@gfgghgftgffg/amox-pi-sync 0.1.3 → 0.1.5

package/MAINTENANCE.md

@@ -5,15 +5,15 @@
 - Upstream: [MuratAitov/pi-sync](https://github.com/MuratAitov/pi-sync), npm `pi-sync-suite@0.1.1`.
 - Source ref: `npm:pi-sync-suite@0.1.1` (published source baseline, not the repository's moving HEAD).
 - Upstream MIT notice is preserved verbatim in `LICENSE`: Copyright (c) 2026 Murat.
-- Local package: `@gfgghgftgffg/amox-pi-sync@0.1.3`, standalone TypeScript entrypoint `index.ts` and `core.ts`; no runtime dependency on the original suite.
+- Local package: `@gfgghgftgffg/amox-pi-sync@0.1.5`, standalone TypeScript entrypoint `index.ts` and `core.ts`; no runtime dependency on the original suite.
 
 ## Scope
 
 Keep raw agent-data push/pull, safe relative include/exclude paths (sessions + missions by default), manual/background automatic sync, backups/restoration and diagnostics. No configuration sync/settings merging, Markdown/JSON exports, Environment Tools or Local Packages. Cleanup is retained only for manually deleting local backup directories (Preview, Run, Delete Selected Backup, Retention); never sessions/missions, with no automatic deletion or archive restoration. Default cleanup candidates are complete backups older than 180 days or beyond the newest 20; counting individual files is not the retention unit. No three-line widget: optional Starline capsule/details, with `/sync-status` fallback.
 
-Settings are stored in `amox-pi-sync.json`; legacy `pi-sync-suite.json` is read only as a migration fallback until new settings are saved. Backups use `amox-pi-sync-backups` and require manual retention management via Cleanup. Manual/off startup must not access the network; auto startup fingerprints locally then starts timers and a non-awaited background pull. Setup only saves configuration and stops timers, requiring reload to activate auto mode. The automatic loop must not block the UI. Migration uses an independent `amox-pi-sync-repo`, not the old snapshot directory. The `pi-sync` status key preserves existing Starline placement; the pill bridge takes priority over legacy command mapping. `off` disables automation, not explicit commands. Presentation uses semantic Pi theme colours for labels, values and errors, and bold targets without fixed foreground/background colours so Starline owns selection contrast. Keep Manual/Auto/Off and Push/Pull terminology consistent across capsule, details, menus and command feedback; never append idle to the mode. Anchor bubbles to the clicked Starline cell, including submenus and confirmations; commands reuse the last clicked anchor or center before one is known. Forward pill colours by default and offer semantic theme colour overrides through bubbleColor; do not override selected-row text contrast. Colour changes must not start timers or network work. Without Starline use native Pi UI and hide the Starline colour option. Recompute theme styles when rendering, keep RPC/native status text plain, and do not store styled strings in settings. On Windows prefer native OpenSSH when present for non-ASCII home paths; retain batch mode, timeout and host-key verification. Keep large diagnostic results in the action notification rather than copying JSON dumps into status details.
+Settings are stored in `amox-pi-sync.json`; legacy `pi-sync-suite.json` is read only as a migration fallback until new settings are saved. Backups use `amox-pi-sync-backups` and require manual retention management via Cleanup. Manual/off startup must not access the network; auto startup fingerprints locally then starts timers and a non-awaited background pull. Setup only saves configuration and stops timers, requiring reload to activate auto mode. The automatic loop must not block the UI. Migration uses an independent `amox-pi-sync-repo`, not the old snapshot directory. The `pi-sync` status key preserves existing Starline placement; the pill bridge takes priority over legacy command mapping. `off` disables automation, not explicit commands. Presentation separates labels and values with a colon; the path count is explicitly marked configured. Starline action rows have a leading bullet, while native Pi selectors retain their own indicators. Presentation uses semantic Pi theme colours for labels, values and errors, and bold targets without fixed foreground/background colours so Starline owns selection contrast. Keep Manual/Auto/Off and Push/Pull terminology consistent across capsule, details, menus and command feedback; never append idle to the mode. Anchor bubbles to the clicked Starline cell, including submenus and confirmations; commands reuse the last clicked anchor or center before one is known. Forward pill colours by default and offer semantic theme colour overrides through bubbleColor; do not override selected-row text contrast. Colour changes must not start timers or network work. Without Starline use native Pi UI and hide the Starline colour option. Recompute theme styles when rendering, keep RPC/native status text plain, and do not store styled strings in settings. On Windows prefer native OpenSSH when present for non-ASCII home paths; retain batch mode, timeout and host-key verification. Keep large diagnostic results in the action notification rather than copying JSON dumps into status details.
 
-Safety requirements: private SSH remote, no working-directory mutation, no JSONL merging, preserve local-only files, back up replacements and never overwrite active sessions. Safe-path validation must exclude configuration and implementation data even when users select arbitrary relative data paths. Do not claim encryption, conflict-free multi-device merging or automatic secret removal.
+Safety requirements: private SSH remote, no working-directory mutation, no semantic JSONL merging, preserve local-only files, back up replacements and never overwrite active sessions. Network transfers use a 10-minute timeout and local Git commands 60 seconds; a terminated or timed-out process must never be recorded as success, even when an executor reports code 0. Pull fast-forwards or performs a clean file-level three-way merge; conflicts abort and apply nothing. A rejected non-fast-forward push fetches, integrates without rebase or force, and retries once; files integrated during push are applied on the next pull. Git commands force `core.autocrlf=false` and `core.eol=lf`, with a repository-local `* -text` attribute; do not rewrite raw bytes or existing mixed-EOL history automatically. Safe-path validation must exclude configuration and implementation data even when users select arbitrary relative data paths. Do not claim encryption, conflict-free multi-device merging or automatic secret removal.
 
 ## 功能取舍与维护边界
 

package/README.md

@@ -33,7 +33,7 @@ pi update --extensions
 
 The settings menu contains **View Status**, **Sync Mode** (`auto`, `manual`, `off`), **Sync Paths** (include/exclude safe relative agent-data paths), **Backups** (create/list/restore), **Diagnostics** (doctor/diff/log), and **Cleanup** (Preview, Run, Delete Selected Backup, Retention). `sessions` and `missions` are the default paths. Manual push and pull commands remain available in both `manual` and `off` modes.
 
-Manual/off startup performs no network access. Auto startup computes a local fingerprint, starts timers and launches a background pull without awaiting network completion. `/sync-setup` only saves configuration and stops timers; reload to activate auto mode if enabled. With Starline installed, use its clickable status capsule to open details and actions: check status, push, pull and settings. The status key remains `pi-sync` for existing Starline placement; the pill bridge takes precedence over legacy `extensionStatuses.commands`, with no Starline configuration changes required. There is no three-line widget. Pill clicks anchor bubbles to the corresponding Starline cell, like Model; settings, submenus and confirmations retain that anchor. `/sync-status` uses the last clicked anchor, or a centered fallback before the first click. Text entry still uses Pi input dialogs. **Bubble colour** in settings defaults to **Follow pill**; alternatively choose the current theme’s accent, success, warning or error colour for borders and selection. Before a pill click, Follow pill uses theme accent. The optional `bubbleColor` setting stores `pill`, `accent`, `success`, `warning` or `error`; changing it performs no transfer. Without Starline this option is hidden and Pi renders its native dialogs. Labels and values use Pi theme colours, while bold action rows keep Starline’s selection contrast. State shows Manual, Auto or Off directly; active operations use Push/Pull, with the configured mode shown separately. Without Starline, the native UI remains available and status output stays plain text.
+Manual/off startup performs no network access. Auto startup computes a local fingerprint, starts timers and launches a background pull without awaiting network completion. `/sync-setup` only saves configuration and stops timers; reload to activate auto mode if enabled. With Starline installed, use its clickable status capsule to open details and actions: check status, push, pull and settings. The status key remains `pi-sync` for existing Starline placement; the pill bridge takes precedence over legacy `extensionStatuses.commands`, with no Starline configuration changes required. There is no three-line widget. Pill clicks anchor bubbles to the corresponding Starline cell, like Model; settings, submenus and confirmations retain that anchor. `/sync-status` uses the last clicked anchor, or a centered fallback before the first click. Text entry still uses Pi input dialogs. **Bubble colour** in settings defaults to **Follow pill**; alternatively choose the current theme’s accent, success, warning or error colour for borders and selection. Before a pill click, Follow pill uses theme accent. The optional `bubbleColor` setting stores `pill`, `accent`, `success`, `warning` or `error`; changing it performs no transfer. Without Starline this option is hidden and Pi renders its native dialogs. Labels and values are separated by a colon (for example, `Paths: 2 configured`); Starline action rows start with `•`. Labels and values use Pi theme colours, while bold action rows keep Starline’s selection contrast. State shows Manual, Auto or Off directly; active operations use Push/Pull, with the configured mode shown separately. Without Starline, the native UI remains available and status output stays plain text.
 
 ## Data and safety
 
@@ -41,9 +41,10 @@ Manual/off startup performs no network access. Auto startup computes a local fin
 > Sessions, missions and other selected files may contain secrets. Use a **private SSH repository**, review included paths, and secure both the remote and local backups. Private Git is not encryption or a secret scrubber.
 
 - Paths are relative to Pi's agent-data directory, not the current project. Arbitrary safe data paths can be included or excluded; the extension does not change the working directory.
-- Raw files are transferred without Markdown/JSON export or JSONL merging. Concurrent edits are not a semantic merge; coordinate devices and inspect diagnostics.
+- Raw files are transferred without Markdown/JSON export or semantic JSONL merging. Concurrent edits are not a semantic merge; an automatic three-way merge is file-level and aborts if both sides changed the same file. Coordinate devices and inspect diagnostics.
 - Local-only files are retained; deletions are not propagated. Incoming content replaces differing same-path files after backup; active sessions must not be overwritten. Restore applies only the currently managed paths.
-- Git commands disable automatic line-ending conversion so Windows `core.autocrlf` does not rewrite raw sessions. On Windows, SSH prefers native OpenSSH (`System32/OpenSSH/ssh.exe`) when available to support non-ASCII user directories; otherwise it uses `ssh`. Batch mode, connection timeout and host-key verification remain enabled, overriding a custom `core.sshCommand`.
+- Network Git operations (`clone`, `fetch`, `pull`, `push`) use a 10-minute timeout; local Git operations use 60 seconds. A process terminated by timeout or cancellation is a failure and is never recorded as completed, even if Pi reports exit code 0. Pull fast-forwards when possible; otherwise it performs a clean three-way merge in the snapshot repository. Conflicts abort the merge and apply no files. A rejected non-fast-forward push fetches, integrates remote history without rebase or force, and retries once; files integrated during push are applied on the next pull.
+- Git commands force `core.autocrlf=false` and `core.eol=lf`, and the snapshot repository uses a local `* -text` attribute so Git does not convert raw bytes. Existing history with mixed CRLF/LF is not rewritten automatically; normalizing it requires an explicit manual migration and repack. On Windows, SSH prefers native OpenSSH (`System32/OpenSSH/ssh.exe`) when available to support non-ASCII user directories; otherwise it uses `ssh`. Batch mode, connection timeout and host-key verification remain enabled, overriding a custom `core.sshCommand`.
 - Backups use `amox-pi-sync-backups` under the agent-data directory. Cleanup only deletes local backups after manual preview/confirmation, using complete backup directories rather than individual files. The default limits are 20 complete backups and a maximum age of 180 days; backups older than this or beyond the newest 20 become cleanup candidates. There is no automatic deletion; sessions and missions are never cleanup targets.
 - Settings use `amox-pi-sync.json`. If absent, legacy `pi-sync-suite.json` can be read for migration. The old file is not changed before new settings are saved; saving writes the new file. Migration uses a separate `amox-pi-sync-repo` directory rather than reusing the old snapshot.
 

package/README.zh-CN.md

@@ -33,7 +33,7 @@ pi update --extensions
 
 设置菜单保留 **View Status**、**Sync Mode**（`auto`、`manual`、`off`）、**Sync Paths**（包含/排除任意安全的 agent 数据相对路径）、**Backups**（创建/列表/恢复）、**Diagnostics**（doctor/diff/log）和 **Cleanup**（Preview、Run、Delete Selected Backup、Retention）。默认路径为 `sessions` 和 `missions`。`manual` 和 `off` 模式仍可手动上传、拉取。
 
-manual/off 启动不访问网络。auto 启动先计算本地 fingerprint，再启动定时器并发起后台拉取，不等待网络完成。`/sync-setup` 只保存配置并停止定时器；已启用 auto 时需 reload 激活。安装 Starline 时，优先点击状态胶囊打开详情，执行 Check status、Push、Pull 或 Settings。状态 key 保留为 `pi-sync`，兼容原 Starline placement；pill bridge 优先于旧 `extensionStatuses.commands`，无需修改 Starline 配置。没有三行 widget。点击胶囊时，气泡像 Model 一样锚定对应的 Starline cell；设置、子菜单及确认框沿用该锚点。`/sync-status` 使用最近点击的锚点，首次点击前回退居中。文本输入仍使用 Pi 输入框。设置中的 **Bubble colour** 默认 **Follow pill**（跟随胶囊），也可选择当前主题的 accent、success、warning 或 error 作为边框和选中项颜色；首次点击前使用主题 accent。可选配置 `bubbleColor` 保存为 `pill`、`accent`、`success`、`warning` 或 `error`，修改配色不触发传输。未安装 Starline 时隐藏此选项，由 Pi 渲染原生弹框。标签、数值和异常使用 Pi 主题色区分，可选操作使用粗体并保留 Starline 自带的选中对比度。State 直接显示 Manual、Auto 或 Off；执行中显示 Push／Pull，另列当前模式，不追加 idle。未安装 Starline 时回退原生界面，状态输出保留纯文本。
+manual/off 启动不访问网络。auto 启动先计算本地 fingerprint，再启动定时器并发起后台拉取，不等待网络完成。`/sync-setup` 只保存配置并停止定时器；已启用 auto 时需 reload 激活。安装 Starline 时，优先点击状态胶囊打开详情，执行 Check status、Push、Pull 或 Settings。状态 key 保留为 `pi-sync`，兼容原 Starline placement；pill bridge 优先于旧 `extensionStatuses.commands`，无需修改 Starline 配置。没有三行 widget。点击胶囊时，气泡像 Model 一样锚定对应的 Starline cell；设置、子菜单及确认框沿用该锚点。`/sync-status` 使用最近点击的锚点，首次点击前回退居中。文本输入仍使用 Pi 输入框。设置中的 **Bubble colour** 默认 **Follow pill**（跟随胶囊），也可选择当前主题的 accent、success、warning 或 error 作为边框和选中项颜色；首次点击前使用主题 accent。可选配置 `bubbleColor` 保存为 `pill`、`accent`、`success`、`warning` 或 `error`，修改配色不触发传输。未安装 Starline 时隐藏此选项，由 Pi 渲染原生弹框。标签与值统一用冒号分隔（如 `Paths: 2 configured`，表示配置了 2 个同步路径），Starline 中的可选操作统一以 `•` 开头。标签、数值和异常使用 Pi 主题色区分，可选操作使用粗体并保留 Starline 自带的选中对比度。State 直接显示 Manual、Auto 或 Off；执行中显示 Push／Pull，另列当前模式，不追加 idle。未安装 Starline 时回退原生界面，状态输出保留纯文本。
 
 ## 数据与安全
 
@@ -41,9 +41,10 @@ manual/off 启动不访问网络。auto 启动先计算本地 fingerprint，再
 > 会话、missions 及其他选中文件可能包含秘密。请使用**私有 SSH 仓库**，检查同步路径，并保护远端和本地备份。私有 Git 不提供加密或秘密清除。
 
 - 路径相对于 Pi agent 数据目录，不是当前项目。可包含/排除任意安全的数据相对路径；扩展不改写工作目录。
-- 传输原始文件，不生成 Markdown/JSON 归档，不合并 JSONL。并发编辑不是语义合并；请协调多设备操作并查看诊断。
+- 传输原始文件，不生成 Markdown/JSON 归档，不做语义化 JSONL 合并。并发编辑不是语义合并；自动三方合并按文件进行，双方修改同一文件时会中止。请协调多设备操作并查看诊断。
 - 保留本地独有文件，不传播删除；同路径的不同内容以拉取数据为准，覆盖前备份；不得覆盖活跃会话。恢复备份只处理当前纳管范围。
-- Git 操作关闭自动换行转换，避免 Windows 的 `core.autocrlf` 改写原始会话。Windows 优先使用原生 OpenSSH（`System32/OpenSSH/ssh.exe`），支持中文用户目录；不存在时及其他平台使用 `ssh`。保留非交互模式、连接超时及主机密钥验证，不复用自定义 `core.sshCommand`。
+- 网络 Git 操作（`clone`、`fetch`、`pull`、`push`）超时为 10 分钟，本地 Git 操作为 60 秒。被超时或取消终止的进程一律视为失败，即使 Pi 返回 exit code 0，也不会写入完成时间。能快进时 Pull 直接快进，否则在快照仓库中执行干净的三方合并；冲突会中止合并且不应用任何文件。Push 被非快进拒绝时会 fetch、在不 rebase、不 force 的前提下整合远端历史，并重试一次；Push 整合的文件在下一次 Pull 时应用。
+- Git 操作强制 `core.autocrlf=false`、`core.eol=lf`，快照仓库使用本地 `* -text` 属性，避免 Git 转换原始字节。已有 CRLF/LF 混合历史不会被自动改写；统一换行需要显式的手动迁移和 repack。Windows 优先使用原生 OpenSSH（`System32/OpenSSH/ssh.exe`），支持中文用户目录；不存在时及其他平台使用 `ssh`。保留非交互模式、连接超时及主机密钥验证，不复用自定义 `core.sshCommand`。
 - 备份位于 agent 数据目录下的 `amox-pi-sync-backups`。Cleanup 仅在手动预览/确认后删除本地备份，按完整备份目录计数，不按单个文件计数。默认数量上限 20 份、最长 180 天；超龄或超出最新 20 份的备份纳入清理候选，不自动删除，不清理 sessions 或 missions。
 - 新设置文件为 `amox-pi-sync.json`；不存在时可读取旧 `pi-sync-suite.json` 迁移。保存新设置前不改旧文件，保存时写入新文件。迁移使用独立的 `amox-pi-sync-repo` 目录，不复用旧快照。
 

package/core.ts

@@ -33,7 +33,7 @@ export type Config = {
   retention?: { keepBackups: number; maxAgeDays: number };
 };
 export type Paths = { agentDir: string; configFile: string; backupDir: string };
-export type GitExecutor = (args: string[], cwd: string) => Promise<{ stdout: string; stderr: string; code: number }>;
+export type GitExecutor = (args: string[], cwd: string, timeoutMs?: number) => Promise<{ stdout: string; stderr: string; code: number; killed?: boolean }>;
 export type Status = { busy?: string; error?: string; localChanges?: string; remoteChanges?: number; checkedAt?: string };
 export type Backup = { id: string; createdAt: string; reason: string; includedPaths: string[] };
 export type BackupSummary = Backup;
@@ -137,6 +137,10 @@ export async function saveConfig(config: Config, paths = defaultPaths()): Promis
 // Raw sessions are opaque bytes and intentionally bypass content scanning. Use a
 // trusted PRIVATE repository: sessions may contain credentials or private text.
 const secret = /-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----|\bghp_[A-Za-z0-9_]{30,}\b|\bsk-[A-Za-z0-9_-]{20,}\b|\b(?:api[_-]?key|token|password|secret)\b\s*[:=]\s*["']?[^"'\s]{12,}/i;
+// Local Git work is bounded; network transfers can legitimately take minutes
+// for large session histories, and a killed transfer must never look successful.
+const LOCAL_TIMEOUT_MS = 60_000;
+const NETWORK_TIMEOUT_MS = 10 * 60_000;
 // Git for Windows SSH can misdecode non-ASCII home paths; prefer native OpenSSH.
 const nativeSsh = path.join(process.env.SystemRoot ?? "C:/Windows", "System32", "OpenSSH", "ssh.exe");
 const sshCommand = process.platform === "win32" && existsSync(nativeSsh)
@@ -144,6 +148,7 @@ const sshCommand = process.platform === "win32" && existsSync(nativeSsh)
 const gitOptions = [
   "-c", "core.hooksPath=",
   "-c", "core.autocrlf=false",
+  "-c", "core.eol=lf",
   "-c", "credential.interactive=false",
   "-c", `core.sshCommand=${sshCommand} -oBatchMode=yes -oConnectTimeout=10`,
 ];
@@ -167,23 +172,42 @@ export class SyncService {
     } catch (e) { this.status.error = e instanceof Error ? e.message : String(e); throw e; }
     finally { try { if (lock) { await lock.close(); await fs.unlink(lockFile); } } finally { this.status.busy = undefined; } }
   }
-  private async git(args: string[], cwd = this.config.repoDir): Promise<string> {
-    const result = await this.exec([...gitOptions, ...args], cwd);
+  private async gitResult(args: string[], cwd = this.config.repoDir, timeoutMs = LOCAL_TIMEOUT_MS) {
+    const result = await this.exec([...gitOptions, ...args], cwd, timeoutMs);
+    // pi.exec can report code 0 for a process killed by its timeout; the killed
+    // flag is the only reliable failure signal for that path.
+    if (result.killed) throw new Error(`git ${args[0]} was terminated before completion (timeout or cancellation); no success was recorded. Verify the repository state before retrying.`);
+    return result;
+  }
+  private async git(args: string[], cwd = this.config.repoDir, timeoutMs = LOCAL_TIMEOUT_MS): Promise<string> {
+    const result = await this.gitResult(args, cwd, timeoutMs);
     if (result.code !== 0) throw new Error(`git ${args[0]} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}. Resolve repository conflicts manually; no force push or JSONL merge is performed.`);
     return result.stdout;
   }
+  /** Keep raw bytes raw: local attributes override any text/EOL rules in the snapshot. */
+  private async ensureAttributes(): Promise<void> {
+    const file = path.join(this.config.repoDir, ".git", "info", "attributes");
+    await noLinks(file);
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    let current = "";
+    try { current = await fs.readFile(file, "utf8"); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+    if (current.split(/\r?\n/).filter(Boolean).at(-1) === "* -text") return;
+    await fs.writeFile(file, `${current}${current && !current.endsWith("\n") ? "\n" : ""}* -text\n`, { mode: 0o600 });
+  }
   private async ensureRepo(): Promise<void> {
     await noLinks(this.config.repoDir);
     const gitDir = path.join(this.config.repoDir, ".git"); await noLinks(gitDir);
     if (!(await stat(gitDir))) {
       if (await stat(this.config.repoDir) && (await fs.readdir(this.config.repoDir)).length) throw new Error("Repository directory is nonempty but has no .git; choose an empty directory");
       await fs.mkdir(path.dirname(this.config.repoDir), { recursive: true });
-      await this.git(["clone", "--", this.config.repoUrl, this.config.repoDir], path.dirname(this.config.repoDir));
+      await this.git(["clone", "--", this.config.repoUrl, this.config.repoDir], path.dirname(this.config.repoDir), NETWORK_TIMEOUT_MS);
     }
     const origin = (await this.git(["remote", "get-url", "origin"])).trim();
     if (origin !== this.config.repoUrl) throw new Error("Repository origin differs from configured SSH URL; inspect it before syncing");
     const pushUrls = (await this.git(["remote", "get-url", "--push", "--all", "origin"])).trim().split(/\r?\n/);
     if (pushUrls.some(url => url !== this.config.repoUrl)) throw new Error("Repository push URL differs from configured SSH URL");
+    await this.ensureAttributes();
     for (const file of (await this.git(["ls-files", "-z"])).split("\0").filter(Boolean)) validatePath(file);
   }
   private async collect(root: string, scan = false): Promise<Files> {
@@ -266,7 +290,7 @@ export class SyncService {
   }
   async check(): Promise<Status> { return this.run("check", async () => {
     this.status.checkedAt = undefined; this.status.remoteChanges = undefined;
-    await this.ensureRepo(); await this.git(["fetch", "origin"]);
+    await this.ensureRepo(); await this.git(["fetch", "origin"], this.config.repoDir, NETWORK_TIMEOUT_MS);
     const local = await this.collect(this.paths.agentDir, true);
     const snapshot = await this.collect(this.config.repoDir, true);
     let added = 0; let changed = 0; let remoteOnly = 0;
@@ -277,11 +301,35 @@ export class SyncService {
     }
     for (const file of snapshot.keys()) if (!local.has(file)) remoteOnly++;
     const localChanges = added || changed || remoteOnly ? `added/local-only: ${added}; changed: ${changed}; remote-only: ${remoteOnly}` : "";
-    const upstream = await this.exec([...gitOptions, "rev-parse", "--verify", "@{u}"], this.config.repoDir);
+    const upstream = await this.gitResult(["rev-parse", "--verify", "@{u}"], this.config.repoDir);
     const remoteChanges = upstream.code === 0 ? Number((await this.git(["rev-list", "--count", "HEAD..@{u}"])).trim()) : undefined;
     this.status.localChanges = localChanges; this.status.remoteChanges = remoteChanges;
     this.status.checkedAt = new Date().toISOString(); return { ...this.status, busy: undefined };
   }); }
+  /** Fetch and integrate remote history without rewriting local commits. */
+  private async integrateRemote(): Promise<{ merged: boolean; fastForward: boolean }> {
+    await this.git(["fetch", "origin"], this.config.repoDir, NETWORK_TIMEOUT_MS);
+    const relation = await this.gitResult(["merge-base", "--is-ancestor", "HEAD", "@{u}"]);
+    if (relation.code === 0) {
+      await this.git(["merge", "--ff-only", "@{u}"]);
+      return { merged: false, fastForward: true };
+    }
+    if (relation.code !== 1) throw new Error(`git merge-base failed: ${relation.stderr.trim() || relation.stdout.trim() || `exit ${relation.code}`}`);
+    // The remote is not ahead. Distinguish a local-only commit (nothing to
+    // integrate) from true divergence before attempting a merge.
+    const ahead = await this.gitResult(["merge-base", "--is-ancestor", "@{u}", "HEAD"]);
+    if (ahead.code === 0) return { merged: false, fastForward: false };
+    if (ahead.code !== 1) throw new Error(`git merge-base failed: ${ahead.stderr.trim() || ahead.stdout.trim() || `exit ${ahead.code}`}`);
+    // Local and remote both have commits. Only accept a clean merge; any
+    // conflict restores the previous clean repository.
+    try {
+      await this.git(["merge", "--no-edit", "@{u}"]);
+      return { merged: true, fastForward: false };
+    } catch (error) {
+      try { await this.git(["merge", "--abort"]); } catch { /* no merge in progress */ }
+      throw new Error(`Remote and local snapshots diverged, and the three-way merge was not clean. The repository was restored. Resolve the divergence manually. ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
   async push(): Promise<string> { return this.run("push", async () => {
     await this.ensureRepo();
     if ((await this.git(["diff", "--cached", "--name-only"])).trim()) throw new Error("Repository has staged changes; inspect/commit them manually before sync");
@@ -301,19 +349,34 @@ export class SyncService {
     if (batch.length) await this.git(["--literal-pathspecs", "add", "--", ...batch]);
     const staged = (await this.git(["diff", "--cached", "--name-only"])).trim();
     if (staged) await this.git(["commit", "-m", `amox-pi-sync: ${new Date().toISOString()}`]);
-    // Always retry push, even when the previous attempt committed but failed offline.
-    await this.git(["push", "-u", "origin", "HEAD"]);
+    // A rejected non-fast-forward push is recoverable without force. Any other
+    // failure, including a killed transfer, is final and records no success.
+    const first = await this.gitResult(["push", "-u", "origin", "HEAD"], this.config.repoDir, NETWORK_TIMEOUT_MS);
+    let integrated = false;
+    if (first.code !== 0) {
+      if (!/non-fast-forward|fetch first|\[rejected\]|Updates were rejected/i.test(first.stderr)) {
+        throw new Error(`git push failed: ${first.stderr.trim() || first.stdout.trim() || `exit ${first.code}`}. Inspect the repository before retrying; no force push is performed.`);
+      }
+      const result = await this.integrateRemote();
+      integrated = result.merged || result.fastForward;
+      if (!integrated) throw new Error("git push was rejected, but the fetched remote is not ahead; inspect the repository before retrying.");
+      await this.git(["push", "-u", "origin", "HEAD"], this.config.repoDir, NETWORK_TIMEOUT_MS);
+    }
     this.config.lastPushAt = new Date().toISOString();
-    this.config.lastResult = "Pushed managed snapshot (no force push; remote-only files preserved)";
+    this.config.lastResult = integrated
+      ? "Integrated remote history and pushed managed snapshot; run Pull to apply remote files (no force push)"
+      : "Pushed managed snapshot (no force push; remote-only files preserved)";
     await saveConfig(this.config, this.paths);
     return this.config.lastResult;
   }); }
   async pull(): Promise<string> { return this.run("pull", async () => {
     await this.ensureRepo();
-    if ((await this.git(["status", "--porcelain"])).trim()) throw new Error("Repository has uncommitted changes; resolve them before ff-only pull");
-    await this.git(["pull", "--ff-only", "origin"]);
-    const result = await this.apply(await this.collect(this.config.repoDir, true), "before applying remote snapshot");
-    this.config.lastPullAt = new Date().toISOString(); await saveConfig(this.config, this.paths); return result.message;
+    if ((await this.git(["status", "--porcelain"])).trim()) throw new Error("Repository has uncommitted changes; resolve them before pulling");
+    const result = await this.integrateRemote();
+    const applied = await this.apply(await this.collect(this.config.repoDir, true), "before applying remote snapshot");
+    this.config.lastPullAt = new Date().toISOString();
+    this.config.lastResult = `${result.merged ? "Merged diverged snapshots cleanly. " : ""}${applied.message}`;
+    await saveConfig(this.config, this.paths); return this.config.lastResult;
   }); }
   async backup(): Promise<Backup> { return this.run("backup", () => this.makeBackup("manual")); }
   async listBackups(): Promise<Backup[]> { return this.run("listBackups", () => this.backups()); }

package/index.ts

@@ -85,9 +85,9 @@ export default function amoxPiSync(pi: ExtensionAPI): void {
   }
 
   function makeService(): void {
-    service = config ? new SyncService(config, paths, async (args, cwd) => {
-      const result = await pi.exec("git", args, { cwd, timeout: 60_000 });
-      return { stdout: result.stdout, stderr: result.stderr, code: result.code };
+    service = config ? new SyncService(config, paths, async (args, cwd, timeoutMs) => {
+      const result = await pi.exec("git", args, { cwd, timeout: timeoutMs });
+      return { stdout: result.stdout, stderr: result.stderr, code: result.code, killed: result.killed };
     }) : undefined;
     if (service) service.activeSessionFile = ctx?.sessionManager.getSessionFile();
   }
@@ -208,13 +208,13 @@ export default function amoxPiSync(pi: ExtensionAPI): void {
 
   function renderRows(context: ExtensionContext, rows: DetailRow[]): string[] {
     const theme = context.ui.theme;
-    return rows.map(row => theme.fg("muted", `${row.label.padEnd(14)} `)
+    return rows.map(row => theme.fg("muted", `${`${row.label}:`.padEnd(15)} `)
       + theme.fg(row.tone ?? "text", row.label === "State" ? theme.bold(terminalText(row.value)) : terminalText(row.value)));
   }
 
   // Targets inherit Starline's foreground so a selected row remains legible on
   // its pill-coloured background. Bold adds hierarchy without overriding it.
-  const actionText = (context: ExtensionContext, text: string) => context.ui.theme.bold(terminalText(text));
+  const actionText = (context: ExtensionContext, text: string) => context.ui.theme.bold(`• ${terminalText(text)}`);
 
   function content(context: ExtensionContext): BubbleContent {
     const body: BubbleLine[] = renderRows(context, detailRows());
@@ -297,9 +297,9 @@ export default function amoxPiSync(pi: ExtensionAPI): void {
     for (;;) {
       const choice = await select(context, "Sync settings", [
         { value: "status", label: "Status" },
-        { value: "mode", label: `Mode  ${config ? modeLabel(config.mode) : "Not configured"}` },
-        { value: "paths", label: `Paths  ${config?.paths.length ?? 0}` },
-        ...(bubbleAPI(context)?.version === 1 ? [{ value: "color", label: `Bubble colour  ${colorChoices.find(choice => choice.value === (config?.bubbleColor ?? "pill"))!.label}` }] : []),
+        { value: "mode", label: `Mode: ${config ? modeLabel(config.mode) : "Not configured"}` },
+        { value: "paths", label: `Paths: ${config?.paths.length ?? 0} configured` },
+        ...(bubbleAPI(context)?.version === 1 ? [{ value: "color", label: `Bubble colour: ${colorChoices.find(choice => choice.value === (config?.bubbleColor ?? "pill"))!.label}` }] : []),
         "Backups", "Cleanup", "Diagnostics", "Back",
       ], { rows: overviewRows });
       if (!choice || choice === "Back") return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gfgghgftgffg/amox-pi-sync",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "Independent Pi agent-data sync fork with SSH Git transport, backups and optional Starline status.",
   "license": "MIT",