bazilion 0.10.0 → 0.11.0

package/dist/cli.js

@@ -6,7 +6,7 @@ import { defineCommand as defineCommand25, runCommand, showUsage } from "citty";
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.10.0",
+  version: "0.11.0",
   description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/teams/skills, and run the local daemon.",
   license: "MIT",
   repository: {
@@ -68,6 +68,7 @@ var package_default = {
     "qrcode-terminal": "^0.12.0",
     react: "^19.2.7",
     "react-dom": "^19.2.7",
+    tar: "^7.5.16",
     typebox: "^1.3.0",
     undici: "^8.5.0",
     yaml: "^2.9.0"
@@ -372,12 +373,12 @@ var listCmd = defineCommand({
   async run({ args }) {
     const client = createClient2();
     const q = args.all ? "?includeArchived=true" : "";
-    const list3 = await client.get(`/api/agents${q}`);
-    if (list3.length === 0) {
+    const list4 = await client.get(`/api/agents${q}`);
+    if (list4.length === 0) {
       console.log("(no agents)");
       return;
     }
-    const rows = list3.map(
+    const rows = list4.map(
       (a) => args.long ? [a.id, a.status, a.name, a.profileId] : (
         // Short UUID prefix — all CLI commands accept 4+ char prefixes now.
         [a.id.slice(0, 8), a.status, a.name]
@@ -448,6 +449,74 @@ var deleteCmd = defineCommand({
     console.log(`deleted agent ${args.id}`);
   }
 });
+function bashApprovalModeForTty(inputIsTty, outputIsTty) {
+  return inputIsTty && outputIsTty ? "interactive" : "auto_deny";
+}
+function buildChatRequest(message, attachments, bashApprovalMode) {
+  return {
+    message,
+    bashApprovalMode,
+    ...attachments && attachments.length > 0 ? { attachments } : {}
+  };
+}
+function terminalSafe(value) {
+  let safe = "";
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    const isControl = code <= 9 || code >= 11 && code <= 31 || code >= 127 && code <= 159;
+    safe += isControl ? `\\x${code.toString(16).padStart(2, "0")}` : character;
+  }
+  return safe;
+}
+async function promptForCommandApproval(approval, prompt) {
+  prompt.write("  [shell command approval required]");
+  prompt.write("  command:");
+  for (const line of approval.command.split("\n")) prompt.write(`    ${terminalSafe(line)}`);
+  prompt.write("  risks:");
+  for (const risk of approval.risks) {
+    prompt.write(
+      `    - ${terminalSafe(risk.code)} (${terminalSafe(risk.severity)}): ${terminalSafe(risk.message)}`
+    );
+  }
+  try {
+    const answer = (await prompt.question("  Allow this command once? [y/N] ")).trim().toLowerCase();
+    return answer === "y" || answer === "yes" ? "allow" : "deny";
+  } catch {
+    prompt.write("  [approval input unavailable; denying]");
+    return "deny";
+  }
+}
+async function respondToCommandApproval(client, approval, prompt) {
+  const decision2 = prompt ? await promptForCommandApproval(approval, prompt) : "deny";
+  await client.post(`/api/shell-approvals/${encodeURIComponent(approval.id)}`, { decision: decision2 });
+  return decision2;
+}
+function closeDeltaLine(state) {
+  if (!state.inDeltaStream) return;
+  process.stdout.write("\n");
+  state.inDeltaStream = false;
+}
+function printCommandApprovalStatus(approval) {
+  switch (approval.status) {
+    case "allowed":
+      console.log("  [shell command allowed]");
+      break;
+    case "denied":
+      console.log("  [shell command denied]");
+      break;
+    case "auto_denied":
+      console.log("  [shell command auto-denied: non-interactive turn]");
+      break;
+    case "expired":
+      console.log("  [shell command approval expired]");
+      break;
+    case "cancelled":
+      console.log("  [shell command approval cancelled]");
+      break;
+    case "pending":
+      break;
+  }
+}
 function printEvent(e, state) {
   switch (e.type) {
     case "assistant_delta":
@@ -494,16 +563,32 @@ function printEvent(e, state) {
       break;
   }
 }
-async function streamTurn(client, agentId, message, attachments) {
+async function streamTurn(client, agentId, message, attachments, options = { bashApprovalMode: "auto_deny" }) {
   const state = { inDeltaStream: false };
-  for await (const frame of client.stream("POST", `/api/agents/${agentId}/chat`, {
-    message,
-    ...attachments && attachments.length > 0 ? { attachments } : {}
-  })) {
+  const respondedApprovalIds = /* @__PURE__ */ new Set();
+  for await (const frame of client.stream(
+    "POST",
+    `/api/agents/${agentId}/chat`,
+    buildChatRequest(message, attachments, options.bashApprovalMode)
+  )) {
     if (frame.kind === "event") {
-      if (frame.event.type !== "user_message") printEvent(frame.event, state);
+      const event = frame.event;
+      if (event.type === "command_approval") {
+        closeDeltaLine(state);
+        const approval = event.approval;
+        if (approval.status === "pending") {
+          if (!respondedApprovalIds.has(approval.id)) {
+            respondedApprovalIds.add(approval.id);
+            await respondToCommandApproval(client, approval, options.approvalPrompt);
+          }
+        } else {
+          printCommandApprovalStatus(approval);
+        }
+      } else if (event.type !== "user_message") {
+        printEvent(event, state);
+      }
     } else if (frame.kind === "fatal") {
-      if (state.inDeltaStream) process.stdout.write("\n");
+      closeDeltaLine(state);
       throw new Error(frame.error);
     }
   }
@@ -528,34 +613,78 @@ var chatCmd = defineCommand({
   async run({ args }) {
     const client = createClient2();
     const resolved = await client.get(`/api/agents/${args.id}`);
+    const bashApprovalMode = bashApprovalModeForTty(stdin.isTTY, stdout.isTTY);
     const attachments = [
       ...loadImages(asPaths(args.image)),
       ...loadFiles(asPaths(args.file))
     ];
     if (args.message || attachments.length > 0) {
-      await streamTurn(client, resolved.agent.id, args.message ?? "", attachments);
+      const rl2 = bashApprovalMode === "interactive" ? createInterface({ input: stdin, output: stdout }) : null;
+      try {
+        await streamTurn(client, resolved.agent.id, args.message ?? "", attachments, {
+          bashApprovalMode,
+          ...rl2 ? {
+            approvalPrompt: {
+              question: (question) => rl2.question(question),
+              write: (line) => console.log(line)
+            }
+          } : {}
+        });
+      } finally {
+        rl2?.close();
+      }
       return;
     }
     console.log(`chatting with ${resolved.agent.name} (${resolved.model})`);
     console.log("(type /exit to quit)");
     const rl = createInterface({ input: stdin, output: stdout });
-    rl.setPrompt("> ");
-    rl.prompt();
-    for await (const line of rl) {
-      const trimmed = line.trim();
-      if (trimmed === "/exit" || trimmed === "/quit") break;
-      if (!trimmed) {
+    try {
+      if (bashApprovalMode === "interactive") {
+        while (true) {
+          let line;
+          try {
+            line = await rl.question("> ");
+          } catch {
+            break;
+          }
+          const trimmed = line.trim();
+          if (trimmed === "/exit" || trimmed === "/quit") break;
+          if (!trimmed) continue;
+          try {
+            await streamTurn(client, resolved.agent.id, trimmed, void 0, {
+              bashApprovalMode,
+              approvalPrompt: {
+                question: (question) => rl.question(question),
+                write: (output) => console.log(output)
+              }
+            });
+          } catch (err) {
+            console.error(`error: ${err.message}`);
+          }
+        }
+      } else {
+        rl.setPrompt("> ");
         rl.prompt();
-        continue;
-      }
-      try {
-        await streamTurn(client, resolved.agent.id, trimmed);
-      } catch (err) {
-        console.error(`error: ${err.message}`);
+        for await (const line of rl) {
+          const trimmed = line.trim();
+          if (trimmed === "/exit" || trimmed === "/quit") break;
+          if (!trimmed) {
+            rl.prompt();
+            continue;
+          }
+          try {
+            await streamTurn(client, resolved.agent.id, trimmed, void 0, {
+              bashApprovalMode
+            });
+          } catch (err) {
+            console.error(`error: ${err.message}`);
+          }
+          rl.prompt();
+        }
       }
-      rl.prompt();
+    } finally {
+      rl.close();
     }
-    rl.close();
   }
 });
 var chatResetCmd = defineCommand({
@@ -567,8 +696,8 @@ var chatResetCmd = defineCommand({
   async run({ args }) {
     if (!args.force) {
       process.stdout.write(`reset all chat history for ${args.id}? [y/N] `);
-      const answer = await new Promise((resolve3) => {
-        process.stdin.once("data", (d) => resolve3(String(d).trim().toLowerCase()));
+      const answer = await new Promise((resolve4) => {
+        process.stdin.once("data", (d) => resolve4(String(d).trim().toLowerCase()));
       });
       if (answer !== "y" && answer !== "yes") {
         console.log("aborted");
@@ -716,8 +845,8 @@ var chatCompactCmd = defineCommand({
       process.stdout.write(
         `compact chat history for ${args.id}? head turns become a summary; tail is preserved. [y/N] `
       );
-      const answer = await new Promise((resolve3) => {
-        process.stdin.once("data", (d) => resolve3(String(d).trim().toLowerCase()));
+      const answer = await new Promise((resolve4) => {
+        process.stdin.once("data", (d) => resolve4(String(d).trim().toLowerCase()));
       });
       if (answer !== "y" && answer !== "yes") {
         console.log("aborted");
@@ -990,8 +1119,8 @@ var openaiLoginCmd = defineCommand3({
       },
       onPrompt: async (prompt) => {
         process.stdout.write(`${prompt.message}: `);
-        return new Promise((resolve3) => {
-          process.stdin.once("data", (d) => resolve3(String(d).trim()));
+        return new Promise((resolve4) => {
+          process.stdin.once("data", (d) => resolve4(String(d).trim()));
         });
       },
       onProgress: (msg) => {
@@ -1065,12 +1194,435 @@ var authCommand = defineCommand3({
 });
 
 // src/commands/backup.ts
-import { spawn } from "child_process";
-import { createWriteStream, existsSync as existsSync2, mkdirSync, readdirSync, rmSync } from "fs";
-import { resolve } from "path";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync2,
+  copyFileSync,
+  createWriteStream,
+  existsSync as existsSync2,
+  fsyncSync as fsyncSync2,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync2,
+  mkdtempSync,
+  openSync as openSync2,
+  readdirSync,
+  readFileSync as readFileSync4,
+  renameSync as renameSync2,
+  rmSync as rmSync2
+} from "fs";
+import { tmpdir } from "os";
+import { basename as basename3, dirname as dirname2, isAbsolute, parse, posix, relative, resolve as resolve2 } from "path";
+import { DatabaseSync } from "node:sqlite";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 import { defineCommand as defineCommand4 } from "citty";
+import { extract, list as list2 } from "tar";
+
+// src/backup-schema.ts
+import { createHash } from "crypto";
+var CANONICAL_MIGRATION = "0001_init";
+var CANONICAL_SCHEMA_HASH = "f2da105d21bdea7bedff3ba601243c22d0a7b2d023b954c714940642152b227f";
+var CANONICAL_OBJECTS = [
+  ["index", "agent_triggers_agent"],
+  ["index", "agent_triggers_enabled"],
+  ["index", "communication_approval_events_attempt"],
+  ["index", "communication_approvals_queue"],
+  ["index", "communication_approvals_teams"],
+  ["index", "idx_agents_telegram_topic_id"],
+  ["index", "idx_provider_models_provider"],
+  ["index", "messages_policy_delivery_queue"],
+  ["index", "messages_to_unread"],
+  ["index", "team_policy_baseline_owner"],
+  ["index", "team_policy_blocks_team_time"],
+  ["index", "team_template_active_position"],
+  ["index", "trigger_dispatches_claimable"],
+  ["index", "trigger_dispatches_trigger_time"],
+  ["index", "web_tokens_active"],
+  ["table", "agent_skills"],
+  ["table", "agent_triggers"],
+  ["table", "agents"],
+  ["table", "communication_approval_events"],
+  ["table", "communication_approval_message_grants"],
+  ["table", "communication_approvals"],
+  ["table", "config"],
+  ["table", "mcp_servers"],
+  ["table", "messages"],
+  ["table", "profile_communication_defaults"],
+  ["table", "profile_default_skills"],
+  ["table", "profiles"],
+  ["table", "provider_models"],
+  ["table", "provider_state"],
+  ["table", "schema_migrations"],
+  ["table", "secrets"],
+  ["table", "skill_meta"],
+  ["table", "source_slot_bindings"],
+  ["table", "team_agent_state"],
+  ["table", "team_policies"],
+  ["table", "team_policy_block_events"],
+  ["table", "team_policy_edges"],
+  ["table", "team_template_edges"],
+  ["table", "team_template_revision_edges"],
+  ["table", "team_template_revision_slots"],
+  ["table", "team_template_revisions"],
+  ["table", "team_template_slots"],
+  ["table", "team_templates"],
+  ["table", "teams"],
+  ["table", "telegram_allowed_users"],
+  ["table", "template_instantiations"],
+  ["table", "trigger_dispatches"],
+  ["table", "web_tokens"],
+  ["trigger", "create_team_policy"],
+  ["trigger", "prevent_detached_team_policy_delete"],
+  ["trigger", "validate_source_binding_insert"],
+  ["trigger", "validate_team_agent_state_insert"],
+  ["trigger", "validate_team_policy_baseline_update"],
+  ["trigger", "validate_team_policy_edge_insert"],
+  ["trigger", "validate_team_template_edge_insert"]
+];
+function normalizeSql(sql) {
+  return sql.replace(/\s+/g, " ").trim();
+}
+function assertCanonicalBackupSchema(db) {
+  const migrations = db.prepare("SELECT version FROM schema_migrations ORDER BY version").all();
+  if (migrations.length !== 1 || migrations[0]?.version !== CANONICAL_MIGRATION) {
+    throw new Error(
+      `schema_migrations must contain exactly ${CANONICAL_MIGRATION}; found ` + (migrations.map((row) => row.version).join(", ") || "none")
+    );
+  }
+  const rows = db.prepare(
+    `SELECT type, name, tbl_name, sql
+       FROM sqlite_schema
+       WHERE sql IS NOT NULL AND name NOT LIKE 'sqlite_%'`
+  ).all();
+  const byKey = new Map(rows.map((row) => [`${row.type}\0${row.name}`, row]));
+  const canonicalKeys = new Set(CANONICAL_OBJECTS.map(([type, name]) => `${type}\0${name}`));
+  for (const row of rows) {
+    if (!canonicalKeys.has(`${row.type}\0${row.name}`)) {
+      throw new Error(`unexpected schema ${row.type} is not canonical: ${row.name}`);
+    }
+  }
+  const canonicalRows = [];
+  for (const [type, name] of CANONICAL_OBJECTS) {
+    const row = byKey.get(`${type}\0${name}`);
+    if (!row) throw new Error(`required canonical schema ${type} is missing: ${name}`);
+    canonicalRows.push(row);
+  }
+  const payload = canonicalRows.map((row) => [row.type, row.name, row.tbl_name, normalizeSql(row.sql)].join("\0")).join("\n");
+  const actualHash = createHash("sha256").update(payload).digest("hex");
+  if (actualHash !== CANONICAL_SCHEMA_HASH) {
+    throw new Error(
+      "canonical schema fingerprint does not match this Bazilion release; restore a backup created from the current clean-install schema"
+    );
+  }
+}
+
+// src/daemon-liveness.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import {
+  chmodSync,
+  closeSync,
+  fstatSync,
+  fsyncSync,
+  ftruncateSync,
+  futimesSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync as readFileSync3,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeSync
+} from "fs";
+import { basename as basename2, dirname, join as join2, resolve } from "path";
+var DAEMON_LIVENESS_FILENAME = "daemon-runtime.json";
+var STALE_AFTER_MS = 6e4;
+var PROBE_TIMEOUT_MS = 750;
+function canonicalHomeIdentity(home) {
+  const absolute = resolve(home);
+  try {
+    return realpathSync.native(absolute);
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") throw error;
+    const parent = dirname(absolute);
+    if (parent === absolute) throw error;
+    return join2(canonicalHomeIdentity(parent), basename2(absolute));
+  }
+}
+function daemonLivenessPath(home) {
+  const canonicalHome = canonicalHomeIdentity(home);
+  const identity = createHash2("sha256").update(canonicalHome).digest("hex").slice(0, 24);
+  return join2(dirname(canonicalHome), `.bazilion-runtime-${identity}.json`);
+}
+function errorCode(error) {
+  return error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+function parseRecord(raw) {
+  try {
+    const value = JSON.parse(raw);
+    if (value.version !== 1 || typeof value.instanceId !== "string" || !value.instanceId || !Number.isSafeInteger(value.pid) || (value.pid ?? 0) <= 0 || !["daemon", "restore"].includes(value.owner ?? "") || ![
+      "starting",
+      "listening",
+      "restoring",
+      "swapping",
+      "installed",
+      "recovery-required"
+    ].includes(value.state ?? "") || !Number.isFinite(value.startedAt)) {
+      return null;
+    }
+    if (value.owner === "daemon" && !["starting", "listening"].includes(value.state ?? "") || value.owner === "restore" && !["restoring", "swapping", "installed", "recovery-required"].includes(value.state ?? "")) {
+      return null;
+    }
+    if (value.owner === "restore" && ["swapping", "recovery-required"].includes(value.state ?? "") && (typeof value.recoveryPath !== "string" || !value.recoveryPath || typeof value.hadPrevious !== "boolean")) {
+      return null;
+    }
+    if (value.owner === "daemon" && value.state === "listening" && (typeof value.host !== "string" || !value.host || !Number.isSafeInteger(value.port) || (value.port ?? 0) < 1 || (value.port ?? 0) > 65535)) {
+      return null;
+    }
+    return value;
+  } catch {
+    return null;
+  }
+}
+function readRecord(path) {
+  try {
+    const stat = lstatSync(path);
+    const raw = stat.isFile() ? readFileSync3(path, "utf8") : "";
+    return { raw, stat, record: stat.isFile() ? parseRecord(raw) : null };
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return null;
+    throw error;
+  }
+}
+function pidIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return errorCode(error) !== "ESRCH";
+  }
+}
+function endpointFor(record) {
+  if (record.state !== "listening" || !record.host || !record.port) return null;
+  const normalized = record.host.toLowerCase();
+  if (normalized === "0.0.0.0") return `http://127.0.0.1:${record.port}`;
+  if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0") {
+    return `http://[::1]:${record.port}`;
+  }
+  if (normalized === "localhost" || normalized === "127.0.0.1") {
+    return `http://${normalized}:${record.port}`;
+  }
+  if (normalized === "::1" || normalized === "[::1]") {
+    return `http://[::1]:${record.port}`;
+  }
+  return null;
+}
+async function endpointHasOwner(endpoint3, instanceId) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+  try {
+    const response = await fetch(new URL("/api/health", endpoint3), {
+      signal: controller.signal
+    });
+    return response.headers.get("x-bazilion-daemon-instance") === instanceId;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function sameFile(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function writeRecord(fd, record) {
+  const body = `${JSON.stringify(record, null, 2)}
+`;
+  ftruncateSync(fd, 0);
+  writeSync(fd, body, 0, "utf8");
+  fsyncSync(fd);
+}
+function fsyncParentDirectory(path) {
+  let directoryFd = null;
+  try {
+    directoryFd = openSync(dirname(path), "r");
+    fsyncSync(directoryFd);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+  } finally {
+    if (directoryFd !== null) closeSync(directoryFd);
+  }
+}
+function reclaimRecord(path, existing) {
+  const identity = createHash2("sha256").update(existing.record?.instanceId ?? existing.raw).update(`\0${existing.stat.dev}\0${existing.stat.ino}`).digest("hex").slice(0, 24);
+  const claim = `${path}.reclaim-${identity}`;
+  try {
+    mkdirSync(claim, { mode: 448 });
+  } catch (error) {
+    if (errorCode(error) !== "EEXIST") throw error;
+    return null;
+  }
+  const current = readRecord(path);
+  if (!current || !sameFile(current.stat, existing.stat) || current.raw !== existing.raw) {
+    return null;
+  }
+  try {
+    renameSync(path, join2(claim, "stale-record.json"));
+    return claim;
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return null;
+    throw error;
+  }
+}
+async function acquireHomeRestoreLock(home) {
+  const targetHome = resolve(home);
+  mkdirSync(dirname(targetHome), { recursive: true });
+  const path = daemonLivenessPath(targetHome);
+  mkdirSync(dirname(path), { recursive: true });
+  const instanceId = randomUUID();
+  let fd = null;
+  let reclaimClaim = null;
+  for (let attempt = 0; attempt < 8 && fd === null; attempt++) {
+    try {
+      fd = openSync(path, "wx", 384);
+      break;
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+    }
+    const existing = readRecord(path);
+    if (!existing) continue;
+    const endpoint3 = existing.record ? endpointFor(existing.record) : null;
+    if (endpoint3 && existing.record && await endpointHasOwner(endpoint3, existing.record.instanceId)) {
+      throw new Error(
+        `bazilion daemon is running at ${endpoint3} for ${targetHome} \u2014 stop it before restoring`
+      );
+    }
+    if (!existing.record) {
+      throw new Error(
+        `the daemon ownership record for ${targetHome} is invalid; verify no daemon is running before removing it manually`
+      );
+    }
+    const livePid = pidIsAlive(existing.record.pid);
+    if (existing.record.owner === "restore" && ["swapping", "recovery-required"].includes(existing.record.state)) {
+      if (livePid) {
+        throw new Error(
+          `bazilion restore process ${existing.record.pid} is ${existing.record.state} ${targetHome} \u2014 wait for it to finish`
+        );
+      }
+      const phase = existing.record.state.replace("-", " ");
+      throw new Error(
+        `Bazilion restore ${phase} for ${targetHome}; recovery data is at ${existing.record.recoveryPath}. Recover the previous home, then remove ${path} manually.`
+      );
+    }
+    if (livePid) {
+      const ageMs = Math.max(0, Date.now() - existing.stat.mtimeMs);
+      const staleDetail = ageMs > STALE_AFTER_MS ? " (its heartbeat is stale)" : "";
+      const owner = existing.record.owner === "daemon" ? "daemon" : "restore";
+      throw new Error(
+        `bazilion ${owner} process ${existing.record.pid} owns ${targetHome}${staleDetail} \u2014 stop it before restoring`
+      );
+    }
+    const claim = reclaimRecord(path, existing);
+    if (claim) {
+      reclaimClaim = claim;
+      console.warn(`removed stale Bazilion daemon ownership record for ${targetHome}`);
+    }
+  }
+  if (fd === null) {
+    throw new Error(
+      `could not safely acquire exclusive restore ownership for ${targetHome}; try again`
+    );
+  }
+  const ownedStat = fstatSync(fd);
+  const record = {
+    version: 1,
+    instanceId,
+    pid: process.pid,
+    owner: "restore",
+    state: "restoring",
+    startedAt: Date.now()
+  };
+  try {
+    writeRecord(fd, record);
+    fsyncParentDirectory(path);
+    if (reclaimClaim) rmSync(reclaimClaim, { recursive: true, force: true });
+    try {
+      chmodSync(path, 384);
+    } catch {
+    }
+  } catch (error) {
+    closeSync(fd);
+    fd = null;
+    try {
+      if (sameFile(lstatSync(path), ownedStat)) rmSync(path, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+  let released = false;
+  const stillOwnsPath = () => {
+    try {
+      return sameFile(lstatSync(path), ownedStat);
+    } catch {
+      return false;
+    }
+  };
+  const heartbeat = setInterval(() => {
+    if (released) return;
+    if (!stillOwnsPath()) {
+      console.error("restore ownership was lost; exiting to protect the Bazilion database");
+      process.exit(1);
+    }
+    try {
+      const now = /* @__PURE__ */ new Date();
+      futimesSync(fd, now, now);
+    } catch (error) {
+      console.error(
+        "restore ownership heartbeat failed:",
+        error instanceof Error ? error.message : error
+      );
+      process.exit(1);
+    }
+  }, 2e3);
+  heartbeat.unref();
+  return {
+    path,
+    markSwapping(recoveryPath, hadPrevious) {
+      if (released || !stillOwnsPath()) throw new Error("restore ownership was lost");
+      record.state = "swapping";
+      record.recoveryPath = resolve(recoveryPath);
+      record.hadPrevious = hadPrevious;
+      writeRecord(fd, record);
+      fsyncParentDirectory(path);
+    },
+    markInstalled() {
+      if (released || !stillOwnsPath()) throw new Error("restore ownership was lost");
+      record.state = "installed";
+      delete record.recoveryPath;
+      delete record.hadPrevious;
+      writeRecord(fd, record);
+    },
+    markRecoveryRequired(recoveryPath, hadPrevious) {
+      if (released || !stillOwnsPath()) throw new Error("restore ownership was lost");
+      record.state = "recovery-required";
+      record.recoveryPath = resolve(recoveryPath);
+      record.hadPrevious = hadPrevious;
+      writeRecord(fd, record);
+    },
+    release() {
+      if (released) return;
+      released = true;
+      clearInterval(heartbeat);
+      const ownsPath = stillOwnsPath();
+      const retainForRecovery = ["swapping", "recovery-required"].includes(record.state);
+      closeSync(fd);
+      fd = null;
+      if (ownsPath && !retainForRecovery) rmSync(path, { force: true });
+    }
+  };
+}
+
+// src/commands/backup.ts
 var createCmd = defineCommand4({
   meta: { name: "create", description: "Download a tar.gz backup of ~/.bazilion from the server" },
   args: {
@@ -1083,7 +1635,14 @@ var createCmd = defineCommand4({
   async run({ args }) {
     const cfg = loadClientConfig();
     const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const outAbs = resolve(args.output ?? `bazilion-backup-${date}.tar.gz`);
+    const outAbs = resolve2(args.output ?? `bazilion-backup-${date}.tar.gz`);
+    const configuredHome = resolve2(resolveCliPaths().home);
+    const outputFromHome = relative(configuredHome, outAbs);
+    if (!outputFromHome || !outputFromHome.startsWith("..") && !isAbsolute(outputFromHome)) {
+      throw new Error(
+        `backup output must be outside BAZILION_HOME (${configuredHome}) to avoid nesting backups`
+      );
+    }
     console.log(`downloading backup \u2192 ${outAbs}`);
     const res = await fetch(`${cfg.serverUrl}/api/backup`, {
       headers: { authorization: `Bearer ${cfg.token}`, origin: cfg.serverUrl }
@@ -1097,21 +1656,462 @@ var createCmd = defineCommand4({
       }
       throw new Error(`backup failed: ${err}`);
     }
-    await pipeline(Readable.fromWeb(res.body), createWriteStream(outAbs));
+    const downloadDir = mkdtempSync(resolve2(tmpdir(), "bazilion-download-"));
+    const partial = resolve2(downloadDir, "backup.tar.gz");
+    try {
+      await pipeline(
+        Readable.fromWeb(res.body),
+        createWriteStream(partial, { flags: "wx", mode: 384 })
+      );
+      await validateArchive(partial);
+      try {
+        renameSync2(partial, outAbs);
+      } catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "EXDEV") throw error;
+        const installPartial = resolve2(
+          dirname2(outAbs),
+          `.${basename3(outAbs)}.${randomUUID2()}.installing`
+        );
+        try {
+          copyFileSync(partial, installPartial);
+          chmodSync2(installPartial, 384);
+          renameSync2(installPartial, outAbs);
+        } finally {
+          rmSync2(installPartial, { force: true });
+        }
+      }
+    } finally {
+      rmSync2(downloadDir, { recursive: true, force: true });
+    }
     console.log("done");
   }
 });
-async function probeServerRunning(port) {
+async function probeServerRunning(serverUrl) {
   try {
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), 500);
-    const res = await fetch(`http://127.0.0.1:${port}/login`, { signal: ctrl.signal });
-    clearTimeout(timer);
-    return res.status >= 200 && res.status < 600;
+    try {
+      const res = await fetch(new URL("/api/health", serverUrl), { signal: ctrl.signal });
+      return res.status >= 200 && res.status < 600;
+    } finally {
+      clearTimeout(timer);
+    }
   } catch {
     return false;
   }
 }
+function loopbackServerUrl(raw) {
+  if (!raw) return null;
+  try {
+    const url = new URL(raw);
+    if (!["http:", "https:"].includes(url.protocol)) return null;
+    const hostname = url.hostname.toLowerCase();
+    if (!["127.0.0.1", "localhost", "[::1]", "::1"].includes(hostname)) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function configuredLoopbackUrls() {
+  const urls = /* @__PURE__ */ new Set(["http://127.0.0.1:4321"]);
+  const envUrl = loopbackServerUrl(process.env.BAZILION_SERVER);
+  if (envUrl) urls.add(envUrl);
+  try {
+    const clientUrl = loopbackServerUrl(loadClientConfig().serverUrl);
+    if (clientUrl) urls.add(clientUrl);
+  } catch {
+  }
+  return [...urls];
+}
+var EXTRACTABLE_ENTRY_TYPES = /* @__PURE__ */ new Set([
+  "File",
+  "OldFile",
+  "Directory",
+  "SymbolicLink"
+]);
+function normalizeArchivePath(rawPath) {
+  if (!rawPath || rawPath.includes("\0")) throw new Error("backup contains an invalid empty path");
+  if (rawPath.includes("\\")) {
+    throw new Error(`backup contains a non-portable path: ${JSON.stringify(rawPath)}`);
+  }
+  if (rawPath.startsWith("/") || /^[A-Za-z]:/.test(rawPath)) {
+    throw new Error(`backup contains an absolute path: ${JSON.stringify(rawPath)}`);
+  }
+  const segments = [];
+  for (const segment of rawPath.split("/")) {
+    if (!segment || segment === ".") continue;
+    if (segment === "..") {
+      throw new Error(`backup path escapes the restore directory: ${JSON.stringify(rawPath)}`);
+    }
+    segments.push(segment);
+  }
+  return segments.join("/");
+}
+function validateArchiveSymbolicLink(path, rawTarget) {
+  if (!rawTarget || rawTarget.includes("\0")) {
+    throw new Error(`backup contains an invalid symbolic link target: ${path}`);
+  }
+  const segments = path.split("/");
+  const isTeamSlot = segments.length === 2 && segments[0] === "teams" && /^[a-z0-9][a-z0-9-]*$/.test(segments[1] ?? "");
+  const portableTarget = rawTarget.replaceAll("\\", "/");
+  const absoluteOnAnyPlatform = isAbsolute(rawTarget) || posix.isAbsolute(portableTarget) || /^[A-Za-z]:\//.test(portableTarget);
+  if (absoluteOnAnyPlatform) {
+    if (!isTeamSlot) {
+      throw new Error(`backup absolute symbolic links are only allowed for Team slots: ${path}`);
+    }
+    if (!isAbsolute(rawTarget)) {
+      throw new Error(`backup contains an invalid Team link target: ${path}`);
+    }
+    return;
+  }
+  if (isTeamSlot) {
+    throw new Error(`backup contains an invalid Team link target: ${path}`);
+  }
+  if (/^[A-Za-z]:/.test(portableTarget)) {
+    throw new Error(`backup contains a non-portable symbolic link target: ${path}`);
+  }
+  const target = posix.normalize(posix.join(posix.dirname(path), portableTarget));
+  if (target === ".." || target.startsWith("../") || posix.isAbsolute(target)) {
+    throw new Error(`backup symbolic link target escapes the restore directory: ${path}`);
+  }
+}
+async function validateArchive(file) {
+  const entries = [];
+  await list2({
+    file,
+    strict: true,
+    onentry(entry2) {
+      if (entry2.meta) return;
+      const path = normalizeArchivePath(entry2.path);
+      if (!path) return;
+      if (!EXTRACTABLE_ENTRY_TYPES.has(entry2.type)) {
+        throw new Error(`backup contains unsupported ${entry2.type} entry: ${path}`);
+      }
+      if (entry2.type === "SymbolicLink") {
+        validateArchiveSymbolicLink(path, entry2.linkpath);
+      }
+      entries.push({ path, type: entry2.type, linkpath: entry2.linkpath });
+    }
+  });
+  const byPath = /* @__PURE__ */ new Map();
+  for (const entry2 of entries) {
+    if (byPath.has(entry2.path)) throw new Error(`backup contains a duplicate path: ${entry2.path}`);
+    byPath.set(entry2.path, entry2);
+  }
+  const symlinks = new Set(
+    entries.filter((entry2) => entry2.type === "SymbolicLink").map((entry2) => entry2.path)
+  );
+  for (const entry2 of entries) {
+    const segments = entry2.path.split("/");
+    for (let i = 1; i < segments.length; i++) {
+      const ancestor = segments.slice(0, i).join("/");
+      if (symlinks.has(ancestor)) {
+        throw new Error(`backup entry traverses symbolic link ${ancestor}: ${entry2.path}`);
+      }
+      const ancestorEntry = byPath.get(ancestor);
+      if (ancestorEntry && ancestorEntry.type !== "Directory") {
+        throw new Error(`backup entry traverses non-directory ${ancestor}: ${entry2.path}`);
+      }
+    }
+  }
+  for (const required of ["bazilion.db", "auth.json"]) {
+    const entry2 = byPath.get(required);
+    if (!entry2 || entry2.type !== "File" && entry2.type !== "OldFile") {
+      throw new Error(`backup is missing required regular file: ${required}`);
+    }
+  }
+  for (const transient of [
+    "bazilion.db-wal",
+    "bazilion.db-shm",
+    "bazilion.db-journal",
+    DAEMON_LIVENESS_FILENAME
+  ]) {
+    if (byPath.has(transient)) {
+      throw new Error(`backup contains unsafe transient SQLite file: ${transient}`);
+    }
+  }
+  return entries;
+}
+function validateAuthFile(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(path, "utf8"));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`backup auth.json is invalid: ${detail}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || !("token" in parsed) || typeof parsed.token !== "string" || !parsed.token.trim()) {
+    throw new Error("backup auth.json is invalid: token is missing");
+  }
+  return parsed.token;
+}
+function validateDatabase(path, authToken) {
+  let db = null;
+  try {
+    db = new DatabaseSync(path, { readOnly: true });
+    const integrity = db.prepare("PRAGMA integrity_check").all();
+    if (integrity.length !== 1 || integrity[0]?.integrity_check !== "ok") {
+      const detail = integrity.map((row) => row.integrity_check).join("; ") || "no result";
+      throw new Error(`integrity_check failed: ${detail}`);
+    }
+    const foreignKeyErrors = db.prepare("PRAGMA foreign_key_check").all();
+    if (foreignKeyErrors.length > 0) {
+      throw new Error(`foreign_key_check failed with ${foreignKeyErrors.length} violation(s)`);
+    }
+    assertCanonicalBackupSchema(db);
+    const tokenHash = createHash3("sha256").update(authToken).digest("hex");
+    const activeBootstrap = db.prepare(
+      `SELECT 1 FROM web_tokens
+         WHERE token_hash = ? AND label = 'bootstrap' AND revoked_at IS NULL
+         LIMIT 1`
+    ).get(tokenHash);
+    if (!activeBootstrap) {
+      throw new Error("auth.json token does not match an active web_tokens row");
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("backup database is invalid:")) {
+      throw error;
+    }
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`backup database is invalid: ${detail}`);
+  } finally {
+    db?.close();
+  }
+}
+var SLUG_ID = /^[a-z0-9][a-z0-9-]*$/;
+var AGENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function validateEntityId(id, pattern, entity) {
+  if (typeof id !== "string" || !pattern.test(id)) {
+    throw new Error(`${entity} has an invalid canonical id: ${JSON.stringify(id)}`);
+  }
+  return id;
+}
+function containedChildDirectory(root, id, rowLabel) {
+  const child = resolve2(root, id);
+  const fromRoot = relative(root, child);
+  if (!fromRoot || fromRoot.startsWith("..") || isAbsolute(fromRoot)) {
+    throw new Error(`${rowLabel} directory escapes its canonical root: ${JSON.stringify(id)}`);
+  }
+  return child;
+}
+function requireExtractedDirectory(path, rowLabel) {
+  try {
+    if (lstatSync2(path).isDirectory()) return;
+  } catch {
+  }
+  throw new Error(`${rowLabel} is missing its canonical directory in the backup`);
+}
+function requireExtractedTeamSlot(path, rowLabel) {
+  try {
+    const entry2 = lstatSync2(path);
+    if (entry2.isDirectory() || entry2.isSymbolicLink()) return;
+  } catch {
+  }
+  throw new Error(`${rowLabel} is missing its canonical Team slot in the backup`);
+}
+function rebaseRestoredHomeDirectories(database, payload, targetHome) {
+  let db = null;
+  try {
+    db = new DatabaseSync(database);
+    db.exec("PRAGMA foreign_keys = ON");
+    const profiles = db.prepare("SELECT id FROM profiles ORDER BY id").all();
+    const agents = db.prepare("SELECT id FROM agents ORDER BY id").all();
+    const teams = db.prepare("SELECT id FROM teams ORDER BY id").all();
+    const rewrites = [];
+    for (const [table, rows, idPattern] of [
+      ["profiles", profiles, SLUG_ID],
+      ["agents", agents, AGENT_ID]
+    ]) {
+      const collection = table;
+      const stagedRoot = resolve2(payload, collection);
+      const targetRoot = resolve2(targetHome, collection);
+      for (const row of rows) {
+        const id = validateEntityId(row.id, idPattern, `${table} row`);
+        const rowLabel = `${table} row ${JSON.stringify(id)}`;
+        const stagedDir = containedChildDirectory(stagedRoot, id, rowLabel);
+        requireExtractedDirectory(stagedDir, rowLabel);
+        rewrites.push({
+          table,
+          id,
+          dir: containedChildDirectory(targetRoot, id, rowLabel)
+        });
+      }
+    }
+    const stagedTeamsRoot = resolve2(payload, "teams");
+    for (const row of teams) {
+      const id = validateEntityId(row.id, SLUG_ID, "teams row");
+      const rowLabel = `teams row ${JSON.stringify(id)}`;
+      requireExtractedTeamSlot(containedChildDirectory(stagedTeamsRoot, id, rowLabel), rowLabel);
+    }
+    db.exec("PRAGMA journal_mode = DELETE");
+    db.exec("PRAGMA synchronous = FULL");
+    let transactionOpen = false;
+    try {
+      db.exec("BEGIN IMMEDIATE");
+      transactionOpen = true;
+      const updateProfile = db.prepare("UPDATE profiles SET dir = ? WHERE id = ?");
+      const updateAgent = db.prepare("UPDATE agents SET dir = ? WHERE id = ?");
+      for (const rewrite of rewrites) {
+        const result = rewrite.table === "profiles" ? updateProfile.run(rewrite.dir, rewrite.id) : updateAgent.run(rewrite.dir, rewrite.id);
+        if (result.changes !== 1) {
+          throw new Error(`could not rebase ${rewrite.table} row ${JSON.stringify(rewrite.id)}`);
+        }
+      }
+      const readProfile = db.prepare("SELECT dir FROM profiles WHERE id = ?");
+      const readAgent = db.prepare("SELECT dir FROM agents WHERE id = ?");
+      for (const rewrite of rewrites) {
+        const row = rewrite.table === "profiles" ? readProfile.get(rewrite.id) : readAgent.get(rewrite.id);
+        if (row?.dir !== rewrite.dir) {
+          throw new Error(
+            `could not verify rebased ${rewrite.table} row ${JSON.stringify(rewrite.id)}`
+          );
+        }
+      }
+      db.exec("COMMIT");
+      transactionOpen = false;
+    } catch (error) {
+      if (transactionOpen) db.exec("ROLLBACK");
+      throw error;
+    }
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`backup database is invalid: ${detail}`);
+  } finally {
+    db?.close();
+  }
+  for (const suffix of ["-wal", "-shm", "-journal"]) {
+    if (existsSync2(`${database}${suffix}`)) {
+      throw new Error(`backup database is invalid: path rebasing left transient ${suffix} state`);
+    }
+  }
+}
+function removeRebuildableQmdIndexes(payload) {
+  const teamsDir = resolve2(payload, "teams");
+  if (!existsSync2(teamsDir) || !lstatSync2(teamsDir).isDirectory()) return;
+  for (const team of readdirSync(teamsDir, { withFileTypes: true })) {
+    if (!team.isDirectory() || team.isSymbolicLink()) continue;
+    const memoryDir = resolve2(teamsDir, team.name, "memory");
+    if (!existsSync2(memoryDir) || !lstatSync2(memoryDir).isDirectory()) continue;
+    for (const entry2 of readdirSync(memoryDir, { withFileTypes: true })) {
+      if (entry2.isFile() && entry2.name.startsWith(".qmd-index.sqlite")) {
+        rmSync2(resolve2(memoryDir, entry2.name), { force: true });
+      }
+    }
+  }
+}
+function installValidatedPayload(payload, targetHome, staging, lifecycle, operations = { rename: renameSync2 }) {
+  const previous = resolve2(staging, "previous-home");
+  const hadPrevious = existsSync2(targetHome);
+  const targetParent = dirname2(targetHome);
+  const syncDirectory = operations.fsyncDirectory ?? fsyncDirectory;
+  const recoveryError = (message, recoveryPath, cause) => {
+    let markerError;
+    try {
+      lifecycle?.markRecoveryRequired(recoveryPath, hadPrevious);
+    } catch (error) {
+      markerError = error;
+    }
+    const causeDetail = cause instanceof Error ? cause.message : String(cause);
+    const markerDetail = markerError ? `; recovery marker update failed: ${markerError instanceof Error ? markerError.message : markerError}` : "";
+    return new RestoreRecoveryRequiredError(
+      `${message} (${causeDetail}); recovery data is at ${recoveryPath}${markerDetail}`,
+      recoveryPath
+    );
+  };
+  lifecycle?.markSwapping(previous, hadPrevious);
+  if (hadPrevious) {
+    try {
+      operations.rename(targetHome, previous);
+    } catch (moveError) {
+      lifecycle?.markInstalled();
+      throw moveError;
+    }
+    try {
+      syncDirectory(targetParent);
+      operations.afterPreviousMoved?.();
+    } catch (postMoveError) {
+      throw recoveryError(
+        "the previous home moved but the swap could not continue safely",
+        previous,
+        postMoveError
+      );
+    }
+  }
+  try {
+    operations.rename(payload, targetHome);
+  } catch (installError) {
+    if (hadPrevious) {
+      try {
+        operations.rename(previous, targetHome);
+      } catch (rollbackError) {
+        const installDetail = installError instanceof Error ? installError.message : String(installError);
+        throw recoveryError(
+          `restore install failed (${installDetail}) and rollback failed`,
+          previous,
+          rollbackError
+        );
+      }
+      try {
+        syncDirectory(targetParent);
+      } catch (rollbackSyncError) {
+        throw recoveryError(
+          "the previous home was restored but its directory entry could not be made durable",
+          targetHome,
+          rollbackSyncError
+        );
+      }
+      try {
+        lifecycle?.markInstalled();
+      } catch (phaseError) {
+        throw recoveryError(
+          "the previous home was restored but could not be marked safe",
+          targetHome,
+          phaseError
+        );
+      }
+    } else {
+      lifecycle?.markInstalled();
+    }
+    throw installError;
+  }
+  try {
+    syncDirectory(targetParent);
+  } catch (installSyncError) {
+    throw recoveryError(
+      "the restored home was installed but its directory entry could not be made durable",
+      hadPrevious ? previous : targetHome,
+      installSyncError
+    );
+  }
+  try {
+    lifecycle?.markInstalled();
+  } catch (phaseError) {
+    throw recoveryError(
+      "the restored home was installed but could not be marked safe",
+      hadPrevious ? previous : targetHome,
+      phaseError
+    );
+  }
+}
+var RestoreRecoveryRequiredError = class extends Error {
+  recoveryPath;
+  constructor(message, recoveryPath) {
+    super(message);
+    this.name = "RestoreRecoveryRequiredError";
+    this.recoveryPath = recoveryPath;
+  }
+};
+function fsyncDirectory(path) {
+  let fd = null;
+  try {
+    fd = openSync2(path, "r");
+    fsyncSync2(fd);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+  } finally {
+    if (fd !== null) closeSync2(fd);
+  }
+}
 var restoreCmd = defineCommand4({
   meta: {
     name: "restore",
@@ -1130,37 +2130,91 @@ var restoreCmd = defineCommand4({
     }
   },
   async run({ args }) {
-    const file = resolve(args.file);
+    const file = resolve2(args.file);
     if (!existsSync2(file)) throw new Error(`backup file not found: ${file}`);
     const paths = resolveCliPaths(args.home);
-    const targetHome = paths.home;
-    const defaultHome = !args.home && !process.env.BAZILION_HOME;
-    if (defaultHome && !args.force && await probeServerRunning(4321)) {
-      throw new Error(
-        "bazilion server appears to be running on :4321 \u2014 stop it first (DB corruption risk), or pass --force to override."
-      );
+    const targetHome = resolve2(paths.home);
+    if (targetHome === parse(targetHome).root) {
+      throw new Error(`refusing to restore over filesystem root: ${targetHome}`);
     }
-    if (existsSync2(targetHome)) {
-      const entries = readdirSync(targetHome);
-      if (entries.length > 0) {
-        if (!args.force) {
+    const targetParent = dirname2(targetHome);
+    mkdirSync2(targetParent, { recursive: true });
+    const restoreLock = await acquireHomeRestoreLock(targetHome);
+    try {
+      const targetsConfiguredHome = targetHome === resolve2(resolveCliPaths().home);
+      if (targetsConfiguredHome) {
+        for (const serverUrl of configuredLoopbackUrls()) {
+          if (await probeServerRunning(serverUrl)) {
+            throw new Error(
+              `bazilion server appears to be running at ${serverUrl} \u2014 stop it before restoring.`
+            );
+          }
+        }
+      }
+      if (existsSync2(targetHome)) {
+        if (!lstatSync2(targetHome).isDirectory()) {
+          throw new Error(`${targetHome} exists and is not a directory`);
+        }
+        const entries = readdirSync(targetHome);
+        if (entries.length > 0 && !args.force) {
           throw new Error(
             `${targetHome} is not empty. Pass --force to overwrite (destroys existing data).`
           );
         }
-        rmSync(targetHome, { recursive: true, force: true });
       }
+      const staging = mkdtempSync(resolve2(targetParent, ".bazilion-restore-"));
+      const stagedArchive = resolve2(staging, "backup.tar.gz");
+      const payload = resolve2(staging, "payload");
+      let preserveStaging = false;
+      try {
+        copyFileSync(file, stagedArchive);
+        await validateArchive(stagedArchive);
+        mkdirSync2(payload);
+        await extract({
+          file: stagedArchive,
+          cwd: payload,
+          strict: true,
+          preserveOwner: false,
+          // The private copy has already passed complete entry-path and link
+          // validation above. Preserve paths here so an intentionally absolute
+          // external linked-Team target is not stripped into a different,
+          // payload-relative path by npm-tar.
+          preservePaths: true
+        });
+        const database = resolve2(payload, "bazilion.db");
+        const authFile = resolve2(payload, "auth.json");
+        if (!lstatSync2(database).isFile() || !lstatSync2(authFile).isFile()) {
+          throw new Error("backup required files did not extract as regular files");
+        }
+        const authToken = validateAuthFile(authFile);
+        validateDatabase(database, authToken);
+        rebaseRestoredHomeDirectories(database, payload, targetHome);
+        validateDatabase(database, authToken);
+        removeRebuildableQmdIndexes(payload);
+        console.log(`installing validated backup ${file} \u2192 ${targetHome}`);
+        try {
+          installValidatedPayload(payload, targetHome, staging, restoreLock);
+        } catch (error) {
+          if (error instanceof RestoreRecoveryRequiredError) {
+            preserveStaging = true;
+          }
+          throw error;
+        }
+      } finally {
+        if (!preserveStaging) {
+          try {
+            rmSync2(staging, { recursive: true, force: true });
+          } catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            console.warn(
+              `warning: could not remove restore staging directory ${staging}: ${detail}`
+            );
+          }
+        }
+      }
+    } finally {
+      restoreLock.release();
     }
-    mkdirSync(targetHome, { recursive: true });
-    console.log(`extracting ${file} \u2192 ${targetHome}`);
-    await new Promise((res, rej) => {
-      const proc = spawn("tar", ["-xzf", file, "-C", targetHome], { stdio: "inherit" });
-      proc.on("error", rej);
-      proc.on("exit", (code) => {
-        if (code === 0) res();
-        else rej(new Error(`tar exited with code ${code}`));
-      });
-    });
     console.log(`restored to ${targetHome}`);
     console.log("start the server with: bazilion serve  (migrations apply automatically)");
   }
@@ -1389,19 +2443,19 @@ var configCommand = defineCommand6({
 });
 
 // src/commands/dashboard.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { connect } from "net";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { defineCommand as defineCommand7 } from "citty";
-var bundledDaemonEntry = join2(import.meta.dirname, "daemon.js");
-var sourceDaemonEntry = join2(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
+var bundledDaemonEntry = join3(import.meta.dirname, "daemon.js");
+var sourceDaemonEntry = join3(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry = existsSync3(bundledDaemonEntry) ? bundledDaemonEntry : sourceDaemonEntry;
-var bundledWebServerEntry = join2(import.meta.dirname, "web-server.js");
-var sourceWebServerEntry = join2(import.meta.dirname, "..", "web-server.ts");
+var bundledWebServerEntry = join3(import.meta.dirname, "web-server.js");
+var sourceWebServerEntry = join3(import.meta.dirname, "..", "web-server.ts");
 var webServerEntry = existsSync3(bundledWebServerEntry) ? bundledWebServerEntry : sourceWebServerEntry;
-var bundledWebDist = join2(import.meta.dirname, "web");
-var sourceWebDist = join2(import.meta.dirname, "..", "..", "..", "web", "dist");
+var bundledWebDist = join3(import.meta.dirname, "web");
+var sourceWebDist = join3(import.meta.dirname, "..", "..", "..", "web", "dist");
 var webDist = existsSync3(bundledWebDist) ? bundledWebDist : sourceWebDist;
 function nodeArgs(entry2) {
   return entry2.endsWith(".ts") ? ["--import", "tsx/esm", entry2] : [entry2];
@@ -1420,12 +2474,12 @@ function probeHost(host) {
   return host;
 }
 function isTcpPortOpen(host, port) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const socket = connect({ host: probeHost(host), port: Number(port) });
     const done = (open) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve3(open);
+      resolve4(open);
     };
     socket.setTimeout(600);
     socket.once("connect", () => done(true));
@@ -1475,14 +2529,14 @@ function openBrowser(url) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : process.env.BROWSER || "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-  const proc = spawn2(cmd, args, { detached: true, stdio: "ignore" });
+  const proc = spawn(cmd, args, { detached: true, stdio: "ignore" });
   proc.unref();
 }
 function spawnProcess(label, entry2, env) {
   if (!existsSync3(entry2)) {
     throw new Error(`${label} entry not found at ${entry2}`);
   }
-  return spawn2(process.execPath, nodeArgs(entry2), {
+  return spawn(process.execPath, nodeArgs(entry2), {
     env,
     stdio: "inherit"
   });
@@ -1564,7 +2618,7 @@ var dashboardCommand = defineCommand7({
             `web UI port ${webPort} is already in use. Re-run with --port <free-port>.`
           );
         }
-        if (!existsSync3(join2(webDist, "server", "server.js"))) {
+        if (!existsSync3(join3(webDist, "server", "server.js"))) {
           throw new Error(
             `bazilion web UI bundle not found at ${webDist}. Run "pnpm --filter @bazilion/web build" from a source checkout, or reinstall the published package.`
           );
@@ -1591,13 +2645,13 @@ var dashboardCommand = defineCommand7({
     if (children.length === 0) return;
     process.on("SIGINT", terminateChildren);
     process.on("SIGTERM", terminateChildren);
-    await new Promise((resolve3) => {
+    await new Promise((resolve4) => {
       let remaining = children.length;
       for (const child of children) {
         child.on("close", (code) => {
           remaining--;
           if (!signalled && code && code !== 0) process.exitCode = code;
-          if (remaining === 0) resolve3();
+          if (remaining === 0) resolve4();
         });
       }
     });
@@ -1688,6 +2742,36 @@ var doctorCommand = defineCommand8({
       `  ${r.scheduler.enabled ? "\u2713" : "-"} scheduler${r.scheduler.enabled ? ` (tick ${r.scheduler.tickMs}ms)` : " (BAZILION_SCHEDULER=off)"}`
     );
     console.log();
+    console.log("agent shell security");
+    if (!r.shellSecurity.ok) {
+      check("valid shell-security configuration", false, r.shellSecurity.error);
+    } else {
+      if (r.shellSecurity.approvalMode === "dangerous") {
+        console.log("  - dangerous-command approval enabled");
+        console.log(
+          "    web and TTY CLI turns can allow once; background and non-TTY turns auto-deny"
+        );
+      } else {
+        console.log("  - dangerous-command approval off");
+        console.log("    set BAZILION_BASH_APPROVAL=dangerous to opt in");
+      }
+      if (r.shellSecurity.sandboxMode === "docker") {
+        console.log(`  - Docker sandbox configured (${r.shellSecurity.sandboxImage})`);
+        console.log(
+          "    workspace-only writable mount \xB7 bounded inputs/skills/memory read-only \xB7 network disabled"
+        );
+        console.log("    host coding tools hidden");
+        console.log(
+          "    policy syntax is valid; Docker and image availability are checked on execution"
+        );
+        console.log("    commands fail closed if either is unavailable");
+      } else {
+        console.log("  - sandbox off (agent shell and coding tools run on the host)");
+        console.log("    approval is a host-execution tripwire, not a filesystem sandbox");
+        console.log("    set BAZILION_BASH_SANDBOX=docker to opt in");
+      }
+    }
+    console.log();
     console.log("operational counts");
     console.log(`  ${r.triggers.active} active trigger(s), ${r.triggers.disabled} disabled`);
     console.log(`  ${r.tokens.active} active web token(s)`);
@@ -1795,7 +2879,7 @@ var inboxCommand = defineCommand9({
 });
 
 // src/commands/login.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
 import { defineCommand as defineCommand10 } from "citty";
 function normalizeServer(raw) {
   let url;
@@ -1834,7 +2918,7 @@ var loginCommand = defineCommand10({
         `${paths.authFile} not found. Start the daemon with "bazilion serve" first \u2014 login stores the remote there.`
       );
     }
-    const auth = JSON.parse(readFileSync3(paths.authFile, "utf8"));
+    const auth = JSON.parse(readFileSync5(paths.authFile, "utf8"));
     if (args.clear) {
       if (!auth.remote) {
         console.log("no remote stored \u2014 nothing to clear");
@@ -2082,11 +3166,11 @@ var memoryCommand = defineCommand12({
 });
 
 // src/commands/profile.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
 
 // ../../packages/api-types/src/index.ts
 var PROFILE_FILES = [
@@ -2155,7 +3239,7 @@ var createCmd2 = defineCommand13({
   },
   async run({ args }) {
     const skillsMode = parseSkillsMode(args["skills-mode"]);
-    const readTemplate = (path) => path ? readFileSync4(path, "utf8") : void 0;
+    const readTemplate = (path) => path ? readFileSync6(path, "utf8") : void 0;
     const body = {
       id: args.id,
       name: args.name,
@@ -2177,12 +3261,12 @@ var listCmd6 = defineCommand13({
   meta: { name: "list", description: "List profiles" },
   async run() {
     const client = createClient2();
-    const list3 = await client.get("/api/profiles");
-    if (list3.length === 0) {
+    const list4 = await client.get("/api/profiles");
+    if (list4.length === 0) {
       console.log("(no profiles)");
       return;
     }
-    const rows = list3.map((p) => [p.id, p.defaultModel, p.name]);
+    const rows = list4.map((p) => [p.id, p.defaultModel, p.name]);
     for (const line of columnize(rows)) console.log(line);
   }
 });
@@ -2230,17 +3314,17 @@ var editCmd2 = defineCommand13({
     const { content } = await client.get(
       `/api/profiles/${args.id}/files/${file}`
     );
-    const tmpPath = join3(tmpdir(), `bazilion-${args.id}-${file}-${randomBytes(4).toString("hex")}`);
+    const tmpPath = join4(tmpdir2(), `bazilion-${args.id}-${file}-${randomBytes(4).toString("hex")}`);
     writeFileSync3(tmpPath, content);
     try {
       const editor = process.env.EDITOR ?? process.env.VISUAL ?? "vi";
-      const code = await new Promise((resolve3, reject) => {
-        const child = spawn3(editor, [tmpPath], { stdio: "inherit" });
+      const code = await new Promise((resolve4, reject) => {
+        const child = spawn2(editor, [tmpPath], { stdio: "inherit" });
         child.on("error", reject);
-        child.on("close", (c) => resolve3(c ?? 0));
+        child.on("close", (c) => resolve4(c ?? 0));
       });
       if (code !== 0) throw new Error(`editor exited with code ${code}`);
-      const updated = readFileSync4(tmpPath, "utf8");
+      const updated = readFileSync6(tmpPath, "utf8");
       if (updated === content) {
         console.log("(no changes)");
         return;
@@ -2250,7 +3334,7 @@ var editCmd2 = defineCommand13({
       console.log(`saved ${file}`);
     } finally {
       try {
-        rmSync2(tmpPath, { force: true });
+        rmSync3(tmpPath, { force: true });
       } catch {
       }
     }
@@ -2495,12 +3579,12 @@ var sendCommand = defineCommand15({
 });
 
 // src/commands/serve.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { defineCommand as defineCommand16 } from "citty";
-var bundledDaemonEntry2 = join4(import.meta.dirname, "daemon.js");
-var sourceDaemonEntry2 = join4(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
+var bundledDaemonEntry2 = join5(import.meta.dirname, "daemon.js");
+var sourceDaemonEntry2 = join5(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry2 = existsSync5(bundledDaemonEntry2) ? bundledDaemonEntry2 : sourceDaemonEntry2;
 var serveCommand = defineCommand16({
   meta: {
@@ -2535,7 +3619,7 @@ var serveCommand = defineCommand16({
     console.log(`starting bazilion daemon at http://${host}:${port}`);
     console.log("(web UI runs separately: cd apps/web && pnpm dev)");
     const nodeArgs2 = daemonEntry2.endsWith(".ts") ? ["--import", "tsx/esm", daemonEntry2] : [daemonEntry2];
-    const proc = spawn4("node", nodeArgs2, {
+    const proc = spawn3("node", nodeArgs2, {
       env,
       stdio: "inherit"
     });
@@ -2551,17 +3635,17 @@ var serveCommand = defineCommand16({
       signalled = true;
     });
     process.on("SIGTERM", onSigterm);
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       proc.on("error", (err) => reject(err));
       proc.on("close", (code) => {
         if (signalled) {
           process.exitCode = 0;
-          resolve3();
+          resolve4();
         } else if (code === 0 || code === null) {
-          resolve3();
+          resolve4();
         } else {
           process.exitCode = code;
-          resolve3();
+          resolve4();
         }
       });
     });
@@ -2569,8 +3653,8 @@ var serveCommand = defineCommand16({
 });
 
 // src/commands/skill.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync } from "fs";
-import { basename as basename2, resolve as resolve2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7, statSync } from "fs";
+import { basename as basename4, resolve as resolve3 } from "path";
 import { defineCommand as defineCommand17 } from "citty";
 function printFindings(findings, prefix = "  ") {
   for (const f of findings) {
@@ -2634,13 +3718,13 @@ var importCmd = defineCommand17({
   },
   async run({ args }) {
     const client = createClient2();
-    const absFrom = resolve2(args.from);
+    const absFrom = resolve3(args.from);
     const isLocalZip = args.from.toLowerCase().endsWith(".zip") && existsSync6(absFrom) && statSync(absFrom).isFile();
     let result;
     try {
       if (isLocalZip) {
-        const bytes = readFileSync5(absFrom);
-        const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
+        const bytes = readFileSync7(absFrom);
+        const file = new File([bytes], basename4(absFrom), { type: "application/zip" });
         const fd = new FormData();
         fd.set("file", file);
         if (args.force) fd.set("force", "true");
@@ -2709,12 +3793,12 @@ var skillCommand = defineCommand17({
 });
 
 // src/commands/team.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { stdin as stdin2 } from "process";
 import { defineCommand as defineCommand19 } from "citty";
 
 // src/commands/team-policy.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { defineCommand as defineCommand18 } from "citty";
 
 // src/team-interchange.ts
@@ -2931,7 +4015,7 @@ function edgeDiff(before, after) {
 // src/commands/team-policy.ts
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync8(path, "utf8"));
   } catch (error) {
     throw new Error(`invalid JSON: ${error.message}`);
   }
@@ -3201,12 +4285,12 @@ var listCmd9 = defineCommand19({
   meta: { name: "list", description: "List teams" },
   async run() {
     const client = createClient2();
-    const list3 = await client.get("/api/teams");
-    if (list3.length === 0) {
+    const list4 = await client.get("/api/teams");
+    if (list4.length === 0) {
       console.log("(no teams)");
       return;
     }
-    const rows = list3.map((g) => [g.id, g.path]);
+    const rows = list4.map((g) => [g.id, g.path]);
     for (const line of columnize(rows)) console.log(line);
   }
 });
@@ -3255,7 +4339,7 @@ var userMdSetCmd = defineCommand19({
   async run({ args }) {
     let content;
     if (args["from-stdin"]) content = await readStdin();
-    else if (args.file) content = readFileSync7(args.file, "utf8");
+    else if (args.file) content = readFileSync9(args.file, "utf8");
     else if (args.text !== void 0) content = args.text;
     else {
       console.error("team user-md set: provide --file, --from-stdin, or --text");
@@ -3348,11 +4432,11 @@ var teamCommand = defineCommand19({
 });
 
 // src/commands/team-template.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { defineCommand as defineCommand20 } from "citty";
 function jsonFile(path) {
   try {
-    return JSON.parse(readFileSync8(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch (error) {
     throw new Error(`invalid JSON: ${error.message}`);
   }
@@ -3377,7 +4461,7 @@ function printTeam(detail) {
       console.log(line);
   }
 }
-var list2 = defineCommand20({
+var list3 = defineCommand20({
   meta: { name: "list", description: "List canonical Team templates" },
   args: { json: { type: "boolean", description: "Emit stable JSON" } },
   async run({ args }) {
@@ -3531,7 +4615,7 @@ var teamTemplateCommand = defineCommand20({
     name: "team-template",
     description: "Inspect and exchange canonical Team templates"
   },
-  subCommands: { list: list2, show: show3, export: exportCommand2, import: importCommand2 }
+  subCommands: { list: list3, show: show3, export: exportCommand2, import: importCommand2 }
 });
 
 // src/commands/telegram.ts
@@ -4024,6 +5108,34 @@ var disableCmd3 = defineCommand23({
     console.log(`disabled trigger ${args.id}`);
   }
 });
+var historyCmd = defineCommand23({
+  meta: { name: "history", description: "Show recent dispatches for a trigger" },
+  args: {
+    id: { type: "positional", required: true },
+    limit: { type: "string", description: "Maximum rows (default 20)" }
+  },
+  async run({ args }) {
+    const limit = args.limit ? Number(args.limit) : 20;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+      throw new Error("--limit must be an integer from 1 to 100");
+    }
+    const client = createClient2();
+    const { dispatches } = await client.get(
+      `/api/triggers/${args.id}/dispatches?limit=${limit}`
+    );
+    if (dispatches.length === 0) {
+      console.log("(no dispatches)");
+      return;
+    }
+    const rows = dispatches.map((dispatch) => [
+      new Date(dispatch.scheduledAt).toISOString(),
+      dispatch.status,
+      `attempts: ${dispatch.attemptCount}`,
+      dispatch.lastError ?? ""
+    ]);
+    for (const line of columnize(rows)) console.log(line);
+  }
+});
 var triggerCommand = defineCommand23({
   meta: { name: "trigger", description: "Manage scheduled agent triggers" },
   subCommands: {
@@ -4031,13 +5143,14 @@ var triggerCommand = defineCommand23({
     list: listCmd11,
     rm: rmCmd6,
     enable: enableCmd3,
-    disable: disableCmd3
+    disable: disableCmd3,
+    history: historyCmd
   }
 });
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync4 } from "fs";
+import { join as join6 } from "path";
 import { defineCommand as defineCommand24 } from "citty";
 function makeLineReader() {
   let buffer = "";
@@ -4048,8 +5161,8 @@ function makeLineReader() {
       const nlIdx = buffer.indexOf("\n");
       if (nlIdx === -1) {
         if (ended) {
-          const resolve3 = queue.shift();
-          resolve3?.(buffer);
+          const resolve4 = queue.shift();
+          resolve4?.(buffer);
           buffer = "";
         } else {
           return;
@@ -4057,8 +5170,8 @@ function makeLineReader() {
       } else {
         const line = buffer.slice(0, nlIdx);
         buffer = buffer.slice(nlIdx + 1);
-        const resolve3 = queue.shift();
-        resolve3?.(line);
+        const resolve4 = queue.shift();
+        resolve4?.(line);
       }
     }
   };
@@ -4071,8 +5184,8 @@ function makeLineReader() {
     ended = true;
     tryDeliver();
   });
-  return () => new Promise((resolve3) => {
-    queue.push(resolve3);
+  return () => new Promise((resolve4) => {
+    queue.push(resolve4);
     tryDeliver();
   });
 }
@@ -4083,7 +5196,7 @@ async function askYes(readLine, prompt) {
 }
 function removePath(p) {
   if (!existsSync7(p)) return false;
-  rmSync3(p, { recursive: true, force: true });
+  rmSync4(p, { recursive: true, force: true });
   return true;
 }
 var uninstallCommand = defineCommand24({
@@ -4104,12 +5217,12 @@ var uninstallCommand = defineCommand24({
   },
   async run({ args }) {
     const paths = resolveCliPaths(args.home);
-    const dbFile = join5(paths.home, "bazilion.db");
-    const profilesDir = join5(paths.home, "profiles");
-    const agentsDir = join5(paths.home, "agents");
-    const teamsDir = join5(paths.home, "teams");
-    const skillsDir = join5(paths.home, "skills");
-    const logsDir = join5(paths.home, "logs");
+    const dbFile = join6(paths.home, "bazilion.db");
+    const profilesDir = join6(paths.home, "profiles");
+    const agentsDir = join6(paths.home, "agents");
+    const teamsDir = join6(paths.home, "teams");
+    const skillsDir = join6(paths.home, "skills");
+    const logsDir = join6(paths.home, "logs");
     if (!existsSync7(paths.home)) {
       console.log(`nothing to remove: ${paths.home} does not exist`);
       return;
@@ -4142,7 +5255,7 @@ var uninstallCommand = defineCommand24({
         if (removePath(p)) console.log(`removed ${p}`);
       }
       if (readdirSync2(paths.home).length === 0) {
-        rmSync3(paths.home, { recursive: true, force: true });
+        rmSync4(paths.home, { recursive: true, force: true });
         console.log(`removed ${paths.home}`);
       } else {
         console.log(`${paths.home} still has unmanaged files; left in place`);