talon-agent 5.14.0 → 5.18.2

package/src/core/backup/plan.ts

@@ -52,6 +52,8 @@ export const DEFAULT_BACKUP_SETTINGS = {
   keepLocal: 12,
   keepRemote: 30,
   includePalace: true,
+  loginSessions: "local",
+  includeSessions: true,
   workspaceInclude: DEFAULT_WORKSPACE_INCLUDE,
   extraPaths: [] as readonly string[],
   checkpointBeforeUpdate: true,
@@ -70,14 +72,26 @@ export const HOME_INCLUDES: readonly string[] = [
   "prompts",
   "data",
   "keys",
-  "whatsapp-auth",
-  ".user-session",
+  "google",
+  "plugins",
   "mesh-devices.json",
   "mesh-history.json",
+  "mesh-locations.json",
   "teleport-state.json",
   "agent-workspace",
 ];
 
+/**
+ * Login sessions — the WhatsApp pairing and the userbot's Telegram login
+ * (the operator's own account). They get their own part so they can stay
+ * on this machine: a stolen remote copy must not be a logged-in session.
+ * Re-linking after a disaster is a QR scan; losing the account is not.
+ */
+export const LOGIN_INCLUDES: readonly string[] = [
+  "whatsapp-auth",
+  ".user-session",
+];
+
 /** The exclusion rules, in the words the manifest records them by. */
 export const EXCLUDE_RULES: readonly string[] = [
   "talon.log*",
@@ -86,8 +100,9 @@ export const EXCLUDE_RULES: readonly string[] = [
   "*venv*/",
   "ns/ (FUSE mount — never stat()ed)",
   "backups/",
-  "data/traces/**",
+  "data/traces/** (in the sessions part)",
   "data/talon.db* (the database is added via VACUUM INTO)",
+  "plugin-src/**/{dist,build,.venv,cache,.cache,__pycache__}/",
   "*.tmp-*",
   "workspace/palace/** (its own part)",
 ];
@@ -101,7 +116,6 @@ export function isExcluded(path: string): boolean {
   const segments = path.split("/").filter(Boolean);
   if (segments.length === 0) return true;
   const first = segments[0];
-  const last = segments[segments.length - 1];
   // Anchored rules — only at the root of the archive.
   if (first === "ns" || first === "backups") return true;
   if (
@@ -118,19 +132,58 @@ export function isExcluded(path: string): boolean {
   }
   if (path === "workspace/palace" || path.startsWith("workspace/palace/"))
     return true;
-  // Rules that hold at any depth: build output, virtualenvs, half-written
-  // files from an atomic write that never landed.
-  if (
-    segments.some(
-      (s) => s === "node-bin" || s === "node_modules" || s.includes("venv"),
-    )
-  ) {
+  if (isExcludedAnywhere(path)) return true;
+  // Plugin sources: the code and its lockfiles, not what a build or an
+  // install regenerates from them.
+  if (first === "plugin-src" && segments.some((s) => PLUGIN_BUILD_DIRS.has(s)))
     return true;
-  }
-  if (last.includes(".tmp-")) return true;
   return false;
 }
 
+/** Build and cache output inside a plugin checkout — regenerated on install. */
+const PLUGIN_BUILD_DIRS = new Set([
+  "dist",
+  "build",
+  ".venv",
+  "cache",
+  ".cache",
+  "__pycache__",
+]);
+
+/** Archive roots that live in their own part, exempt from {@link isExcluded}. */
+const OWN_PART_ROOTS = ["workspace/palace", "data/traces"] as const;
+
+/**
+ * The exclusion rule for one include root. The palace and the traces are
+ * kept out of the state part by {@link isExcluded} because they travel in
+ * parts of their own; walking those roots (to build their part, or to
+ * restore them) must therefore not apply that same rule to them.
+ */
+export function excludeForRoot(root: string): (archivePath: string) => boolean {
+  const own = OWN_PART_ROOTS.find(
+    (prefix) => root === prefix || root.startsWith(`${prefix}/`),
+  );
+  if (!own) return isExcluded;
+  return (archivePath) =>
+    archivePath === own || archivePath.startsWith(`${own}/`)
+      ? isExcludedAnywhere(archivePath)
+      : isExcluded(archivePath);
+}
+
+/**
+ * The rules that hold at any depth: build output, virtualenvs, and
+ * half-written files from an atomic write that never landed.
+ */
+function isExcludedAnywhere(path: string): boolean {
+  const segments = path.split("/").filter(Boolean);
+  const last = segments[segments.length - 1] ?? "";
+  return (
+    segments.some(
+      (s) => s === "node-bin" || s === "node_modules" || s.includes("venv"),
+    ) || last.includes(".tmp-")
+  );
+}
+
 /**
  * Match one workspace-relative path against the `workspaceInclude` list.
  * The pattern language is deliberately two rules wide — an exact relative

package/src/core/backup/restore-guard.ts

@@ -0,0 +1,101 @@
+/**
+ * What a restore must check before it trusts a snapshot, and the file
+ * modes it leaves behind.
+ *
+ * A manifest can come from anywhere — copied off a remote target, handed
+ * over on a USB stick — and it decides what gets extracted where. So:
+ *
+ *   - A manifest with an `auth` block must verify under the configured
+ *     passphrase, and then every part it lists must be encrypted: an
+ *     authenticated manifest pointing at a plaintext part is a swap.
+ *   - A manifest without one is a legacy (or plaintext) snapshot. It
+ *     still restores — unless this install has a backup passphrase or
+ *     the parts came from a remote target, because that is exactly what
+ *     an attacker who stripped the MAC would hand us. Then the operator
+ *     has to say so explicitly (`--allow-unauthenticated`).
+ *
+ * Everything a restore writes is owner-only: files keep their owner
+ * bits (so scripts stay executable) and gain nothing for group/other;
+ * directories are 0700. The snapshot carries config.json, keys and
+ * sessions — whatever mode they had on the old machine, this one should
+ * not publish them.
+ */
+
+import { chmod } from "node:fs/promises";
+import { logWarn } from "../../util/log.js";
+import { TalonError } from "../errors.js";
+import { verifyManifest } from "./archive/manifest-auth.js";
+import { resolvePassphrase } from "./passphrase.js";
+import type { BackupSettings, Manifest } from "./types.js";
+
+export type ManifestTrust = {
+  /** Operator override for unauthenticated manifests. */
+  allowUnauthenticated?: boolean;
+  /** True when any part is being fetched from a remote target. */
+  fromRemote?: boolean;
+};
+
+function refuse(message: string): TalonError {
+  return new TalonError(message, { reason: "bad_request" });
+}
+
+/**
+ * Throw unless this manifest may be trusted. Returns whether it was
+ * authenticated, so the part check can insist on encryption.
+ */
+export async function authenticateManifest(
+  manifest: Manifest,
+  settings: Pick<BackupSettings, "encryption">,
+  trust: ManifestTrust = {},
+): Promise<boolean> {
+  const passphrase = await resolvePassphrase(settings);
+  if (manifest.auth) {
+    if (!passphrase) {
+      throw refuse(
+        `Snapshot ${manifest.id} is signed with a backup passphrase — set backup.encryption.passphraseFile or TALON_BACKUP_PASSPHRASE to restore it`,
+      );
+    }
+    if (!(await verifyManifest(manifest, passphrase))) {
+      throw refuse(
+        `Snapshot ${manifest.id}: manifest authentication failed — wrong passphrase, or the manifest was modified; restore aborted`,
+      );
+    }
+    return true;
+  }
+  if (trust.allowUnauthenticated) {
+    logWarn(
+      "backup",
+      `Restoring unauthenticated snapshot ${manifest.id} (--allow-unauthenticated)`,
+    );
+    return false;
+  }
+  if (passphrase || trust.fromRemote) {
+    throw refuse(
+      `Snapshot ${manifest.id} has no manifest signature` +
+        (trust.fromRemote
+          ? " and its parts come from a remote target"
+          : " although this install has a backup passphrase") +
+        ` — it may have been tampered with. If you know it is a snapshot from before backup encryption, re-run with --allow-unauthenticated`,
+    );
+  }
+  return false;
+}
+
+/** Owner-only mode for a restored file, keeping the owner's execute bit. */
+export function privateFileMode(mode: number): number {
+  return (mode & 0o700) | 0o600;
+}
+
+/** Tighten one restored path. Failures are logged, not fatal. */
+export async function makePrivate(
+  path: string,
+  type: "file" | "dir" | "symlink",
+  mode: number,
+): Promise<void> {
+  if (type === "symlink" || process.platform === "win32") return;
+  try {
+    await chmod(path, type === "dir" ? 0o700 : privateFileMode(mode));
+  } catch (err) {
+    logWarn("backup", `Could not set mode on ${path}: ${String(err)}`);
+  }
+}

package/src/core/backup/restore.ts

@@ -3,9 +3,10 @@
  *
  * The rules that make this safe to run on a live home directory:
  *
- *   1. Verify before you touch anything. Every part's sha256 is checked
- *      against the manifest first; a part that fails is a stopped
- *      restore, not a half-applied one.
+ *   1. Verify before you touch anything. The manifest's signature is
+ *      checked (restore-guard.ts), then every part's sha256 and — for
+ *      encrypted parts — every record's tag; a part that fails is a
+ *      stopped restore, not a half-applied one.
  *   2. Stage, then swap. The archive is extracted into a staging
  *      directory beside the snapshot (same filesystem, so the swap is
  *      renames), and only then do the live paths change.
@@ -23,6 +24,8 @@
  */
 
 import { createReadStream } from "node:fs";
+import { pipeline } from "node:stream";
+import type { Readable } from "node:stream";
 import {
   mkdir,
   readFile,
@@ -33,19 +36,36 @@ import {
   unlink,
   copyFile,
 } from "node:fs/promises";
+import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 import { dirs } from "../../util/paths.js";
 import { log, logWarn } from "../../util/log.js";
 import { TalonError } from "../errors.js";
+import {
+  isEncryptedFile,
+  openDecrypted,
+  verifyDecryptable,
+} from "./archive/crypt.js";
 import { sha256File } from "./archive/digest.js";
 import { extractTar } from "./archive/tar.js";
 import { createDecompressor } from "./archive/zstd.js";
-import { collectTree } from "./plan.js";
+import { requirePassphrase } from "./passphrase.js";
+import { collectTree, excludeForRoot } from "./plan.js";
+import {
+  authenticateManifest,
+  makePrivate,
+  type ManifestTrust,
+} from "./restore-guard.js";
 import { buildSnapshot } from "./snapshot.js";
+import {
+  relocateRoot,
+  rewriteConfigForClone,
+  type CloneTarget,
+} from "./sources/relocate.js";
 import { isSnapshotId, partPath, readManifest, snapshotDir } from "./store.js";
 import type { BackupTarget } from "./targets.js";
-import type { BackupSettings, Manifest } from "./types.js";
+import type { BackupSettings, Manifest, SnapshotPart } from "./types.js";
 
 /** A staged request older than this is stale and ignored. */
 export const RESTORE_PENDING_MAX_AGE_MS = 10 * 60_000;
@@ -67,6 +87,8 @@ export type RestoreReport = {
   written: Record<string, number>;
   removed: number;
   databaseReplaced: boolean;
+  /** A clone rewrote config.json's paths for this machine. */
+  configRewritten?: boolean;
 };
 
 export function restorePendingPath(home: string = dirs.root): string {
@@ -143,19 +165,49 @@ export async function readRestorePending(
 
 // ── Parts ───────────────────────────────────────────────────────────────────
 
-/** Fetch any part that is not on local disk from the given target. */
+async function isLocal(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** The parts of this snapshot that are not on local disk. */
+async function missingParts(
+  manifest: Manifest,
+  home: string,
+): Promise<SnapshotPart[]> {
+  const missing: SnapshotPart[] = [];
+  for (const part of manifest.parts) {
+    if (!(await isLocal(partPath(manifest.id, part.name, home)))) {
+      missing.push(part);
+    }
+  }
+  return missing;
+}
+
+/**
+ * Fetch every missing part from the given target and return the parts
+ * the restore will use. A missing local-only part (login sessions kept
+ * off remotes) is skipped with a warning — the restore goes on without it.
+ */
 async function ensureParts(
   manifest: Manifest,
   home: string,
+  missing: readonly SnapshotPart[],
   target?: BackupTarget,
-): Promise<void> {
-  for (const part of manifest.parts) {
-    const path = partPath(manifest.id, part.name, home);
-    try {
-      await stat(path);
+): Promise<SnapshotPart[]> {
+  const skipped = new Set<string>();
+  for (const part of missing) {
+    if (part.localOnly) {
+      logWarn(
+        "backup",
+        `${part.name} was kept on the original machine only — restoring without it (re-link WhatsApp / the userbot afterwards)`,
+      );
+      skipped.add(part.name);
       continue;
-    } catch {
-      /* not here — fall through to the download */
     }
     if (!target) {
       throw new TalonError(
@@ -163,18 +215,31 @@ async function ensureParts(
         { reason: "bad_request" },
       );
     }
+    const path = partPath(manifest.id, part.name, home);
     log("backup", `Downloading ${part.name} from ${target.id}…`);
-    await mkdir(dirname(path), { recursive: true });
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     await target.download(manifest.id, part.name, path);
   }
+  return manifest.parts.filter((part) => !skipped.has(part.name));
 }
 
-/** Check every part against the manifest. Throws on the first mismatch. */
+/** Who may read backups: only the settings' encryption block matters. */
+type KeySettings = Pick<BackupSettings, "encryption">;
+
+/**
+ * Check every part against the manifest. Throws on the first mismatch.
+ * An encrypted part is also decrypted end to end (and discarded), so a
+ * wrong passphrase or a tampered byte stops the restore before a single
+ * file is extracted — the manifest's digest alone cannot prove that, as
+ * the manifest travels with the parts.
+ */
 export async function verifyParts(
   manifest: Manifest,
   home: string,
+  settings: KeySettings = {},
+  parts: readonly SnapshotPart[] = manifest.parts,
 ): Promise<void> {
-  for (const part of manifest.parts) {
+  for (const part of parts) {
     const path = partPath(manifest.id, part.name, home);
     const actual = await sha256File(path);
     if (actual !== part.sha256) {
@@ -183,30 +248,78 @@ export async function verifyParts(
         { reason: "bad_request" },
       );
     }
+    if (!(await isEncryptedFile(path))) {
+      // A signed manifest only ever lists encrypted parts; a plaintext
+      // one here was swapped in.
+      if (manifest.auth) {
+        throw new TalonError(
+          `Part ${part.name} of ${manifest.id} is not encrypted although its manifest is signed — restore aborted`,
+          { reason: "bad_request" },
+        );
+      }
+      continue;
+    }
+    const passphrase = await requirePassphrase(
+      settings,
+      `Snapshot ${manifest.id}`,
+    );
+    try {
+      await verifyDecryptable(path, passphrase);
+    } catch (err) {
+      throw new TalonError(
+        `Part ${part.name} of ${manifest.id} cannot be decrypted — ${err instanceof Error ? err.message : String(err)}; restore aborted`,
+        { reason: "bad_request", cause: err },
+      );
+    }
   }
 }
 
+/** A part's archive bytes: decrypted when the file carries the header. */
+async function openPart(
+  path: string,
+  settings: KeySettings,
+): Promise<Readable> {
+  if (!(await isEncryptedFile(path))) return createReadStream(path);
+  return openDecrypted(path, await requirePassphrase(settings, path));
+}
+
 /** Unpack every part into one staging tree. */
 async function extractParts(
   manifest: Manifest,
   home: string,
   staging: string,
+  settings: KeySettings,
+  parts: readonly SnapshotPart[],
 ): Promise<void> {
   await rm(staging, { recursive: true, force: true });
-  await mkdir(staging, { recursive: true });
-  for (const part of manifest.parts) {
-    const source = createReadStream(partPath(manifest.id, part.name, home));
-    await extractTar(source.pipe(createDecompressor()), staging);
+  await mkdir(staging, { recursive: true, mode: 0o700 });
+  for (const part of parts) {
+    const source = await openPart(
+      partPath(manifest.id, part.name, home),
+      settings,
+    );
+    const archive = pipeline(source, createDecompressor(), () => {
+      /* a failure surfaces through extractTar's read */
+    });
+    await extractTar(archive, staging);
   }
 }
 
 // ── Applying ────────────────────────────────────────────────────────────────
 
+/** An external root and where it lands on this machine. */
+export type ExternalDestination = {
+  root: string;
+  dest: string;
+  sqlite?: boolean;
+};
+
 /** Where an archive path lands on this machine. */
 export function destinationFor(
   archivePath: string,
   home: string,
   extras: readonly { n: number; source: string }[],
+  external: readonly ExternalDestination[] = [],
 ): string | null {
   const segments = archivePath.split("/");
   if (segments[0] === "extra") {
@@ -214,6 +327,15 @@ export function destinationFor(
     if (!extra) return null; // an extra path this machine has no mapping for
     return join(extra.source, ...segments.slice(2));
   }
+  const outside = external.find(
+    (entry) =>
+      archivePath === entry.root || archivePath.startsWith(`${entry.root}/`),
+  );
+  if (outside) {
+    const rest = archivePath.slice(outside.root.length).split("/");
+    return join(outside.dest, ...rest.filter(Boolean));
+  }
+  if (segments[0] === "sessions" || segments[0] === "plugin-src") return null;
   if (archivePath === DB_MEMBER) return join(home, "data", "talon.db");
   return join(home, ...segments);
 }
@@ -227,7 +349,9 @@ async function clearCovered(
   destRoot: string,
   archiveRoot: string,
 ): Promise<number> {
-  const existing = await collectTree(destRoot, archiveRoot);
+  const existing = await collectTree(destRoot, archiveRoot, {
+    exclude: excludeForRoot(archiveRoot),
+  });
   let removed = 0;
   for (const entry of [...existing].reverse()) {
     try {
@@ -243,6 +367,21 @@ async function clearCovered(
   return removed;
 }
 
+/**
+ * The roots to apply: the manifest's includes, plus the palace whenever a
+ * palace part is present (older manifests did not always list it).
+ */
+function rootsToApply(manifest: Manifest): string[] {
+  const roots = manifest.includes.filter((root) => root !== DB_MEMBER);
+  const hasPalace = manifest.parts.some((part) =>
+    part.name.startsWith("palace-"),
+  );
+  if (hasPalace && !roots.includes("workspace/palace")) {
+    roots.push("workspace/palace");
+  }
+  return roots;
+}
+
 /** Move one staged file into place, falling back to a copy across devices. */
 async function placeFile(from: string, to: string): Promise<void> {
   await mkdir(dirname(to), { recursive: true });
@@ -262,6 +401,7 @@ async function applyStaged(
   manifest: Manifest,
   staging: string,
   home: string,
+  external: readonly ExternalDestination[],
 ): Promise<RestoreReport> {
   const extras = manifest.extras ?? [];
   const report: RestoreReport = {
@@ -270,27 +410,33 @@ async function applyStaged(
     removed: 0,
     databaseReplaced: false,
   };
-  for (const root of manifest.includes) {
-    if (root === DB_MEMBER) continue;
+  for (const root of rootsToApply(manifest)) {
     const stagedRoot = join(staging, ...root.split("/"));
-    const staged = await collectTree(stagedRoot, root);
+    const staged = await collectTree(stagedRoot, root, {
+      exclude: excludeForRoot(root),
+    });
     if (staged.length === 0) continue;
-    const destRoot = destinationFor(root, home, extras);
+    const destRoot = destinationFor(root, home, extras, external);
     if (!destRoot) {
       logWarn("backup", `No destination for ${root} on this machine — skipped`);
       continue;
     }
     report.removed += await clearCovered(destRoot, root);
+    // A session database's sidecars describe the file being replaced.
+    if (external.some((entry) => entry.root === root && entry.sqlite)) {
+      await rm(`${destRoot}-wal`, { force: true });
+      await rm(`${destRoot}-shm`, { force: true });
+    }
     let written = 0;
     for (const entry of staged) {
-      const dest = destinationFor(entry.archivePath, home, extras);
+      const dest = destinationFor(entry.archivePath, home, extras, external);
       if (!dest) continue;
-      if (entry.type === "dir")
-        await mkdir(dest, { recursive: true, mode: entry.mode });
+      if (entry.type === "dir") await mkdir(dest, { recursive: true });
       else {
         await placeFile(entry.source, dest);
         written += 1;
       }
+      await makePrivate(dest, entry.type, entry.mode);
     }
     report.written[root] = written;
   }
@@ -304,6 +450,7 @@ async function applyStaged(
     await rm(`${dbPath}-wal`, { force: true });
     await rm(`${dbPath}-shm`, { force: true });
     await placeFile(stagedDb, dbPath);
+    await makePrivate(dbPath, "file", 0o600);
     report.databaseReplaced = true;
   } catch {
     logWarn(
@@ -330,8 +477,49 @@ export type RestoreOptions = {
   beforeApply?: () => void | Promise<void>;
   /** Skip the automatic pre-restore checkpoint (it has already been taken). */
   skipCheckpoint?: boolean;
+  /** Restore a manifest that carries no signature (see restore-guard.ts). */
+  allowUnauthenticated?: ManifestTrust["allowUnauthenticated"];
+  /**
+   * Restoring onto a different machine: relocate the session stores and
+   * plugin checkouts to this user's home and rewrite config.json's paths
+   * (see sources/relocate.ts). Without it, a snapshot from another home
+   * is refused rather than written to paths this machine does not own.
+   */
+  clone?: boolean;
+  /** This machine's user home; defaults to `os.homedir()`. */
+  userHome?: string;
+  /** Environment for locating stores (CLAUDE_CONFIG_DIR, …). */
+  env?: Readonly<Record<string, string | undefined>>;
 };
 
+/**
+ * Where each external root of `manifest` goes. A plain restore puts it
+ * back where it came from; a clone relocates it to this machine.
+ */
+function externalDestinations(
+  manifest: Manifest,
+  clone: boolean,
+  target: CloneTarget,
+): ExternalDestination[] {
+  const origin = manifest.origin;
+  const foreign =
+    origin !== undefined &&
+    (origin.userHome !== target.userHome || origin.home !== target.home);
+  if (foreign && !clone && (manifest.external ?? []).length > 0) {
+    throw new TalonError(
+      `Snapshot ${manifest.id} was taken for ${origin.home} (user home ${origin.userHome}); ` +
+        `this machine is ${target.home}. Restore it with --clone to relocate its ` +
+        `session stores and plugin paths.`,
+      { reason: "bad_request" },
+    );
+  }
+  return (manifest.external ?? []).map((root) => ({
+    root: root.root,
+    dest: clone && origin ? relocateRoot(root, origin, target) : root.source,
+    ...(root.sqlite ? { sqlite: true } : {}),
+  }));
+}
+
 /**
  * Restore a snapshot over this home directory. The daemon must already be
  * stopped — this does not check, because the two callers check in their
@@ -347,8 +535,29 @@ export async function restoreSnapshot(
       reason: "bad_request",
     });
   }
-  await ensureParts(manifest, home, options.target);
-  await verifyParts(manifest, home);
+  // Same default rule as the builder: the real home looks at the real
+  // user home; a caller that points at another Talon home (a test) must
+  // say which user home goes with it.
+  const realHome = options.home === undefined;
+  const cloneTarget: CloneTarget = {
+    home,
+    userHome: options.userHome ?? homedir(),
+    env: options.env ?? (realHome ? process.env : {}),
+  };
+  const missing = await missingParts(manifest, home);
+  await authenticateManifest(manifest, options.settings, {
+    allowUnauthenticated: options.allowUnauthenticated,
+    fromRemote: options.target !== undefined && missing.length > 0,
+  });
+  // Decided before anything is fetched or replaced: a refused clone must
+  // leave this machine exactly as it was.
+  const external = externalDestinations(
+    manifest,
+    options.clone ?? false,
+    cloneTarget,
+  );
+  const parts = await ensureParts(manifest, home, missing, options.target);
+  await verifyParts(manifest, home, options.settings, parts);
 
   let checkpointId: string | undefined;
   if (!options.skipCheckpoint) {
@@ -358,16 +567,24 @@ export async function restoreSnapshot(
       pinned: true,
       settings: options.settings,
       home,
+      userHome: options.userHome ?? (realHome ? homedir() : null),
+      env: cloneTarget.env,
     });
     checkpointId = checkpoint.id;
     log("backup", `Pre-restore checkpoint ${checkpointId} taken`);
   }
 
   const staging = join(snapshotDir(manifest.id, home), "restore-staging");
-  await extractParts(manifest, home, staging);
+  await extractParts(manifest, home, staging, options.settings, parts);
   await options.beforeApply?.();
-  const report = await applyStaged(manifest, staging, home);
+  const report = await applyStaged(manifest, staging, home, external);
   report.checkpointId = checkpointId;
+  if (options.clone && manifest.origin) {
+    report.configRewritten = await rewriteConfigForClone(
+      manifest.origin,
+      cloneTarget,
+    );
+  }
   await rm(staging, { recursive: true, force: true });
   log(
     "backup",