🤖 feat: back up Mux settings to a git repository - #3767

Merged

ibetitsmike merged 202 commits into

mainfrom

mike/backup-sync-dbgh

Aug 10, 2026

Commits on Aug 7, 2026

feat(backup): add settings backup configuration
ibetitsmike
committed
dae7c7e
fix(backup): persist backup settings through config
ibetitsmike
committed
05a9fcb
feat(backup): add settings backup primitives
ibetitsmike
committed
e5aec8e
feat(backup): add backup orchestration
ibetitsmike
committed
0532a4e
feat(settings): add settings backup controls
ibetitsmike
committed
f4085c6
fix(backup): wire the service to the git cache and payload modules
ibetitsmike
committed
d598aad
fix(backup): keep unchanged backups a true no-op and report secrets to the service
ibetitsmike
committed
53a6757
fix(backup): align MCP redaction with Mux's real reference forms and keep jsonc comments
ibetitsmike
committed
4e5dceb
fix(backup): treat a repository with no backup as a normal state
ibetitsmike
committed
d82ca66
fix(backup): make the secret-scan override reachable and clarify a preferences-only restore
ibetitsmike
committed
8612c48
refactor(backup): apply simplify/deslop cleanup and audit comments
ibetitsmike
committed
23c574b
fix(backup): close three path and redaction gaps found in review
ibetitsmike
committed
f4f6acc
fix(backup): harden paths against symlinks and .git, validate payloads before writing
ibetitsmike
committed
451d9cd
fix(backup): never write a manifest this code cannot read back
ibetitsmike
committed
014c8a7
fix(backup): keep manifest validation strict
ibetitsmike
committed
e1bf23b
fix(backup): deliver a configured token to git and align the override shortcut
ibetitsmike
committed
bea3bcb
fix(backup): close four review gaps in paths, commands, modes, and preview
ibetitsmike
committed
05af030
fix(backup): redact bearer tokens in stdio commands and clarify preview comment
ibetitsmike
committed
f0f2748
fix(backup): preview preferences by their merge result
ibetitsmike
committed
5e0154f
fix(backup): close redaction and mode gaps found in self-review
ibetitsmike
committed
5bd18c0
fix(backup): stop restore from dropping machine-local preferences
ibetitsmike
committed
f98f7e0
fix(backup): force-stage payload files the target repository ignores
ibetitsmike
committed
b4a19cf
fix(backup): clear ignored cache leftovers and preflight restore destinations
ibetitsmike
committed
9f330e9
fix(backup): keep the GitHub token off other hosts and close three payload gaps
ibetitsmike
committed
67ee89d
fix(backup): close four export paths that could carry data outside the allowlist
ibetitsmike
committed
b0c1b78
fix(backup): merge provider options per provider and tighten two comparisons
ibetitsmike
committed
18b42bc
fix(backup): let a restore repair a corrupt local MCP config
ibetitsmike
committed
e6db268
fix(backup): refuse ambiguous MCP keys and case-colliding payload paths
ibetitsmike
committed
1e1b9cf
fix(backup): discard cache modifications and never resurrect a deleted branch
ibetitsmike
committed
48ecbb3
fix(backup): recheck the remote before reporting an unchanged push
ibetitsmike
committed
e269f11
fix(backup): exclude the editor command, widen flag separators, classify auth failures
ibetitsmike
committed
31df786
fix(backup): classify push-time write denials and exclude local disk failures
ibetitsmike
committed
13ccd6f
fix(backup): require approval for restored MCP commands, gate the secret override, lease the push
ibetitsmike
committed
8cf23c0
fix(backup): fail closed on an unparseable backup MCP config and update the story contract
ibetitsmike
committed
04cbd68
fix(backup): treat re-enabling a command as a change and never send a hidden override
ibetitsmike
committed
47b315b
fix(backup): approve a changed disabled command a workspace override can enable
ibetitsmike
committed
d0ab977
fix(backup): redact paired user credentials and type corrupt payloads as INVALID_BACKUP
ibetitsmike
committed
8158a92
fix(backup): apply the paired credential rule only to curl commands
ibetitsmike
committed
26b62e9
fix(backup): type a missing manifest entry as invalid and keep passwordless cert URIs
ibetitsmike
committed
38674bb
fix(backup): redact a colon-bearing certificate password whole
ibetitsmike
committed
1c1a673
fix(backup): match curl.exe, redact slash-bearing cert passwords, honor escaped colons
ibetitsmike
committed
0a2c169
refactor(backup): never export stdio MCP command text instead of parsing it for credentials
ibetitsmike
committed
dd38164
fix(backup): refuse to publish a path Windows cannot check out
ibetitsmike
committed
b30fce9
fix(backup): rehydrate commands across entry shapes and drop unrestorable ones
ibetitsmike
committed
acbf7d5
fix(backup): rehydrate a mixed entry's url and headers, qualify the secrets claim
ibetitsmike
committed
e822518
fix(backup): keep mixed HTTP entries and try the token after gh is denied
ibetitsmike
committed
3a7b948
fix(backup): treat an empty url as stdio and report the pushing credential
ibetitsmike
committed
cf42150
fix(backup): mirror normalizeEntry's url truthiness exactly
ibetitsmike
committed
d377760
fix(backup): bind a restored MCP header credential to the local endpoint
ibetitsmike
committed
10cf472
fix(backup): withhold a mismatched endpoint's whole headers subtree from rehydration
ibetitsmike
committed
a5fa1e9
fix(backup): restore a header only from the local value at that path
ibetitsmike
committed
6850123
fix(backup): use shared tooltips for the backup action shortcut hints
ibetitsmike
committed
9daecda
fix(backup): read local values by own property when the backup names the key
ibetitsmike
committed
189d6fe
fix(backup): exclude hidden files and keep the ambient ssh retry non-interactive
ibetitsmike
committed
d6a38b0
refactor(backup): reuse the validated jsonc tree and drop redundant tooltip wrappers
ibetitsmike
committed
59e75c1
fix(backup): report an unreachable remote instead of a local IO error
ibetitsmike
committed
1ad8ce6
test(backup): pin the client-facing unreachable-remote error code
ibetitsmike
committed
c482264
fix(backup): approve url-to-stdio transitions, widen credential-name and local-failure matching, bound git calls
ibetitsmike
committed
d9aabc2
fix(backup): keep local snapshots writable, skip the unused clone checkout, guard stale settings, classify timeouts
ibetitsmike
committed
2a2c24b
docs(backup): tighten comments added in this branch
ibetitsmike
committed
9dcbb2e
fix(backup): gate non-documentation recursive files behind a payload-bound review
ibetitsmike
committed
afd1504
fix(backup): merge restored preferences inside the serialized config edit
ibetitsmike
committed
1f37b4f
docs(backup): drop two comments that restate the code
ibetitsmike
committed
1681736
test(backup): pin nested materialization under the sparse checkout
ibetitsmike
committed
d2d2c4a
fix(backup): derive persisted and IPC backup settings from one schema
ibetitsmike
committed
86dc1a1
fix(backup): normalize the managed path and keep a configured core.sshCommand
ibetitsmike
committed
730ee22
fix(backup): extend a GIT_SSH wrapper instead of replacing it
ibetitsmike
committed
7f1cdf8
fix(backup): stop exporting URL query values, bound payload size, match the ssh flag to the client
ibetitsmike
committed
3a354f0
fix(backup): publish only the MCP fields Mux reads, bound the manifest and generated files
ibetitsmike
committed
f9dd5e3
fix(backup): treat a non-object servers map as unsupported, bound the remaining manifest reads
ibetitsmike
committed
b99d2b4
fix(backup): stop publishing MCP endpoints and comments
ibetitsmike
committed
b1e878b
test(backup): answer the core.sshCommand probe in the credential ladder fakes
ibetitsmike
committed
5746653
fix(backup): keep case-distinct local files in a safety snapshot
ibetitsmike
committed
86c418a
fix(backup): report local-only files by filesystem identity, not spelling
ibetitsmike
committed
6ea1f44
fix(backup): keep every name a shared file identity has
ibetitsmike
committed
49ec57f
fix(backup): refuse a restore whose entries are already one local file
ibetitsmike
committed
31a795c
fix(backup): run the whole restore preflight before the safety snapshot
ibetitsmike
committed
3229ff5
fix(backup): validate backup preferences in the preflight, remove a failed snapshot
ibetitsmike
committed
304223e
fix(backup): read a file through the handle its size was checked on
ibetitsmike
committed
0e9f123
fix(backup): verify an opened file is still the contained one, write through the handle
ibetitsmike
committed
d69e6bd
fix(backup): resolve the root once per operation, finish every write
ibetitsmike
committed
029ebe5
fix(backup): check the root by identity, not by its resolved name
ibetitsmike
committed
e4bc6f0
fix(backup): keep the safety snapshot and local MCP reads inside the root
ibetitsmike
committed
675d59c
fix(backup): refuse a symlinked git cache root or per-repository cache
ibetitsmike
committed
3b4f7d5
perf(backup): fetch only the configured backup branch
ibetitsmike
committed
12827b0
fix(backup): read porcelain status verbatim, do not hide a failed ref delete
ibetitsmike
committed
3f49cd4
fix(backup): fetch nothing when the backup branch does not exist yet
ibetitsmike
committed
45a7177
fix(backup): repair a half-initialized cache and keep it blob-filtered
ibetitsmike
committed
9ade3ad
fix(backup): keep payload bytes verbatim and check where a push lands
ibetitsmike
committed
4886ec8
chore(backup): pin the locale for git invocations
ibetitsmike
committed
e48149e
fix(backup): check every push url, and do not write attributes through a link
ibetitsmike
committed
25c2275
fix(backup): check `.git` before writing repository config
ibetitsmike
committed
eebadaa
fix(backup): check `.git` before initializing or repairing a cache
ibetitsmike
committed
63d6aa6
fix(backup): do not report a server-side push denial as backup drift
ibetitsmike
committed
963530b
refactor(backup): remove the explicit-token credential rung
ibetitsmike
committed
ab0f8bb
fix(backup): apply code-review findings
ibetitsmike
committed
c47c2cd
fix(backup): strip GitHub token variables from the gh rung
ibetitsmike
committed
7a25918
fix(backup): fetch lazy blobs through the credential ladder
ibetitsmike
committed
92b0506
fix(backup): reject a repository URL that embeds a credential
ibetitsmike
committed
faff9fa
fix(backup): surface the required command approvals on a blocked restore
ibetitsmike
committed
0790226
fix(backup): report a config write that never reached disk
ibetitsmike
committed
103ba7c
refactor(backup): pass keybind hints through Button's explicit tooltip prop
ibetitsmike
committed
6f6e068
fix(scripts): pass PR JSON to jq through stdin, not argv
ibetitsmike
committed
c1a4b6f
fix(backup): compare the stored origin url, not the insteadOf-rewritten one
ibetitsmike
committed
0dd5112
fix(backup): reject gitfile and commondir indirection in the cache
ibetitsmike
committed
989c032
fix(backup): hash approvals over JSON, not a NUL-delimited preimage
ibetitsmike
committed
cc43007
backup: neutralize all content-transforming git attributes in the cache
ibetitsmike
committed
44df5b5
backup: rebuild cache-local git config from a closed allowlist
ibetitsmike
committed
1590de2
backup: strip git repo-selection env vars, contain hard links at payload boundaries
ibetitsmike
committed
f1f66ef
backup: strip environment-supplied git config, force core.bare in the rebuild
ibetitsmike
committed
51dfa68
backup: owner-only safety snapshot modes, clear approvals on settings save
ibetitsmike
committed
180f2a7
backup: reject any symlink under the cache's .git directory
ibetitsmike
committed
ee8cf48
backup: owner-only cache tree, carry the snapshot path on post-snapshot restore failures
ibetitsmike
committed
795a2dc
🤖 fix: isolate hard-linked backup metadata
ibetitsmike
committed
7887967
🤖 fix: preserve relative backup repository paths
ibetitsmike
committed
321c052
🤖 fix: self-heal backup cache configuration
ibetitsmike
committed
03698c1
🤖 fix: preserve filtered Git repository formats
ibetitsmike
committed
61e124c
🤖 refactor: remove redundant keybind comment
ibetitsmike
committed
a3c6a89
🤖 fix: gate credential-named backup files
ibetitsmike
committed
d94dba4
🤖 fix: recover malformed backup cache config
ibetitsmike
committed
f07708a
🤖 fix: preserve backup repository object format
ibetitsmike
committed
737b91b
🤖 fix: make MCP settings backups portable
ibetitsmike
committed
991a7b6
🤖 fix: gate disabled MCP transport changes
ibetitsmike
committed
691cf49
🤖 fix: gate credential-bearing MCP URLs
ibetitsmike
committed
021ac86
🤖 fix: harden backup URL and restore validation
ibetitsmike
committed
7568dbb
🤖 fix: harden backup credentials and file reads
ibetitsmike
committed
678788f
🤖 fix: validate backup branches and snapshot inputs
ibetitsmike
committed
2522cea
🤖 fix: close backup URL and restore races
ibetitsmike
committed
a245ce5
🤖 fix: require approval for published MCP commands
ibetitsmike
committed
592fb7b
🤖 fix: disambiguate backup redaction markers
ibetitsmike
committed
33b4ffc
🤖 fix: guard portable field lookup
ibetitsmike
committed
2d7dcbe
🤖 fix: gate additional backup credentials
ibetitsmike
committed
38979fc
🤖 fix: reject slashless backup credentials
ibetitsmike
committed
f14399c
🤖 fix: allow usernames in git+ssh and ssh+git remotes
ibetitsmike
committed
3677c42
🤖 fix: narrow git URL comments to verified behavior
ibetitsmike
committed
806a27a
🤖 fix: route git+ssh and ssh+git remotes through the ssh rung
ibetitsmike
committed
3f1097b
🤖 fix: clear stale git lock files from the backup cache
ibetitsmike
committed
c5aae5e
🤖 fix: keep auto gc from outliving awaited cache commands
ibetitsmike
committed
f17d664
🤖 fix: keep a restored MCP config owner-only
ibetitsmike
committed
f4e30db
🤖 fix: set exact owner-only mode and keep severed link permissions
ibetitsmike
committed
f09292d
🤖 fix: rebuild a backup cache left with an incomplete .git
ibetitsmike
committed
52ded67
🤖 fix: reuse a cache directory left without a .git
ibetitsmike
committed
76f789f
🤖 fix: discard a backup cache atomically
ibetitsmike
committed
2384847
🤖 fix: reap caches left by an interrupted discard
ibetitsmike
committed
73ca167
🤖 fix: rebuild a corrupt backup cache instead of enumerating corruption
ibetitsmike
committed
2c3271c
🤖 fix: keep tamper refusals out of the backup cache rebuild retry
ibetitsmike
committed
95c4754
🤖 fix: recheck cache ownership at the point of deletion
ibetitsmike
committed
3535b49
🤖 fix: gate credential-named agent definitions before publishing
ibetitsmike
committed
8ce2e4e
🤖 fix: refuse backups that could never be restored
ibetitsmike
committed
c693328
🤖 fix: put BatchMode=yes ahead of a configured ssh option
ibetitsmike
committed
fbd1a49
🤖 fix: read a Windows drive path as a local repository
ibetitsmike
committed
ac4e483
🤖 fix: bound retained restore snapshots
ibetitsmike
committed
7a38e87
🤖 fix: only reap snapshots whose restore has returned
ibetitsmike
committed
7d2b5f6
🤖 fix: read local safety snapshots with local path rules
ibetitsmike
committed
8c032f7
🤖 fix: parse a double-quoted ssh path before touching the command
ibetitsmike
committed
2e97a15
🤖 fix: do not reap snapshots while a restore is still running
ibetitsmike
committed
58d7925
🤖 fix: keep separators when decoding a quoted ssh path
ibetitsmike
committed
609b9d8
🤖 fix: reject percent-encoded credentials in an ssh repo url
ibetitsmike
committed
02669c1
🤖 fix: serialize local payload work across repositories
ibetitsmike
committed
6c7c766
🤖 fix: scan for an encoded userinfo delimiter instead of decoding
ibetitsmike
committed
4c4f9a4
🤖 fix: order same-millisecond snapshots by creation
ibetitsmike
committed
240f706
🤖 docs: correct two overstated comment claims
ibetitsmike
committed
f34ebcf
🤖 docs: correct two more comment claims about their own code
ibetitsmike
committed
f774f05
🤖 fix: parse an unquoted ssh path with escaped whitespace
ibetitsmike
committed
04e15d1
🤖 fix: resolve encoded authority delimiters before splitting userinfo
ibetitsmike
committed
e98e98a
🤖 fix: decode MCP URL authorities before finding userinfo
ibetitsmike
committed
422d460
🤖 fix: skip shell assignments when finding the ssh program
ibetitsmike
committed
95a28ba
🤖 fix: read the ssh program with one shell-word scanner
ibetitsmike
committed
63120d0
🤖 fix: only add an ssh option where the client can be located
ibetitsmike
committed
0e3854e
🤖 fix: treat a passphrase URL parameter as a credential
ibetitsmike
committed
e7cace3
🤖 fix: sanitize settingsBackup on the real config load path
ibetitsmike
committed
6e459b9
🤖 fix: drop special permission bits when restoring a file
ibetitsmike
committed
835a179
🤖 fix: restore hard-linked entries instead of refusing them
ibetitsmike
committed
75da7ed
🤖 fix: bound the output git ls-remote may buffer
ibetitsmike
committed
1ad571c
🤖 fix: settle the output-cap bail-out without waiting on descendants
ibetitsmike
committed
4f0c2d4
🤖 fix: refuse an unwritable restore destination during planning
ibetitsmike
committed
231fa99
🤖 fix: kill the whole tree on cap overflow and preflight two more restore refusals
ibetitsmike
committed
f17854c
🤖 ci: give each quarantined unit test file its own bun process
ibetitsmike
committed
49a5776
🤖 fix: detach only the command whose output is capped
ibetitsmike
committed
888cd77
🤖 fix: count capped output per chunk, and correct two comment claims
ibetitsmike
committed
e3f4054
fix: bound cumulative subprocess output
ibetitsmike
committed
015755e
refactor: simplify settings backup internals
ibetitsmike
committed
8414c75
🤖 tests: simplify settings backup tests
ibetitsmike
committed
5d40873
🤖 refactor: clean up simplification comments
ibetitsmike
committed
2883e56
🤖 fix: kill capped-command trees on timeout, and preflight restore chmod
ibetitsmike
committed
59e879e
🤖 fix: preflight sticky-directory unlink ownership before restore writes
ibetitsmike
committed
6d2bcba
🤖 fix: terminate a capped command's group even after its leader exited
ibetitsmike
committed
1f74c56
🤖 fix: terminate timed backup command trees
ibetitsmike
committed
0d2f2cd
🤖 fix: bound backup payload file counts
ibetitsmike
committed
1ae8b43
🤖 fix: refresh backup settings after config changes
ibetitsmike
committed
f463d91
🤖 fix: report severed hard-link aliases as local-only
ibetitsmike
committed
d5c1fca
🤖 fix: load backup settings even when the config subscription fails
ibetitsmike
committed
68cb540
refactor: cleanup gate round 3 (comments, deslop, load-ordering simplify)
ibetitsmike
committed
77059d1
fix: bound remote managed-tree materialization and settings freshness
ibetitsmike
committed
a53e259
fix: cap backup network git output and bound payload directory complexity
ibetitsmike
committed
2947ef6
fix: shallow the backup cache clone and fetch
ibetitsmike
committed
841eb42
fix: post-save config re-read, gitlink refusal, cache object budget, empty-dir bounds
ibetitsmike
committed
edc1190

Commits on Aug 8, 2026

fix: dead-stream freshness, over-budget cache discard, MCP redaction bounds
ibetitsmike
committed
4c0d5f8
fix: keep unsubscribed settings stale and reap inactive backup caches
ibetitsmike
committed
2979fd6
fix: gate freshness on stream liveness and clean the whole cache worktree
ibetitsmike
committed
4955283
🤖 refactor: clean up milestone comments
ibetitsmike
committed
a1adeba
🤖 fix: close cache and stream failure gaps
ibetitsmike
committed
0e76a2b

Uh oh!

Commits

Commits on Aug 7, 2026