---
name: config-audit:rollback
description: Restore configuration from backup — list available backups or rollback a specific one
argument-hint: "[backup-id]"
allowed-tools: Read, Write, Glob, Grep, Bash, AskUserQuestion
model: sonnet
---

# Config-Audit: Rollback

Restore configuration files from a previous backup. Without arguments, lists available backups. With a backup ID, restores files from that backup.

## Arguments

- `$ARGUMENTS` may contain a backup ID (format: `YYYYMMDD_HHMMSS`)
- `--raw`: pass-through flag accepted for CLI surface consistency. Rollback is file restoration only (no scanner output, no findings prose), so `--raw` is a no-op here, but the flag is still parsed so users get uniform behaviour across the toolchain.

## Behavior

### List mode (no argument)

Parse flags and list available backups from `~/.claude/config-audit/backups/`:

```bash
RAW_FLAG=""
if echo "$ARGUMENTS" | grep -q -- "--raw"; then RAW_FLAG="--raw"; fi
ls -1 ~/.claude/config-audit/backups/
```

```
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Available Backups
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

 1. 20260403_163045 — 3 files (settings.json, hooks.json, typescript.md)
 2. 20260403_141230 — 1 file (CLAUDE.md)
 3. 20260402_092015 — 5 files (full audit)

 Usage: /config-audit rollback 20260403_163045
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
```

Use the Read tool on each backup's `manifest.yaml` (the list of changes captured at backup time) to extract the file list and timestamps.

### Restore mode (with backup ID)

1. Read the list of changes from `~/.claude/config-audit/backups/{backup-id}/manifest.yaml` using the Read tool
2. Show files that will be restored — ask for confirmation:
   ```
   AskUserQuestion:
     question: "Restore 3 files from backup 20260403_163045?"
     options:
       - "Yes, restore"
       - "Cancel"
   ```
3. For each file in the list of changes:
   a. Read the backup file from `~/.claude/config-audit/backups/{backup-id}/files/{safeName}`
   b. Write to the original path
   c. Verify the checksum matches the recorded value in the list of changes
4. Show result:
   ```
   Restored 3 files from backup 20260403_163045
   - .claude/settings.json (checksum verified)
   - hooks/hooks.json (checksum verified)
   - .claude/rules/typescript.md (checksum verified)
   ```

### Delete mode

If user says "delete" after listing, confirm and remove the backup directory.

## Implementation

Use the backup and rollback libraries directly:
```javascript
import { listBackups, restoreBackup, deleteBackup } from '../scanners/rollback-engine.mjs';
import { parseManifest } from '../scanners/lib/backup.mjs';
```

Or via Bash:
```bash
# List backups
ls -1 ~/.claude/config-audit/backups/

# Read manifest
cat ~/.claude/config-audit/backups/{id}/manifest.yaml

# Restore (copy back)
cp ~/.claude/config-audit/backups/{id}/files/{safeName} {originalPath}
```