fix(uninstall): MANDATORY tar backup in ALL modes (safe/settings-only/full)

Per user demand after data loss incident: never trust mode flags alone.
Previously only `full` mode created tar.gz backup. Now `safe` and
`settings-only` also create full tar.gz of ~/.claude (resp .codex,
.gemini, .qwen) BEFORE any mutation. If backup fails, refuse to
proceed for that user — skip to next.

Restore is always one command:
  tar -xzf ~/.<tool>.uninstall-backup.<TS>.tar.gz -C ~

Applies to all 4 scripts: uclaude, ucodex, ugemini, uqwen.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude/uclaude_uninstall.sh

@@ -166,6 +166,24 @@ for user_home in /root /home/*; do
     CLAUDE_DIR="$user_home/.claude"
     [ -d "$CLAUDE_DIR" ] || continue
 
+    # ALWAYS create full tar backup BEFORE any destructive operation, in EVERY mode.
+    # Per user demand after data loss incident: never trust mode flags alone.
+    # If backup fails, refuse to touch this user's data and skip to next user.
+    FULL_BACKUP_TAR="$user_home/.claude.uninstall-backup.${TIMESTAMP}.tar.gz"
+    info "Creating safety backup: $FULL_BACKUP_TAR ..."
+    if ! tar -czf "$FULL_BACKUP_TAR" -C "$user_home" .claude 2>/dev/null; then
+        err "Backup FAILED for $CLAUDE_DIR — REFUSING to proceed (data preserved)"
+        continue
+    fi
+    backup_size=$(du -h "$FULL_BACKUP_TAR" 2>/dev/null | awk '{print $1}')
+    log "Safety backup: $FULL_BACKUP_TAR ($backup_size)"
+    log "Restore anytime: tar -xzf $FULL_BACKUP_TAR -C $user_home"
+
+    # Also back up ~/.claude.json (onboarding state lives outside .claude/)
+    if [ -f "$user_home/.claude.json" ]; then
+        cp -p "$user_home/.claude.json" "$user_home/.claude.json.uninstall.bak.${TIMESTAMP}" 2>/dev/null || true
+    fi
+
     case "$MODE" in
         safe)
             # Remove ONLY patcher-managed files. Preserve all user data.
@@ -197,18 +215,9 @@ for user_home in /root /home/*; do
             ;;
 
         full)
-            # WIPE — but ALWAYS backup first.
-            BACKUP_TAR="$user_home/.claude.uninstall-backup.${TIMESTAMP}.tar.gz"
-            info "Creating backup: $BACKUP_TAR ..."
-            if tar -czf "$BACKUP_TAR" -C "$user_home" .claude 2>/dev/null; then
-                local_size=$(du -h "$BACKUP_TAR" 2>/dev/null | awk '{print $1}')
-                log "Backup saved: $BACKUP_TAR ($local_size)"
+            # Backup already created above. Now wipe.
             rm -rf "$CLAUDE_DIR"
-                log "Removed $CLAUDE_DIR"
-                log "  Restore anytime: tar -xzf $BACKUP_TAR -C $user_home"
-            else
-                err "Backup FAILED — refusing to delete $CLAUDE_DIR (data preserved)"
-            fi
+            log "Removed $CLAUDE_DIR (full wipe)"
             ;;
     esac
 

codex/ucodex_uninstall.sh

@@ -113,8 +113,20 @@ fi
 
 # ---- Remove config ----
 
-for user_home in "${_home_dirs[@]}"; do    CODEX_DIR="$user_home/.codex"
+for user_home in "${_home_dirs[@]}"; do
+    CODEX_DIR="$user_home/.codex"
     if [ -d "$CODEX_DIR" ]; then
+        # ALWAYS create full tar backup BEFORE any destructive op, in EVERY mode.
+        # Per user demand after data loss incident: never trust mode flags alone.
+        FULL_BAK="$user_home/.codex.uninstall-backup.$TIMESTAMP.tar.gz"
+        echo "  Creating safety backup: $FULL_BAK ..."
+        if ! tar -czf "$FULL_BAK" -C "$user_home" .codex 2>/dev/null; then
+            echo "  ERROR: backup FAILED for $CODEX_DIR — REFUSING to proceed (data preserved)"
+            continue
+        fi
+        echo "  Safety backup: $FULL_BAK ($(du -h "$FULL_BAK" 2>/dev/null | awk '{print $1}'))"
+        echo "  Restore anytime: tar -xzf $FULL_BAK -C $user_home"
+
         # PRESERVE user data by default. See uclaude_uninstall.sh history.
         case "${MODE:-safe}" in
             safe)
@@ -137,14 +149,8 @@ for user_home in "${_home_dirs[@]}"; do    CODEX_DIR="$user_home/.codex"
                 done
                 ;;
             full)
-                BAK="$user_home/.codex.uninstall-backup.$TIMESTAMP.tar.gz"
-                if tar -czf "$BAK" -C "$user_home" .codex 2>/dev/null; then
-                    echo "  Backup: $BAK"
                 rm -rf "$user_home/.codex"
-                    echo "  Removed $user_home/.codex (restore: tar -xzf $BAK -C $user_home)"
-                else
-                    echo "  ERROR: backup failed — refusing to delete $user_home/.codex"
-                fi
+                echo "  Removed $user_home/.codex (full wipe)"
                 ;;
         esac
     fi

gemini/ugemini_uninstall.sh

@@ -103,8 +103,20 @@ fi
 
 # ---- Remove settings ----
 
-for user_home in /root $SCAN_DIRS/*; do    GEMINI_DIR="$user_home/.gemini"
+for user_home in /root $SCAN_DIRS/*; do
+    GEMINI_DIR="$user_home/.gemini"
     if [ -d "$GEMINI_DIR" ]; then
+        # ALWAYS create full tar backup BEFORE any destructive op, in EVERY mode.
+        # Per user demand after data loss incident: never trust mode flags alone.
+        FULL_BAK="$user_home/.gemini.uninstall-backup.$TIMESTAMP.tar.gz"
+        echo "  Creating safety backup: $FULL_BAK ..."
+        if ! tar -czf "$FULL_BAK" -C "$user_home" .gemini 2>/dev/null; then
+            echo "  ERROR: backup FAILED for $GEMINI_DIR — REFUSING to proceed (data preserved)"
+            continue
+        fi
+        echo "  Safety backup: $FULL_BAK ($(du -h "$FULL_BAK" 2>/dev/null | awk '{print $1}'))"
+        echo "  Restore anytime: tar -xzf $FULL_BAK -C $user_home"
+
         # PRESERVE user data by default. See uclaude_uninstall.sh history.
         case "${MODE:-safe}" in
             safe)
@@ -127,14 +139,8 @@ for user_home in /root $SCAN_DIRS/*; do    GEMINI_DIR="$user_home/.gemini"
                 done
                 ;;
             full)
-                BAK="$user_home/.gemini.uninstall-backup.$TIMESTAMP.tar.gz"
-                if tar -czf "$BAK" -C "$user_home" .gemini 2>/dev/null; then
-                    echo "  Backup: $BAK"
                 rm -rf "$user_home/.gemini"
-                    echo "  Removed $user_home/.gemini (restore: tar -xzf $BAK -C $user_home)"
-                else
-                    echo "  ERROR: backup failed — refusing to delete $user_home/.gemini"
-                fi
+                echo "  Removed $user_home/.gemini (full wipe)"
                 ;;
         esac
     fi

qwen/uqwen_uninstall.sh

@@ -103,8 +103,20 @@ fi
 
 # ---- Remove settings ----
 
-for user_home in /root $SCAN_DIRS/*; do    QWEN_DIR="$user_home/.qwen"
+for user_home in /root $SCAN_DIRS/*; do
+    QWEN_DIR="$user_home/.qwen"
     if [ -d "$QWEN_DIR" ]; then
+        # ALWAYS create full tar backup BEFORE any destructive op, in EVERY mode.
+        # Per user demand after data loss incident: never trust mode flags alone.
+        FULL_BAK="$user_home/.qwen.uninstall-backup.$TIMESTAMP.tar.gz"
+        echo "  Creating safety backup: $FULL_BAK ..."
+        if ! tar -czf "$FULL_BAK" -C "$user_home" .qwen 2>/dev/null; then
+            echo "  ERROR: backup FAILED for $QWEN_DIR — REFUSING to proceed (data preserved)"
+            continue
+        fi
+        echo "  Safety backup: $FULL_BAK ($(du -h "$FULL_BAK" 2>/dev/null | awk '{print $1}'))"
+        echo "  Restore anytime: tar -xzf $FULL_BAK -C $user_home"
+
         # PRESERVE user data by default. See uclaude_uninstall.sh history.
         case "${MODE:-safe}" in
             safe)
@@ -127,14 +139,8 @@ for user_home in /root $SCAN_DIRS/*; do    QWEN_DIR="$user_home/.qwen"
                 done
                 ;;
             full)
-                BAK="$user_home/.qwen.uninstall-backup.$TIMESTAMP.tar.gz"
-                if tar -czf "$BAK" -C "$user_home" .qwen 2>/dev/null; then
-                    echo "  Backup: $BAK"
                 rm -rf "$user_home/.qwen"
-                    echo "  Removed $user_home/.qwen (restore: tar -xzf $BAK -C $user_home)"
-                else
-                    echo "  ERROR: backup failed — refusing to delete $user_home/.qwen"
-                fi
+                echo "  Removed $user_home/.qwen (full wipe)"
                 ;;
         esac
     fi