restore

Restore a previously-taken memory backup. Safe by default: always takes a timestamped snapshot of the current memory dir before overwriting, so a bad restore is itself reversible.

Step 1 — Parse arguments

The user invoked this command with: $ARGUMENTS

• Positional arg — a specific backup name (e.g., memory.backup-20260417143052) OR the literal word latest. If omitted, we'll list backups and prompt the user interactively.
• --dir <path> — absolute path to the memory directory to restore INTO. If not set, auto-detect the current project's memory dir (same logic as /mempenny:clean).
• --lang <code> — output language. Defaults to MEMPENNY_LOCALE or en.

Step 2 — Load locale strings

2a — Validate <lang> before reading (H2: path traversal guard)

Before constructing the locale path, validate that <lang> matches the regex ^[a-zA-Z]{2,3}(-[A-Za-z0-9]{2,8})?$. If it does not match, treat it exactly like a missing locale: silently reset <lang> to en and warn with errors.locale_missing.

Read ${CLAUDE_PLUGIN_ROOT}/locales/<lang>/strings.json. Fall back to en if the file is missing (warn with errors.locale_missing). You need restore.* and errors.* keys.

Step 3 — Locate the target memory directory

If --dir <path> was passed, apply the following validation before using it. On any failure, print errors.memory_dir_not_found and STOP:

Validate --dir <path> (C-class shell-injection guard):

1. Regex: the candidate path must match ^/[A-Za-z0-9/_.\ -]{1,4096}$ (alphanumerics, slash, underscore, dot, hyphen, space only).
2. Realpath: run realpath "<candidate>" via Bash. Use the resolved value for all subsequent steps.
3. Depth: reject if the realpath equals / or has fewer than 2 path components.
4. Existence + not-a-symlink: [ -d "$resolved" ] && [ ! -L "$resolved" ]. (It's OK if the directory does not exist yet — restore will create it. Skip check 4 if the path does not exist, but still apply checks 1–3.)