(userHome, "Library", "Application Support");
+  }
+  if (targetOS === "win32") {
+    return env.APPDATA ?? path2.join(userHome, "AppData", "Roaming");
+  }
+  return env.XDG_CONFIG_HOME ?? path2.join(userHome, ".config");
+}
 function linuxPackageManagerCandidates() {
   return LINUX_PM_PROBES;
 }
@@ -899,6 +908,16 @@ var init_denylist = __esm({
   }
 });
 
+// src/utils/symlink.ts
+function normalizeCapturedSymlinkTarget(target) {
+  return target.replace(/\\/g, "/");
+}
+var init_symlink = __esm({
+  "src/utils/symlink.ts"() {
+    "use strict";
+  }
+});
+
 // src/adapters/claude/plugins.ts
 function isRecord(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -1004,7 +1023,7 @@ async function walk(ctx, home4, abs, deny, files, symlinks, warnings) {
     return;
   }
   if (kind === "symlink") {
-    const target = await ctx.fs.readLink(abs);
+    const target = normalizeCapturedSymlinkTarget(await ctx.fs.readLink(abs));
     symlinks.push({ repoPath: repoPathFor(rel), target });
     ctx.log.debug(`claude: symlink ${rel} -> ${target}`);
     return;
@@ -1068,7 +1087,7 @@ async function captureSkills(ctx, home4, skillsDir, deny, files, symlinks, skill
     }
     const kind = await ctx.fs.statKind(abs);
     if (kind === "symlink") {
-      const target = await ctx.fs.readLink(abs);
+      const target = normalizeCapturedSymlinkTarget(await ctx.fs.readLink(abs));
       symlinks.push({ repoPath: repoPathFor(rel), target });
       skills.push({
         name,
@@ -1166,6 +1185,7 @@ var init_capture = __esm({
   "src/adapters/claude/capture.ts"() {
     "use strict";
     init_denylist();
+    init_symlink();
     init_install();
     init_paths();
     init_plugins();
@@ -1849,7 +1869,7 @@ async function captureFile2(ctx, absPath, rel, out2) {
 async function captureSymlink(ctx, absPath, rel, out2) {
   let target;
   try {
-    target = await ctx.fs.readLink(absPath);
+    target = normalizeCapturedSymlinkTarget(await ctx.fs.readLink(absPath));
   } catch {
     out2.warnings.push(`codex: could not read symlink ${rel}; skipped`);
     return;
@@ -2007,6 +2027,7 @@ var init_capture2 = __esm({
     "use strict";
     init_denylist();
     init_install();
+    init_symlink();
     init_paths2();
     init_configToml();
     DENY = denylistFor("codex");
@@ -2259,38 +2280,54 @@ function paths3(overrideHome) {
   return {
     home: base,
     mcpJson: path10.join(base, "mcp.json"),
-    skillsDir: path10.join(base, "skills"),
-    rulesDir: path10.join(base, "rules")
+    skillsDir: path10.join(base, "skills")
   };
 }
-function sharedRulePath(overrideHome) {
-  return path10.join(paths3(overrideHome).rulesDir, SHARED_RULE_FILENAME);
+function cursorUserPaths(toolHome, os2, env = {}) {
+  const userHome = path10.dirname(toolHome);
+  const userDir = path10.join(appUserConfigRoot(os2, userHome, env), "Cursor", "User");
+  return {
+    userDir,
+    settingsJson: path10.join(userDir, "settings.json"),
+    keybindingsJson: path10.join(userDir, "keybindings.json"),
+    snippetsDir: path10.join(userDir, "snippets")
+  };
 }
-var REPO_PREFIX3, FROZEN_PATHS3, SHARED_INSTRUCTIONS_REPO_PATH, SHARED_RULE_FILENAME;
+var REPO_PREFIX3, USER_REPO_PREFIX, FROZEN_PATHS3;
 var init_paths3 = __esm({
   "src/adapters/cursor/paths.ts"() {
     "use strict";
     init_os();
     REPO_PREFIX3 = "cursor/files";
-    FROZEN_PATHS3 = ["mcp.json"];
-    SHARED_INSTRUCTIONS_REPO_PATH = "shared/instructions.md";
-    SHARED_RULE_FILENAME = "arbella-shared-instructions.mdc";
+    USER_REPO_PREFIX = "cursor/user";
+    FROZEN_PATHS3 = ["mcp.json", "skills"];
   }
 });
 
 // src/adapters/cursor/index.ts
 import path11 from "path";
+import process3 from "process";
+import { execa as execa4 } from "execa";
 function repoPathFor3(rel) {
   return `${REPO_PREFIX3}/${rel}`;
 }
+function userRepoPathFor(rel) {
+  return `${USER_REPO_PREFIX}/${rel}`;
+}
 function toRel2(home4, abs) {
   return path11.relative(home4, abs).split(path11.sep).join("/");
 }
-function relFromRepoPath(repoPath) {
+function targetFromRepoPath(repoPath) {
   const norm = repoPath.replace(/\\/g, "/");
-  const prefix = `${REPO_PREFIX3}/`;
-  if (!norm.startsWith(prefix)) return void 0;
-  return norm.slice(prefix.length);
+  const homePrefix = `${REPO_PREFIX3}/`;
+  if (norm.startsWith(homePrefix)) return { root: "home", rel: norm.slice(homePrefix.length) };
+  const userPrefix = `${USER_REPO_PREFIX}/`;
+  if (norm.startsWith(userPrefix)) return { root: "user", rel: norm.slice(userPrefix.length) };
+  return void 0;
+}
+function targetAbsFor2(ctx, target) {
+  const root = target.root === "home" ? ctx.toolHome : cursorUserPaths(ctx.toolHome, ctx.os, ctx.env).userDir;
+  return path11.join(root, ...target.rel.split("/").filter(Boolean));
 }
 function looksBinary2(buf) {
   const n = Math.min(buf.length, 8e3);
@@ -2333,72 +2370,250 @@ function collectMcpSecretRefs(ctx, parsed, source) {
   }
   return refs;
 }
-async function capture4(ctx, _opts) {
-  const files = [];
-  const symlinks = [];
-  const secrets = [];
-  const warnings = [];
-  const manifest = emptyCursorManifest();
-  const p = paths3(ctx.toolHome);
-  const deny = denylistFor("cursor");
-  if (await ctx.fs.statKind(p.home) !== "dir") {
-    warnings.push("cursor: ~/.cursor not found; skipping (Cursor not installed?).");
-    return { tool: "cursor", files, symlinks, manifest, secrets, warnings };
+async function readMode(abs) {
+  try {
+    const { promises: fsp5 } = await import("fs");
+    const st = await fsp5.stat(abs);
+    return st.mode & 511;
+  } catch {
+    return void 0;
   }
-  for (const rel of FROZEN_PATHS3) {
-    const abs = path11.join(p.home, rel);
-    const relPosix = toRel2(p.home, abs);
-    if (matchesDeny(relPosix, deny)) {
-      ctx.log.debug(`cursor: skip (denylist) ${relPosix}`);
-      continue;
+}
+async function captureFile3(args) {
+  const { ctx, abs, rel, repoPath, files, secrets, warnings, scanMcpSecrets = false } = args;
+  const mode = await readMode(abs);
+  let bytes;
+  try {
+    bytes = await ctx.fs.readBytes(abs);
+  } catch (err) {
+    warnings.push(`cursor: could not read ${rel}: ${err.message}`);
+    return;
+  }
+  if (looksBinary2(bytes)) {
+    const file2 = {
+      repoPath,
+      content: bytes.toString("base64"),
+      binary: true
+    };
+    if (mode !== void 0) file2.mode = mode;
+    files.push(file2);
+    return;
+  }
+  const raw = bytes.toString("utf8");
+  if (scanMcpSecrets) {
+    try {
+      secrets.push(...collectMcpSecretRefs(ctx, JSON.parse(raw), rel));
+    } catch (err) {
+      warnings.push(`cursor: could not parse ${rel} for secret scan: ${err.message}`);
+    }
+  }
+  let content = raw;
+  if (!ctx.includeSecrets) {
+    const sanitized = ctx.sanitizer.sanitizeFile(raw, "cursor", rel);
+    content = sanitized.content;
+    secrets.push(...sanitized.found);
+  }
+  const templated = ctx.templater.toTemplate(content, ctx.vars);
+  const file = { repoPath, content: templated };
+  if (mode !== void 0) file.mode = mode;
+  files.push(file);
+}
+async function walkFrozen(ctx, root, abs, deny, repoPathBuilder, files, symlinks, secrets, warnings) {
+  const kind = await ctx.fs.statKind(abs);
+  if (kind === "missing") return;
+  const rel = toRel2(root, abs);
+  if (rel && matchesDeny(rel, deny)) {
+    ctx.log.debug(`cursor: skip (denylist) ${rel}`);
+    return;
+  }
+  if (kind === "symlink") {
+    const target = normalizeCapturedSymlinkTarget(await ctx.fs.readLink(abs));
+    symlinks.push({ repoPath: repoPathBuilder(rel), target });
+    ctx.log.debug(`cursor: symlink ${rel} -> ${target}`);
+    return;
+  }
+  if (kind === "dir") {
+    const entries = await ctx.fs.list(abs);
+    entries.sort();
+    for (const name of entries) {
+      await walkFrozen(ctx, root, path11.join(abs, name), deny, repoPathBuilder, files, symlinks, secrets, warnings);
     }
+    return;
+  }
+  await captureFile3({
+    ctx,
+    abs,
+    rel,
+    repoPath: repoPathBuilder(rel),
+    files,
+    secrets,
+    warnings,
+    scanMcpSecrets: rel === "mcp.json"
+  });
+}
+async function captureSkills3(ctx, home4, skillsDir, deny, files, symlinks, skills, secrets, warnings) {
+  if (await ctx.fs.statKind(skillsDir) !== "dir") return;
+  const entries = await ctx.fs.list(skillsDir);
+  entries.sort();
+  for (const name of entries) {
+    const abs = path11.join(skillsDir, name);
+    const rel = toRel2(home4, abs);
+    if (matchesDeny(rel, deny)) continue;
     const kind = await ctx.fs.statKind(abs);
-    if (kind === "missing") {
-      ctx.log.debug(`cursor: not present ${relPosix}`);
+    if (kind === "symlink") {
+      const target = normalizeCapturedSymlinkTarget(await ctx.fs.readLink(abs));
+      symlinks.push({ repoPath: repoPathFor3(rel), target });
+      skills.push({
+        name,
+        source: "skills.sh",
+        installCommand: `npx skills add ${name}`,
+        symlinked: true
+      });
       continue;
     }
-    if (kind !== "file") {
-      ctx.log.debug(`cursor: skip non-file ${relPosix}`);
+    if (kind === "dir") {
+      skills.push({ name, source: "frozen", symlinked: false });
+      await walkFrozen(ctx, home4, abs, deny, repoPathFor3, files, symlinks, secrets, warnings);
       continue;
     }
-    let bytes;
+    if (kind === "file") {
+      skills.push({ name, source: "frozen", symlinked: false });
+      await walkFrozen(ctx, home4, abs, deny, repoPathFor3, files, symlinks, secrets, warnings);
+    }
+  }
+}
+function parseExtensionId(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]*\.[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(trimmed)) return void 0;
+  return trimmed;
+}
+function parseCursorExtensionEntry(entry) {
+  if (entry === null || typeof entry !== "object") return void 0;
+  const obj = entry;
+  const identifier = obj.identifier;
+  const identifierObj = identifier !== null && typeof identifier === "object" ? identifier : {};
+  const id = parseExtensionId(identifierObj.id) ?? parseExtensionId(obj.id);
+  if (id === void 0) return void 0;
+  const version = typeof obj.version === "string" ? obj.version : void 0;
+  return {
+    id,
+    name: id,
+    version,
+    enabled: true,
+    scope: "user"
+  };
+}
+function parseCursorExtensionsJson(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of parsed) {
+    const plugin = parseCursorExtensionEntry(entry);
+    if (plugin === void 0 || seen.has(plugin.id)) continue;
+    seen.add(plugin.id);
+    out2.push(plugin);
+  }
+  return out2;
+}
+function parseCursorExtensionLine(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0) return void 0;
+  const at = trimmed.lastIndexOf("@");
+  const id = at > 0 ? trimmed.slice(0, at) : trimmed;
+  const version = at > 0 ? trimmed.slice(at + 1) : void 0;
+  const parsedId = parseExtensionId(id);
+  if (parsedId === void 0) return void 0;
+  return {
+    id: parsedId,
+    name: parsedId,
+    version: version && version.length > 0 ? version : void 0,
+    enabled: true,
+    scope: "user"
+  };
+}
+async function captureExtensions(ctx, cursorHome, warnings) {
+  const extensionState = path11.join(cursorHome, "extensions", "extensions.json");
+  if (await ctx.fs.statKind(extensionState) === "file") {
     try {
-      bytes = await ctx.fs.readBytes(abs);
+      const fromState = parseCursorExtensionsJson(await ctx.fs.read(extensionState));
+      if (fromState.length > 0) return fromState;
     } catch (err) {
-      warnings.push(`cursor: could not read ${relPosix}: ${err.message}`);
-      continue;
-    }
-    if (looksBinary2(bytes)) {
-      files.push({ repoPath: repoPathFor3(relPosix), content: bytes.toString("base64"), binary: true });
-      continue;
+      warnings.push(`cursor: could not read extensions metadata: ${err.message}`);
     }
-    const raw = bytes.toString("utf8");
-    if (relPosix === "mcp.json") {
-      try {
-        secrets.push(...collectMcpSecretRefs(ctx, JSON.parse(raw), relPosix));
-      } catch (err) {
-        warnings.push(`cursor: could not parse mcp.json for secret scan: ${err.message}`);
+  }
+  if (!await which(cliBinaryName("cursor"))) return [];
+  try {
+    const result = await execa4(cliBinaryName("cursor"), ["--list-extensions", "--show-versions"], {
+      stdin: "ignore",
+      stderr: "ignore",
+      stdout: "pipe",
+      reject: false
+    });
+    const plugins = result.stdout.split(/\r?\n/).map(parseCursorExtensionLine).filter((plugin) => plugin !== void 0);
+    const seen = /* @__PURE__ */ new Set();
+    return plugins.filter((plugin) => {
+      if (seen.has(plugin.id)) return false;
+      seen.add(plugin.id);
+      return true;
+    });
+  } catch (err) {
+    warnings.push(`cursor: could not list extensions via CLI: ${err.message}`);
+    return [];
+  }
+}
+async function capture4(ctx, _opts) {
+  const files = [];
+  const symlinks = [];
+  const secrets = [];
+  const warnings = [];
+  const manifest = emptyCursorManifest();
+  const p = paths3(ctx.toolHome);
+  const userPaths = cursorUserPaths(p.home, ctx.os, ctx.env);
+  const deny = denylistFor("cursor");
+  const hasToolHome = await ctx.fs.statKind(p.home) === "dir";
+  const hasUserDir = await ctx.fs.statKind(userPaths.userDir) === "dir";
+  if (!hasToolHome && !hasUserDir) {
+    warnings.push("cursor: no ~/.cursor or Cursor User data found; skipping (Cursor not installed?).");
+    return { tool: "cursor", files, symlinks, manifest, secrets, warnings };
+  }
+  if (hasToolHome) {
+    for (const rel of FROZEN_PATHS3) {
+      const abs = path11.join(p.home, rel);
+      if (rel === "skills") {
+        await captureSkills3(ctx, p.home, abs, deny, files, symlinks, manifest.skills, secrets, warnings);
+      } else {
+        await walkFrozen(ctx, p.home, abs, deny, repoPathFor3, files, symlinks, secrets, warnings);
       }
     }
-    const content = ctx.includeSecrets ? raw : ctx.sanitizer.sanitizeFile(raw, "cursor", relPosix).content;
-    const templated = ctx.templater.toTemplate(content, ctx.vars);
-    files.push({ repoPath: repoPathFor3(relPosix), content: templated });
-    ctx.log.debug(`cursor: froze ${relPosix}`);
+    manifest.plugins = await captureExtensions(ctx, p.home, warnings);
   }
-  if (files.length === 0) {
-    warnings.push("cursor: present but nothing portable to capture (no mcp.json).");
+  if (hasUserDir) {
+    const userItems = [userPaths.settingsJson, userPaths.keybindingsJson, userPaths.snippetsDir];
+    for (const abs of userItems) {
+      await walkFrozen(ctx, userPaths.userDir, abs, deny, userRepoPathFor, files, symlinks, secrets, warnings);
+    }
+  }
+  if (files.length === 0 && symlinks.length === 0 && manifest.plugins.length === 0) {
+    warnings.push("cursor: present but nothing portable to capture.");
   }
   return { tool: "cursor", files, symlinks, manifest, secrets, warnings };
 }
 async function writeRestoredFile(ctx, file) {
-  const rel = relFromRepoPath(file.repoPath);
-  if (rel === void 0) {
+  const target = targetFromRepoPath(file.repoPath);
+  if (target === void 0) {
     ctx.log.debug(`cursor: ignoring foreign repoPath ${file.repoPath}`);
     return;
   }
-  const dest = path11.join(ctx.toolHome, ...rel.split("/"));
+  const dest = targetAbsFor2(ctx, target);
   if (ctx.sourceOfTruth === "local" && await ctx.fs.exists(dest)) {
-    ctx.log.debug(`cursor: keep local ${rel} (sourceOfTruth=local)`);
+    ctx.log.debug(`cursor: keep local ${target.rel} (sourceOfTruth=local)`);
     return;
   }
   if (file.binary) {
@@ -2408,33 +2623,93 @@ async function writeRestoredFile(ctx, file) {
   const expanded = ctx.templater.fromTemplate(file.content, ctx.vars);
   await ctx.fs.write(dest, expanded, file.mode);
 }
-async function deploySharedRule(ctx) {
-  const sharedAbs = path11.join(ctx.repoRoot, ...SHARED_INSTRUCTIONS_REPO_PATH.split("/"));
-  if (!await ctx.fs.exists(sharedAbs)) {
-    ctx.log.debug("cursor: no shared/instructions.md to deploy as a Cursor rule.");
+async function writeRestoredSymlink(ctx, link) {
+  const target = targetFromRepoPath(link.repoPath);
+  if (target === void 0) {
+    ctx.log.debug(`cursor: ignoring foreign symlink ${link.repoPath}`);
     return;
   }
-  const body = await ctx.fs.read(sharedAbs);
-  const rule = `---
-description: Shared agent instructions (managed by arbella)
-alwaysApply: true
----
-
-${body}`;
-  const dest = sharedRulePath(ctx.toolHome);
-  await ctx.fs.write(dest, rule);
-  ctx.log.debug(`cursor: wrote shared-instructions rule -> ${dest}`);
+  const dest = targetAbsFor2(ctx, target);
+  if (ctx.sourceOfTruth === "local" && await ctx.fs.statKind(dest) !== "missing") {
+    ctx.log.debug(`cursor: keep local symlink ${target.rel} (sourceOfTruth=local)`);
+    return;
+  }
+  await ctx.fs.symlink(link.target, dest);
+}
+async function reinstallExtensions(ctx, plugins) {
+  const userPlugins = plugins.filter((plugin) => plugin.scope === "user");
+  if (userPlugins.length === 0) return;
+  const cursorBin = cliBinaryName("cursor");
+  if (!await which(cursorBin)) {
+    ctx.log.warn(
+      "cursor CLI not found; extension IDs were restored in manifest.json, but extensions were not installed."
+    );
+    return;
+  }
+  for (const plugin of userPlugins) {
+    try {
+      const result = await execa4(cursorBin, ["--install-extension", plugin.id], {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "pipe",
+        reject: false
+      });
+      if (result.exitCode === 0) {
+        ctx.log.step(`cursor: installed extension ${plugin.id}`);
+      } else {
+        const stderr = result.stderr.trim();
+        ctx.log.warn(
+          `cursor: failed to install extension ${plugin.id}${stderr ? ` (${stderr})` : ""}`
+        );
+      }
+    } catch (err) {
+      ctx.log.warn(`cursor: failed to install extension ${plugin.id}: ${err.message}`);
+    }
+  }
+}
+async function planActions3(ctx, data) {
+  const actions = [];
+  for (const file of data.files) {
+    const target = targetFromRepoPath(file.repoPath);
+    if (target === void 0) continue;
+    const targetPath = targetAbsFor2(ctx, target);
+    const overwrites = await ctx.fs.exists(targetPath);
+    if (ctx.sourceOfTruth === "local" && overwrites) continue;
+    actions.push({
+      type: "write-file",
+      tool: "cursor",
+      targetPath,
+      description: `Write ${target.root === "user" ? "User/" : ""}${target.rel}`,
+      overwrites
+    });
+  }
+  for (const link of data.symlinks) {
+    const target = targetFromRepoPath(link.repoPath);
+    if (target === void 0) continue;
+    const targetPath = targetAbsFor2(ctx, target);
+    const overwrites = await ctx.fs.statKind(targetPath) !== "missing";
+    if (ctx.sourceOfTruth === "local" && overwrites) continue;
+    actions.push({
+      type: "write-symlink",
+      tool: "cursor",
+      targetPath,
+      description: `Link ${target.root === "user" ? "User/" : ""}${target.rel} -> ${link.target}`,
+      overwrites
+    });
+  }
+  for (const plugin of data.manifest.plugins.filter((p) => p.scope === "user")) {
+    actions.push({
+      type: "install-plugin",
+      tool: "cursor",
+      description: `cursor --install-extension ${plugin.id}`
+    });
+  }
+  return actions;
 }
 async function restore4(ctx, data) {
   if (ctx.dryRun) {
-    for (const file of data.files) {
-      const rel = relFromRepoPath(file.repoPath);
-      if (rel) ctx.log.step(`cursor: would write ${path11.join(ctx.toolHome, ...rel.split("/"))}`);
-    }
-    const sharedAbs = path11.join(ctx.repoRoot, ...SHARED_INSTRUCTIONS_REPO_PATH.split("/"));
-    if (await ctx.fs.exists(sharedAbs)) {
-      ctx.log.step(`cursor: would write shared-instructions rule -> ${sharedRulePath(ctx.toolHome)}`);
-    }
+    const actions = await planActions3(ctx, data);
+    for (const action of actions) ctx.log.step(action.description);
     return;
   }
   for (const file of data.files) {
@@ -2444,18 +2719,22 @@ async function restore4(ctx, data) {
       ctx.log.warn(`cursor: failed to write ${file.repoPath}: ${err.message}`);
     }
   }
-  try {
-    await deploySharedRule(ctx);
-  } catch (err) {
-    ctx.log.warn(`cursor: failed to deploy shared-instructions rule: ${err.message}`);
+  for (const link of data.symlinks) {
+    try {
+      await writeRestoredSymlink(ctx, link);
+    } catch (err) {
+      ctx.log.warn(`cursor: failed to create symlink ${link.repoPath}: ${err.message}`);
+    }
   }
+  await reinstallExtensions(ctx, data.manifest.plugins);
 }
 async function detect2() {
-  return fsExistsDir(paths3().home);
+  const p = paths3();
+  return await fsExistsDir(p.home) || await fsExistsDir(cursorUserPaths(p.home, detectOS(), process3.env).userDir);
 }
 async function fsExistsDir(p) {
-  const { fs: fs3 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
-  return await fs3.statKind(p) === "dir";
+  const { fs: fs4 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
+  return await fs4.statKind(p) === "dir";
 }
 async function isCliInstalled3() {
   return which(cliBinaryName("cursor"));
@@ -2476,6 +2755,7 @@ var init_cursor = __esm({
     init_denylist();
     init_os();
     init_install();
+    init_symlink();
     init_paths3();
     cursorAdapter = {
       id: "cursor",
@@ -2497,8 +2777,39 @@ var init_cursor = __esm({
   }
 });
 
-// src/core/autobackup/hook.ts
+// src/core/version.ts
+import fs2 from "fs";
 import path12 from "path";
+import { fileURLToPath } from "url";
+function getPackageVersion() {
+  if (cachedVersion !== void 0) return cachedVersion;
+  const here = path12.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path12.join(here, "..", "package.json"),
+    path12.join(here, "..", "..", "package.json")
+  ];
+  for (const packagePath of candidates) {
+    try {
+      const parsed = JSON.parse(fs2.readFileSync(packagePath, "utf8"));
+      if (typeof parsed.version === "string" && parsed.version.trim() !== "") {
+        cachedVersion = parsed.version;
+        return cachedVersion;
+      }
+    } catch {
+    }
+  }
+  cachedVersion = "0.0.0";
+  return cachedVersion;
+}
+var cachedVersion;
+var init_version = __esm({
+  "src/core/version.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/autobackup/hook.ts
+import path13 from "path";
 function hookCommand() {
   if (detectOS() === "win32") {
     return `start /b "" arbella push --auto >NUL 2>&1 :: ${HOOK_TAG}`;
@@ -2548,7 +2859,7 @@ async function writeJsonObject(file, value) {
   await fs.write(file, JSON.stringify(value, null, 2) + "\n");
 }
 function claudeSettingsPath() {
-  return path12.join(toolHomeDir("claude"), "settings.json");
+  return path13.join(toolHomeDir("claude"), "settings.json");
 }
 async function applyClaude(enable) {
   const home4 = toolHomeDir("claude");
@@ -2573,7 +2884,7 @@ async function applyClaude(enable) {
   return true;
 }
 function codexHooksPath() {
-  return path12.join(toolHomeDir("codex"), "hooks.json");
+  return path13.join(toolHomeDir("codex"), "hooks.json");
 }
 async function applyCodex(enable) {
   const home4 = toolHomeDir("codex");
@@ -2619,7 +2930,7 @@ var init_hook = __esm({
 });
 
 // src/core/autobackup/throttle.ts
-import path13 from "path";
+import path14 from "path";
 async function readState() {
   if (!await fs.exists(STAMP_FILE)) {
     return { lastRunIso: null };
@@ -2662,7 +2973,7 @@ var init_throttle = __esm({
     "use strict";
     init_fs();
     init_os();
-    STAMP_FILE = path13.join(dataDir(), "autobackup.json");
+    STAMP_FILE = path14.join(dataDir(), "autobackup.json");
     MIN_SESSION_GAP_MS = 5 * 60 * 1e3;
     DAILY_GAP_MS = 24 * 60 * 60 * 1e3;
   }
@@ -2750,9 +3061,9 @@ var init_schema = __esm({
 });
 
 // src/core/config/index.ts
-import path14 from "path";
+import path15 from "path";
 function configPath() {
-  return path14.join(configDir(), "config.json");
+  return path15.join(configDir(), "config.json");
 }
 async function configExists() {
   return fs.exists(configPath());
@@ -2801,7 +3112,7 @@ function defaultConfig() {
 async function saveConfig(config) {
   const valid = arbellaConfigSchema.parse(config);
   const file = configPath();
-  await fs.ensureDir(path14.dirname(file));
+  await fs.ensureDir(path15.dirname(file));
   await fs.write(file, serializeConfig(valid));
 }
 function serializeConfig(value) {
@@ -2837,7 +3148,7 @@ var init_config = __esm({
 });
 
 // src/core/auth/cli.ts
-import { execa as execa4 } from "execa";
+import { execa as execa5 } from "execa";
 function cliForProvider(provider) {
   return CLI_BY_PROVIDER[provider];
 }
@@ -2856,7 +3167,7 @@ async function providerCliAuthStatus(provider, host) {
   let exitCode = 1;
   let combined = "";
   try {
-    const res = await execa4(cli.bin, args, {
+    const res = await execa5(cli.bin, args, {
       reject: false,
       // exit code is the signal; never throw on "not logged in".
       stdin: "ignore",
@@ -2899,7 +3210,7 @@ async function providerCliLogin(provider, opts = {}) {
   );
   log.step(`Running: ${cli.bin} ${args.join(" ")}`);
   try {
-    await execa4(cli.bin, args, {
+    await execa5(cli.bin, args, {
       // INHERITED stdio: the user interacts with gh/glab directly. This is the
       // whole point — arbella steps out of the way for the actual login.
       stdio: "inherit",
@@ -2942,7 +3253,7 @@ async function providerCliLogout(provider, host) {
   }
   log.step(`Running: ${cli.bin} ${args.join(" ")}`);
   try {
-    await execa4(cli.bin, args, { stdio: "inherit", timeout: 6e4 });
+    await execa5(cli.bin, args, { stdio: "inherit", timeout: 6e4 });
     log.success(`${cli.label}: signed out.`);
     return true;
   } catch (err) {
@@ -3194,7 +3505,7 @@ var init_device_flow = __esm({
 });
 
 // src/core/auth/providers.ts
-import process3 from "process";
+import process4 from "process";
 function isPlaceholderClientId(clientId) {
   return clientId.trim() === "" || clientId === PLACEHOLDER_CLIENT_ID;
 }
@@ -3240,7 +3551,7 @@ function resolveClientId(spec, overrides) {
   if (typeof override === "string" && override.trim() !== "") {
     return override.trim();
   }
-  const fromEnv = process3.env[spec.clientIdEnvVar];
+  const fromEnv = process4.env[spec.clientIdEnvVar];
   if (typeof fromEnv === "string" && fromEnv.trim() !== "") {
     return fromEnv.trim();
   }
@@ -3301,9 +3612,9 @@ var init_providers = __esm({
 
 // src/core/auth/store.ts
 import { promises as fsp3 } from "fs";
-import path15 from "path";
+import path16 from "path";
 function credentialsPath() {
-  return path15.join(dataDir(), "credentials.json");
+  return path16.join(dataDir(), "credentials.json");
 }
 async function loadFile() {
   const file = credentialsPath();
@@ -3358,7 +3669,7 @@ function normalizeCredential(host, value) {
 }
 async function saveFile(data) {
   const file = credentialsPath();
-  await fs.ensureDir(path15.dirname(file));
+  await fs.ensureDir(path16.dirname(file));
   const json = `${JSON.stringify(data, null, 2)}
 `;
   await fs.write(file, json, CREDENTIALS_MODE);
@@ -3832,13 +4143,13 @@ var init_auth = __esm({
 });
 
 // src/core/repo/git.ts
-import { execa as execa5 } from "execa";
+import { execa as execa6 } from "execa";
 async function git(cwd, args, opts = {}) {
   const reject = opts.reject ?? true;
   log.debug(`git ${args.map(redactArg).join(" ")} (cwd=${cwd})`);
   let res;
   try {
-    res = await execa5("git", args, {
+    res = await execa6("git", args, {
       cwd,
       reject,
       // Keep output as strings; do not inherit stdio so we can capture/redact.
@@ -3921,7 +4232,7 @@ async function hasUpstream(cwd, branch) {
 async function clone(url, dest) {
   log.debug(`git clone <url> -> ${dest}`);
   try {
-    await execa5("git", ["clone", url, dest], {
+    await execa6("git", ["clone", url, dest], {
       reject: true,
       stdout: "pipe",
       stderr: "pipe",
@@ -4024,10 +4335,10 @@ var init_generic = __esm({
 });
 
 // src/core/repo/providers/github.ts
-import { execa as execa6 } from "execa";
+import { execa as execa7 } from "execa";
 async function ghPresent() {
   try {
-    await execa6("gh", ["--version"], { reject: true, stdin: "ignore" });
+    await execa7("gh", ["--version"], { reject: true, stdin: "ignore" });
     return true;
   } catch {
     return false;
@@ -4036,7 +4347,7 @@ async function ghPresent() {
 async function gh(args) {
   log.debug(`gh ${args.join(" ")}`);
   try {
-    const res = await execa6("gh", args, {
+    const res = await execa7("gh", args, {
       reject: true,
       stdout: "pipe",
       stderr: "pipe",
@@ -4115,10 +4426,10 @@ var init_github = __esm({
 });
 
 // src/core/repo/providers/gitlab.ts
-import { execa as execa7 } from "execa";
+import { execa as execa8 } from "execa";
 async function glabPresent() {
   try {
-    await execa7("glab", ["--version"], { reject: true, stdin: "ignore" });
+    await execa8("glab", ["--version"], { reject: true, stdin: "ignore" });
     return true;
   } catch {
     return false;
@@ -4127,7 +4438,7 @@ async function glabPresent() {
 async function glab(args) {
   log.debug(`glab ${args.join(" ")}`);
   try {
-    const res = await execa7("glab", args, {
+    const res = await execa8("glab", args, {
       reject: true,
       stdout: "pipe",
       stderr: "pipe",
@@ -4206,7 +4517,7 @@ var init_gitlab = __esm({
 });
 
 // src/core/repo/index.ts
-import path16 from "path";
+import path17 from "path";
 async function withRepoAuth(repoUrl, hooks, op) {
   try {
     await op(repoUrl, false);
@@ -4281,7 +4592,7 @@ async function ensureLocalClone(repo, auth) {
       "repo.url is not configured; cannot clone. Run `arbella init` first."
     );
   }
-  await fs.ensureDir(path16.dirname(localPath));
+  await fs.ensureDir(path17.dirname(localPath));
   log.step(`Cloning backup repo into ${localPath}`);
   await withRepoAuth(repo.url, auth, async (url, credentialed) => {
     await clone(url, localPath);
@@ -4433,13 +4744,11 @@ function createSanitizer() {
   }
   function sanitizeFile(content, tool, source) {
     if (looksLikeJsonSource(source)) {
-      let parsed;
-      try {
-        parsed = JSON.parse(content);
-      } catch {
+      const parsed = parseJsonOrJsonc(content);
+      if (!parsed.ok) {
         return sanitizeText(content, tool, source);
       }
-      const { value, found } = sanitizeJson(parsed, tool, source);
+      const { value, found } = sanitizeJson(parsed.value, tool, source);
       const indent = detectJsonIndent(content);
       const serialized = JSON.stringify(value, null, indent);
       return { content: serialized, found, changed: serialized !== content };
@@ -4452,6 +4761,92 @@ function looksLikeJsonSource(source) {
   const base = source.replace(/\\/g, "/").split("/").pop() ?? source;
   return /\.json$/i.test(base);
 }
+function parseJsonOrJsonc(content) {
+  try {
+    return { ok: true, value: JSON.parse(content) };
+  } catch {
+  }
+  try {
+    return { ok: true, value: JSON.parse(stripJsonc(content)) };
+  } catch {
+    return { ok: false };
+  }
+}
+function stripJsonc(content) {
+  return removeTrailingCommas(removeJsonComments(content));
+}
+function removeJsonComments(content) {
+  let out2 = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < content.length; i++) {
+    const ch = content[i];
+    const next = content[i + 1];
+    if (inString) {
+      out2 += ch;
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out2 += ch;
+      continue;
+    }
+    if (ch === "/" && next === "/") {
+      while (i < content.length && content[i] !== "\n") i++;
+      if (i < content.length) out2 += "\n";
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < content.length && !(content[i] === "*" && content[i + 1] === "/")) {
+        if (content[i] === "\n") out2 += "\n";
+        i++;
+      }
+      i++;
+      continue;
+    }
+    out2 += ch;
+  }
+  return out2;
+}
+function removeTrailingCommas(content) {
+  let out2 = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < content.length; i++) {
+    const ch = content[i];
+    if (inString) {
+      out2 += ch;
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out2 += ch;
+      continue;
+    }
+    if (ch === ",") {
+      let j = i + 1;
+      while (j < content.length && /\s/.test(content[j])) j++;
+      if (content[j] === "}" || content[j] === "]") continue;
+    }
+    out2 += ch;
+  }
+  return out2;
+}
 function detectJsonIndent(content) {
   const m = /\n([ \t]+)\S/.exec(content);
   if (!m) return 2;
@@ -4674,6 +5069,7 @@ var init_templater = __esm({
 
 // src/commands/_context.ts
 import { confirm, isCancel, password } from "@clack/prompts";
+import process5 from "process";
 function buildRepoAuthHooks(args) {
   return {
     interactive: args.interactive ?? true,
@@ -5134,7 +5530,7 @@ function shouldShareInstructions(claudeMd, agentsMd) {
 }
 function buildSharedInstructionsFile(content) {
   return {
-    repoPath: SHARED_INSTRUCTIONS_REPO_PATH2,
+    repoPath: SHARED_INSTRUCTIONS_REPO_PATH,
     content
   };
 }
@@ -5144,12 +5540,12 @@ function sharedInstructionsTargets() {
     { tool: "codex", relPath: "AGENTS.md" }
   ];
 }
-var SHARED_INSTRUCTIONS_REPO_PATH2;
+var SHARED_INSTRUCTIONS_REPO_PATH;
 var init_manifest = __esm({
   "src/core/manifest/index.ts"() {
     "use strict";
     init_schema2();
-    SHARED_INSTRUCTIONS_REPO_PATH2 = "shared/instructions.md";
+    SHARED_INSTRUCTIONS_REPO_PATH = "shared/instructions.md";
   }
 });
 
@@ -5159,7 +5555,8 @@ __export(backup_exports, {
   register: () => register2,
   run: () => run2
 });
-import path17 from "path";
+import path18 from "path";
+import process6 from "process";
 function register2(program) {
   const configure = (cmd) => cmd.description(
     "Push your AI dev setup to your private repo (snapshot local changes, then commit + push)."
@@ -5190,7 +5587,8 @@ function buildCoreServices(toolHome) {
     sanitizer,
     templater,
     vars: buildVariables(toolHome),
-    os: detectOS()
+    os: detectOS(),
+    env: process6.env
   };
 }
 function buildCaptureContext(tool, config, dryRun) {
@@ -5275,9 +5673,9 @@ async function run2(opts = {}) {
   if (sharedContent !== void 0) {
     const shared = buildSharedInstructionsFile(sharedContent);
     await writeCapturedFile2(repoRoot, shared);
-    log.step(`Wrote ${SHARED_INSTRUCTIONS_REPO_PATH2} (shared CLAUDE.md == AGENTS.md)`);
+    log.step(`Wrote ${SHARED_INSTRUCTIONS_REPO_PATH} (shared CLAUDE.md == AGENTS.md)`);
   } else {
-    await fs.rmrf(repoJoin(repoRoot, SHARED_INSTRUCTIONS_REPO_PATH2));
+    await fs.rmrf(repoJoin(repoRoot, SHARED_INSTRUCTIONS_REPO_PATH));
   }
   const meta = buildArbellaMeta({
     arbellaVersion: ARBELLA_VERSION,
@@ -5309,8 +5707,8 @@ async function decideSharedInstructions(present) {
   if (!present.includes("claude") || !present.includes("codex")) {
     return { share: false };
   }
-  const claudeMd = await readIfExists(path17.join(toolHomeDir("claude"), "CLAUDE.md"));
-  const agentsMd = await readIfExists(path17.join(toolHomeDir("codex"), "AGENTS.md"));
+  const claudeMd = await readIfExists(path18.join(toolHomeDir("claude"), "CLAUDE.md"));
+  const agentsMd = await readIfExists(path18.join(toolHomeDir("codex"), "AGENTS.md"));
   if (shouldShareInstructions(claudeMd, agentsMd)) {
     return { share: true, content: claudeMd };
   }
@@ -5320,8 +5718,9 @@ function toolFilesPrefix(tool) {
   return `${tool}/files`;
 }
 async function replaceToolFiles(repoRoot, result) {
-  const filesDir = repoJoin(repoRoot, toolFilesPrefix(result.tool));
-  await fs.rmrf(filesDir);
+  for (const root of toolRepoDataRoots(result.tool)) {
+    await fs.rmrf(repoJoin(repoRoot, root));
+  }
   for (const file of result.files) {
     await writeCapturedFile2(repoRoot, file);
   }
@@ -5332,6 +5731,11 @@ async function replaceToolFiles(repoRoot, result) {
   const manifestPath = repoJoin(repoRoot, `${result.tool}/manifest.json`);
   await fs.write(manifestPath, serialize(result.manifest));
 }
+function toolRepoDataRoots(tool) {
+  const roots = [toolFilesPrefix(tool)];
+  if (tool === "cursor") roots.push("cursor/user");
+  return roots;
+}
 async function writeCapturedFile2(repoRoot, file) {
   const dest = repoJoin(repoRoot, file.repoPath);
   if (file.binary === true) {
@@ -5343,7 +5747,7 @@ async function writeCapturedFile2(repoRoot, file) {
 }
 function repoJoin(repoRoot, repoPath) {
   const segments = repoPath.split("/").filter((s) => s.length > 0);
-  return path17.join(repoRoot, ...segments);
+  return path18.join(repoRoot, ...segments);
 }
 function toolLabel(tool) {
   switch (tool) {
@@ -5357,7 +5761,8 @@ function toolLabel(tool) {
 }
 function renderRepoReadme(meta, generatedAtIso) {
   const toolList = meta.tools.map((t) => `- ${toolLabel(t)} (\`${t}\`)`).join("\n");
-  const sharedLine = meta.sharedInstructions ? "Your `CLAUDE.md` and `AGENTS.md` were identical and are stored once in [`shared/instructions.md`](shared/instructions.md); restore deploys it to both tools.\n" : "";
+  const cursorUserLine = meta.tools.includes("cursor") ? "- `cursor/user/\u2026` \u2014 Cursor application User data such as settings,\n  keybindings, and snippets.\n" : "";
+  const sharedLine = meta.sharedInstructions ? "Your `CLAUDE.md` and `AGENTS.md` were identical and are stored once in [`shared/instructions.md`](shared/instructions.md); restore deploys it to Claude Code and Codex.\n" : "";
   return `# arbella backup
 
 This is a **private** backup of an AI coding setup, produced by
@@ -5377,6 +5782,7 @@ Each tool lives under \`<tool>/\`:
 
 - \`<tool>/files/\u2026\` \u2014 frozen config files (paths replaced with \`{{HOME}}\`-style
   placeholders, secret values redacted).
+${cursorUserLine}
 - \`<tool>/manifest.json\` \u2014 what to reinstall (plugins, marketplaces, skills,
   npm globals) and which plugins to re-enable.
 
@@ -5391,7 +5797,7 @@ npm install -g arbella
 arbella pull <this-repo-url>
 \`\`\`
 
-arbella will (R6/R14) take a timestamped safety copy of any existing tool homes,
+arbella will (R6/R14) take a timestamped safety copy of any existing restore targets,
 auto-install missing CLIs, write the frozen files back (re-expanding placeholders
 to this machine's paths), reinstall plugins/marketplaces/skills, and re-enable
 plugins.
@@ -5446,15 +5852,17 @@ function renderRepoGitignore(tools) {
     "*.key"
   ];
   for (const name of secretBasenames) lines.push(name);
-  lines.push("", "# Per-tool excluded directories (scoped under <tool>/files/)");
+  lines.push("", "# Per-tool excluded directories (scoped under owned data roots)");
   const seen = /* @__PURE__ */ new Set();
   for (const tool of tools) {
     for (const pattern of denylistFor(tool)) {
       if (!pattern.endsWith("/")) continue;
-      const scoped = `${tool}/files/${pattern}`;
-      if (seen.has(scoped)) continue;
-      seen.add(scoped);
-      lines.push(scoped);
+      for (const root of toolRepoDataRoots(tool)) {
+        const scoped = `${root}/${pattern}`;
+        if (seen.has(scoped)) continue;
+        seen.add(scoped);
+        lines.push(scoped);
+      }
     }
   }
   return lines.join("\n") + "\n";
@@ -5475,7 +5883,7 @@ function reportDryRun(results, sharing, config) {
     );
   }
   if (sharing) {
-    log.step(`+ ${SHARED_INSTRUCTIONS_REPO_PATH2} (shared CLAUDE.md == AGENTS.md)`);
+    log.step(`+ ${SHARED_INSTRUCTIONS_REPO_PATH} (shared CLAUDE.md == AGENTS.md)`);
   }
   log.step("+ arbella.json, README.md, .gitignore");
   reportSecrets(results.flatMap((r) => r.secrets), config.includeSecrets);
@@ -5575,15 +5983,16 @@ var init_backup = __esm({
     init_capture();
     init_capture2();
     init_cursor();
-    ARBELLA_VERSION = "0.1.0";
+    init_version();
+    ARBELLA_VERSION = getPackageVersion();
   }
 });
 
 // src/index.ts
 init_log();
-import fs2 from "fs";
-import path23 from "path";
-import { fileURLToPath } from "url";
+import fs3 from "fs";
+import path24 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 import pc2 from "picocolors";
 
@@ -5604,8 +6013,11 @@ function listAdapters() {
   return ALL_ADAPTERS.map((a) => ({ id: a.id, displayName: a.displayName }));
 }
 
+// src/index.ts
+init_version();
+
 // src/commands/init.ts
-import path18 from "path";
+import path19 from "path";
 import {
   cancel as cancel2,
   confirm as confirm3,
@@ -6023,7 +6435,7 @@ async function ensureProviderSignedIn(provider, yes) {
   }
 }
 function defaultLocalPath() {
-  return path18.join(dataDir(), "repo");
+  return path19.join(dataDir(), "repo");
 }
 function displayName(id) {
   switch (id) {
@@ -6239,7 +6651,8 @@ function resolveProviderSpec(raw) {
 init_backup();
 
 // src/commands/restore.ts
-import path19 from "path";
+import path20 from "path";
+import process7 from "process";
 init_fs();
 init_log();
 init_os();
@@ -6256,12 +6669,13 @@ init_manifest();
 init_claude();
 init_codex();
 init_cursor();
+init_paths3();
 init_restore();
 init_restore2();
 var WIRING = [
   { id: "claude", adapter: claudeAdapter, planActions },
   { id: "codex", adapter: codexAdapter, planActions: planActions2 },
-  { id: "cursor", adapter: cursorAdapter }
+  { id: "cursor", adapter: cursorAdapter, planActions: planActions3 }
 ];
 function wiringFor(id) {
   const w = WIRING.find((entry) => entry.id === id);
@@ -6275,12 +6689,13 @@ function buildCoreServices2(toolHome, os2) {
     sanitizer: createSanitizer(),
     templater: createTemplater(),
     vars: buildVariables(toolHome),
-    os: os2
+    os: os2,
+    env: process7.env
   };
 }
 function buildRestoreContext(args) {
   const toolHome = toolHomeDir(args.toolId);
-  const repoToolDir = path19.join(args.repoRoot, args.toolId);
+  const repoToolDir = path20.join(args.repoRoot, args.toolId);
   return {
     ...buildCoreServices2(toolHome, args.os),
     toolHome,
@@ -6298,20 +6713,17 @@ function looksBinary3(buf) {
   return false;
 }
 async function readToolFrozen(repoToolDir, tool) {
-  const filesRoot = path19.join(repoToolDir, "files");
   const files = [];
   const symlinks = [];
-  if (await fs.statKind(filesRoot) !== "dir") {
-    return { files, symlinks };
-  }
-  async function walk2(absDir, relParts) {
+  const roots = frozenRootsForTool(repoToolDir, tool);
+  async function walk2(absDir, relParts, repoPrefix) {
     const entries = await fs.list(absDir);
     entries.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     for (const name of entries) {
-      const abs = path19.join(absDir, name);
+      const abs = path20.join(absDir, name);
       const nextRel = [...relParts, name];
       const relPosix = nextRel.join("/");
-      const repoPath = `${tool}/files/${relPosix}`;
+      const repoPath = `${repoPrefix}/${relPosix}`;
       const kind = await fs.statKind(abs);
       if (kind === "symlink") {
         let target;
@@ -6327,7 +6739,7 @@ async function readToolFrozen(repoToolDir, tool) {
         continue;
       }
       if (kind === "dir") {
-        await walk2(abs, nextRel);
+        await walk2(abs, nextRel, repoPrefix);
         continue;
       }
       if (kind !== "file") continue;
@@ -6355,11 +6767,23 @@ async function readToolFrozen(repoToolDir, tool) {
       }
     }
   }
-  await walk2(filesRoot, []);
+  for (const root of roots) {
+    if (await fs.statKind(root.absRoot) !== "dir") continue;
+    await walk2(root.absRoot, [], root.repoPrefix);
+  }
   return { files, symlinks };
 }
+function frozenRootsForTool(repoToolDir, tool) {
+  const roots = [
+    { absRoot: path20.join(repoToolDir, "files"), repoPrefix: `${tool}/files` }
+  ];
+  if (tool === "cursor") {
+    roots.push({ absRoot: path20.join(repoToolDir, "user"), repoPrefix: "cursor/user" });
+  }
+  return roots;
+}
 async function readToolManifest(repoToolDir, tool) {
-  const manifestPath = path19.join(repoToolDir, "manifest.json");
+  const manifestPath = path20.join(repoToolDir, "manifest.json");
   if (!await fs.exists(manifestPath)) {
     log.debug(`restore: no manifest.json for ${tool}; using empty manifest.`);
     return emptyManifest(tool);
@@ -6376,7 +6800,7 @@ async function readToolManifest(repoToolDir, tool) {
   return parseManifest(json);
 }
 async function loadRestoreData(repoRoot, tool) {
-  const repoToolDir = path19.join(repoRoot, tool);
+  const repoToolDir = path20.join(repoRoot, tool);
   const manifest = await readToolManifest(repoToolDir, tool);
   const { files, symlinks } = await readToolFrozen(repoToolDir, tool);
   return { manifest, files, symlinks };
@@ -6389,49 +6813,65 @@ function parseToolsFlag(raw) {
   );
   return ids;
 }
-function selectTools(meta, flagTools, configTools) {
+function selectToolsForRestore(meta, flagTools, _configTools) {
   const captured = new Set(meta.tools);
   let candidate;
   if (flagTools && flagTools.length > 0) {
     candidate = new Set(flagTools);
-  } else if (configTools.length > 0) {
-    candidate = new Set(configTools);
   } else {
     candidate = new Set(captured);
   }
   return TOOL_IDS.filter((id) => captured.has(id) && candidate.has(id));
 }
-async function safetyBackup(tools, iso) {
+async function safetyBackup(tools, iso, os2) {
   const stamp = iso.replace(/[:.]/g, "-");
-  const backupsRoot = path19.join(dataDir(), "safety-backups");
   const made = [];
   for (const tool of tools) {
-    const source = toolHomeDir(tool);
-    if (!await fs.exists(source)) {
-      log.debug(`restore: no existing ${tool} home to back up (${source}).`);
-      continue;
-    }
-    const dest = path19.join(backupsRoot, `${tool}-${stamp}`);
-    try {
-      await fs.copy(source, dest);
-      made.push({ tool, source, dest });
-      log.step(`Safety backup: ${source} -> ${dest}`);
-    } catch (err) {
-      log.warn(
-        `restore: failed to safety-backup ${tool} (${source}): ${errMsg(err)}`
-      );
+    for (const entry of safetySourcesForTool(tool, os2, stamp)) {
+      if (!await fs.exists(entry.source)) {
+        log.debug(`restore: no existing ${entry.label} to back up (${entry.source}).`);
+        continue;
+      }
+      try {
+        await fs.copy(entry.source, entry.dest);
+        made.push({ tool, source: entry.source, dest: entry.dest });
+        log.step(`Safety backup: ${entry.source} -> ${entry.dest}`);
+      } catch (err) {
+        log.warn(
+          `restore: failed to safety-backup ${entry.label} (${entry.source}): ${errMsg(err)}`
+        );
+      }
     }
   }
   return made;
 }
+function safetySourcesForTool(tool, os2, stamp) {
+  const backupsRoot = path20.join(dataDir(), "safety-backups");
+  const toolHome = toolHomeDir(tool);
+  const sources = [
+    {
+      label: `${tool} home`,
+      source: toolHome,
+      dest: path20.join(backupsRoot, `${tool}-${stamp}`)
+    }
+  ];
+  if (tool === "cursor") {
+    sources.push({
+      label: "cursor User data",
+      source: cursorUserPaths(toolHome, os2, process7.env).userDir,
+      dest: path20.join(backupsRoot, `cursor-user-${stamp}`)
+    });
+  }
+  return sources;
+}
 async function deploySharedInstructions(repoRoot, toolsInScope, dryRun) {
-  const sharedAbs = path19.join(
+  const sharedAbs = path20.join(
     repoRoot,
-    ...SHARED_INSTRUCTIONS_REPO_PATH2.split("/")
+    ...SHARED_INSTRUCTIONS_REPO_PATH.split("/")
   );
   if (!await fs.exists(sharedAbs)) {
     log.warn(
-      `restore: meta.sharedInstructions is set but ${SHARED_INSTRUCTIONS_REPO_PATH2} is missing from the repo; skipping shared-instructions deployment.`
+      `restore: meta.sharedInstructions is set but ${SHARED_INSTRUCTIONS_REPO_PATH} is missing from the repo; skipping shared-instructions deployment.`
     );
     return;
   }
@@ -6439,7 +6879,7 @@ async function deploySharedInstructions(repoRoot, toolsInScope, dryRun) {
   const content = await fs.read(sharedAbs);
   for (const target of sharedInstructionsTargets()) {
     if (!inScope.has(target.tool)) continue;
-    const dest = path19.join(toolHomeDir(target.tool), target.relPath);
+    const dest = path20.join(toolHomeDir(target.tool), target.relPath);
     if (dryRun) {
       log.step(`Would deploy shared instructions -> ${dest}`);
       continue;
@@ -6496,7 +6936,7 @@ async function fallbackActions(ctx, tool, data) {
   const out2 = [];
   for (const file of data.files) {
     const rel = stripFilesPrefix(tool, file.repoPath);
-    const dest = path19.join(ctx.toolHome, ...rel.split("/"));
+    const dest = path20.join(ctx.toolHome, ...rel.split("/"));
     const overwrites = await ctx.fs.exists(dest);
     if (ctx.sourceOfTruth === "local" && overwrites) continue;
     out2.push({
@@ -6509,7 +6949,7 @@ async function fallbackActions(ctx, tool, data) {
   }
   for (const link of data.symlinks) {
     const rel = stripFilesPrefix(tool, link.repoPath);
-    const dest = path19.join(ctx.toolHome, ...rel.split("/"));
+    const dest = path20.join(ctx.toolHome, ...rel.split("/"));
     const overwrites = await ctx.fs.statKind(dest) !== "missing";
     if (ctx.sourceOfTruth === "local" && overwrites) continue;
     out2.push({
@@ -6564,7 +7004,7 @@ function printPlan(plan, meta, l = log) {
     `Tools: ${plan.tools.length > 0 ? plan.tools.join(", ") : "(none)"}`
   );
   l.step(
-    `A timestamped safety backup of existing tool homes WILL be taken first (R14).`
+    `A timestamped safety backup of existing restore targets WILL be taken first (R14).`
   );
   if (plan.missingClis.length > 0) {
     l.step(`CLIs to auto-install: ${plan.missingClis.join(", ")}`);
@@ -6631,7 +7071,7 @@ async function resolveRepo(repoUrl, optRepo) {
   if (explicit && explicit.trim() !== "") {
     const url = explicit.trim();
     const sameAsConfig = config.repo.url.trim() !== "" && config.repo.url.trim() === url;
-    const localPath2 = sameAsConfig && config.repo.localPath ? config.repo.localPath : path19.join(dataDir(), "restore", slugForUrl(url));
+    const localPath2 = sameAsConfig && config.repo.localPath ? config.repo.localPath : path20.join(dataDir(), "restore", slugForUrl(url));
     return { provider: config.repo.provider, url, localPath: localPath2 };
   }
   if (!config.repo.url || config.repo.url.trim() === "") {
@@ -6639,7 +7079,7 @@ async function resolveRepo(repoUrl, optRepo) {
       "No repo to pull from. Pass a repo URL (`arbella pull <repo-url>`) or run `arbella init` first."
     );
   }
-  const localPath = config.repo.localPath && config.repo.localPath.trim() !== "" ? config.repo.localPath : path19.join(dataDir(), "restore", slugForUrl(config.repo.url));
+  const localPath = config.repo.localPath && config.repo.localPath.trim() !== "" ? config.repo.localPath : path20.join(dataDir(), "restore", slugForUrl(config.repo.url));
   return { provider: config.repo.provider, url: config.repo.url, localPath };
 }
 function slugForUrl(url) {
@@ -6676,7 +7116,7 @@ async function run4(repoUrl, opts) {
   });
   await ensureRepoReady(repo, authHooks);
   const repoRoot = repo.localPath;
-  const metaPath = path19.join(repoRoot, "arbella.json");
+  const metaPath = path20.join(repoRoot, "arbella.json");
   if (!await fs.exists(metaPath)) {
     throw new Error(
       `Not a arbella backup repo: ${metaPath} is missing. Did you point restore at the right repository?`
@@ -6692,7 +7132,7 @@ async function run4(repoUrl, opts) {
   }
   const config = await loadConfigOrDefault();
   const flagTools = parseToolsFlag(opts.tools);
-  const tools = selectTools(meta, flagTools, config.tools);
+  const tools = selectToolsForRestore(meta, flagTools, config.tools);
   if (tools.length === 0) {
     log.warn(
       `No tools to restore (the repo + your selection have no overlap). Repo captured: ${meta.tools.join(", ") || "(none)"}.`
@@ -6716,7 +7156,7 @@ async function run4(repoUrl, opts) {
   }
   const iso = (/* @__PURE__ */ new Date()).toISOString();
   log.info("Creating safety backups of existing tool homes (R14)\u2026");
-  const backups = await safetyBackup(tools, iso);
+  const backups = await safetyBackup(tools, iso, os2);
   if (backups.length === 0) {
     log.debug("restore: no existing tool homes needed backing up.");
   }
@@ -6756,7 +7196,7 @@ async function run4(repoUrl, opts) {
   printReauthReminder(tools);
   if (backups.length > 0) {
     log.info(
-      `Previous tool homes were safely backed up under ${path19.join(
+      `Previous tool homes were safely backed up under ${path20.join(
         dataDir(),
         "safety-backups"
       )} (restore them manually if anything looks wrong).`
@@ -6816,7 +7256,8 @@ init_cursor();
 init_capture();
 init_capture2();
 init_cursor();
-import path20 from "path";
+import path21 from "path";
+import process8 from "process";
 var ADAPTERS = {
   claude: { adapter: claudeAdapter, capture },
   codex: { adapter: codexAdapter, capture: capture2 },
@@ -6834,8 +7275,8 @@ async function run5(opts) {
   await ensureLocalClone(config.repo);
   const repoRoot = config.repo.localPath;
   const repoInitialized = await isRepoInitialized(repoRoot);
-  const claudeMd = await readIfExists2(path20.join(toolHomeDir("claude"), "CLAUDE.md"));
-  const agentsMd = await readIfExists2(path20.join(toolHomeDir("codex"), "AGENTS.md"));
+  const claudeMd = await readIfExists2(path21.join(toolHomeDir("claude"), "CLAUDE.md"));
+  const agentsMd = await readIfExists2(path21.join(toolHomeDir("codex"), "AGENTS.md"));
   const sharing = shouldShareInstructions(claudeMd, agentsMd);
   const toolStatuses = [];
   for (const tool of config.tools) {
@@ -6897,8 +7338,8 @@ async function run5(opts) {
     const change = await classifyFile(repoRoot, file);
     if (change.kind !== "unchanged") sharedChanges.push(change);
   } else {
-    if (await committedFileExists(repoRoot, SHARED_INSTRUCTIONS_REPO_PATH2)) {
-      sharedChanges.push({ repoPath: SHARED_INSTRUCTIONS_REPO_PATH2, kind: "removed" });
+    if (await committedFileExists(repoRoot, SHARED_INSTRUCTIONS_REPO_PATH)) {
+      sharedChanges.push({ repoPath: SHARED_INSTRUCTIONS_REPO_PATH, kind: "removed" });
     }
   }
   const clean = sharedChanges.length === 0 && toolStatuses.every(
@@ -6914,7 +7355,7 @@ async function run5(opts) {
     clean
   };
   if (opts.json) {
-    process.stdout.write(serialize(report));
+    process8.stdout.write(serialize(report));
     return;
   }
   printHuman(report);
@@ -6928,6 +7369,7 @@ function buildCaptureContext2(tool, includeSecrets, includeMemories) {
     templater,
     vars: buildVariables(toolHome),
     os: detectOS(),
+    env: process8.env,
     toolHome,
     includeSecrets,
     includeMemories,
@@ -7133,7 +7575,7 @@ async function walkRepoFiles(baseAbs, basePosix) {
   const entries = await fs.list(baseAbs);
   for (const name of entries) {
     if (name === ".git") continue;
-    const childAbs = path20.join(baseAbs, name);
+    const childAbs = path21.join(baseAbs, name);
     const childPosix = `${basePosix}/${name}`;
     const kind = await fs.statKind(childAbs);
     if (kind === "symlink") {
@@ -7147,7 +7589,7 @@ async function walkRepoFiles(baseAbs, basePosix) {
   return out2;
 }
 function repoAbsPath(repoRoot, repoPath) {
-  return path20.join(repoRoot, ...repoPath.split("/"));
+  return path21.join(repoRoot, ...repoPath.split("/"));
 }
 async function committedFileExists(repoRoot, repoPath) {
   const kind = await fs.statKind(repoAbsPath(repoRoot, repoPath));
@@ -7257,8 +7699,37 @@ function renderChangeLine(c) {
   return `${sigil} ${c.repoPath}${linkTag}`;
 }
 
+// src/commands/update.ts
+init_version();
+init_install();
+init_log();
+function normalizeVersion(version) {
+  const trimmed = version?.trim();
+  if (!trimmed) return "latest";
+  if (trimmed.startsWith("arbella@")) return trimmed.slice("arbella@".length);
+  return trimmed.replace(/^v(?=\d)/, "");
+}
+function packageSpec(version) {
+  return `arbella@${normalizeVersion(version)}`;
+}
+function register7(program) {
+  program.command("update").description("Update arbella itself through npm").option("--version <version>", "install a specific arbella version or npm tag instead of latest").option("--dry-run", "show the npm command without running it").action(async (opts) => {
+    await run6(opts);
+  });
+}
+async function run6(opts = {}) {
+  const spec = packageSpec(opts.version);
+  if (opts.dryRun) {
+    log.info(`Would run: npm install -g ${spec}`);
+    return;
+  }
+  log.info(`Updating arbella ${getPackageVersion()} -> ${spec}`);
+  await npmInstallGlobal(spec);
+  log.success(`arbella updated (${spec}).`);
+}
+
 // src/commands/secrets.ts
-import path22 from "path";
+import path23 from "path";
 import * as clack2 from "@clack/prompts";
 
 // src/core/secrets/index.ts
@@ -7271,7 +7742,7 @@ import {
   scryptSync
 } from "crypto";
 import { promises as fsp4 } from "fs";
-import path21 from "path";
+import path22 from "path";
 var SCRYPT_PARAMS = {
   N: 1 << 15,
   // 32768
@@ -7366,7 +7837,7 @@ async function gatherSecretRefs(toolId) {
   const refs = [];
   const home4 = toolHomeDir(toolId);
   for (const spec of SECRET_FILES_BY_TOOL[toolId]) {
-    const abs = path21.join(home4, spec.relPath);
+    const abs = path22.join(home4, spec.relPath);
     if (await fs.exists(abs)) {
       refs.push({
         tool: toolId,
@@ -7388,10 +7859,10 @@ async function collectSecretFiles(refs, createdAt) {
     const dedupeKey = `${ref.tool}:${relPath}`;
     if (seen.has(dedupeKey)) continue;
     seen.add(dedupeKey);
-    const abs = path21.join(toolHomeDir(ref.tool), relPath);
+    const abs = path22.join(toolHomeDir(ref.tool), relPath);
     if (!await fs.exists(abs)) continue;
     const bytes = await fs.readBytes(abs);
-    const mode = await readMode(abs);
+    const mode = await readMode2(abs);
     entries.push({
       tool: ref.tool,
       relPath,
@@ -7405,9 +7876,9 @@ async function applySecretBundle(bundle) {
   for (const entry of bundle.entries) {
     const home4 = toolHomeDir(entry.tool);
     const rel = entry.relPath.replace(/\\/g, "/");
-    const dest = path21.resolve(home4, rel);
-    const homeResolved = path21.resolve(home4);
-    const withinHome = dest === homeResolved || dest.startsWith(homeResolved + path21.sep);
+    const dest = path22.resolve(home4, rel);
+    const homeResolved = path22.resolve(home4);
+    const withinHome = dest === homeResolved || dest.startsWith(homeResolved + path22.sep);
     if (!withinHome) {
       throw new Error(
         `Refusing to write secret outside ${entry.tool} home (suspicious path: ${rel}).`
@@ -7418,7 +7889,7 @@ async function applySecretBundle(bundle) {
     await fs.writeBytes(dest, bytes, mode);
   }
 }
-async function readMode(abs) {
+async function readMode2(abs) {
   try {
     const st = await fsp4.lstat(abs);
     const m = st.mode & 4095;
@@ -7470,7 +7941,7 @@ function assertBundle(value) {
 init_fs();
 init_log();
 var DEFAULT_BLOB_FILE = "arbella-secrets.blob";
-function register7(program) {
+function register8(program) {
   const secrets = program.command("secrets").description(
     "Move secret files (auth tokens / credentials) between machines via an encrypted, passphrase-protected blob. Never uses git."
   );
@@ -7523,7 +7994,7 @@ async function runExport(opts) {
     return;
   }
   const blob = encryptBundle(bundle, passphrase);
-  const outPath = path22.resolve(opts.out);
+  const outPath = path23.resolve(opts.out);
   await fs.write(outPath, blob + "\n", 384);
   clack2.note(
     [
@@ -7532,7 +8003,7 @@ async function runExport(opts) {
       "",
       "This blob is safe to copy between machines (it is encrypted with your",
       "passphrase). It NEVER goes through git. On the target machine run:",
-      `  arbella secrets import --in ${path22.basename(outPath)}`,
+      `  arbella secrets import --in ${path23.basename(outPath)}`,
       "",
       "Keep your passphrase safe: without it the blob cannot be decrypted."
     ].join("\n"),
@@ -7542,7 +8013,7 @@ async function runExport(opts) {
 }
 async function runImport(opts) {
   clack2.intro("arbella secrets import");
-  const inPath = path22.resolve(opts.in);
+  const inPath = path23.resolve(opts.in);
   if (!await fs.exists(inPath)) {
     clack2.cancel(
       `No blob found at:
@@ -7644,7 +8115,7 @@ function errMessage7(err) {
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
+var VERSION = getPackageVersion();
 function buildProgram() {
   const program = new Command();
   const supported = listAdapters().map((a) => a.displayName).join(", ");
@@ -7664,6 +8135,7 @@ Supported tools: ${supported}.`
   register5(program);
   register6(program);
   register7(program);
+  register8(program);
   return program;
 }
 async function main(argv = process.argv) {
@@ -7673,11 +8145,11 @@ async function main(argv = process.argv) {
 function isDirectRun() {
   const entry = process.argv[1];
   if (!entry) return false;
-  const modulePath = fileURLToPath(import.meta.url);
+  const modulePath = fileURLToPath2(import.meta.url);
   try {
-    return fs2.realpathSync(entry) === fs2.realpathSync(modulePath);
+    return fs3.realpathSync(entry) === fs3.realpathSync(modulePath);
   } catch {
-    return path23.resolve(entry) === modulePath;
+    return path24.resolve(entry) === modulePath;
   }
 }
 function handleTopLevelError(err) {