@dboio/cli 0.8.0 → 0.9.2

package/src/commands/deploy.js

@@ -178,7 +178,7 @@ export const deployCommand = new Command('deploy')
           log.success(`${entryName} deployed`);
         } else {
           log.error(`${entryName} failed`);
-          formatResponse(result, { json: options.json });
+          formatResponse(result, { json: options.json, verbose: options.verbose });
           if (!options.all) process.exit(1);
         }
       }

package/src/commands/init.js

@@ -7,6 +7,7 @@ import { scaffoldProjectDirs, logScaffoldResult } from '../lib/scaffold.js';
 import { createDboignore, loadIgnore } from '../lib/ignore.js';
 import { log } from '../lib/logger.js';
 import { checkDomainChange, writeAppJsonDomain } from '../lib/domain-guard.js';
+import { performLogin } from './login.js';
 
 export const initCommand = new Command('init')
   .description('Initialize DBO CLI configuration for the current directory')
@@ -19,8 +20,9 @@ export const initCommand = new Command('init')
   .option('--non-interactive', 'Skip all interactive prompts')
   .option('-g, --global', 'Install Claude commands to user home directory (~/.claude/commands/)')
   .option('--local', 'Install Claude commands to project directory (.claude/commands/)')
-  .option('--scaffold', 'Create standard project directories (App Versions, Automations, Bins, …)')
+  .option('--scaffold', 'Create standard project directories (app_version, automation, bins, …)')
   .option('--dboignore', 'Create or reset .dboignore to defaults (use with --force to overwrite)')
+  .option('--media-placement <placement>', 'Set media placement when cloning: fullpath or binpath (default: bin)')
   .action(async (options) => {
     // Merge --yes into nonInteractive
     if (options.yes) options.nonInteractive = true;
@@ -97,7 +99,7 @@ export const initCommand = new Command('init')
       }
 
       // Ensure sensitive files are gitignored
-      await ensureGitignore(['.dbo/credentials.json', '.dbo/cookies.txt', '.dbo/config.local.json', '.dbo/ticketing.local.json']);
+      await ensureGitignore(['.dbo/credentials.json', '.dbo/cookies.txt', '.dbo/config.local.json', '.dbo/ticketing.local.json', 'trash/']);
 
       const createdIgnore = await createDboignore();
       if (createdIgnore) log.dim('  Created .dboignore');
@@ -165,7 +167,7 @@ export const initCommand = new Command('init')
         logScaffoldResult(result);
       }
 
-      // Clone if requested
+      // Clone if requested — requires authentication first
       if (options.clone || options.app) {
         let appShortName = options.app;
         if (!appShortName) {
@@ -177,8 +179,15 @@ export const initCommand = new Command('init')
           }]);
           appShortName = appName;
         }
+
+        // Authenticate before fetching app data from the server
+        if (!options.nonInteractive) {
+          log.info('Login required to fetch app data from the server.');
+          await performLogin(domain, username);
+        }
+
         const { performClone } = await import('./clone.js');
-        await performClone(null, { app: appShortName, domain });
+        await performClone(null, { app: appShortName, domain, mediaPlacement: options.mediaPlacement });
       }
 
       // Offer Claude Code integration (skip in non-interactive mode)

package/src/commands/input.js

@@ -124,7 +124,7 @@ export const inputCommand = new Command('input')
           result = await client.postMultipart('/api/input/submit', fields, files);
         }
 
-        formatResponse(result, { json: options.json, jq: options.jq });
+        formatResponse(result, { json: options.json, jq: options.jq, verbose: options.verbose });
         if (!result.successful) process.exit(1);
       } else {
         // URL-encoded mode
@@ -153,7 +153,7 @@ export const inputCommand = new Command('input')
           result = await client.postUrlEncoded('/api/input/submit', body);
         }
 
-        formatResponse(result, { json: options.json, jq: options.jq });
+        formatResponse(result, { json: options.json, jq: options.jq, verbose: options.verbose });
         if (!result.successful) process.exit(1);
       }
     } catch (err) {

package/src/commands/login.js

@@ -3,6 +3,75 @@ import { loadConfig, saveUserInfo, saveUserProfile, ensureGitignore } from '../l
 import { DboClient } from '../lib/client.js';
 import { log } from '../lib/logger.js';
 
+/**
+ * Perform authentication against a DBO instance.
+ * Prompts for missing credentials interactively.
+ * Returns true on success, throws on failure.
+ *
+ * @param {string|null} domain - Override domain (null = use config)
+ * @param {string|null} knownUsername - Pre-filled username (will prompt if null)
+ */
+export async function performLogin(domain, knownUsername) {
+  const config = await loadConfig();
+  const client = new DboClient({ domain });
+
+  let username = knownUsername || config.username;
+  let password;
+
+  // Interactive prompt for missing credentials
+  const inquirer = (await import('inquirer')).default;
+  const answers = await inquirer.prompt([
+    { type: 'input', name: 'username', message: 'Username (email):', default: username || undefined, when: !username },
+    { type: 'password', name: 'password', message: 'Password:', mask: '*' },
+  ]);
+  username = username || answers.username;
+  password = answers.password;
+
+  const params = new URLSearchParams();
+  params.append('_username', username);
+  params.append('_password', password);
+
+  const result = await client.postUrlEncoded('/api/authenticate', params.toString());
+
+  if (!result.successful) {
+    throw new Error('Authentication failed');
+  }
+
+  log.success(`Authenticated as ${username} on ${await client.getDomain()}`);
+  await ensureGitignore(['.dbo/credentials.json', '.dbo/cookies.txt', '.dbo/ticketing.local.json']);
+
+  // Fetch and store user info (non-critical)
+  try {
+    const userResult = await client.get('/api/output/31799e38f0854956a47f10', { '_format': 'json_raw' });
+    const userData = userResult.payload || userResult.data;
+    const rows = Array.isArray(userData) ? userData : (userData?.Rows || userData?.rows || []);
+    if (rows.length > 0) {
+      const row = rows[0];
+      const userId = row.ID || row.id || row.UserID || row.userId;
+      if (userId) {
+        await saveUserInfo({ userId: String(userId) });
+        log.dim(`  User ID: ${userId}`);
+      }
+      const firstName = row.FirstName || row.firstname || row.first_name;
+      const lastName = row.LastName || row.lastname || row.last_name;
+      const email = row.Email || row.email;
+      const profile = {};
+      if (firstName) profile.FirstName = firstName;
+      if (lastName) profile.LastName = lastName;
+      if (email) profile.Email = email;
+      if (Object.keys(profile).length > 0) {
+        await saveUserProfile(profile);
+        if (firstName || lastName) log.dim(`  Name:     ${[firstName, lastName].filter(Boolean).join(' ')}`);
+        if (email) log.dim(`  Email:    ${email}`);
+      }
+    }
+  } catch {
+    log.dim('  Could not retrieve user info (non-critical)');
+  }
+
+  return true;
+}
+
 export const loginCommand = new Command('login')
   .description('Authenticate with a DBO.io instance')
   .option('-u, --username <value>', 'Username')

package/src/commands/pull.js

@@ -5,6 +5,7 @@ import { loadConfig } from '../lib/config.js';
 import { formatError } from '../lib/formatter.js';
 import { saveToDisk } from '../lib/save-to-disk.js';
 import { log } from '../lib/logger.js';
+import { renameToUidConvention, hasUidInFilename } from '../lib/filenames.js';
 
 function collect(value, previous) {
   return previous.concat([value]);

package/src/commands/push.js

@@ -1,8 +1,8 @@
 import { Command } from 'commander';
-import { readFile, stat, writeFile } from 'fs/promises';
+import { readFile, stat, writeFile, rename as fsRename, mkdir } from 'fs/promises';
 import { join, dirname, basename, extname, relative } from 'path';
 import { DboClient } from '../lib/client.js';
-import { buildInputBody, checkSubmitErrors } from '../lib/input-parser.js';
+import { buildInputBody, checkSubmitErrors, getSessionUserOverride } from '../lib/input-parser.js';
 import { formatResponse, formatError } from '../lib/formatter.js';
 import { log } from '../lib/logger.js';
 import { shouldSkipColumn } from '../lib/columns.js';
@@ -11,8 +11,11 @@ import { checkStoredTicket, applyStoredTicketToSubmission, clearRecordTicket, cl
 import { checkModifyKey, isModifyKeyError, handleModifyKeyError } from '../lib/modify-key.js';
 import { resolveTransactionKey } from '../lib/transaction-key.js';
 import { setFileTimestamps } from '../lib/timestamps.js';
+import { stripUidFromFilename, renameToUidConvention, hasUidInFilename } from '../lib/filenames.js';
 import { findMetadataFiles } from '../lib/diff.js';
+import { loadIgnore } from '../lib/ignore.js';
 import { detectChangedColumns, findBaselineEntry } from '../lib/delta.js';
+import { BINS_DIR } from '../lib/structure.js';
 
 /**
  * Resolve an @reference file path to an absolute filesystem path.
@@ -90,6 +93,8 @@ async function processPendingDeletes(client, options, modifyKey = null, transact
     const extraParams = { '_confirm': options.confirm || 'true' };
     if (options.ticket) extraParams['_OverrideTicketID'] = options.ticket;
     if (modifyKey) extraParams['_modify_key'] = modifyKey;
+    const cachedUser2 = getSessionUserOverride();
+    if (cachedUser2) extraParams['_OverrideUserID'] = cachedUser2;
 
     const body = await buildInputBody([entry.expression], extraParams);
 
@@ -123,7 +128,7 @@ async function processPendingDeletes(client, options, modifyKey = null, transact
           deletedUids.push(entry.UID);
         } else {
           log.error(`  Failed to delete "${entry.name}"`);
-          formatResponse(retryResponse, { json: options.json, jq: options.jq });
+          formatResponse(retryResponse, { json: options.json, jq: options.jq, verbose: options.verbose });
           remaining.push(entry);
         }
       } else if (result.successful) {
@@ -131,7 +136,7 @@ async function processPendingDeletes(client, options, modifyKey = null, transact
         deletedUids.push(entry.UID);
       } else {
         log.error(`  Failed to delete "${entry.name}"`);
-        formatResponse(result, { json: options.json, jq: options.jq });
+        formatResponse(result, { json: options.json, jq: options.jq, verbose: options.verbose });
         remaining.push(entry);
       }
     } catch (err) {
@@ -140,6 +145,12 @@ async function processPendingDeletes(client, options, modifyKey = null, transact
     }
   }
 
+  // Move __WILL_DELETE__ files to Trash/ for successfully deleted records
+  for (const entry of sync.delete) {
+    if (!deletedUids.includes(entry.UID)) continue;
+    await moveWillDeleteToTrash(entry);
+  }
+
   // Remove edit entries for successfully deleted records (spec requirement)
   if (deletedUids.length > 0) {
     sync.edit = (sync.edit || []).filter(e => !deletedUids.includes(e.UID));
@@ -154,6 +165,65 @@ async function processPendingDeletes(client, options, modifyKey = null, transact
   }
 }
 
+/**
+ * Move __WILL_DELETE__-prefixed files associated with a sync entry to Trash/.
+ */
+async function moveWillDeleteToTrash(entry) {
+  if (!entry.metaPath) return;
+
+  const trashDir = join(process.cwd(), 'trash');
+  await mkdir(trashDir, { recursive: true });
+
+  const metaDir = dirname(entry.metaPath);
+  const metaBase = basename(entry.metaPath);
+  const willDeleteMeta = join(metaDir, `__WILL_DELETE__${metaBase}`);
+
+  const filesToMove = [];
+
+  try {
+    await stat(willDeleteMeta);
+    filesToMove.push({ from: willDeleteMeta, to: join(trashDir, metaBase) });
+
+    // Read the __WILL_DELETE__ metadata to find associated content files
+    const rawMeta = await readFile(willDeleteMeta, 'utf8');
+    const deletedMeta = JSON.parse(rawMeta);
+    for (const col of (deletedMeta._contentColumns || [])) {
+      const ref = deletedMeta[col];
+      if (ref && String(ref).startsWith('@')) {
+        const refFile = String(ref).substring(1);
+        const willDeleteContent = join(metaDir, `__WILL_DELETE__${refFile}`);
+        try {
+          await stat(willDeleteContent);
+          filesToMove.push({ from: willDeleteContent, to: join(trashDir, refFile) });
+        } catch {}
+      }
+    }
+    if (deletedMeta._mediaFile && String(deletedMeta._mediaFile).startsWith('@')) {
+      const refFile = String(deletedMeta._mediaFile).substring(1);
+      const willDeleteMedia = join(metaDir, `__WILL_DELETE__${refFile}`);
+      try {
+        await stat(willDeleteMedia);
+        filesToMove.push({ from: willDeleteMedia, to: join(trashDir, refFile) });
+      } catch {}
+    }
+  } catch {
+    // No __WILL_DELETE__ metadata file — nothing to move
+    return;
+  }
+
+  for (const { from, to } of filesToMove) {
+    // Handle Trash collision: append timestamp
+    let destPath = to;
+    try { await stat(destPath); destPath = `${to}.${Date.now()}`; } catch {}
+    try {
+      await fsRename(from, destPath);
+      log.dim(`  Moved to trash: ${basename(destPath)}`);
+    } catch (err) {
+      log.warn(`  Could not move to trash: ${from} — ${err.message}`);
+    }
+  }
+}
+
 /**
  * Push a single file using its companion .metadata.json
  */
@@ -178,7 +248,8 @@ async function pushSingleFile(filePath, client, options, modifyKey = null, trans
  * Push all records found in a directory (recursive)
  */
 async function pushDirectory(dirPath, client, options, modifyKey = null, transactionKey = 'RowUID') {
-  const metaFiles = await findMetadataFiles(dirPath);
+  const ig = await loadIgnore();
+  const metaFiles = await findMetadataFiles(dirPath, ig);
 
   if (metaFiles.length === 0) {
     log.warn(`No .metadata.json files found in "${dirPath}".`);
@@ -238,6 +309,26 @@ async function pushDirectory(dirPath, client, options, modifyKey = null, transac
     }
     if (missingFiles) { skipped++; continue; }
 
+    // Check if any companion content file is ignored by .dboignore
+    {
+      const metaDir = dirname(metaPath);
+      let contentIgnored = false;
+      for (const col of contentCols) {
+        const ref = meta[col];
+        if (ref && String(ref).startsWith('@')) {
+          const refFile = String(ref).substring(1);
+          const contentPath = resolveAtReference(refFile, metaDir);
+          const relContent = relative(process.cwd(), contentPath).replace(/\\/g, '/');
+          if (ig.ignores(relContent)) {
+            log.dim(`  Skipped (dboignored): ${basename(metaPath)}`);
+            contentIgnored = true;
+            break;
+          }
+        }
+      }
+      if (contentIgnored) { skipped++; continue; }
+    }
+
     // Detect changed columns (delta detection)
     let changedColumns = null;
     if (baseline) {
@@ -263,7 +354,8 @@ async function pushDirectory(dirPath, client, options, modifyKey = null, transac
 
   // Pre-flight ticket validation (only if no --ticket flag)
   if (!options.ticket && toPush.length > 0) {
-    const ticketCheck = await checkStoredTicket(options);
+    const recordSummary = toPush.map(r => basename(r.metaPath, '.metadata.json')).join(', ');
+    const ticketCheck = await checkStoredTicket(options, `${toPush.length} record(s): ${recordSummary}`);
     if (ticketCheck.cancel) {
       log.info('Submission cancelled');
       return;
@@ -397,31 +489,66 @@ async function pushFromMetadata(meta, metaPath, client, options, changedColumns
     }
   }
 
-  if (dataExprs.length === 0) {
+  // Detect media file upload (binary file changed for media entity)
+  const isMediaUpload = entity === 'media' && meta._mediaFile
+    && String(meta._mediaFile).startsWith('@')
+    && changedColumns?.includes('_mediaFile');
+
+  if (dataExprs.length === 0 && !isMediaUpload) {
     log.warn(`Nothing to push for ${basename(metaPath)}`);
     return false;
   }
 
-  const fieldLabel = changedColumns ? `${dataExprs.length} changed field(s)` : `${dataExprs.length} field(s)`;
+  const fieldLabel = changedColumns ? `${dataExprs.length} changed field(s)${isMediaUpload ? ' + media file' : ''}` : `${dataExprs.length} field(s)`;
   log.info(`Pushing ${basename(metaPath, '.metadata.json')} (${entity}:${rowKeyValue}) — ${fieldLabel}`);
 
   // Apply stored ticket if no --ticket flag
-  await applyStoredTicketToSubmission(dataExprs, entity, uid || id, uid || id, options);
+  const storedTicket = await applyStoredTicketToSubmission(dataExprs, entity, uid || id, uid || id, options);
 
   const extraParams = { '_confirm': options.confirm };
   if (options.ticket) extraParams['_OverrideTicketID'] = options.ticket;
+  else if (storedTicket) extraParams['_OverrideTicketID'] = storedTicket;
   if (modifyKey) extraParams['_modify_key'] = modifyKey;
+  const cachedUser = getSessionUserOverride();
+  if (cachedUser) extraParams['_OverrideUserID'] = cachedUser;
+
+  let result;
+
+  if (isMediaUpload) {
+    // Media file upload: use multipart/form-data
+    const mediaLocalName = String(meta._mediaFile).substring(1);
+    const mediaFilePath = resolveAtReference(mediaLocalName, metaDir);
+    const mediaUid = meta.UID || meta._id;
+    const mediaUploadName = meta.Filename
+      || stripUidFromFilename(mediaLocalName, mediaUid);
+
+    // Ensure at least one data expression to identify the row for the server
+    if (dataExprs.length === 0 && meta.Filename) {
+      dataExprs.push(`${rowKeyPrefix}:${rowKeyValue};column:${entity}.Filename=${meta.Filename}`);
+    }
 
-  let body = await buildInputBody(dataExprs, extraParams);
-  let result = await client.postUrlEncoded('/api/input/submit', body);
+    const fields = { ...extraParams };
+    for (const expr of dataExprs) {
+      const eqIdx = expr.indexOf('=');
+      if (eqIdx !== -1) {
+        fields[expr.substring(0, eqIdx)] = expr.substring(eqIdx + 1);
+      }
+    }
 
-  // Reactive ModifyKey retry — server rejected because key wasn't set locally
-  if (!result.successful && result.messages?.some(m => isModifyKeyError(m))) {
-    const retryMK = await handleModifyKeyError();
-    if (retryMK.cancel) { log.info('Submission cancelled'); return false; }
-    extraParams['_modify_key'] = retryMK.modifyKey;
-    body = await buildInputBody(dataExprs, extraParams);
+    const files = [{ fieldName: 'file', filePath: mediaFilePath, fileName: mediaUploadName }];
+    result = await client.postMultipart('/api/input/submit', fields, files);
+  } else {
+    let body = await buildInputBody(dataExprs, extraParams);
     result = await client.postUrlEncoded('/api/input/submit', body);
+
+    // Reactive ModifyKey retry — server rejected because key wasn't set locally
+    if (!result.successful && result.messages?.some(m => isModifyKeyError(m))) {
+      const retryMK = await handleModifyKeyError();
+      if (retryMK.cancel) { log.info('Submission cancelled'); return false; }
+      extraParams['_modify_key'] = retryMK.modifyKey;
+      body = await buildInputBody(dataExprs, extraParams);
+      result = await client.postUrlEncoded('/api/input/submit', body);
+    }
   }
 
   // Retry with prompted params if needed (ticket, user, repo mismatch)
@@ -445,11 +572,28 @@ async function pushFromMetadata(meta, metaPath, client, options, changedColumns
     const params = retryResult.retryParams || retryResult;
     Object.assign(extraParams, params);
 
-    body = await buildInputBody(dataExprs, extraParams);
-    result = await client.postUrlEncoded('/api/input/submit', body);
+    if (isMediaUpload) {
+      const retryLocalName = String(meta._mediaFile).substring(1);
+      const retryFilePath = resolveAtReference(retryLocalName, metaDir);
+      const retryUid = meta.UID || meta._id;
+      const retryUploadName = meta.Filename
+        || stripUidFromFilename(retryLocalName, retryUid);
+      const fields = { ...extraParams };
+      for (const expr of dataExprs) {
+        const eqIdx = expr.indexOf('=');
+        if (eqIdx !== -1) {
+          fields[expr.substring(0, eqIdx)] = expr.substring(eqIdx + 1);
+        }
+      }
+      const files = [{ fieldName: 'file', filePath: retryFilePath, fileName: retryUploadName }];
+      result = await client.postMultipart('/api/input/submit', fields, files);
+    } else {
+      const body = await buildInputBody(dataExprs, extraParams);
+      result = await client.postUrlEncoded('/api/input/submit', body);
+    }
   }
 
-  formatResponse(result, { json: options.json, jq: options.jq });
+  formatResponse(result, { json: options.json, jq: options.jq, verbose: options.verbose });
 
   // Update metadata on disk if path was changed
   if (metaUpdated) {
@@ -464,6 +608,25 @@ async function pushFromMetadata(meta, metaPath, client, options, changedColumns
   // Clean up per-record ticket on success
   await clearRecordTicket(uid || id);
 
+  // Post-UID rename: if the record lacked a UID and the server returned one
+  try {
+    const editResults2 = result.payload?.Results?.Edit || result.data?.Payload?.Results?.Edit || [];
+    const addResults2 = result.payload?.Results?.Add || result.data?.Payload?.Results?.Add || [];
+    const allResults = [...editResults2, ...addResults2];
+    if (allResults.length > 0 && !meta.UID) {
+      const serverUID = allResults[0].UID;
+      if (serverUID && !hasUidInFilename(basename(metaPath), serverUID)) {
+        const config2 = await loadConfig();
+        const renameResult = await renameToUidConvention(meta, metaPath, serverUID, allResults[0]._LastUpdated, config2.ServerTimezone);
+        if (renameResult.newMetaPath !== metaPath) {
+          log.success(`  Renamed to ~${serverUID} convention`);
+          // Update metaPath reference for subsequent timestamp operations
+          // (metaPath is const, but timestamp update below re-reads from meta)
+        }
+      }
+    }
+  } catch { /* non-critical rename */ }
+
   // Update file timestamps from server response
   try {
     const editResults = result.payload?.Results?.Edit || result.data?.Payload?.Results?.Edit || [];
@@ -486,6 +649,11 @@ async function pushFromMetadata(meta, metaPath, client, options, changedColumns
               await setFileTimestamps(contentPath, meta._CreatedOn, updated, serverTz);
             }
           }
+          // Update media file mtime too
+          if (meta._mediaFile && String(meta._mediaFile).startsWith('@')) {
+            const mediaPath = join(dirname(metaPath), String(meta._mediaFile).substring(1));
+            await setFileTimestamps(mediaPath, meta._CreatedOn, updated, serverTz);
+          }
         }
       }
     }
@@ -497,29 +665,29 @@ async function pushFromMetadata(meta, metaPath, client, options, changedColumns
 /**
  * Normalize a local file path for comparison with server-side Path.
  *
- * The Bins/ directory is used for local file organization and does not reflect
+ * The bins/ directory is used for local file organization and does not reflect
  * the actual server-side serving path. This function strips organizational prefixes
  * to enable correct path comparison during push operations.
  *
  * **Directory Structure:**
- * - `Bins/` — Local organizational root (always stripped)
- * - `Bins/app/` — Special case: the "app" subdirectory is also stripped because it's
- *   purely organizational. Files in Bins/app/ are served from the app root without
+ * - `bins/` — Local organizational root (always stripped)
+ * - `bins/app/` — Special case: the "app" subdirectory is also stripped because it's
+ *   purely organizational. Files in bins/app/ are served from the app root without
  *   the "app/" prefix on the server.
- * - `Bins/custom_name/` — Custom bin directories (tpl/, ticket_test/, etc.) are
+ * - `bins/custom_name/` — Custom bin directories (tpl/, ticket_test/, etc.) are
  *   preserved because they represent actual bin hierarchies that serve from their
  *   directory name.
  *
  * **Why "app/" is special:**
- * The main app bin is placed in Bins/app/ locally for organization, but server-side
+ * The main app bin is placed in bins/app/ locally for organization, but server-side
  * these files are served from the root path (no "app/" prefix). Other custom bins
  * like "tpl/" maintain their directory name in the serving path.
  *
  * Examples:
- *   "Bins/app/assets/css/file.css" → "assets/css/file.css" (strips Bins/app/)
- *   "Bins/tpl/header.html" → "tpl/header.html" (preserves tpl/)
- *   "Bins/assets/css/file.css" → "assets/css/file.css" (strips Bins/ only)
- *   "Sites/MySite/content/page.html" → "Sites/MySite/content/page.html" (unchanged)
+ *   "bins/app/assets/css/file.css" → "assets/css/file.css" (strips bins/app/)
+ *   "bins/tpl/header.html" → "tpl/header.html" (preserves tpl/)
+ *   "bins/assets/css/file.css" → "assets/css/file.css" (strips bins/ only)
+ *   "site/MySite/content/page.html" → "site/MySite/content/page.html" (unchanged)
  *
  * @param {string} localPath - Relative path from project root
  * @returns {string} - Normalized path for comparison with metadata Path column
@@ -531,10 +699,10 @@ function normalizePathForComparison(localPath) {
   // Strip leading and trailing slashes
   const cleaned = normalized.replace(/^\/+|\/+$/g, '');
 
-  // Check if path starts with "Bins/" organizational directory
-  if (cleaned.startsWith('Bins/')) {
-    // Remove "Bins/" prefix (length = 5)
-    const withoutBins = cleaned.substring(5);
+  // Check if path starts with bins/ organizational directory
+  const binsPrefix = BINS_DIR + '/';
+  if (cleaned.startsWith(binsPrefix)) {
+    const withoutBins = cleaned.substring(binsPrefix.length);
 
     // Special case: strip "app/" organizational subdirectory
     // This is the only special subdirectory - all others (tpl/, assets/, etc.) are preserved

package/src/commands/rm.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { readFile, unlink, stat, rm as fsRm } from 'fs/promises';
+import { readFile, unlink, stat, rm as fsRm, rename } from 'fs/promises';
 import { join, dirname, basename, extname } from 'path';
 import { log } from '../lib/logger.js';
 import { formatError } from '../lib/formatter.js';
@@ -12,6 +12,7 @@ export const rmCommand = new Command('rm')
   .argument('<path>', 'File, metadata.json, or directory to remove')
   .option('-f, --force', 'Skip confirmation prompts')
   .option('--keep-local', 'Only stage server deletion, do not delete local files')
+  .option('--hard', 'Immediately delete local files (no Trash; legacy behavior)')
   .action(async (targetPath, options) => {
     try {
       const pathStat = await stat(targetPath).catch(() => null);
@@ -113,21 +114,35 @@ async function rmFileRecord(metaPath, options, { skipPrompt = false } = {}) {
     }
   }
 
-  // Stage deletion
+  // Stage deletion (include metaPath for Trash workflow in push.js)
   const expression = `RowID:del${rowId};entity:${entity}=true`;
-  await addDeleteEntry({ UID: uid, RowID: rowId, entity, name: displayName, expression });
+  await addDeleteEntry({ UID: uid, RowID: rowId, entity, name: displayName, expression, metaPath });
   log.success(`  Staged: ${displayName} → ${expression}`);
 
   // Remove from app.json
   await removeAppJsonReference(metaPath);
 
-  // Delete local files
+  // Handle local files
   if (!options.keepLocal) {
-    for (const f of localFiles) {
-      try {
-        await unlink(f);
-        log.dim(`  Deleted ${f}`);
-      } catch { /* file may not exist */ }
+    if (options.hard) {
+      // --hard: original behavior — immediate delete
+      for (const f of localFiles) {
+        try { await unlink(f); log.dim(`  Deleted ${f}`); } catch {}
+      }
+    } else {
+      // Default: rename to __WILL_DELETE__ prefix
+      for (const f of localFiles) {
+        const fDir = dirname(f);
+        const fName = basename(f);
+        if (fName.startsWith('__WILL_DELETE__')) continue; // idempotency guard
+        const willDeletePath = join(fDir, `__WILL_DELETE__${fName}`);
+        try {
+          await rename(f, willDeletePath);
+          log.dim(`  Staged for delete: ${willDeletePath}`);
+        } catch (err) {
+          log.warn(`  Could not rename ${f}: ${err.message}`);
+        }
+      }
     }
   }
 
@@ -196,18 +211,35 @@ async function rmFile(filePath, options) {
   }
 
   const expression = `RowID:del${rowId};entity:${entity}=true`;
-  await addDeleteEntry({ UID: uid, RowID: rowId, entity, name: displayName, expression });
+  await addDeleteEntry({ UID: uid, RowID: rowId, entity, name: displayName, expression, metaPath });
   log.success(`Staged deletion: ${expression}`);
 
   await removeAppJsonReference(metaPath);
 
   if (!options.keepLocal) {
-    for (const f of localFiles) {
-      try {
-        await unlink(f);
-        log.dim(`  Deleted ${f}`);
-      } catch {
-        log.warn(`  Could not delete ${f} (may not exist)`);
+    if (options.hard) {
+      // --hard: original behavior — immediate delete
+      for (const f of localFiles) {
+        try {
+          await unlink(f);
+          log.dim(`  Deleted ${f}`);
+        } catch {
+          log.warn(`  Could not delete ${f} (may not exist)`);
+        }
+      }
+    } else {
+      // Default: rename to __WILL_DELETE__ prefix
+      for (const f of localFiles) {
+        const fDir = dirname(f);
+        const fName = basename(f);
+        if (fName.startsWith('__WILL_DELETE__')) continue; // idempotency guard
+        const willDeletePath = join(fDir, `__WILL_DELETE__${fName}`);
+        try {
+          await rename(f, willDeletePath);
+          log.dim(`  Staged for delete: ${willDeletePath}`);
+        } catch (err) {
+          log.warn(`  Could not rename ${f}: ${err.message}`);
+        }
       }
     }
   }