@gfgghgftgffg/amox-pi-sync 0.1.4 → 0.1.5

package/MAINTENANCE.md

@@ -5,7 +5,7 @@
 - Upstream: [MuratAitov/pi-sync](https://github.com/MuratAitov/pi-sync), npm `pi-sync-suite@0.1.1`.
 - Source ref: `npm:pi-sync-suite@0.1.1` (published source baseline, not the repository's moving HEAD).
 - Upstream MIT notice is preserved verbatim in `LICENSE`: Copyright (c) 2026 Murat.
-- Local package: `@gfgghgftgffg/amox-pi-sync@0.1.4`, standalone TypeScript entrypoint `index.ts` and `core.ts`; no runtime dependency on the original suite.
+- Local package: `@gfgghgftgffg/amox-pi-sync@0.1.5`, standalone TypeScript entrypoint `index.ts` and `core.ts`; no runtime dependency on the original suite.
 
 ## Scope
 
@@ -13,7 +13,7 @@ Keep raw agent-data push/pull, safe relative include/exclude paths (sessions + m
 
 Settings are stored in `amox-pi-sync.json`; legacy `pi-sync-suite.json` is read only as a migration fallback until new settings are saved. Backups use `amox-pi-sync-backups` and require manual retention management via Cleanup. Manual/off startup must not access the network; auto startup fingerprints locally then starts timers and a non-awaited background pull. Setup only saves configuration and stops timers, requiring reload to activate auto mode. The automatic loop must not block the UI. Migration uses an independent `amox-pi-sync-repo`, not the old snapshot directory. The `pi-sync` status key preserves existing Starline placement; the pill bridge takes priority over legacy command mapping. `off` disables automation, not explicit commands. Presentation separates labels and values with a colon; the path count is explicitly marked configured. Starline action rows have a leading bullet, while native Pi selectors retain their own indicators. Presentation uses semantic Pi theme colours for labels, values and errors, and bold targets without fixed foreground/background colours so Starline owns selection contrast. Keep Manual/Auto/Off and Push/Pull terminology consistent across capsule, details, menus and command feedback; never append idle to the mode. Anchor bubbles to the clicked Starline cell, including submenus and confirmations; commands reuse the last clicked anchor or center before one is known. Forward pill colours by default and offer semantic theme colour overrides through bubbleColor; do not override selected-row text contrast. Colour changes must not start timers or network work. Without Starline use native Pi UI and hide the Starline colour option. Recompute theme styles when rendering, keep RPC/native status text plain, and do not store styled strings in settings. On Windows prefer native OpenSSH when present for non-ASCII home paths; retain batch mode, timeout and host-key verification. Keep large diagnostic results in the action notification rather than copying JSON dumps into status details.
 
-Safety requirements: private SSH remote, no working-directory mutation, no JSONL merging, preserve local-only files, back up replacements and never overwrite active sessions. Safe-path validation must exclude configuration and implementation data even when users select arbitrary relative data paths. Do not claim encryption, conflict-free multi-device merging or automatic secret removal.
+Safety requirements: private SSH remote, no working-directory mutation, no semantic JSONL merging, preserve local-only files, back up replacements and never overwrite active sessions. Network transfers use a 10-minute timeout and local Git commands 60 seconds; a terminated or timed-out process must never be recorded as success, even when an executor reports code 0. Pull fast-forwards or performs a clean file-level three-way merge; conflicts abort and apply nothing. A rejected non-fast-forward push fetches, integrates without rebase or force, and retries once; files integrated during push are applied on the next pull. Git commands force `core.autocrlf=false` and `core.eol=lf`, with a repository-local `* -text` attribute; do not rewrite raw bytes or existing mixed-EOL history automatically. Safe-path validation must exclude configuration and implementation data even when users select arbitrary relative data paths. Do not claim encryption, conflict-free multi-device merging or automatic secret removal.
 
 ## 功能取舍与维护边界
 

package/README.md

@@ -41,9 +41,10 @@ Manual/off startup performs no network access. Auto startup computes a local fin
 > Sessions, missions and other selected files may contain secrets. Use a **private SSH repository**, review included paths, and secure both the remote and local backups. Private Git is not encryption or a secret scrubber.
 
 - Paths are relative to Pi's agent-data directory, not the current project. Arbitrary safe data paths can be included or excluded; the extension does not change the working directory.
-- Raw files are transferred without Markdown/JSON export or JSONL merging. Concurrent edits are not a semantic merge; coordinate devices and inspect diagnostics.
+- Raw files are transferred without Markdown/JSON export or semantic JSONL merging. Concurrent edits are not a semantic merge; an automatic three-way merge is file-level and aborts if both sides changed the same file. Coordinate devices and inspect diagnostics.
 - Local-only files are retained; deletions are not propagated. Incoming content replaces differing same-path files after backup; active sessions must not be overwritten. Restore applies only the currently managed paths.
-- Git commands disable automatic line-ending conversion so Windows `core.autocrlf` does not rewrite raw sessions. On Windows, SSH prefers native OpenSSH (`System32/OpenSSH/ssh.exe`) when available to support non-ASCII user directories; otherwise it uses `ssh`. Batch mode, connection timeout and host-key verification remain enabled, overriding a custom `core.sshCommand`.
+- Network Git operations (`clone`, `fetch`, `pull`, `push`) use a 10-minute timeout; local Git operations use 60 seconds. A process terminated by timeout or cancellation is a failure and is never recorded as completed, even if Pi reports exit code 0. Pull fast-forwards when possible; otherwise it performs a clean three-way merge in the snapshot repository. Conflicts abort the merge and apply no files. A rejected non-fast-forward push fetches, integrates remote history without rebase or force, and retries once; files integrated during push are applied on the next pull.
+- Git commands force `core.autocrlf=false` and `core.eol=lf`, and the snapshot repository uses a local `* -text` attribute so Git does not convert raw bytes. Existing history with mixed CRLF/LF is not rewritten automatically; normalizing it requires an explicit manual migration and repack. On Windows, SSH prefers native OpenSSH (`System32/OpenSSH/ssh.exe`) when available to support non-ASCII user directories; otherwise it uses `ssh`. Batch mode, connection timeout and host-key verification remain enabled, overriding a custom `core.sshCommand`.
 - Backups use `amox-pi-sync-backups` under the agent-data directory. Cleanup only deletes local backups after manual preview/confirmation, using complete backup directories rather than individual files. The default limits are 20 complete backups and a maximum age of 180 days; backups older than this or beyond the newest 20 become cleanup candidates. There is no automatic deletion; sessions and missions are never cleanup targets.
 - Settings use `amox-pi-sync.json`. If absent, legacy `pi-sync-suite.json` can be read for migration. The old file is not changed before new settings are saved; saving writes the new file. Migration uses a separate `amox-pi-sync-repo` directory rather than reusing the old snapshot.
 

package/README.zh-CN.md

@@ -41,9 +41,10 @@ manual/off 启动不访问网络。auto 启动先计算本地 fingerprint，再
 > 会话、missions 及其他选中文件可能包含秘密。请使用**私有 SSH 仓库**，检查同步路径，并保护远端和本地备份。私有 Git 不提供加密或秘密清除。
 
 - 路径相对于 Pi agent 数据目录，不是当前项目。可包含/排除任意安全的数据相对路径；扩展不改写工作目录。
-- 传输原始文件，不生成 Markdown/JSON 归档，不合并 JSONL。并发编辑不是语义合并；请协调多设备操作并查看诊断。
+- 传输原始文件，不生成 Markdown/JSON 归档，不做语义化 JSONL 合并。并发编辑不是语义合并；自动三方合并按文件进行，双方修改同一文件时会中止。请协调多设备操作并查看诊断。
 - 保留本地独有文件，不传播删除；同路径的不同内容以拉取数据为准，覆盖前备份；不得覆盖活跃会话。恢复备份只处理当前纳管范围。
-- Git 操作关闭自动换行转换，避免 Windows 的 `core.autocrlf` 改写原始会话。Windows 优先使用原生 OpenSSH（`System32/OpenSSH/ssh.exe`），支持中文用户目录；不存在时及其他平台使用 `ssh`。保留非交互模式、连接超时及主机密钥验证，不复用自定义 `core.sshCommand`。
+- 网络 Git 操作（`clone`、`fetch`、`pull`、`push`）超时为 10 分钟，本地 Git 操作为 60 秒。被超时或取消终止的进程一律视为失败，即使 Pi 返回 exit code 0，也不会写入完成时间。能快进时 Pull 直接快进，否则在快照仓库中执行干净的三方合并；冲突会中止合并且不应用任何文件。Push 被非快进拒绝时会 fetch、在不 rebase、不 force 的前提下整合远端历史，并重试一次；Push 整合的文件在下一次 Pull 时应用。
+- Git 操作强制 `core.autocrlf=false`、`core.eol=lf`，快照仓库使用本地 `* -text` 属性，避免 Git 转换原始字节。已有 CRLF/LF 混合历史不会被自动改写；统一换行需要显式的手动迁移和 repack。Windows 优先使用原生 OpenSSH（`System32/OpenSSH/ssh.exe`），支持中文用户目录；不存在时及其他平台使用 `ssh`。保留非交互模式、连接超时及主机密钥验证，不复用自定义 `core.sshCommand`。
 - 备份位于 agent 数据目录下的 `amox-pi-sync-backups`。Cleanup 仅在手动预览/确认后删除本地备份，按完整备份目录计数，不按单个文件计数。默认数量上限 20 份、最长 180 天；超龄或超出最新 20 份的备份纳入清理候选，不自动删除，不清理 sessions 或 missions。
 - 新设置文件为 `amox-pi-sync.json`；不存在时可读取旧 `pi-sync-suite.json` 迁移。保存新设置前不改旧文件，保存时写入新文件。迁移使用独立的 `amox-pi-sync-repo` 目录，不复用旧快照。
 

package/core.ts

@@ -33,7 +33,7 @@ export type Config = {
   retention?: { keepBackups: number; maxAgeDays: number };
 };
 export type Paths = { agentDir: string; configFile: string; backupDir: string };
-export type GitExecutor = (args: string[], cwd: string) => Promise<{ stdout: string; stderr: string; code: number }>;
+export type GitExecutor = (args: string[], cwd: string, timeoutMs?: number) => Promise<{ stdout: string; stderr: string; code: number; killed?: boolean }>;
 export type Status = { busy?: string; error?: string; localChanges?: string; remoteChanges?: number; checkedAt?: string };
 export type Backup = { id: string; createdAt: string; reason: string; includedPaths: string[] };
 export type BackupSummary = Backup;
@@ -137,6 +137,10 @@ export async function saveConfig(config: Config, paths = defaultPaths()): Promis
 // Raw sessions are opaque bytes and intentionally bypass content scanning. Use a
 // trusted PRIVATE repository: sessions may contain credentials or private text.
 const secret = /-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----|\bghp_[A-Za-z0-9_]{30,}\b|\bsk-[A-Za-z0-9_-]{20,}\b|\b(?:api[_-]?key|token|password|secret)\b\s*[:=]\s*["']?[^"'\s]{12,}/i;
+// Local Git work is bounded; network transfers can legitimately take minutes
+// for large session histories, and a killed transfer must never look successful.
+const LOCAL_TIMEOUT_MS = 60_000;
+const NETWORK_TIMEOUT_MS = 10 * 60_000;
 // Git for Windows SSH can misdecode non-ASCII home paths; prefer native OpenSSH.
 const nativeSsh = path.join(process.env.SystemRoot ?? "C:/Windows", "System32", "OpenSSH", "ssh.exe");
 const sshCommand = process.platform === "win32" && existsSync(nativeSsh)
@@ -144,6 +148,7 @@ const sshCommand = process.platform === "win32" && existsSync(nativeSsh)
 const gitOptions = [
   "-c", "core.hooksPath=",
   "-c", "core.autocrlf=false",
+  "-c", "core.eol=lf",
   "-c", "credential.interactive=false",
   "-c", `core.sshCommand=${sshCommand} -oBatchMode=yes -oConnectTimeout=10`,
 ];
@@ -167,23 +172,42 @@ export class SyncService {
     } catch (e) { this.status.error = e instanceof Error ? e.message : String(e); throw e; }
     finally { try { if (lock) { await lock.close(); await fs.unlink(lockFile); } } finally { this.status.busy = undefined; } }
   }
-  private async git(args: string[], cwd = this.config.repoDir): Promise<string> {
-    const result = await this.exec([...gitOptions, ...args], cwd);
+  private async gitResult(args: string[], cwd = this.config.repoDir, timeoutMs = LOCAL_TIMEOUT_MS) {
+    const result = await this.exec([...gitOptions, ...args], cwd, timeoutMs);
+    // pi.exec can report code 0 for a process killed by its timeout; the killed
+    // flag is the only reliable failure signal for that path.
+    if (result.killed) throw new Error(`git ${args[0]} was terminated before completion (timeout or cancellation); no success was recorded. Verify the repository state before retrying.`);
+    return result;
+  }
+  private async git(args: string[], cwd = this.config.repoDir, timeoutMs = LOCAL_TIMEOUT_MS): Promise<string> {
+    const result = await this.gitResult(args, cwd, timeoutMs);
     if (result.code !== 0) throw new Error(`git ${args[0]} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}. Resolve repository conflicts manually; no force push or JSONL merge is performed.`);
     return result.stdout;
   }
+  /** Keep raw bytes raw: local attributes override any text/EOL rules in the snapshot. */
+  private async ensureAttributes(): Promise<void> {
+    const file = path.join(this.config.repoDir, ".git", "info", "attributes");
+    await noLinks(file);
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    let current = "";
+    try { current = await fs.readFile(file, "utf8"); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+    if (current.split(/\r?\n/).filter(Boolean).at(-1) === "* -text") return;
+    await fs.writeFile(file, `${current}${current && !current.endsWith("\n") ? "\n" : ""}* -text\n`, { mode: 0o600 });
+  }
   private async ensureRepo(): Promise<void> {
     await noLinks(this.config.repoDir);
     const gitDir = path.join(this.config.repoDir, ".git"); await noLinks(gitDir);
     if (!(await stat(gitDir))) {
       if (await stat(this.config.repoDir) && (await fs.readdir(this.config.repoDir)).length) throw new Error("Repository directory is nonempty but has no .git; choose an empty directory");
       await fs.mkdir(path.dirname(this.config.repoDir), { recursive: true });
-      await this.git(["clone", "--", this.config.repoUrl, this.config.repoDir], path.dirname(this.config.repoDir));
+      await this.git(["clone", "--", this.config.repoUrl, this.config.repoDir], path.dirname(this.config.repoDir), NETWORK_TIMEOUT_MS);
     }
     const origin = (await this.git(["remote", "get-url", "origin"])).trim();
     if (origin !== this.config.repoUrl) throw new Error("Repository origin differs from configured SSH URL; inspect it before syncing");
     const pushUrls = (await this.git(["remote", "get-url", "--push", "--all", "origin"])).trim().split(/\r?\n/);
     if (pushUrls.some(url => url !== this.config.repoUrl)) throw new Error("Repository push URL differs from configured SSH URL");
+    await this.ensureAttributes();
     for (const file of (await this.git(["ls-files", "-z"])).split("\0").filter(Boolean)) validatePath(file);
   }
   private async collect(root: string, scan = false): Promise<Files> {
@@ -266,7 +290,7 @@ export class SyncService {
   }
   async check(): Promise<Status> { return this.run("check", async () => {
     this.status.checkedAt = undefined; this.status.remoteChanges = undefined;
-    await this.ensureRepo(); await this.git(["fetch", "origin"]);
+    await this.ensureRepo(); await this.git(["fetch", "origin"], this.config.repoDir, NETWORK_TIMEOUT_MS);
     const local = await this.collect(this.paths.agentDir, true);
     const snapshot = await this.collect(this.config.repoDir, true);
     let added = 0; let changed = 0; let remoteOnly = 0;
@@ -277,11 +301,35 @@ export class SyncService {
     }
     for (const file of snapshot.keys()) if (!local.has(file)) remoteOnly++;
     const localChanges = added || changed || remoteOnly ? `added/local-only: ${added}; changed: ${changed}; remote-only: ${remoteOnly}` : "";
-    const upstream = await this.exec([...gitOptions, "rev-parse", "--verify", "@{u}"], this.config.repoDir);
+    const upstream = await this.gitResult(["rev-parse", "--verify", "@{u}"], this.config.repoDir);
     const remoteChanges = upstream.code === 0 ? Number((await this.git(["rev-list", "--count", "HEAD..@{u}"])).trim()) : undefined;
     this.status.localChanges = localChanges; this.status.remoteChanges = remoteChanges;
     this.status.checkedAt = new Date().toISOString(); return { ...this.status, busy: undefined };
   }); }
+  /** Fetch and integrate remote history without rewriting local commits. */
+  private async integrateRemote(): Promise<{ merged: boolean; fastForward: boolean }> {
+    await this.git(["fetch", "origin"], this.config.repoDir, NETWORK_TIMEOUT_MS);
+    const relation = await this.gitResult(["merge-base", "--is-ancestor", "HEAD", "@{u}"]);
+    if (relation.code === 0) {
+      await this.git(["merge", "--ff-only", "@{u}"]);
+      return { merged: false, fastForward: true };
+    }
+    if (relation.code !== 1) throw new Error(`git merge-base failed: ${relation.stderr.trim() || relation.stdout.trim() || `exit ${relation.code}`}`);
+    // The remote is not ahead. Distinguish a local-only commit (nothing to
+    // integrate) from true divergence before attempting a merge.
+    const ahead = await this.gitResult(["merge-base", "--is-ancestor", "@{u}", "HEAD"]);
+    if (ahead.code === 0) return { merged: false, fastForward: false };
+    if (ahead.code !== 1) throw new Error(`git merge-base failed: ${ahead.stderr.trim() || ahead.stdout.trim() || `exit ${ahead.code}`}`);
+    // Local and remote both have commits. Only accept a clean merge; any
+    // conflict restores the previous clean repository.
+    try {
+      await this.git(["merge", "--no-edit", "@{u}"]);
+      return { merged: true, fastForward: false };
+    } catch (error) {
+      try { await this.git(["merge", "--abort"]); } catch { /* no merge in progress */ }
+      throw new Error(`Remote and local snapshots diverged, and the three-way merge was not clean. The repository was restored. Resolve the divergence manually. ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
   async push(): Promise<string> { return this.run("push", async () => {
     await this.ensureRepo();
     if ((await this.git(["diff", "--cached", "--name-only"])).trim()) throw new Error("Repository has staged changes; inspect/commit them manually before sync");
@@ -301,19 +349,34 @@ export class SyncService {
     if (batch.length) await this.git(["--literal-pathspecs", "add", "--", ...batch]);
     const staged = (await this.git(["diff", "--cached", "--name-only"])).trim();
     if (staged) await this.git(["commit", "-m", `amox-pi-sync: ${new Date().toISOString()}`]);
-    // Always retry push, even when the previous attempt committed but failed offline.
-    await this.git(["push", "-u", "origin", "HEAD"]);
+    // A rejected non-fast-forward push is recoverable without force. Any other
+    // failure, including a killed transfer, is final and records no success.
+    const first = await this.gitResult(["push", "-u", "origin", "HEAD"], this.config.repoDir, NETWORK_TIMEOUT_MS);
+    let integrated = false;
+    if (first.code !== 0) {
+      if (!/non-fast-forward|fetch first|\[rejected\]|Updates were rejected/i.test(first.stderr)) {
+        throw new Error(`git push failed: ${first.stderr.trim() || first.stdout.trim() || `exit ${first.code}`}. Inspect the repository before retrying; no force push is performed.`);
+      }
+      const result = await this.integrateRemote();
+      integrated = result.merged || result.fastForward;
+      if (!integrated) throw new Error("git push was rejected, but the fetched remote is not ahead; inspect the repository before retrying.");
+      await this.git(["push", "-u", "origin", "HEAD"], this.config.repoDir, NETWORK_TIMEOUT_MS);
+    }
     this.config.lastPushAt = new Date().toISOString();
-    this.config.lastResult = "Pushed managed snapshot (no force push; remote-only files preserved)";
+    this.config.lastResult = integrated
+      ? "Integrated remote history and pushed managed snapshot; run Pull to apply remote files (no force push)"
+      : "Pushed managed snapshot (no force push; remote-only files preserved)";
     await saveConfig(this.config, this.paths);
     return this.config.lastResult;
   }); }
   async pull(): Promise<string> { return this.run("pull", async () => {
     await this.ensureRepo();
-    if ((await this.git(["status", "--porcelain"])).trim()) throw new Error("Repository has uncommitted changes; resolve them before ff-only pull");
-    await this.git(["pull", "--ff-only", "origin"]);
-    const result = await this.apply(await this.collect(this.config.repoDir, true), "before applying remote snapshot");
-    this.config.lastPullAt = new Date().toISOString(); await saveConfig(this.config, this.paths); return result.message;
+    if ((await this.git(["status", "--porcelain"])).trim()) throw new Error("Repository has uncommitted changes; resolve them before pulling");
+    const result = await this.integrateRemote();
+    const applied = await this.apply(await this.collect(this.config.repoDir, true), "before applying remote snapshot");
+    this.config.lastPullAt = new Date().toISOString();
+    this.config.lastResult = `${result.merged ? "Merged diverged snapshots cleanly. " : ""}${applied.message}`;
+    await saveConfig(this.config, this.paths); return this.config.lastResult;
   }); }
   async backup(): Promise<Backup> { return this.run("backup", () => this.makeBackup("manual")); }
   async listBackups(): Promise<Backup[]> { return this.run("listBackups", () => this.backups()); }

package/index.ts

@@ -85,9 +85,9 @@ export default function amoxPiSync(pi: ExtensionAPI): void {
   }
 
   function makeService(): void {
-    service = config ? new SyncService(config, paths, async (args, cwd) => {
-      const result = await pi.exec("git", args, { cwd, timeout: 60_000 });
-      return { stdout: result.stdout, stderr: result.stderr, code: result.code };
+    service = config ? new SyncService(config, paths, async (args, cwd, timeoutMs) => {
+      const result = await pi.exec("git", args, { cwd, timeout: timeoutMs });
+      return { stdout: result.stdout, stderr: result.stderr, code: result.code, killed: result.killed };
     }) : undefined;
     if (service) service.activeSessionFile = ctx?.sessionManager.getSessionFile();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gfgghgftgffg/amox-pi-sync",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "Independent Pi agent-data sync fork with SSH Git transport, backups and optional Starline status.",
   "license": "MIT",