home-hosted 0.7.4 → 0.7.6

package/AGENTS.md

@@ -12,8 +12,9 @@ level: `settings.json` (listener, auth, TLS policy, host vitals, backups, revers
 `.backups/`, `.ui/`, `.logs/` (the panel console), `.proxy/` (the reverse-proxy engine, its generated
 configuration and its nanny state), and `run.json` — the live daemon's pid/url/token, 0600. Every workspace owns
 `.hh/<id>/`: `settings.json` (server defaults, log retention, notifications, DDNS), `servers.config.json`,
-`.secrets.json` (0600: Telegram bot token and DDNS credentials sealed with AES-256-GCM under
-`HHOSTED_DDNS_SECRET`), `.logs/`, and `.state/` (a persistent entry's nanny state plus its 0600 spawn
+`.secrets.json` (0600: Telegram bot token, plus DDNS credentials sealed with AES-256-GCM under
+`HHOSTED_DDNS_SECRET` — only DDNS is sealed, because it is the one thing replayed to a third party),
+`.logs/`, and `.state/` (a persistent entry's nanny state plus its 0600 spawn
 spec until the nanny reads it, plus `ddns.json`). A pre-`.hh` instance is relocated automatically by
 `ensureLayout()` (`src/config/layout.ts`). The package ships **no servers**: never commit a config, a
 seed entry, or a path that names one.
@@ -165,9 +166,10 @@ a minor without one.
 - A single on/off setting is a `ToggleSwitch`; `CheckField` is only for picking items out of a set
   (the restore plan). A checkbox in a `FieldGroup` grid reads as misaligned next to the inputs.
 - A create body carries only what differs from what the entry would inherit — the schema's defaults
-  with `Workspace Settings → Server defaults` on top (`inheritBaseline` + `diffFields` in both
-  UIs). A value written into `servers.config.json` stops following those defaults, so anything the
-  person did not decide stays out; the editor applies the same rule to an edit.
+  with `Workspace Settings → Server defaults` on top (each UI's own `inheritBaseline` plus the shared
+  `diffFields` in `src/shared/patch-diff.ts`). A value written into `servers.config.json` stops
+  following those defaults, so anything the person did not decide stays out; the editor applies the
+  same rule to an edit.
 - ArkType at every runtime boundary: routes use `validate('json'|'query'|'param', schema)` then
   `c.req.valid(...)`; ad-hoc payloads use `parseOrThrow`. Schemas reject undeclared keys.
 - Every failure is a `DetailedError` (`@namesmt/utils`), mapped by `src/helpers/error.ts` into one

package/README.md

@@ -232,6 +232,7 @@ default workspace.
 | `GET`/`PATCH /api/settings/workspace` | server defaults, logs, notifications | ✅ |
 | `GET`/`PATCH /api/settings` | panel-wide: listener, authentication, TLS, host vitals, backups | ❌ |
 | `GET`/`POST /api/backups`, restore | archives | ❌ |
+| `GET`/`PATCH /api/proxy`, `POST /api/proxy/{engine,start,stop,apply,revert}`, `PUT`/`DELETE /api/proxy/certificates/:id` | the reverse proxy: its engine, its route table, and its uploaded certificates | ❌ |
 | `GET /healthz` | no session needed — the one an external monitor wants (its per-server detail needs a credential) | ❌ |
 | `GET /api/metrics` | Prometheus text (needs a token or session, like every `/api` route) | ❌ |
 
@@ -346,7 +347,7 @@ restarts itself), and how hand-edits are validated: [SERVERS.md](./docs/SERVERS.
 | `home-hosted set-password` | set the panel password without opening a browser |
 | `home-hosted set-token` | set the API token scripts and agents use (`--generate`, `--clear`) |
 | `home-hosted migrate` | relocate a pre-workspaces state directory and stamp every config for this release (`--dry-run`, `--yes`) |
-| `home-hosted init` | scaffold a self-contained project (`HHOSTED_HOME` sets to the repo) |
+| `home-hosted init` | scaffold a self-contained project, whose scripts keep state in the repo (`--home ./state`) |
 | `home-hosted ui-switch` | install a UI from a release asset, a zip file or a URL (interactive) |
 | `home-hosted ui-update` | bring an installed UI up to date automatically (official UI) or pick a release (`--old`, `--check`) |
 | `home-hosted ui-revert` | go back to the stock panel UI after uploading your own |
@@ -578,7 +579,9 @@ or `4480`/`4443` unprivileged with your router forwarding to them
 
 Yes. Process trees are sampled from Win32_Process, termination uses `taskkill /T`, and the shipped
 examples avoid POSIX-only commands. CPU temperature and swap are best-effort where the OS does not
-expose them to an unprivileged process, and adopting a self-restarted process is Linux/macOS only.
+expose them to an unprivileged process. Adopting a self-restarted process works on Windows too, off
+its argv instead of the environment marker; a launcher whose real process is a `.cmd` shim is the one
+case it cannot see through, and `kill` is the answer there.
 
 </details>
 

package/dist/cli.js

@@ -5340,6 +5340,10 @@ var init_store = __esmMin((() => {
 			this.listeners.add(listener);
 			return () => this.listeners.delete(listener);
 		}
+		/** How many listeners are attached; a disposed owner must not add to it. */
+		get listenerCount() {
+			return this.listeners.size;
+		}
 		getServer(id) {
 			return this.servers.find((server) => server.id === id);
 		}
@@ -7546,9 +7550,9 @@ function parseUpstream(value) {
 	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
 	try {
 		const url = new URL(withScheme);
-		if (url.port.length === 0) return null;
+		const port = url.port.length > 0 ? url.port : url.protocol === "https:" ? "443" : "80";
 		return {
-			dial: `${url.hostname}:${url.port}`,
+			dial: `${url.hostname}:${port}`,
 			tls: url.protocol === "https:"
 		};
 	} catch {
@@ -7594,7 +7598,7 @@ function validateProxyConfig(config, dnsAccount) {
 	for (const route of config.routes) {
 		if (ids.has(route.id)) errors.push(`route id "${route.id}" is used twice`);
 		ids.add(route.id);
-		const key = `${route.host.toLowerCase()}${route.path}`;
+		const key = `${route.host.toLowerCase()}${route.path.trim().replace(/\/+$/, "")}`;
 		if (seen.has(key)) errors.push(`"${route.host}" is routed twice`);
 		seen.add(key);
 		if (route.target === "server" && (route.workspace.length === 0 || route.server.length === 0)) errors.push(`route "${route.id}" needs a workspace and a server`);
@@ -7613,7 +7617,7 @@ function isPublicHost(host) {
 	const name = host.toLowerCase();
 	if (name === "localhost" || !name.includes(".")) return false;
 	if (LOCAL_TLDS.some((tld) => name.endsWith(tld))) return false;
-	return !/^\d{1,3}(?:\.\d{1,3}){3}$/.test(name);
+	return !/^\d{1,3}(?:\.\d{1,3}){3,}$/.test(name);
 }
 /** Caddy answers with `{"error": "..."}`; that sentence is the useful part. */
 function engineMessage(body) {
@@ -7668,7 +7672,7 @@ var init_proxy$1 = __esmMin((() => {
 		port: "number = 0",
 		origin: "string = \"\""
 	}).onUndeclaredKey("reject");
-	ProxyService = class {
+	ProxyService = class ProxyService {
 		options;
 		nanny = null;
 		admin = null;
@@ -7677,6 +7681,8 @@ var init_proxy$1 = __esmMin((() => {
 		moduleCache = null;
 		/** A legacy `engine.json` is reported once, not on every state frame. */
 		legacyChecksumWarned = false;
+		/** Why the engine's nanny could not be spawned, cleared on the next start. */
+		nannyError = null;
 		certCache = null;
 		/** The certificate state the last apply was built from, so a change re-applies once. */
 		certificateSignature = null;
@@ -8518,11 +8524,15 @@ var init_proxy$1 = __esmMin((() => {
 				subjects: routes.filter((route) => route.tls === "auto" && isPublicHost(route.host)).map((route) => route.host)
 			};
 		}
+		/** The route's path as an engine prefix: trailing slashes are not a different route. */
+		static pathKey(path) {
+			return path.trim().replace(/\/+$/, "");
+		}
 		/** Every route, resolved far enough to render. */
 		resolveRoutes(exclude) {
 			const seen = /* @__PURE__ */ new Map();
 			return this.config.routes.filter((route) => exclude?.has(route.id) !== true).map((route) => {
-				const key = `${route.host.toLowerCase()}${route.path}`;
+				const key = `${route.host.toLowerCase()}${ProxyService.pathKey(route.path)}`;
 				const clash = seen.get(key);
 				if (clash !== void 0) return {
 					route,
@@ -8802,11 +8812,16 @@ var init_proxy$1 = __esmMin((() => {
 				let settled = false;
 				let timer;
 				let killTimer;
+				/** The escalation is cancelled by a real exit, never by `finish`. */
+				const stopEscalation = () => {
+					if (killTimer === void 0) return;
+					clearTimeout(killTimer);
+					killTimer = void 0;
+				};
 				const finish = (value) => {
 					if (settled) return;
 					settled = true;
 					if (timer !== void 0) clearTimeout(timer);
-					if (killTimer !== void 0) clearTimeout(killTimer);
 					resolve(value);
 				};
 				timer = setTimeout(() => {
@@ -8818,8 +8833,14 @@ var init_proxy$1 = __esmMin((() => {
 				child.stdout?.on("data", (chunk) => {
 					output += chunk.toString("utf8");
 				});
-				child.on("error", () => finish(null));
-				child.on("exit", () => finish(output));
+				child.on("error", () => {
+					stopEscalation();
+					finish(null);
+				});
+				child.on("exit", () => {
+					stopEscalation();
+					finish(output);
+				});
 			});
 		}
 		/** Runs `version` once and reports what the binary actually is. */
@@ -8881,7 +8902,7 @@ var init_proxy$1 = __esmMin((() => {
 				return;
 			}
 			await this.assertPortsFree(config.httpPort, config.httpsPort);
-			const admin = await this.chooseAdmin();
+			const admin = await (this.options.chooseAdmin ?? this.chooseAdmin.bind(this))();
 			this.admin = admin;
 			const invalid = this.resolveRoutes().find((view) => view.status === "error");
 			if (invalid !== void 0) throw new DetailedError(invalid.message ?? "a route cannot be built", {
@@ -8937,7 +8958,7 @@ var init_proxy$1 = __esmMin((() => {
 					killPortHolders: false
 				}
 			});
-			this.nanny = spawn(process.execPath, nannyArgv(nannyEntryPoint(), PROXY_ID, specPath, statePath), {
+			const nanny = spawn(process.execPath, nannyArgv(nannyEntryPoint(), PROXY_ID, specPath, statePath), {
 				cwd: this.options.engineDir,
 				env: {
 					...process.env,
@@ -8953,16 +8974,26 @@ var init_proxy$1 = __esmMin((() => {
 				detached: true,
 				windowsHide: true
 			});
-			this.nanny.on("exit", () => {
+			this.nannyError = null;
+			this.nanny = nanny;
+			const nannyGone = () => {
+				if (this.nanny !== nanny) return;
 				this.nanny = null;
 				this.admin = null;
 				fs.rmSync(this.options.adminPath, { force: true });
 				this.options.onStateChange();
+			};
+			nanny.on("error", (error) => {
+				this.nannyError = `the proxy engine's nanny could not be started: ${error.message}`;
+				logger.error(`proxy:    ${this.nannyError}`);
+				nannyGone();
 			});
+			nanny.on("exit", nannyGone);
 			if (!await this.waitReady()) {
-				this.lastError = `the engine did not answer on its admin endpoint within ${Math.round(READY_TIMEOUT_MS / 1e3)}s: ${this.logTail()}`;
+				const failure = this.nannyError ?? `the engine did not answer on its admin endpoint within ${Math.round(READY_TIMEOUT_MS / 1e3)}s: ${this.logTail()}`;
 				await this.stop().catch(() => void 0);
-				throw new DetailedError(this.lastError, {
+				this.lastError = failure;
+				throw new DetailedError(failure, {
 					statusCode: 502,
 					code: "ENGINE_NOT_READY"
 				});
@@ -8990,11 +9021,10 @@ var init_proxy$1 = __esmMin((() => {
 						logger.warn(`proxy:    could not signal pid ${pid}`, error);
 					}
 				}
-				const deadline = Date.now() + 1e4;
+				const deadline = Date.now() + (this.options.stopGraceMs ?? 1e4);
 				while (Date.now() < deadline && pids.some((pid) => isProcessAlive$1(pid))) await new Promise((resolve) => setTimeout(resolve, 100));
-				const survivor = pids.find((pid) => isProcessAlive$1(pid));
-				if (survivor !== void 0) try {
-					process.kill(survivor, "SIGKILL");
+				for (const pid of pids.filter(isProcessAlive$1)) try {
+					process.kill(pid, "SIGKILL");
 				} catch {}
 				fs.rmSync(statePath, { force: true });
 			}
@@ -9087,6 +9117,17 @@ var init_proxy$1 = __esmMin((() => {
 			}
 			if (admin.kind === "tcp") headers.origin = admin.origin;
 			return new Promise((resolve, reject) => {
+				let settled = false;
+				const succeed = (value) => {
+					if (settled) return;
+					settled = true;
+					resolve(value);
+				};
+				const fail = (error) => {
+					if (settled) return;
+					settled = true;
+					reject(error instanceof Error ? error : new Error(String(error)));
+				};
 				const request = http.request({
 					...admin.kind === "unix" ? { socketPath: admin.path } : {
 						host: admin.host,
@@ -9099,20 +9140,24 @@ var init_proxy$1 = __esmMin((() => {
 				}, (response) => {
 					const chunks = [];
 					response.on("data", (chunk) => chunks.push(chunk));
-					response.on("end", () => resolve({
+					response.on("end", () => succeed({
 						status: response.statusCode ?? 0,
 						body: Buffer$1.concat(chunks).toString("utf8")
 					}));
+					response.on("error", fail);
+					response.on("aborted", () => fail(/* @__PURE__ */ new Error("the engine closed the connection before it answered")));
 				});
 				request.on("timeout", () => request.destroy(/* @__PURE__ */ new Error("the engine did not answer in time")));
-				request.on("error", reject);
+				request.on("error", fail);
 				if (payload !== null) request.write(payload);
 				request.end();
 			});
 		}
 		async waitReady() {
+			if (this.options.waitReady !== void 0) return this.options.waitReady();
 			const deadline = Date.now() + READY_TIMEOUT_MS;
 			while (Date.now() < deadline) {
+				if (this.nanny === null) return false;
 				try {
 					if ((await this.request("GET", "/config/")).status < 400) return true;
 				} catch {}
@@ -10255,6 +10300,26 @@ function readJson(file) {
 		return null;
 	}
 }
+/**
+* A legacy file, with "absent" told apart from "present but unreadable".
+*
+* `readJson` collapses both into `null`, and a split that is skipped reads exactly like
+* one with nothing to do — so a corrupt legacy config used to be abandoned silently
+* while `workspaces.json` was still created, after which `hasLegacyLayout()` is false
+* and no later run ever looks at that file again. The definitions would sit unread
+* beside a panel supervising nothing.
+*/
+function readLegacy(file) {
+	if (!fs.existsSync(file)) return {
+		parsed: null,
+		unreadable: false
+	};
+	const parsed = readJson(file);
+	return {
+		parsed,
+		unreadable: parsed === null
+	};
+}
 function writeJson(file, value, mode) {
 	fs.mkdirSync(path.dirname(file), { recursive: true });
 	fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, mode === void 0 ? {} : { mode });
@@ -10352,10 +10417,11 @@ function migrateLayout() {
 	const moved = [];
 	const warnings = [];
 	fs.mkdirSync(hhDir, { recursive: true });
-	const legacyConfig = readJson(legacy.configPath);
+	const legacyConfig = readLegacy(legacy.configPath);
 	let configSplit = false;
-	if (legacyConfig !== null) {
-		const split = splitConfig(legacyConfig);
+	if (legacyConfig.unreadable) warnings.push(`${legacy.configPath} could not be read — it was NOT migrated and is still there; fix or remove it, then move the file in by hand`);
+	if (legacyConfig.parsed !== null) {
+		const split = splitConfig(legacyConfig.parsed);
 		const destinations = [
 			path.join(hhDir, "settings.json"),
 			path.join(hhDir, "default", "settings.json"),
@@ -10372,10 +10438,11 @@ function migrateLayout() {
 			configSplit = true;
 		}
 	}
-	const legacySecrets = readJson(legacy.secretsPath);
+	const legacySecrets = readLegacy(legacy.secretsPath);
 	let secretsSplit = false;
-	if (legacySecrets !== null) {
-		const split = splitSecrets(legacySecrets);
+	if (legacySecrets.unreadable) warnings.push(`${legacy.secretsPath} could not be read — it was NOT migrated and is still there; a panel without it starts on the default password`);
+	if (legacySecrets.parsed !== null) {
+		const split = splitSecrets(legacySecrets.parsed);
 		const destinations = [path.join(hhDir, ".control-secrets.json"), path.join(hhDir, "default", ".secrets.json")];
 		const taken = destinations.filter((file) => fs.existsSync(file));
 		if (taken.length > 0) warnings.push(`${legacy.secretsPath} could not be split — ${taken.map((file) => path.relative(hhDir, file)).join(", ")} already exist(s); left it in place`);
@@ -10555,6 +10622,8 @@ function localCall(runtime, path, method, token, timeoutMs) {
 				status: response.statusCode ?? 0,
 				body
 			}));
+			response.once("aborted", () => resolve(null));
+			response.once("error", () => resolve(null));
 		});
 		request.once("error", () => resolve(null));
 		request.once("timeout", () => {
@@ -10869,10 +10938,23 @@ async function open(file, password) {
 	const blob = await fs.openAsBlob(file, { type: "application/zip" });
 	return password === void 0 ? new ZipReader(new BlobReader(blob)) : new ZipReader(new BlobReader(blob), { password });
 }
-/** Sorted, deterministic walk with symlinks resolved and directory loops broken. */
+/**
+* Sorted, deterministic walk with symlinks resolved and directory loops broken.
+*
+* Every read is best-effort: a directory that vanishes mid-walk (a rotated log, a
+* build directory being cleaned, a container being torn down) must leave it out of
+* the archive rather than reject `createZip` and turn a backup into a failure.
+*/
 function walk(root) {
 	const files = [];
 	const seen = /* @__PURE__ */ new Set();
+	const readDir = (absolute) => {
+		try {
+			return fs.readdirSync(absolute).sort();
+		} catch {
+			return [];
+		}
+	};
 	const visit = (absolute, name) => {
 		let stats;
 		try {
@@ -10881,7 +10963,12 @@ function walk(root) {
 			return;
 		}
 		if (stats.isDirectory()) {
-			const real = fs.realpathSync(absolute);
+			let real;
+			try {
+				real = fs.realpathSync(absolute);
+			} catch {
+				return;
+			}
 			if (seen.has(real)) return;
 			seen.add(real);
 			files.push({
@@ -10890,7 +10977,7 @@ function walk(root) {
 				directory: true,
 				size: 0
 			});
-			for (const child of fs.readdirSync(absolute).sort()) visit(path.join(absolute, child), `${name}/${child}`);
+			for (const child of readDir(absolute)) visit(path.join(absolute, child), `${name}/${child}`);
 			return;
 		}
 		if (stats.isFile()) files.push({
@@ -10900,7 +10987,7 @@ function walk(root) {
 			size: stats.size
 		});
 	};
-	for (const child of fs.readdirSync(root).sort()) visit(path.join(root, child), child);
+	for (const child of readDir(root)) visit(path.join(root, child), child);
 	return files;
 }
 var ZIPS;
@@ -11335,8 +11422,13 @@ var init_log_tail = __esmMin((() => {
 			try {
 				const buffer = Buffer$1.alloc(size - start);
 				const bytes = fs.readSync(handle, buffer, 0, buffer.length, start);
-				const raw = buffer.subarray(0, bytes).toString("utf8").split("\n").filter((line) => line.trim().length > 0);
-				return (start > 0 ? raw.slice(1) : raw).slice(-count).map(parseLogLine).filter((line) => line !== null);
+				const raw = buffer.subarray(0, bytes).toString("utf8").split("\n");
+				let partialStart = false;
+				if (start > 0) {
+					const previous = Buffer$1.alloc(1);
+					partialStart = fs.readSync(handle, previous, 0, 1, start - 1) === 1 && previous[0] !== 10;
+				}
+				return (partialStart ? raw.slice(1) : raw).filter((line) => line.trim().length > 0).slice(-count).map(parseLogLine).filter((line) => line !== null);
 			} catch {
 				return [];
 			} finally {
@@ -11562,6 +11654,8 @@ var init_supervisor = __esmMin((() => {
 		relay = new LogRelay({ onLines: (serverId, lines) => this.ingestExternalLines(serverId, lines) });
 		entries = /* @__PURE__ */ new Map();
 		tickTimer;
+		/** Detaches this supervisor from the store's listener set in `dispose()`. */
+		storeUnsubscribe;
 		disposed = false;
 		constructor(store, hub, options) {
 			this.store = store;
@@ -11570,7 +11664,7 @@ var init_supervisor = __esmMin((() => {
 			const swept = sweepNannySpecs(this.options.nannyDir);
 			if (swept > 0) logger.warn(`removed ${swept} unread nanny spec file(s) from ${this.options.nannyDir}`);
 			this.sync();
-			this.store.onChange(() => this.sync());
+			this.storeUnsubscribe = this.store.onChange(() => this.sync());
 			this.tickTimer = setInterval(() => {
 				this.tick().catch((error) => logger.error("the supervisor tick failed", error));
 			}, TICK_INTERVAL_MS);
@@ -11807,6 +11901,7 @@ var init_supervisor = __esmMin((() => {
 		async dispose() {
 			this.disposed = true;
 			clearInterval(this.tickTimer);
+			this.storeUnsubscribe();
 			for (const entry of this.entries.values()) this.clearRetry(entry);
 			await Promise.all([...this.entries.values()].filter((entry) => !entry.config.persistent).map((entry) => this.stopEntry(entry)));
 			this.relay.dispose();
@@ -11870,6 +11965,9 @@ var init_supervisor = __esmMin((() => {
 			this.clearRetry(entry);
 			entry.nextRetryAt = null;
 			entry.stopping = true;
+			if (entry.config.persistent && entry.child === null && entry.pid === null) await this.resumePersistent(entry).catch((error) => {
+				logger.error(`could not reattach the persistent server ${entry.config.id} to stop it`, error);
+			});
 			if (entry.child === null && entry.pid === null) {
 				entry.stopping = false;
 				entry.status = "stopped";
@@ -12154,19 +12252,26 @@ var init_supervisor = __esmMin((() => {
 			const splitter = new LineSplitter((_stream, text) => {
 				if (text.trim().length > 0) this.log(entry, "system", `[bootstrap] ${text}`);
 			});
-			const child = spawn(resolveCommand(spec.command, cwd, projectDir), args, {
-				cwd,
-				env: {
-					...process.env,
-					...resolveRecord(spec.env, vars)
-				},
-				stdio: [
-					"ignore",
-					"pipe",
-					"pipe"
-				],
-				windowsHide: true
-			});
+			let child;
+			try {
+				child = spawn(resolveCommand(spec.command, cwd, projectDir), args, {
+					cwd,
+					env: {
+						...process.env,
+						...resolveRecord(spec.env, vars)
+					},
+					stdio: [
+						"ignore",
+						"pipe",
+						"pipe"
+					],
+					windowsHide: true
+				});
+			} catch (error) {
+				this.log(entry, "system", `bootstrap could not start: ${error.message} — continuing anyway`);
+				entry.bootstrapDone = true;
+				return;
+			}
 			child.stdout?.on("data", (chunk) => splitter.push("stdout", chunk));
 			child.stderr?.on("data", (chunk) => splitter.push("stderr", chunk));
 			const code = await new Promise((resolve) => {
@@ -12832,6 +12937,29 @@ function isInside(parent, child) {
 	const relative = path.relative(parent, child);
 	return !path.isAbsolute(relative) && (relative.length === 0 || !relative.startsWith(".."));
 }
+/** Resolves symlinks on the deepest existing ancestor, keeping the rest verbatim. */
+function resolveExisting(target) {
+	let prefix = target;
+	const rest = [];
+	for (;;) try {
+		return path.join(fs.realpathSync(prefix), ...rest);
+	} catch {
+		const parent = path.dirname(prefix);
+		if (parent === prefix) return target;
+		rest.unshift(path.basename(prefix));
+		prefix = parent;
+	}
+}
+/**
+* `isInside` after resolving symlinks, so a link inside a declared path cannot stand
+* for somewhere else. `cpSync` follows links already present in the tree it writes
+* into* — a link to an uploads or cache directory is routine — which would let an
+* archive write outside the path the config declared, and on capture let a file from
+* outside it into the archive. Both sides check with this.
+*/
+function isInsideResolved(parent, child) {
+	return isInside(resolveExisting(path.resolve(parent)), resolveExisting(path.resolve(child)));
+}
 /**
 * Every path a backup should capture: the global list, then each server's
 * `backupPaths` and the values of its `dataEnvs`. A path already covered by a
@@ -13408,7 +13536,8 @@ var init_backups = __esmMin((() => {
 						note: target.path === archivedPath ? null : `restored from ${archivedPath}`
 					}, () => fs.cpSync(from, target.path, {
 						recursive: true,
-						force: true
+						force: true,
+						filter: (_source, destination) => isInsideResolved(target.path, destination)
 					}), aliases);
 				}
 				if (parsedGlobal !== null && actions.has("global:settings") && settingsText !== null) {
@@ -16982,6 +17111,7 @@ state/.hh/*
 !state/.hh/settings.json
 !state/.hh/workspaces.json
 state/.hh/*/*
+!state/.hh/*/
 !state/.hh/*/settings.json
 !state/.hh/*/servers.config.json
 data/
@@ -17229,7 +17359,7 @@ async function uiSwitch(argv, io) {
 		io.write("cancelled — nothing was installed\n");
 		return;
 	}
-	await installFromUrl(assetDownloadUrl(chosen), fallbackUiName(chosen.name ?? ""), context);
+	await installFromUrl(assetDownloadUrl(chosen), fallbackUiName(chosen.name ?? ""), context, release.tag);
 }
 async function chooseAsset(assets, values, context) {
 	const { io } = context;
@@ -17269,7 +17399,13 @@ async function installFromFile(value, context) {
 	}
 	await installFromUrl(source.url, fallbackUiName(new URL(source.url).pathname), context);
 }
-async function installFromUrl(url, fallbackName, context) {
+/**
+* `installedTag` is the release the asset came from, never the one inside the archive:
+* a UI zip is built before its release is cut, so it carries the previous tag at best,
+* and recording that makes the panel re-install the same UI on every boot. A local file
+* or a bare URL names no release, so it has none to record.
+*/
+async function installFromUrl(url, fallbackName, context, installedTag) {
 	const headers = {
 		"accept": "application/octet-stream",
 		"user-agent": `home-hosted/${context.version}`
@@ -17277,7 +17413,7 @@ async function installFromUrl(url, fallbackName, context) {
 	if (context.token !== null && context.token.length > 0 && isGithubHost(url)) headers.authorization = `Bearer ${context.token}`;
 	const download = await downloadToTemp(url, headers, context);
 	try {
-		await installArchive(download.file, fallbackName, context);
+		await installArchive(download.file, fallbackName, context, installedTag);
 	} finally {
 		fs.rmSync(download.dir, {
 			recursive: true,
@@ -17285,11 +17421,11 @@ async function installFromUrl(url, fallbackName, context) {
 		});
 	}
 }
-async function installArchive(archivePath, fallbackName, context) {
+async function installArchive(archivePath, fallbackName, context, installedTag) {
 	const { UiService } = await Promise.resolve().then(() => (init_ui(), ui_exports));
 	const { hhDir: dataRoot } = await Promise.resolve().then(() => (init_paths(), paths_exports));
 	const ui = new UiService({ dataRoot });
-	const result = await ui.install(archivePath, fallbackName);
+	const result = await ui.install(archivePath, fallbackName, installedTag);
 	if (!result.ok) throw new Error(`nothing was installed: ${result.error}`);
 	const { meta } = result;
 	const label = meta.version === null ? meta.name : `${meta.name} ${meta.version}`;
@@ -17550,7 +17686,7 @@ async function installTag(repo, wantedAsset, tag, context) {
 	try {
 		const { UiService } = await Promise.resolve().then(() => (init_ui(), ui_exports));
 		const { hhDir: dataRoot } = await Promise.resolve().then(() => (init_paths(), paths_exports));
-		const result = await new UiService({ dataRoot }).install(download.file, assetName);
+		const result = await new UiService({ dataRoot }).install(download.file, assetName, release.tag);
 		if (!result.ok) throw new Error(`nothing was installed: ${result.error}`);
 		const { meta } = result;
 		const { io } = context;