@augmentd-labs/canvas-edge 0.6.2 → 0.7.0

package/node_modules/canvas-stored/src/sync/SyncQueue.js

@@ -1,111 +1,31 @@
-import { Worker } from 'worker_threads';
-import { EventEmitter } from 'events';
-import cacache from 'cacache';
-import Debug from 'debug';
+import { EventEmitter } from 'node:events';
+import { randomUUID, createHash } from 'node:crypto';
 
-const debug = Debug('stored:sync');
-
-/**
- * Background sync queue for remote backend writes.
- *
- * Every job is `{ id, cacheRoot, cacheKey, targets[] }` — the bytes already
- * sit in the cache under `cacheKey`; each target gets a copy. Two lanes:
- *   - `driver: 'file'` targets are streamed by a lazily-spawned worker thread
- *     (disk-to-disk copy is the one thing worth taking off the event loop);
- *   - every other driver is committed IN-PROCESS through its live backend
- *     (`backend.commit(key, cachePath)`): network uploads are async I/O, and
- *     the driver's credentials, token and path cache live on the main thread.
- * One `synced` event per job carries the merged results of both lanes.
- */
+/** Compatibility adapter: ordinary remote transfers use the same durable
+ * executor and verification contract as explicit replica plans. */
 export default class SyncQueue extends EventEmitter {
-    #worker = null;
-    #seq = 0;
-    #pending = new Map(); // seq → resolve(results) for in-flight worker jobs
-    #resolveBackend;
-
-    /** @param {{ resolveBackend?: (name:string) => object|undefined }} [options] */
-    constructor({ resolveBackend = null } = {}) {
+    #service; #listener;
+    constructor({ service }) {
         super();
-        this.#resolveBackend = typeof resolveBackend === 'function' ? resolveBackend : () => undefined;
+        this.#service = service;
+        this.#listener = operation => {
+            if (!operation.plan.transportJob) return;
+            if (!['complete', 'blocked'].includes(operation.state)) return;
+            this.emit('synced', { id: operation.plan.contentId, operationId: operation.id,
+                results: operation.plan.replicas.map((target, i) => ({
+                    backend: target.backend, key: operation.outcomes[i]?.key || target.key,
+                    success: operation.state === 'complete',
+                    ...(operation.error ? { error: operation.error.message } : {}),
+                })) });
+        };
+        service.on('changed', this.#listener);
     }
-
     enqueue(job) {
-        const targets = Array.isArray(job?.targets) ? job.targets : [];
-        const viaWorker = targets.filter((t) => t.driver === 'file');
-        const inProcess = targets.filter((t) => t.driver !== 'file');
-        const lanes = [];
-        if (viaWorker.length) lanes.push(this.#viaWorker({ ...job, targets: viaWorker }));
-        if (inProcess.length) lanes.push(this.#inProcess(job, inProcess));
-        if (!lanes.length) return;
-
-        Promise.all(lanes)
-            .then((parts) => {
-                const results = parts.flat();
-                debug(`Sync complete: ${String(job.id).slice(0, 19)}... → ${results.map((r) => `${r.backend}:${r.success}`).join(', ')}`);
-                this.emit('synced', { id: job.id, results });
-            })
-            .catch((err) => this.emit('error', err));
-    }
-
-    async stop() {
-        if (this.#worker) {
-            await this.#worker.terminate();
-            this.#worker = null;
-        }
-        // Jobs the worker never answered must not hang their `synced` forever.
-        for (const [seq, resolve] of this.#pending) {
-            this.#pending.delete(seq);
-            resolve([]);
-        }
-    }
-
-    #viaWorker(job) {
-        if (!this.#worker) this.#spawnWorker();
-        const seq = ++this.#seq;
-        return new Promise((resolve) => {
-            this.#pending.set(seq, resolve);
-            this.#worker.postMessage({ seq, ...job });
-        });
-    }
-
-    async #inProcess({ cacheRoot, cacheKey }, targets) {
-        const info = await cacache.get.info(cacheRoot, cacheKey).catch(() => null);
-        if (!info) {
-            return targets.map((t) => ({ backend: t.name, key: t.key, success: false, error: 'Cache read failed: entry not found' }));
-        }
-        const results = [];
-        for (const target of targets) {
-            const backend = this.#resolveBackend(target.name);
-            if (!backend || typeof backend.commit !== 'function') {
-                results.push({ backend: target.name, key: target.key, success: false, error: `Backend not registered: ${target.name}` });
-                continue;
-            }
-            try {
-                await backend.commit(target.key, info.path);
-                results.push({ backend: target.name, key: target.key, success: true });
-            } catch (err) {
-                debug(`In-process sync to ${target.name}:${target.key} failed: ${err.message}`);
-                results.push({ backend: target.name, key: target.key, success: false, error: err.message });
-            }
-        }
-        return results;
-    }
-
-    #spawnWorker() {
-        this.#worker = new Worker(new URL('./worker.js', import.meta.url));
-        this.#worker.on('message', (msg) => {
-            const resolve = this.#pending.get(msg.seq);
-            if (resolve) {
-                this.#pending.delete(msg.seq);
-                resolve(msg.results || []);
-                return;
-            }
-            // No correlation (foreign/legacy message) — surface as-is.
-            this.emit('synced', msg);
-        });
-        this.#worker.on('error', (err) => {
-            debug(`Worker error: ${err.message}`);
-            this.emit('error', err);
+        return this.#service.submit({
+            id: `transfer:${randomUUID()}`, owner: `transfer:${createHash('sha256').update(JSON.stringify([job.id, job.targets])).digest('hex')}`,
+            contentId: job.id, sourceCacheKey: job.cacheKey, transportJob: true,
+            replicas: job.targets.map(t => ({ backend: t.name, key: t.key, mirror: false, onConflict: 'error' })),
         });
     }
+    async stop() { this.#service.off('changed', this.#listener); }
 }

package/node_modules/canvas-stored/src/trash.js

@@ -0,0 +1,219 @@
+import crypto from 'node:crypto';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+// Per-deletion provenance, separate from the deduplicated retained blob pool.
+// Restoring one path never consumes the bytes needed by another trash item.
+export default class BackendTrash {
+    tasks = new Map();
+    constructor(stored) { this.stored = stored; }
+    get db() { return this._db ??= this.stored.index.openDB('backend-trash-v1'); }
+    get days() { return this.stored.retention?.days || 0; }
+
+    prepare(backend, key, { retained = null, directory = false, mtime = null, reason = 'delete' } = {}) {
+        if (!this.days || (!directory && !retained)) return null;
+        const item = {
+            id: crypto.randomUUID(), backend, key, type: directory ? 'directory' : 'file',
+            sha256: retained?.sha256 ?? null, size: retained?.size ?? null,
+            mimeType: retained?.mimeType ?? null, mtime, reason, deletedAt: Date.now(), state: 'pending',
+        };
+        this.db.putSync(`item:${item.id}`, item);
+        return item;
+    }
+
+    finish(item) {
+        if (item) this.db.putSync(`item:${item.id}`, { ...item, state: 'active' });
+    }
+
+    async remove(backendName, key, { operationId, sha256 } = {}) {
+        if (!operationId || !/^[a-f0-9]{64}$/i.test(sha256 || '')) return { ok: false, reason: 'content-identity-required' };
+        const backend = this.stored.getBackend(backendName);
+        if (!backend?.canDelete || backend.config.readOnly || backend.config.removalPolicy?.acceptPropagatedDeletions !== true) return { ok: false, reason: 'protected-backend' };
+        // Remote drivers must implement conditional removal before joining this
+        // executor. A stale listing is never authority to erase a newer object.
+        if (!['file', 'cacache'].includes(backend.config.driver)) return { ok: false, reason: 'conditional-removal-unsupported' };
+        if (backend.config.driver === 'file' && !this.days) return { ok: false, reason: 'file-recovery-unavailable' };
+        const digest = crypto.createHash('sha256').update(operationId).digest('hex');
+        const id = `${digest.slice(0, 8)}-${digest.slice(8, 12)}-${digest.slice(12, 16)}-${digest.slice(16, 20)}-${digest.slice(20, 32)}`;
+        let item = this.db.get(`item:${id}`);
+        if (item && (item.backend !== backendName || item.key !== key || item.sha256 !== sha256)) return { ok: false, reason: 'operation-conflict' };
+        if (item && ['active', 'restored', 'discarded'].includes(item.state)) return { ok: true, trashId: id, state: item.state };
+        if (typeof backend.verifyRoot === 'function' && !(await backend.verifyRoot()).ok) return { ok: false, reason: 'backend-unavailable' };
+        const current = await backend.stat(key);
+        if (!current) {
+            if (item?.recoveryReady) { this.finish(item); return { ok: true, trashId: id }; }
+            return { ok: true, missing: true };
+        }
+        item ||= { id, backend: backendName, key, type: 'file', sha256, reason: 'propagated-delete', manual: true,
+            deletedAt: Date.now(), state: 'pending', cacheKey: `trash:${id}`, size: current.size, mtime: current.modified };
+        this.db.putSync(`item:${id}`, item);
+        if (!item.recoveryReady) {
+            const input = await backend.get(key, { stream: true });
+            if (!input) return { ok: false, reason: 'source-unreadable' };
+            const hash = crypto.createHash('sha256');
+            await pipeline(Buffer.isBuffer(input) ? Readable.from([input]) : input,
+                new Transform({ transform(chunk, encoding, done) { hash.update(chunk); done(null, chunk); } }),
+                this.stored.cache.putStream(item.cacheKey, { trashId: id }));
+            if (hash.digest('hex') !== sha256) { await this.stored.cache.delete(item.cacheKey); return { ok: false, reason: 'source-changed' }; }
+            item.recoveryReady = true; this.db.putSync(`item:${id}`, item);
+        }
+        const result = await this.stored.removeObject(backendName, key, { ifMatch: sha256, origin: `trash:${id}`, trashItem: item });
+        if (!result.ok) return result;
+        this.finish(item);
+        return { ...result, trashId: id };
+    }
+    quarantine(item) {
+        item.quarantined = true;
+        this.db.putSync(`item:${item.id}`, item);
+    }
+
+    async importLegacy(backendName) {
+        const backend = this.stored.getBackend(backendName);
+        if (!backend || !this.days) return;
+        for (const retained of this.stored.listRetained({ backend: backendName, limit: Infinity })) {
+            const keys = retained.legacyKeys ?? (retained.trashVersion ? [] : retained.keys || []);
+            for (const address of keys) {
+                if (!address.startsWith(`${backendName}:`)) continue;
+                const key = address.slice(backendName.length + 1);
+                const deletedAt = retained.legacyAt ?? retained.lastAt;
+                const id = crypto.createHash('sha256').update(JSON.stringify([backendName, key, retained.sha256, deletedAt])).digest('hex');
+                if (this.db.get(`legacy:${id}`)) continue;
+                // Old retention mixed overwrites and deletes. Import absent
+                // original paths only, never old versions of a live file.
+                const current = await backend.stat(key);
+                if (!current) this.db.putSync(`item:${id}`, {
+                    id, backend: backendName, key, type: 'file', sha256: retained.sha256,
+                    size: retained.size, mimeType: retained.mimeType, mtime: null,
+                    deletedAt, state: 'active', legacy: true,
+                });
+                this.db.putSync(`legacy:${id}`, true);
+            }
+        }
+    }
+
+    async get(backendName, id) {
+        let item = this.db.get(`item:${id}`);
+        if (!item || item.backend !== backendName || ['restored', 'discarded'].includes(item.state)
+            || (!item.manual && (!this.days || Date.now() - item.deletedAt >= this.days * 86400000))) return null;
+        if (item.state === 'pending') {
+            if (item.manual && !item.recoveryReady) return null;
+            const backend = this.stored.getBackend(backendName);
+            const deleted = item.type === 'directory' || item.quarantined
+                ? await backend.hasTrashedDirectory(item.id)
+                : !await backend.stat(item.key);
+            if (!deleted) return null;
+            this.finish(item);
+            item = { ...item, state: 'active' };
+        }
+        return item;
+    }
+
+    async list(backendName, { cursor = null, limit = 200 } = {}) {
+        limit = Math.max(1, Math.min(1000, Number(limit) || 200));
+        await this.importLegacy(backendName);
+        const items = [];
+        for (const { key, value } of [...this.db.getRange()]) {
+            if (!key.startsWith('item:') || value.backend !== backendName
+                || (cursor && value.id.localeCompare(cursor) <= 0)) continue;
+            const item = await this.get(backendName, value.id);
+            // Overwrite captures back retained versions, not user deletions.
+            if (item && item.reason !== 'overwrite') items.push(item);
+        }
+        items.sort((a, b) => a.id.localeCompare(b.id));
+        const page = items.slice(0, limit);
+        return { items: page.map(({ state: _state, backend: _backend, ...item }) => item),
+            cursor: items.length > limit ? page.at(-1).id : null, retention: this.stored.retention };
+    }
+
+    withItemLock(id, fn) {
+        const task = (this.tasks.get(id) || Promise.resolve()).catch(() => {}).then(fn);
+        this.tasks.set(id, task);
+        void task.finally(() => { if (this.tasks.get(id) === task) this.tasks.delete(id); }).catch(() => {});
+        return task;
+    }
+
+    restore(backendName, id, options = {}) {
+        return this.withItemLock(id, () => this.restoreItem(backendName, id, options));
+    }
+
+    async restoreItem(backendName, id, { origin = null } = {}) {
+        const item = await this.get(backendName, id);
+        if (!item) return { ok: false, reason: 'not-found', id };
+        if (item.state === 'discarding') return { ok: false, reason: 'deletion-pending', id };
+        await this.stored.getBackend(backendName).validateTrashTarget?.(item.key);
+        const result = item.cacheKey
+            ? await this.restorePinned(item, origin)
+            : item.type === 'directory' || item.quarantined
+            ? await this.stored.getBackend(backendName).restoreTrashedDirectory(id, item.key)
+            : await this.stored.restoreRetained(item.sha256, {
+                backend: backendName, key: item.key, ifNoneMatch: '*', mtime: item.mtime, origin,
+            });
+        if (item.quarantined && result.reason === 'target-exists') result.reason = 'precondition-failed';
+        if (result?.ok && item.quarantined) await this.stored.refreshObject(backendName, item.key, origin);
+        if (result?.ok) this.db.putSync(`item:${id}`, { ...item, state: 'restored', restoredAt: Date.now() });
+        if (result?.ok && item.cacheKey) {
+            await this.stored.cache.delete(item.cacheKey);
+            if (item.quarantined) await this.stored.getBackend(backendName).dropTrashedDirectory(id);
+        }
+        return { ...result, id, key: item.key, type: item.type };
+    }
+
+    async restorePinned(item, origin) {
+        const backend = this.stored.getBackend(item.backend);
+        if (!backend?.canWrite || backend.config.readOnly) return { ok: false, reason: 'read-only-backend' };
+        const hash = crypto.createHash('sha256');
+        for await (const chunk of this.stored.cache.getStream(item.cacheKey)) hash.update(chunk);
+        if (hash.digest('hex') !== item.sha256) return { ok: false, reason: 'recovery-content-changed' };
+        if (backend.config.driver === 'cacache') {
+            // Stored's physical mutation lock covers this check and put. The
+            // managed blob store has no external writers.
+            if (await backend.stat(item.key)) return { ok: false, reason: 'precondition-failed' };
+            const info = await this.stored.cache.getInfo(item.cacheKey);
+            return this.stored.put(info.path, { backends: [item.backend], key: item.key, origin });
+        }
+        return this.stored.writeObject(item.backend, item.key, this.stored.cache.getStream(item.cacheKey), { sha256: item.sha256, ifNoneMatch: '*', origin, mtime: item.mtime });
+    }
+
+    hasReference(sha256, exceptId, address = null) {
+        for (const { key, value } of this.db.getRange()) {
+            if (key.startsWith('item:') && value.id !== exceptId && value.sha256 === sha256
+                && !['discarded', 'restored'].includes(value.state)
+                && (!address || `${value.backend}:${value.key}` === address)) return true;
+        }
+        return false;
+    }
+
+    discard(backendName, id) {
+        return this.withItemLock(id, () => this.discardItem(backendName, id));
+    }
+
+    async discardItem(backendName, id) {
+        const item = this.db.get(`item:${id}`);
+        if (!item || item.backend !== backendName || item.state === 'restored') return { id, ok: false, reason: 'not-found' };
+        const result = { id, key: item.key, type: item.type, ok: true };
+        if (item.state === 'discarded') return { ...result, alreadyDeleted: true };
+        const backend = this.stored.getBackend(backendName);
+        if (!backend?.canDelete) return { id, ok: false, reason: 'read-only-backend' };
+        // Persist intent before removing bytes. Interrupted/failed deletion can
+        // be retried, but must not race a subsequent attempt to restore it.
+        this.db.putSync(`item:${id}`, { ...item, state: 'discarding' });
+        const finish = () => this.db.putSync(`item:${id}`, { ...item, state: 'discarded', discardedAt: Date.now() });
+        if (item.cacheKey) { if (item.quarantined) await backend.dropTrashedDirectory(id); await this.stored.cache.delete(item.cacheKey); finish(); }
+        else if (item.type === 'directory') { await backend.dropTrashedDirectory(id); finish(); }
+        else if (item.quarantined) { await backend.dropTrashedDirectory(id); await this.stored.discardTrashBytes(item, finish); }
+        else await this.stored.discardTrashBytes(item, finish);
+        return result;
+    }
+
+    async sweep(now) {
+        for (const { key, value } of [...this.db.getRange()]) {
+            if (!key.startsWith('item:') || value.manual || now - value.deletedAt < this.days * 86400000) continue;
+            if (value.type === 'directory' || value.quarantined) {
+                const backend = this.stored.getBackend(value.backend);
+                if (!backend) continue;
+                await backend.dropTrashedDirectory(value.id);
+            }
+            this.db.removeSync(key);
+        }
+    }
+}

package/node_modules/canvas-stored/src/utils/common.js

@@ -28,6 +28,13 @@ export function isFile(input) {
     catch { return false; }
 }
 
+/** Ingestion must not synchronously stat paths that may live on a NAS. */
+export async function isFileAsync(input) {
+    if (typeof input !== 'string') return false;
+    try { return (await fs.promises.stat(input)).isFile(); }
+    catch { return false; }
+}
+
 export function isBuffer(input) {
     return Buffer.isBuffer(input);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmentd-labs/canvas-edge",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Canvas device runtime: folder mirrors (canvas-stored Mirror engine) + edge tunnel client (dist artifact)",
   "license": "AGPL-3.0-or-later",
   "type": "module",
@@ -21,7 +21,8 @@
   },
   "dependencies": {
     "@augmentd-labs/canvas-protocol": "^0.5.0",
-    "canvas-stored": "1.9.3",
+    "canvas-stored": "1.18.0",
+    "@aws-sdk/client-s3": "^3.1149.0",
     "cacache": "^20.0.4",
     "chokidar": "^5.0.0",
     "debug": "^4.4.3",
@@ -31,7 +32,7 @@
     "fs-extra": "^11.3.4",
     "image-size": "^2.0.2",
     "imap": "^0.8.19",
-    "lmdb": "^3.5.2",
+    "lmdb": "3.5.7",
     "music-metadata": "^11.9.0",
     "picomatch": "^2.3.1",
     "fastify": "^4.29.1",
@@ -47,6 +48,6 @@
   "bundleDependencies": [
     "canvas-stored"
   ],
-  "canvasRev": "52fc07d",
+  "canvasRev": "9cc56fa",
   "canvasSource": "runtimes/edge"
 }

package/src/binding.js

@@ -0,0 +1,33 @@
+'use strict';
+
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+
+/** Where the binding id lives inside a mirrored folder. */
+export const BINDING_FILE = '.workspace/binding';
+
+/**
+ * The id shared by a mirrored folder and its sync history (`stateDir`),
+ * created on first start. History is refused for a folder that does not carry
+ * the id, and for an empty folder when history exists but predates bindings:
+ * both are what an unmounted drive looks like.
+ */
+export function bindFolder(folder, stateDir, hadHistory) {
+    const read = (file) => { try { return fs.readFileSync(file, 'utf8').trim() || null; } catch { return null; } };
+    const marker = path.join(folder, BINDING_FILE);
+    const record = path.join(stateDir, 'binding');
+    const known = read(record);
+    if (known) {
+        if (read(marker) !== known) throw new Error(`${folder} is not the folder this mirror's sync history belongs to (drive not mounted, or the folder was replaced); nothing was synced. Mount it, or remove ${stateDir} to start the mirror from scratch`);
+        return known;
+    }
+    const empty = !fs.existsSync(folder) || fs.readdirSync(folder).every((name) => name.startsWith('.'));
+    if (hadHistory && empty) throw new Error(`${folder} is empty but ${stateDir} holds sync history for it (drive not mounted?); nothing was synced. Mount it, or remove ${stateDir} to start the mirror from scratch`);
+    const id = crypto.randomBytes(16).toString('hex');
+    fs.mkdirSync(path.dirname(marker), { recursive: true });
+    fs.mkdirSync(stateDir, { recursive: true });
+    fs.writeFileSync(marker, `${id}\n`);
+    fs.writeFileSync(record, `${id}\n`);
+    return id;
+}

package/src/control.js

@@ -31,6 +31,19 @@ export async function startControl({ runtimes, reload, shutdown, logger }) {
         r.nudge();
         return { ok: true };
     });
+    // Local deletions held by the mirror's delete guard: list, send, or undo.
+    app.get('/mirrors/:id/deletes', async (req, reply) => {
+        const r = byId(req.params.id);
+        if (typeof r?.heldDeletes !== 'function') return reply.code(404).send({ error: 'no such mirror' });
+        return { held: r.heldDeletes() };
+    });
+    app.post('/mirrors/:id/deletes/:verb', async (req, reply) => {
+        const r = byId(req.params.id);
+        if (typeof r?.heldDeletes !== 'function') return reply.code(404).send({ error: 'no such mirror' });
+        if (req.params.verb === 'approve') return { approved: r.approveDeletes() };
+        if (req.params.verb === 'restore') return { restored: r.restoreDeletes() };
+        return reply.code(404).send({ error: 'approve or restore' });
+    });
     app.post('/reload', async () => { await reload(); return { ok: true, mirrors: runtimes.size }; });
     app.post('/shutdown', async () => { setTimeout(() => shutdown(), 50); return { ok: true }; });
 

package/src/daemon.js

@@ -8,6 +8,8 @@ import { MirrorRuntime } from './mirror-runtime.js';
 import { FuseRuntime } from './fuse-runtime.js';
 import { startControl } from './control.js';
 
+const START_RETRY_MS = 60_000;
+
 /*
  * canvas-edge: the device-side daemon for real-folder mirrors (the non-FUSE
  * client of the sync protocol, for macOS/Windows and anyone who wants a plain
@@ -32,7 +34,13 @@ export async function main(argv = process.argv.slice(2)) {
         logger.error({ err: err?.message }, 'env-driven mirror config failed');
     }
 
+    // A mirror that cannot start (its drive is not mounted yet) is tried again.
+    let retry = null;
+    let stopping = false;
     const load = async () => {
+        clearTimeout(retry);
+        retry = null;
+        let failed = false;
         const wanted = daemonMirrors();
         const fuse = fuseMirrors();
         const wantedIds = new Set([...wanted, ...fuse].map((m) => m.id));
@@ -53,6 +61,8 @@ export async function main(argv = process.argv.slice(2)) {
                 await rt.start();
                 runtimes.set(mirror.id, rt);
             } catch (err) {
+                failed = true;
+                await rt.stop().catch(() => {});
                 logger.error({ mirror: mirror.id, err: err?.message }, 'mirror failed to start');
             }
         }
@@ -67,9 +77,12 @@ export async function main(argv = process.argv.slice(2)) {
                 logger.error({ unit: mirror.id, err: err?.message }, 'fuse unit failed to start');
             }
         }
+        if (failed && !stopping) {
+            retry = setTimeout(() => load().catch((err) => logger.error({ err: err?.message }, 'reload failed')), START_RETRY_MS);
+            retry.unref?.();
+        }
     };
 
-    let stopping = false;
     const shutdown = async () => {
         if (stopping) return;
         stopping = true;

package/src/env.js

@@ -99,7 +99,7 @@ export function ensureEnvConfig(env = process.env) {
         mountpoint: path.resolve(env.CANVAS_MIRROR_PATH ? String(env.CANVAS_MIRROR_PATH) : (existing.mountpoint || '/data')),
         pins: env.CANVAS_PINS != null ? list(env.CANVAS_PINS) : (existing.pins || []),
         ignore: env.CANVAS_IGNORE != null ? list(env.CANVAS_IGNORE) : (existing.ignore || []),
-        conflicts: oneOf(env.CANVAS_CONFLICTS, ['prompt', 'rename'], existing.conflicts || 'prompt'),
+        conflicts: oneOf(env.CANVAS_CONFLICTS, ['prompt', 'rename'], existing.conflicts || 'rename'),
         deletes: oneOf(env.CANVAS_DELETES, ['propagate', 'keep'], existing.deletes || 'propagate'),
         direction: oneOf(env.CANVAS_DIRECTION, ['bi', 'pull', 'push'], existing.direction || 'bi'),
         client: 'daemon',

package/src/mirror-runtime.js

@@ -7,6 +7,7 @@ import { io } from 'socket.io-client';
 import Stored, { Mirror } from 'canvas-stored';
 import { MIRROR_IGNORE_DEFAULTS } from 'canvas-stored/src/sync/keys.js';
 import { DEFAULT_SYNC_EXCLUSIONS, WORKSPACE_INTERNAL_EXCLUSIONS } from '@augmentd-labs/canvas-protocol';
+import { BINDING_FILE, bindFolder } from './binding.js';
 
 const STATUS_THROTTLE_MS = 5000;
 const STATUS_HEARTBEAT_MS = 60000;
@@ -19,7 +20,11 @@ const STATUS_HEARTBEAT_MS = 60000;
  * `<folder>/.workspace/` (mirror.json, db/stored, cache, tmp, trash,
  * conflicts) — the folder is self-describing and movable — unless the mirror
  * names a `stateDir` (or the daemon a CANVAS_EDGE_STATE_ROOT), in which case
- * the folder holds user files only and everything else lives there. Staging
+ * the folder holds user files plus `.workspace/binding` and everything else
+ * lives there. The binding is a random id written to both the folder and the
+ * state dir: sync history is only ever applied to the folder that carries it,
+ * so an unmounted drive or a replaced folder is refused instead of read as
+ * "every file was deleted". Staging
  * (temp) must share a filesystem with the folder for atomic placement, so
  * it stays under the state dir only when that is on the same device and
  * falls back to `<folder>/.stored-tmp` otherwise.
@@ -61,7 +66,9 @@ export class MirrorRuntime {
         const folder = this.folder;
         const internal = this.stateDir;
         const external = internal !== path.join(folder, '.workspace');
+        const hadHistory = fs.existsSync(path.join(internal, 'db', 'stored'));
         for (const d of ['db/stored', 'cache', 'trash', 'conflicts']) fs.mkdirSync(path.join(internal, d), { recursive: true });
+        const binding = bindFolder(folder, internal, hadHistory);
         let tempDir = path.join(internal, 'tmp');
         if (external && !canRenameInto(path.join(internal, 'tmp'), folder)) {
             // st_dev lies for bind mounts (one disk, two mounts, rename refused):
@@ -84,7 +91,8 @@ export class MirrorRuntime {
         this.#stored = new Stored({ root: path.join(internal, 'db', 'stored'), cache: { path: path.join(internal, 'cache') }, checksums: ['sha256'] });
         this.#stored.on('error', (err) => this.#logger.warn({ mirror: this.id, err: err?.message }, 'stored error'));
         this.#stored.addBackend('local', {
-            driver: 'file', root: folder, watch: true, tempDir, followSymlinks: false, stabilityThreshold: 2000,
+            driver: 'file', root: folder, createRoot: false, marker: { file: BINDING_FILE, id: binding },
+            watch: true, tempDir, followSymlinks: false, stabilityThreshold: 2000,
             ignored: [...new Set([...WORKSPACE_INTERNAL_EXCLUSIONS, ...DEFAULT_SYNC_EXCLUSIONS, ...hubExclusions, ...MIRROR_IGNORE_DEFAULTS, ...(this.#mirror.ignore || [])])],
         });
         this.#stored.addBackend('trash', { driver: 'file', root: path.join(internal, 'trash'), watch: false });
@@ -98,7 +106,7 @@ export class MirrorRuntime {
         this.#engine = new Mirror(this.#stored, {
             id: this.#mirror.id, local: 'local', remote: 'canvas:hub', trash: 'trash', conflicts: 'conflicts',
             prefixes: this.#mirror.pins || [], ignore: this.#mirror.ignore || [],
-            deletes: this.#mirror.deletes || 'propagate', conflictMode: this.#mirror.conflicts || 'prompt',
+            deletes: this.#mirror.deletes || 'propagate', conflictMode: this.#mirror.conflicts || 'rename',
             direction: this.#mirror.direction || 'bi',
             deviceId: this.#identity.deviceId, deviceName: this.#identity.deviceName,
         });
@@ -109,6 +117,7 @@ export class MirrorRuntime {
         this.#engine.on('revert', (e) => this.#logger.info({ mirror: this.id, key: e?.key, copy: e?.copy }, 'local edit reverted (pull mirror), copy kept'));
         this.#engine.on('skip', (e) => this.#logger.info({ mirror: this.id, key: e?.key, reason: e?.reason }, 'key skipped'));
         this.#engine.on('conflict', (c) => this.#logger.info({ mirror: this.id, key: c?.key }, 'conflict recorded'));
+        this.#engine.on('hold', (h) => this.#logger.warn({ mirror: this.id, files: h?.count }, 'many files are missing locally — deletions held; approve or restore with `canvas remote mirror deletes`'));
         await this.#engine.start();
         await this.#connectSocket();
         this.#reporter = setInterval(() => this.#report().catch(() => {}), STATUS_HEARTBEAT_MS);
@@ -135,7 +144,9 @@ export class MirrorRuntime {
     }
 
     nudge() { this.#engine?.nudge?.(); }
-    async resync() { return this.#engine?.reconcileAll?.(); }
+    heldDeletes() { return this.#engine?.heldDeletes() ?? []; }
+    approveDeletes() { return this.#engine?.approveDeletes() ?? 0; }
+    restoreDeletes() { return this.#engine?.restoreDeletes() ?? 0; }
 
     async #fetchHubExclusions() {
         try {