@narumitw/pi-sync 0.34.0 → 0.38.0

package/README.md

@@ -52,7 +52,11 @@ Automatic sync: On
 Remote status: Not checked
 ```
 
-Primary actions include **Sync now**, **Switch sync setup**, **Status & changes**, **Settings**, and **More…**. Secondary screens provide **Back**; Escape closes the flow. Destructive and externally visible operations show exact previews and confirmations.
+Primary actions include **Sync now**, **Switch sync setup**, **Status & changes**, **Settings**, and
+**More…**. The standard manager also owns setup and connection lists/details plus history and
+recovery. Secondary screens provide **Back**; Escape goes back and Ctrl+C closes the flow.
+Destructive, credential-bearing, and externally visible operations retain exact specialized previews
+and confirmations.
 
 ## ⚙️ Settings
 
@@ -62,7 +66,7 @@ The canonical private user file is:
 ~/.pi/agent/pi-sync.json
 ```
 
-Pi's configured agent directory replaces `~/.pi/agent` when applicable. On POSIX, pi-sync creates and replaces this file with mode `0600`. Credentials stay in this canonical private file and are never shown in menus, reviews, status, notifications, errors, logs, or completion metadata.
+Pi's configured agent directory replaces `~/.pi/agent` when applicable. Missing settings load as unconfigured without creating an agent directory, file, temporary, or lock. An explicit setup creates the file atomically. On POSIX, pi-sync creates and replaces it with mode `0600`. Pi-sync processes coordinate settings access through `pi-sync.json.mutation-lock`; lock-unaware editors are outside that serialization boundary and should not save the file while a pi-sync settings operation is running. Credentials stay in this canonical private file and are never shown in menus, reviews, status, notifications, errors, logs, or completion metadata.
 
 An existing private `pi-sync.local.json` containing a valid version 3 document is copied byte-for-byte to `pi-sync.json`; the old file remains as a recovery copy. If both paths exist, `pi-sync.json` wins and the other path remains untouched.
 
@@ -165,6 +169,12 @@ Safe agent-relative custom files or directories may also be included. Absolute p
 
 An empty array is valid. It means no useful transfer is selected: **Sync now** reports the condition and does not claim that the setup is up to date. Unselected content remains unmanaged locally and is preserved when republishing existing remote snapshots.
 
+The Included Content editor is a standard bounded multi-select backed by one in-memory draft. Toggles
+never write settings. Leaving the editor opens an exact Include/Exclude review with **Save changes**,
+**Discard changes**, and **Continue editing**; only reviewed Save publishes, while Continue preserves
+the draft and Discard/cancellation preserves the settings bytes. RPC remains a read-only summary with
+the manual `sync.include` path.
+
 Adding `sessions` requires a privacy acknowledgement in interactive flows. Session JSONL can contain prompts, tool output, file paths, images, and secrets. Automatic apply protects the currently open session file; restart Pi or resume a pulled session to use newly synchronized conversations.
 
 ### Unsupported old settings and recovery
@@ -209,7 +219,9 @@ The menu is preferred, while deterministic routes remain available:
 
 The former version 2 setup-addressing flag is rejected. Unknown flags, unknown commands, trailing values, and missing setup/snapshot values are rejected. Completion includes known setup names and preserves preceding command tokens.
 
-TUI mode provides custom components. RPC uses Pi's supported dialog/notification protocol. Print and JSON modes never enter TUI-only screens; unsupported interactive routes reject or remain protocol-safe rather than relying on no-op output.
+TUI mode uses standard manager, settings, resource, and included-content screens plus specialized
+secret, wizard, confirmation, and commit-aware loader components. RPC uses Pi's supported
+dialog/notification protocol and does not gain settings mutation. Print and JSON modes never enter TUI-only screens; unsupported interactive routes reject or remain protocol-safe rather than relying on no-op output.
 
 ## 🔄 Backend and recovery model
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@narumitw/pi-sync",
-	"version": "0.34.0",
+	"version": "0.38.0",
 	"description": "Pi extension that syncs Pi configuration through Git, WebDAV, Cloudflare R2, or S3-compatible storage.",
 	"type": "module",
 	"license": "MIT",
@@ -36,6 +36,7 @@
 		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
+		"@narumitw/pi-tui-kit": "<1",
 		"fast-xml-parser": "^5.10.1",
 		"proper-lockfile": "^4.1.2"
 	},

package/src/config-file.ts

@@ -1,6 +1,5 @@
 import { randomUUID } from "node:crypto";
 import {
-	constants as fsConstants,
 	mkdir,
 	mkdirSync,
 	realpath,
@@ -36,23 +35,51 @@ const LOCKFILE_FS_ADAPTER = {
 	utimesSync,
 };
 
-type LinkFile = (source: string, destination: string) => Promise<void>;
-let linkConfigFile: LinkFile = (source, destination) => fs.link(source, destination);
+type PublishFile = (source: string, destination: string) => Promise<void>;
+let publishConfigFile: PublishFile = publishFileWithoutReplacement;
+let beforeConfigPublicationHook: () => Promise<void> = async () => undefined;
+let afterMissingConfigReadProbeHook: () => Promise<void> = async () => undefined;
 let afterReplacementInstalledHook: () => Promise<void> = async () => undefined;
 let afterConfigQuarantinedHook: () => Promise<void> = async () => undefined;
 
 export type FileIdentity = { dev: number; ino: number };
 
-export async function withConfigFileLinkForTest<T>(
-	link: LinkFile,
+export async function withConfigFilePublicationForTest<T>(
+	publish: PublishFile,
 	run: () => Promise<T>,
 ): Promise<T> {
-	const previous = linkConfigFile;
-	linkConfigFile = link;
+	const previous = publishConfigFile;
+	publishConfigFile = publish;
 	try {
 		return await run();
 	} finally {
-		linkConfigFile = previous;
+		publishConfigFile = previous;
+	}
+}
+
+export async function withConfigPublicationReadyHookForTest<T>(
+	hook: () => Promise<void>,
+	run: () => Promise<T>,
+): Promise<T> {
+	const previous = beforeConfigPublicationHook;
+	beforeConfigPublicationHook = hook;
+	try {
+		return await run();
+	} finally {
+		beforeConfigPublicationHook = previous;
+	}
+}
+
+export async function withMissingConfigReadProbeHookForTest<T>(
+	hook: () => Promise<void>,
+	run: () => Promise<T>,
+): Promise<T> {
+	const previous = afterMissingConfigReadProbeHook;
+	afterMissingConfigReadProbeHook = hook;
+	try {
+		return await run();
+	} finally {
+		afterMissingConfigReadProbeHook = previous;
 	}
 }
 
@@ -99,10 +126,10 @@ export function legacyLocalConfigPath() {
 }
 
 export async function activeLocalConfigPath() {
-	return withLocalConfigFileLock(async () => {
-		const canonicalPath = localConfigPath();
+	const canonicalPath = localConfigPath();
+	const legacyPath = legacyLocalConfigPath();
+	return withLocalConfigReadLockIfNeeded(async () => {
 		if (await pathExists(canonicalPath)) return canonicalPath;
-		const legacyPath = legacyLocalConfigPath();
 		return (await pathExists(legacyPath)) ? legacyPath : canonicalPath;
 	});
 }
@@ -117,9 +144,10 @@ export function consumeLocalConfigMigrationNotice() {
 export async function readActiveLocalConfigDocumentForRepair(): Promise<
 	LocalConfigDocument | undefined
 > {
-	return withLocalConfigFileLock(async () => {
-		const canonicalPath = localConfigPath();
-		const filePath = (await pathExists(canonicalPath)) ? canonicalPath : legacyLocalConfigPath();
+	const canonicalPath = localConfigPath();
+	const legacyPath = legacyLocalConfigPath();
+	return withLocalConfigReadLockIfNeeded(async () => {
+		const filePath = (await pathExists(canonicalPath)) ? canonicalPath : legacyPath;
 		const snapshot = await readConfigSnapshotIfExists(filePath);
 		return snapshot ? { path: filePath, ...snapshot } : undefined;
 	});
@@ -128,13 +156,22 @@ export async function readActiveLocalConfigDocumentForRepair(): Promise<
 export async function readMigratingLocalConfigDocument(
 	validateForMigration: (settings: Record<string, unknown>) => void,
 ): Promise<LocalConfigDocument | undefined> {
-	return withLocalConfigFileLock(async () => {
+	return withLocalConfigReadLockIfNeeded(async () => {
 		const configPath = await prepareLocalConfigPath(validateForMigration);
 		const snapshot = await readConfigSnapshotIfExists(configPath);
 		return snapshot ? { path: configPath, ...snapshot } : undefined;
 	});
 }
 
+async function withLocalConfigReadLockIfNeeded<T>(read: () => Promise<T>): Promise<T> {
+	if ((await pathExists(localConfigPath())) || (await pathExists(legacyLocalConfigPath()))) {
+		return withLocalConfigFileLock(read);
+	}
+	await afterMissingConfigReadProbeHook();
+	if (await pathExists(configMutationLockPath())) return withLocalConfigFileLock(read);
+	return read();
+}
+
 export function updateLocalConfigDocument<T extends Record<string, unknown>>(
 	defaultValue: T,
 	update: (current: T) => T,
@@ -154,7 +191,7 @@ export function updateLocalConfigDocument<T extends Record<string, unknown>>(
 		signal?.throwIfAborted();
 		if (document && JSON.stringify(document.parsed) === JSON.stringify(next)) return next;
 		if (document) await replaceLocalConfigDocumentUnlocked(document, next);
-		else await installPrivateConfigExclusively(localConfigPath(), serializedConfig(next), true);
+		else await installPrivateConfigExclusively(localConfigPath(), serializedConfig(next));
 		return next;
 	});
 }
@@ -163,7 +200,7 @@ export function createLocalConfigDocument(value: Record<string, unknown>) {
 	return withLocalConfigFileLock(async () => {
 		const bytes = serializedConfig(value);
 		try {
-			await installPrivateConfigExclusively(localConfigPath(), bytes, true);
+			await installPrivateConfigExclusively(localConfigPath(), bytes);
 		} catch (error) {
 			if ((error as NodeJS.ErrnoException).code === "EEXIST") {
 				throw new Error("Pi-sync settings were created concurrently; reopen settings and retry.");
@@ -190,7 +227,7 @@ async function replaceLocalConfigDocumentUnlocked(
 		if (!(await configDocumentStillMatches(document))) throw settingsChangedError();
 		let installed: FileIdentity;
 		try {
-			installed = await installPrivateConfigExclusively(canonicalPath, nextBytes, true);
+			installed = await installPrivateConfigExclusively(canonicalPath, nextBytes);
 		} catch (error) {
 			if ((error as NodeJS.ErrnoException).code === "EEXIST") {
 				throw new Error("Canonical settings were created concurrently; no settings were replaced.");
@@ -207,7 +244,7 @@ async function replaceLocalConfigDocumentUnlocked(
 	const quarantinePath = await claimCanonicalConfigDocument(document);
 	let installed: FileIdentity;
 	try {
-		installed = await installPrivateConfigExclusively(canonicalPath, nextBytes, true);
+		installed = await installPrivateConfigExclusively(canonicalPath, nextBytes);
 	} catch (error) {
 		await restoreQuarantinedConfig(canonicalPath, quarantinePath);
 		if ((error as NodeJS.ErrnoException).code === "EEXIST") {
@@ -372,11 +409,7 @@ function parseConfigObject(bytes: Buffer, filePath: string) {
 	return parsed as Record<string, unknown>;
 }
 
-async function installPrivateConfigExclusively(
-	filePath: string,
-	bytes: Buffer,
-	allowCopyFallback = false,
-) {
+async function installPrivateConfigExclusively(filePath: string, bytes: Buffer) {
 	await fs.mkdir(path.dirname(filePath), { recursive: true });
 	const temporaryPath = path.join(
 		path.dirname(filePath),
@@ -390,23 +423,34 @@ async function installPrivateConfigExclusively(
 		await handle.sync();
 		await handle.close();
 		handle = undefined;
-		try {
-			await linkConfigFile(temporaryPath, filePath);
-		} catch (error) {
-			if (!allowCopyFallback || !isUnsupportedLinkError(error)) throw error;
-			await fs.copyFile(temporaryPath, filePath, fsConstants.COPYFILE_EXCL);
-		}
+		await publishConfigFile(temporaryPath, filePath);
 		const installed = await fs.lstat(filePath);
+		let publishedHandle: fs.FileHandle | undefined;
+		let publicationError: unknown;
 		try {
-			if (process.platform !== "win32") await fs.chmod(filePath, 0o600);
-			await syncParentDirectory(filePath).catch(() => undefined);
+			if (installed.isSymbolicLink() || !installed.isFile()) {
+				throw new Error(`Published pi-sync settings are not a regular file: ${filePath}`);
+			}
+			publishedHandle = await fs.open(filePath, "r+");
+			const published = await publishedHandle.stat();
+			if (published.dev !== installed.dev || published.ino !== installed.ino) {
+				throw new Error(`Published pi-sync settings changed while opening: ${filePath}`);
+			}
+			if (process.platform !== "win32") await publishedHandle.chmod(0o600);
+			await publishedHandle.sync();
+			await syncParentDirectory(filePath);
 		} catch (error) {
+			publicationError = error;
+		} finally {
+			await publishedHandle?.close().catch(() => undefined);
+		}
+		if (publicationError) {
 			await quarantineAndRemoveConfigIfMatchesUnlocked(
 				filePath,
 				{ dev: installed.dev, ino: installed.ino },
 				bytes,
 			);
-			throw error;
+			throw publicationError;
 		}
 		return { dev: installed.dev, ino: installed.ino };
 	} finally {
@@ -446,11 +490,6 @@ function settingsChangedError() {
 	return new Error("pi-sync settings changed during migration; no settings were replaced.");
 }
 
-function isUnsupportedLinkError(error: unknown) {
-	const code = (error as NodeJS.ErrnoException).code;
-	return code === "ENOTSUP" || code === "EOPNOTSUPP" || code === "EXDEV" || code === "EPERM";
-}
-
 async function configSnapshotStillMatches(filePath: string, snapshot: ConfigSnapshot) {
 	return fileIdentityAndContentsMatch(filePath, snapshot.identity, snapshot.bytes);
 }
@@ -519,45 +558,32 @@ async function fileIdentityAndContentsMatch(
 
 async function restoreQuarantinedConfig(filePath: string, quarantinePath: string) {
 	try {
-		await linkConfigFile(quarantinePath, filePath);
-		await fs.rm(quarantinePath);
+		await renameFileWithoutReplacement(quarantinePath, filePath);
+		if (process.platform !== "win32") await fs.chmod(filePath, 0o600);
 		await syncParentDirectory(filePath);
 		return;
 	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code !== "EEXIST") {
-			try {
-				await fs.copyFile(quarantinePath, filePath, fsConstants.COPYFILE_EXCL);
-				if (process.platform !== "win32") {
-					await fs.chmod(filePath, 0o600);
-					await fs.chmod(quarantinePath, 0o600);
-				}
-				await syncParentDirectory(filePath);
-				return;
-			} catch (copyError) {
-				if ((copyError as NodeJS.ErrnoException).code !== "EEXIST") return;
-			}
-		}
+		if ((error as NodeJS.ErrnoException).code !== "EEXIST") return;
 	}
 	try {
-		const [current, quarantined] = await Promise.all([
-			fs.readFile(filePath),
-			fs.readFile(quarantinePath),
-		]);
-		if (current.equals(quarantined)) await fs.rm(quarantinePath);
-		else if (process.platform !== "win32") await fs.chmod(quarantinePath, 0o600);
+		if (process.platform !== "win32") await fs.chmod(quarantinePath, 0o600);
 		await syncParentDirectory(filePath);
 	} catch {
 		// Preserve the quarantine rather than risk deleting settings that changed concurrently.
 	}
 }
 
+function configMutationLockPath() {
+	return `${localConfigPath()}.mutation-lock`;
+}
+
 export async function withLocalConfigFileLock<T>(run: () => Promise<T>): Promise<T> {
 	const configPath = localConfigPath();
 	await fs.mkdir(path.dirname(configPath), { recursive: true });
 	let compromisedError: Error | undefined;
 	const release = await lockfile.lock(configPath, {
 		fs: LOCKFILE_FS_ADAPTER,
-		lockfilePath: `${configPath}.mutation-lock`,
+		lockfilePath: configMutationLockPath(),
 		realpath: false,
 		stale: CONFIG_LOCK_STALE_MS,
 		update: CONFIG_LOCK_UPDATE_MS,
@@ -586,6 +612,18 @@ async function syncParentDirectory(filePath: string) {
 	}
 }
 
+async function publishFileWithoutReplacement(source: string, destination: string) {
+	await beforeConfigPublicationHook();
+	await renameFileWithoutReplacement(source, destination);
+}
+
+async function renameFileWithoutReplacement(source: string, destination: string) {
+	if (await pathExists(destination)) {
+		throw Object.assign(new Error(`Settings already exist: ${destination}`), { code: "EEXIST" });
+	}
+	await fs.rename(source, destination);
+}
+
 async function pathExists(filePath: string) {
 	try {
 		await fs.lstat(filePath);

package/src/file-selection.ts

@@ -1,7 +1,6 @@
 import fs from "node:fs/promises";
 import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
-import { getSettingsListTheme } from "@earendil-works/pi-coding-agent";
-import { Container, type SettingItem, SettingsList, Text } from "@earendil-works/pi-tui";
+import { defineMenu, runMenu } from "@narumitw/pi-tui-kit";
 import { agentDir, loadConfig, localConfigPath } from "./config.js";
 import { updateSyncSetup } from "./settings-management.js";
 import {
@@ -10,8 +9,6 @@ import {
 	syncIncludeSelection,
 } from "./sync-policy.js";
 
-const INCLUDED = "included";
-const EXCLUDED = "excluded";
 const BUILT_IN_PREFIX = "builtin:";
 const CUSTOM_PREFIX = "custom:";
 const SESSIONS_ID = "sessions";
@@ -53,11 +50,7 @@ export async function showFileSelection(
 	while (!signal?.aborted) {
 		await showDraftEditor(ctx, config.setupName, draft, customCandidates, signal);
 		if (signal?.aborted || sameDraft(original, draft)) return;
-		const choice = await ctx.ui.select(
-			formatDraftPreview(original, draft),
-			["Save changes", "Discard changes", "Continue editing"],
-			{ signal },
-		);
+		const choice = await showDraftReview(ctx, original, draft, signal);
 		if (signal?.aborted) return;
 		if (choice === "Continue editing") continue;
 		if (choice !== "Save changes") {
@@ -114,74 +107,96 @@ async function showDraftEditor(
 	customCandidates: string[],
 	signal?: AbortSignal,
 ) {
-	const items: SettingItem[] = [
-		...BUILT_IN_SYNC_ROOTS.map((relativePath) => ({
-			id: `${BUILT_IN_PREFIX}${relativePath}`,
-			label: relativePath,
-			description: relativePath.includes(".")
-				? `Sync the top-level ${relativePath} file when present.`
-				: `Recursively sync every safe file under ${relativePath}/.`,
-			currentValue: draft.builtIns.has(relativePath) ? INCLUDED : EXCLUDED,
-			values: [INCLUDED, EXCLUDED],
-		})),
-		{
-			id: SESSIONS_ID,
-			label: "sessions",
-			description:
-				"Session JSONL may contain prompts, tool output, paths, images, and secrets. Sync only to storage you trust.",
-			currentValue: draft.sessions ? INCLUDED : EXCLUDED,
-			values: [INCLUDED, EXCLUDED],
+	const menu = defineMenu<undefined, "editor", "toggle", ExtensionCommandContext>({
+		start: "editor",
+		screens: {
+			editor: () => ({
+				kind: "multiSelect",
+				title: `Included Content · ${safeTerminalText(setupName)}`,
+				lines: ["Draft only · leaving this screen opens Save, Discard, or Continue editing."],
+				viewportSize: 12,
+				items: [
+					...BUILT_IN_SYNC_ROOTS.map((relativePath) => ({
+						id: `${BUILT_IN_PREFIX}${relativePath}`,
+						label: relativePath,
+						description: relativePath.includes(".")
+							? `Sync the top-level ${relativePath} file when present.`
+							: `Recursively sync every safe file under ${relativePath}/.`,
+						selected: draft.builtIns.has(relativePath),
+					})),
+					...customCandidates.map((relativePath) => ({
+						id: `${CUSTOM_PREFIX}${relativePath}`,
+						label: safeTerminalText(relativePath),
+						description: "Additional safe agent-relative file or directory.",
+						selected: draft.custom.has(relativePath),
+					})),
+					{
+						id: SESSIONS_ID,
+						label: "sessions",
+						description:
+							"Session JSONL may contain prompts, tool output, paths, images, and secrets. Sync only to storage you trust.",
+						selected: draft.sessions,
+					},
+				],
+				action: "toggle",
+				hint: "close",
+				doneLabel: "Review changes",
+			}),
 		},
-		...customCandidates.map((relativePath) => ({
-			id: `${CUSTOM_PREFIX}${relativePath}`,
-			label: safeTerminalText(relativePath),
-			description: "Additional safe agent-relative file or directory.",
-			currentValue: draft.custom.has(relativePath) ? INCLUDED : EXCLUDED,
-			values: [INCLUDED, EXCLUDED],
-		})),
-	];
-
-	await ctx.ui.custom((tui, theme, _keybindings, done) => {
-		const container = new Container();
-		let disposed = false;
-		const onAbort = () => done(undefined);
-		signal?.addEventListener("abort", onAbort, { once: true });
-		const title = new Text("", 1, 0);
-		const hint = new Text("", 1, 0);
-		const updateChrome = () => {
-			title.setText(
-				theme.fg("accent", theme.bold(`Included Content · ${safeTerminalText(setupName)}`)),
-			);
-			hint.setText(theme.fg("dim", "Draft only · Esc reviews Save, Discard, or Continue editing."));
-		};
-		updateChrome();
-		container.addChild(title);
-		const list = new SettingsList(
-			items,
-			Math.min(items.length + 2, 15),
-			getSettingsListTheme(),
-			(id, newValue) => updateDraft(draft, id, newValue === INCLUDED),
-			() => done(undefined),
-		);
-		container.addChild(list);
-		container.addChild(hint);
-		return {
-			render: (width: number) => container.render(width),
-			invalidate() {
-				updateChrome();
-				container.invalidate();
-			},
-			handleInput(data: string) {
-				if (disposed) return;
-				list.handleInput(data);
-				tui.requestRender();
+		actions: {
+			toggle: async ({ itemId, selected }) => {
+				updateDraft(draft, itemId, selected === true);
+				return { kind: "stay" };
 			},
-			dispose() {
-				disposed = true;
-				signal?.removeEventListener("abort", onAbort);
+		},
+	});
+	await runMenu(ctx, menu, {
+		getState: () => undefined,
+		signal,
+		isCurrent: () => !signal?.aborted,
+	});
+}
+
+async function showDraftReview(
+	ctx: ExtensionCommandContext,
+	original: SelectionDraft,
+	draft: SelectionDraft,
+	signal?: AbortSignal,
+) {
+	let choice: "Save changes" | "Discard changes" | "Continue editing" | undefined;
+	const menu = defineMenu<undefined, "review", "choose", ExtensionCommandContext>({
+		start: "review",
+		screens: {
+			review: () => ({
+				kind: "actions",
+				title: "Review included-content changes",
+				lines: formatDraftPreview(original, draft).split("\n").slice(2),
+				items: [
+					{ id: "save", label: "Save changes", action: "choose" },
+					{ id: "discard", label: "Discard changes", action: "choose" },
+					{ id: "continue", label: "Continue editing", action: "choose" },
+				],
+				hint: "close",
+			}),
+		},
+		actions: {
+			choose: async ({ itemId }) => {
+				choice =
+					itemId === "save"
+						? "Save changes"
+						: itemId === "continue"
+							? "Continue editing"
+							: "Discard changes";
+				return { kind: "close" };
 			},
-		};
+		},
+	});
+	await runMenu(ctx, menu, {
+		getState: () => undefined,
+		signal,
+		isCurrent: () => !signal?.aborted,
 	});
+	return choice;
 }
 
 function updateDraft(draft: SelectionDraft, id: string, included: boolean) {