Lite docs: sync and backup

src/content/docs-lite/en/architecture.md

@@ -10,7 +10,7 @@ src-tauri/        Tauri 2 shell: supervises core, renders the menu bar and the t
 src-tauri/crates/ client setup (tw-adopt) and the configuration scan (tw-scan)
 ```
 
-- **`src-tauri/`** is the Tauri 2 shell. It starts ThinkWatch Core and supervises it: a core that exits is restarted, and after repeated failed starts it runs in a safe mode in which only its control plane is up, so that configuration, history and rollback stay available. The shell renders the menu bar on macOS, the notification-area icon and menu on Windows, and the tray icon and menu on Linux, and it delivers system notifications. Launch at login starts the app, which then starts core; core is not registered on its own.
+- **`src-tauri/`** is the Tauri 2 shell. It starts ThinkWatch Core and supervises it: a core that exits is restarted, and after repeated failed starts it runs in a safe mode in which only its control plane is up, so that the configuration and restoring from backups stay available. The shell renders the menu bar on macOS, the notification-area icon and menu on Windows, and the tray icon and menu on Linux, and it delivers system notifications. Launch at login starts the app, which then starts core; core is not registered on its own.
 - **`src-tauri/crates/`** holds `tw-adopt`, which points clients at the gateway and restores them, and `tw-scan`, which scans client configuration for the MCP page. Both act on the computer the app runs on, also while the app is connected to a core on a server.
 - **`src/`** is the frontend, written in React 19 and Tailwind 4.
 

src/content/docs-lite/en/faq.md

@@ -46,9 +46,9 @@ ThinkWatch Lite changes a client's configuration when the client is connected on
 
 ## Where does ThinkWatch Lite store data, and what does it connect to?
 
-Configuration, keys and request history stay on the computer: in `~/.thinkwatch` on macOS and Linux, in `%APPDATA%\ThinkWatch` for the Windows installer, and in the `data\` folder next to the program for the Windows portable copy. The gateway listens on `127.0.0.1` port 8788 by default.
+Configuration, keys and request history stay on the computer: in `~/.thinkwatch` on macOS and Linux, in `%APPDATA%\ThinkWatch` for the Windows installer, and in the `data\` folder next to the program for the Windows portable copy. With sync turned on, a copy of the configuration, keys included, is also kept in the sync location the user chose, encrypted with the sync passphrase by default. The gateway listens on `127.0.0.1` port 8788 by default.
 
-Besides the upstreams it forwards requests to, ThinkWatch Lite connects to GitHub to check for updates and to refresh LiteLLM's public price list once a day. Signing in to a ChatGPT or Z.ai account goes through their sign-in pages, and a remote core is contacted only when one is configured.
+Besides the upstreams it forwards requests to, ThinkWatch Lite connects to GitHub to check for updates and to refresh LiteLLM's public price list once a day. Signing in to a ChatGPT or Z.ai account goes through their sign-in pages, a remote core is contacted only when one is configured, and a sync location only when sync is turned on.
 
 ## Does ThinkWatch Lite collect usage data?
 

src/content/docs-lite/en/features.md

@@ -61,7 +61,7 @@ Each upstream is also compared over the last 7 days with the others serving the
 
 API keys and header values can be written as `${NAME}` to read a system environment variable. On macOS these come from the login shell, so variables exported in `~/.zshrc` and similar files apply, and the same holds on Linux (`~/.bashrc`, `~/.profile` and so on); on Windows they are the environment variables configured in system settings. After a variable changes, reopening the app picks it up. Proxy variables such as `HTTPS_PROXY`, and `PATH`, are not read.
 
-A relay, a vendor or a ThinkWatch Enterprise console can hand out an import link, `thinkwatch://import?…` or its web form `https://thinkwat.ch/import#…`, that opens the New upstream dialog with the service, address, key, headers, concurrency limit, models, model specs and a price sheet already filled in. The dialog names the host that will receive requests and keys, and nothing is written or sent before Next is chosen or a sign-in is started. A link only ever adds one upstream and cannot set proxies, aliases, routes or environment variable references; a link that needs a newer version of the app says so. The parameters for each service and a link builder are in [Import links](/docs/lite/import-links).
+A relay, a vendor or a ThinkWatch Enterprise console can hand out an import link, `thinkwatch://import?…` or its web form `https://thinkwat.ch/import#…`, that opens the New upstream dialog with the service, address, key, headers, concurrency limit, models, model specs and a price sheet already filled in. The dialog names the host that will receive requests and keys, and nothing is written or sent before Next is chosen or a sign-in is started. A link only ever adds one upstream and cannot set proxies, aliases, routes or environment variable references; a link that needs a newer version of the app says so. The parameters for each service and a link builder are in [Import links](/docs/lite/import-links). **Share…** in an upstream row's menu writes an import link for an existing upstream, with or without its key, and **Export N selected upstreams…** on the toolbar exports the selected upstreams as a config pack (see [Sync and backup](#sync-and-backup)).
 
 ## Routing and failover
 
@@ -105,7 +105,13 @@ Plugins are short JavaScript files that change requests before they go to an ups
 
 ## Settings
 
-Settings has seven sections. Connection lists the local core and the saved remote cores, described in [Connecting to a remote core](/docs/lite/remote-core). General sets the language, the appearance, what the menu bar item shows on macOS (or that it is hidden), launch at login, whether notices arrive as system notifications, in the app only or not at all, and shows hidden guidance hints and ignored warnings again. Listening sets who can reach the gateway (this machine only, the local network of a chosen interface, or every interface), its port and the allowed address ranges. Failover sets how long a failing upstream is paused before requests go to the next one: after how many consecutive failures, for how long, and separate pauses for an insufficient balance, a used-up quota and rate limits. It also sets the no-response timeout, after which an upstream that has sent no content is given up on (300 seconds by default, from 30 to 3,600), and how long in total a request may wait for a free slot on a full upstream or for a key's per-minute or per-hour limit, 30 seconds by default. Log retention sets how long request payloads and request records are kept, and a size cap for payloads; the security log expires with the request records. About shows the version, checks for updates and produces a diagnostics bundle with keys and addresses masked. Uninstall restores every connected client and removes the autostart entry, and is meant to be run before the app is deleted.
+Settings has eight sections. Connection lists the local core and the saved remote cores, described in [Connecting to a remote core](/docs/lite/remote-core). General sets the language, the appearance, what the menu bar item shows on macOS (or that it is hidden), launch at login, whether notices arrive as system notifications, in the app only or not at all, and shows hidden guidance hints and ignored warnings again. Listening sets who can reach the gateway (this machine only, the local network of a chosen interface, or every interface), its port and the allowed address ranges. Failover sets how long a failing upstream is paused before requests go to the next one: after how many consecutive failures, for how long, and separate pauses for an insufficient balance, a used-up quota and rate limits. It also sets the no-response timeout, after which an upstream that has sent no content is given up on (300 seconds by default, from 30 to 3,600), and how long in total a request may wait for a free slot on a full upstream or for a key's per-minute or per-hour limit, 30 seconds by default. Log retention sets how long request payloads and request records are kept, and a size cap for payloads; the security log expires with the request records. Sync and backup exports and imports the configuration, turns on sync and lists the versions of the configuration that can be restored (see [Sync and backup](#sync-and-backup)). About shows the version, checks for updates and produces a diagnostics bundle with keys and addresses masked. Uninstall restores every connected client and removes the autostart entry, and is meant to be run before the app is deleted.
+
+## Sync and backup
+
+A new computer, a reinstall or a second device does not mean entering the configuration again: it can be exported to one file and imported, or synced between devices automatically through a folder, WebDAV or S3-compatible storage of the user's choosing, encrypted with a passphrase by default. Every change to the configuration leaves a version that can be restored, and a deleted upstream can be brought back on its own.
+
+It needs ThinkWatch Lite 2026.10.25 or later. The export and import options, how to set up each sync location, conflicts and restoring are described in [Sync and backup](/docs/lite/sync-and-backup).
 
 ## Menu bar, system tray and notifications
 

src/content/docs-lite/en/import-links.md

@@ -2,7 +2,7 @@
 
 ThinkWatch Lite accepts links that open the New upstream dialog with the settings already filled in. A relay, a model vendor or a ThinkWatch Enterprise console can place such a link in its dashboard or in a welcome message. The user opens it, checks the settings in the same dialog used to add an upstream by hand, and creates the upstream with a few clicks.
 
-This page is written for relay and vendor operators. It describes the two forms of the link, the parameters grouped the way the dialog groups them, which service takes which parameter, the encodings, and what a link intentionally cannot set. A link builder is at the end of the page.
+This page is written for relay and vendor operators. It describes the two forms of the link, the parameters grouped the way the dialog groups them, which service takes which parameter, the encodings, and what a link intentionally cannot set. A link builder is at the end of the page. ThinkWatch Lite can also write such a link for an existing upstream; see [Generated by Lite](#generated-by-lite).
 
 The parameters other than `name`, `url`, `protocol`, `key` and `models` need ThinkWatch Lite 2026.10.16 or later. A link that uses only those five also opens in earlier versions, and every link written for earlier versions stays valid.
 
@@ -213,6 +213,29 @@ thinkwatch://import?service=newapi&url={address}&key={key}
 
 The site fills in its server address and the key of the row, and the preset appears in the chat menu of each key. Opening it needs ThinkWatch Lite 2026.10.16 or later; with an earlier version, or without the app, nothing happens.
 
+## Generated by Lite
+
+From 2026.10.25, ThinkWatch Lite can also write an import link for an existing upstream, to hand it to another device or another person. In the ⋯ menu of an upstream row, **Share…** follows **View traffic** and opens the share dialog:
+
+- The dialog shows the link in its web form. **Copy web link** and **Copy thinkwatch:// link** copy each form. On a device without Lite, the web link shows how to install it, and nothing after `#` is sent to the site's server.
+- **Include keys** is on by default, and the dialog then notes: “The link contains the key. Anyone holding the link can use the key; send it only through trusted channels.” With it off, the link carries no key, and the recipient fills it in in the dialog.
+- The foot of the dialog lists what the link includes and what it leaves out, for example “Includes: address, protocol, key, 2 models, balance source. Leaves out: outbound proxy, routes.”
+
+What the link carries:
+
+| Content | Written | Notes |
+|---|---|---|
+| Service, authentication method, site, name, address, protocol (`service`, `auth`, `site`, `name`, `url`, `protocol`) | Yes | — |
+| Concurrency limit, client identity forwarding, balance source, model list, the models it is limited to, specs set by hand, billing mode, price multiplier, prices (`concurrency`, `client_identity`, `balance`, `models`, `models_only`, `specs`, `billing`, `price_multiplier`, `prices`) | Yes | Values equal to the defaults are left out |
+| Key, headers, AWS access keys, OAuth credentials | As set by **Include keys**, on by default | A value written as `${NAME}` cannot be written, since links do not accept that form; it is left out, with the reason |
+| Outbound proxy, aliases, routes, weights, the disabled state, AWS profile | No | Import links do not accept them; see [What a link can never set](#what-a-link-can-never-set) |
+| ChatGPT and Z.ai / BigModel account sign-ins | No | The link carries the sign-in method only; the recipient stops at the sign-in step and signs in |
+| Tiered prices above 200K; values with characters links do not accept | No | Listed under “Leaves out” at the foot of the dialog |
+
+When the link would be longer than 8192 characters, usually because of many prices or specs, the link form is unavailable; the dialog gives the link's length and suggests a config pack instead, as it does for an upstream that cannot be written as an import link. **Export as config pack…** opens the export dialog with the upstream checked, with passphrase encryption optional and off by default. The recipient imports it with **Import config…**, and the pack can also carry what a link cannot set, such as the upstream's outbound proxy; see [Sync and backup](/docs/lite/sync-and-backup#exporting).
+
+Links are written by the same rules they are read by: a generated link opened in the same version of the app fills in the New upstream dialog with the settings of the original upstream, apart from what the table above leaves out.
+
 ## Keys in links
 
 A link that contains a key, a refresh token or a secret access key is a credential. Generate a separate link for each customer and deliver it through a private channel, such as the customer's own dashboard. A link without a key leaves the key field empty, to be filled in the dialog.

src/content/docs-lite/en/overview.md

@@ -13,6 +13,7 @@ ThinkWatch Lite is a local gateway for Claude Code, Codex and other AI clients,
 - **Every request traceable.** The matched rule, each attempt, any format conversion and the cost, with replay against another upstream; the whole history can be searched, including the text of requests and answers.
 - **Routing and failover.** Rules by model, tools, images and more; groups that fail over before the answer begins and keep each session on one upstream.
 - **Any upstream.** API keys, Amazon Bedrock, ChatGPT and Z.ai accounts, relays and local models, with conversion between the Anthropic, OpenAI and Gemini APIs.
+- **Sync and backup.** The configuration can be exported to one file and imported on a new computer or after a reinstall, or synced between devices through a cloud drive folder, WebDAV or S3-compatible storage, encrypted by default. Every change to it leaves a version that can be restored.
 - **Costs stated as they are.** Estimates marked, unpriced requests counted separately rather than as zero.
 
 ## Pages
@@ -28,7 +29,7 @@ ThinkWatch Lite is a local gateway for Claude Code, Codex and other AI clients,
 | Security | The security log and the three protections with their rules |
 | MCP | MCP servers, skills and hooks in each client, and the configuration scan |
 | Plugins | JavaScript plugins that change requests and answers, with their permissions, trial runs and logs |
-| Settings | Connection, language, appearance, menu bar, notifications, listening, retention, updates and uninstall |
+| Settings | Connection, language, appearance, menu bar, notifications, listening, retention, sync and backup, updates and uninstall |
 
 Each page is described in [Features](/docs/lite/features).
 

src/content/docs-lite/en/remote-core.md

@@ -51,7 +51,7 @@ Clients on this computer, including those inside WSL on Windows, that point to t
 
 - **Overview, Traffic, Keys, Upstreams, Routing and Security** show and change the configuration and history of the core on the server.
 - **Clients and MCP** still act on the computer the app runs on: the Clients page points this computer's clients at the server's gateway, and the MCP page checks this computer's MCP servers, skills and hooks. A note at the top of each page says so. Clients on other machines are configured by hand with the server's gateway address and a gateway key.
-- **Settings** is divided into the app on this computer (connection, general settings, about, uninstall) and the configuration on the server (listening, log retention). The remote control port and its key can be changed only on the server.
+- **Settings** is divided into the app on this computer (connection, general settings, about, uninstall) and the configuration on the server (listening, failover, log retention, sync and backup). The server's configuration can be exported, imported and restored, and the server can join a sync; see [Sync and backup](/docs/lite/sync-and-backup#with-a-remote-core). The remote control port and its key can be changed only on the server.
 - **ChatGPT sign-in** uses a device code only, with the verification address and the code each ready to copy: a browser sign-in returns to the machine that runs core, which is the server.
 - `${NAME}` in an upstream's key or headers reads the environment of the core process on the server, and the **system proxy** option means the server's system proxy.
 - The **diagnostics bundle** is not available. The server refuses three things over a remote connection: producing the bundle, stopping core, and changing `listen.control`.