@narumitw/pi-sync 0.52.1 → 0.53.1

package/README.md

@@ -166,7 +166,7 @@ Shutdown behavior is unchanged: when **Automatic sync** is On and sessions are i
 
 **Settings → Automatic transfer at startup** controls the separate per-setup `sync.automaticTransfer` boolean, which defaults to `false`. It authorizes one conflict-free startup transfer at a validated idle boundary in TUI/RPC, including session replacement and `/reload`. Busy startup waits for `agent_settled`; foreground commands, a new agent run, replacement, and shutdown cancel and drain owned work. Changing the setting affects authorization immediately; enabling it schedules the next attempt on the next session start. There is no watcher or polling loop.
 
-A baseline and matching authoritative content list are required. First-source choice, changed selection, missing established remote, secrets, and real conflicts remain review barriers. Automatic transfer requires conditional or lease-protected publication: Git and verified WebDAV are supported; R2/S3 remains manual because its publication is read-check-write-verify. The existing **Automatic sync** setting and shutdown policy are unchanged when this new opt-in is absent.
+A baseline and matching authoritative content list are required. First-source choice, changed selection, missing established remote, secrets, and real conflicts remain review barriers. Automatic transfer requires conditional or lease-protected publication: Git, verified WebDAV, and R2/S3 with verified conditional writes are supported. The existing **Automatic sync** setting and shutdown policy are unchanged when this new opt-in is absent.
 
 Successful transfers show one summary. They do not reload resources, activate extension code, or rewrite model context. After local resources change, reload or restart when ready; newly pulled conversations still require explicit resume. Headless print/JSON skip this new startup feature. Reviewed directional settings/session-root transitions record both roots and verified settings evidence so interrupted apply can recover before or after settings installation. Older pending journals without transition evidence retain their original root-ownership checks and may require reviewed recovery; preserve their backups rather than downgrading. See [merge safety and recovery](./docs/merge-implementation-audit.md) for journal boundaries, external-writer limits, and downgrade guidance.
 
@@ -264,7 +264,7 @@ Review [Settings](#-settings) for included-content privacy and [Manager, conflic
 | --- | --- | --- | --- |
 | Git | Exact expected-ref lease | Existing SSH/configured credential helper | `<branch>:<storage.path>` |
 | WebDAV | Verified strong conditional requests | Private settings username/app password | `<url>/<storage.path>` |
-| R2/S3 | Read-check-write-verify | Private settings credentials | `<bucket>/<storage.path>` |
+| R2/S3 | Verified strong conditional requests | Private settings credentials | `<bucket>/<storage.path>` |
 
 Git requires Git 2.30 or newer and a SHA-1-format remote repository.
 HTTPS userinfo, URL passwords, local paths, `file`, `git`, `ext`, and remote-helper transports are rejected.
@@ -275,8 +275,7 @@ WebDAV requires HTTPS except loopback tests.
 URL credentials, query strings, fragments, unsafe redirects, weak/missing ETags, and ignored conditional headers fail closed.
 `/sync doctor` verifies collection and conditional-write behavior with an isolated probe, then repairs a missing active-snapshot history entry.
 
-S3/R2 stages immutable bundles, rechecks the visible head before publication, and verifies afterward.
-Unlike Git/WebDAV, generic S3 does not provide an atomic compare-and-swap for `latest.json`; status review remains important for simultaneous writers.
+S3/R2 publishes `latest.json` and history using ETag `If-Match`, or `If-None-Match: *` for first creation, then verifies the active pointer. Before each publication, an isolated `.pi-sync-probes/<random-id>` object verifies that the server rejects stale ETags and create-only writes to existing objects and rotates strong ETags. Credentials must allow read, write, and delete under the selected storage path; the probe is deleted even after cancellation. Missing/weak ETags, ignored conditions, and probe or cleanup failures stop publication. A failed cleanup reports the probe key for manual removal; bucket versioning may retain probe versions. `/sync doctor` remains read-only for S3/R2 and does not verify write support.
 
 Snapshot recovery is guarded: new journals record before/after images, older journals are retired only when their unchanged preimages are provable, and unrecognized bytes remain untouched for manual review. Current-session targets are never restored during startup. Preserve a blocked transaction and its backup, close Pi, and review the private evidence before restoring selected paths; malformed/unsupported journals are not disposable. Pi may have loaded resources before lifecycle recovery, so reload or restart explicitly after recovery if loaded resources need to match the restored files.
 

package/dist/chunks/{chunk-WKPX2SIC.ts → chunk-FJGNDYGC.ts}

@@ -3,7 +3,7 @@
 import {
   runCancellableOperation,
   showRemoteSelectionReview
-} from "./chunk-2CBF6SMT.ts";
+} from "./chunk-TRCSEIAQ.ts";
 import {
   safeTerminalText
 } from "./chunk-AMJRUXFT.ts";
@@ -206,4 +206,4 @@ async function dispatchManagerResult(ctx, initialResult, origin, runRoute, signa
 export {
   dispatchManagerResult
 };
-//# sourceMappingURL=chunk-WKPX2SIC.ts.map
+//# sourceMappingURL=chunk-FJGNDYGC.ts.map

package/dist/chunks/{chunk-NLS2NV3K.ts → chunk-QDPED3XJ.ts}

@@ -25,7 +25,7 @@ import {
 } from "./chunk-V6VZ5TLG.ts";
 import {
   createSyncBackend
-} from "./chunk-QHSQCK7L.ts";
+} from "./chunk-SDZCTCYQ.ts";
 import {
   applySnapshotTransaction,
   recoverPendingSnapshotTransactions,
@@ -68,7 +68,7 @@ import {
 import {
   SyncBackendConflictError,
   expectedRemoteHead
-} from "./chunk-UETBKTDI.ts";
+} from "./chunk-YDVQYUHE.ts";
 import {
   SyncDecisionRequiredError
 } from "./chunk-7D5SF7P3.ts";
@@ -1017,6 +1017,68 @@ async function applyMergedSnapshot(before, after, protectedPaths, options, valid
   await acquire(0);
 }
 
+// src/sync/merge-transfer-error.ts
+var MAX_CAUSES = 4;
+var MAX_DETAIL_LENGTH = 600;
+function mergeTransferError(error, backend) {
+  const messages = [];
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current instanceof Error && !seen.has(current) && seen.size < MAX_CAUSES) {
+    seen.add(current);
+    const code = current.code;
+    const status = current.status;
+    const metadata = [
+      typeof code === "string" && /^[A-Z][A-Z0-9_]{1,63}$/u.test(code) ? code : void 0,
+      typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? `HTTP ${status}` : void 0
+    ].filter(Boolean);
+    const message = `${current.message}${metadata.length ? ` (${metadata.join(", ")})` : ""}`;
+    if (message && !messages.includes(message)) messages.push(message);
+    current = current.cause;
+  }
+  let detail = messages.join(" \u2192 ") || "No error details available.";
+  for (const secret of credentialVariants(backend)) detail = detail.replaceAll(secret, "[REDACTED]");
+  detail = detail.replace(/\b(Bearer|Basic)\s+[^\s<>"']+/giu, "$1 [REDACTED]");
+  detail = safeTerminalText(detail);
+  if (detail.length > MAX_DETAIL_LENGTH) detail = `${detail.slice(0, MAX_DETAIL_LENGTH)}\u2026 (details truncated)`;
+  return new Error(
+    `Merged transfer interrupted; journal and backup retained. Run /sync sync to reconcile before further mutations. Transfer failure: ${detail}`,
+    { cause: error }
+  );
+}
+function credentialVariants(backend) {
+  const secrets = [];
+  let address;
+  switch (backend.type) {
+    case "s3":
+      secrets.push(backend.profile.accessKeyId, backend.profile.secretAccessKey, backend.profile.sessionToken ?? "");
+      address = backend.profile.endpoint;
+      break;
+    case "webdav":
+      secrets.push(
+        backend.profile.username,
+        backend.profile.password,
+        Buffer.from(`${backend.profile.username}:${backend.profile.password}`).toString("base64")
+      );
+      address = backend.profile.url;
+      break;
+    case "git":
+      address = backend.profile.remote;
+      break;
+  }
+  try {
+    const url = new URL(address);
+    secrets.push(url.username, url.password, ...url.searchParams.values());
+    for (const value of [url.username, url.password]) secrets.push(decodeURIComponent(value));
+  } catch {
+  }
+  return [
+    ...new Set(
+      secrets.filter(Boolean).flatMap((value) => [value, encodeURIComponent(value), JSON.stringify(value).slice(1, -1)])
+    )
+  ].sort((left, right) => right.length - left.length);
+}
+
 // src/sync/partial-progress.ts
 function acceptedMergeFiles(decisions, localFiles, withheld) {
   const localByPath = new Map(localFiles.map((file) => [file.path, file]));
@@ -1559,10 +1621,7 @@ An explicit direction adopts this setup's included-content policy; no automatic
           if (attempt + 1 < MAX_ATTEMPTS) continue;
           throw new Error("Remote changed before commit in all three attempts; retry later.", { cause: error });
         }
-        throw new Error(
-          "Merged transfer interrupted; journal and backup retained. Run /sync sync to reconcile before further mutations.",
-          { cause: error }
-        );
+        throw mergeTransferError(error, config.backend);
       }
       const completed = await completeJournal(ctx, config, backend, journal, validate, options.signal, options.auto);
       if (!completed) {
@@ -1605,7 +1664,7 @@ async function completeJournal(ctx, config, backend, journal, validate, signal,
   }
   const snapshotOptions = { ...snapshotOptionsForContext(ctx, config), sessionDir: sessionRoot, signal };
   const head = await backend.readHead(signal);
-  if (!journal.committedHead && head && backend.sameRevision(head.revision, journal.expectedHead.revision)) {
+  if (!journal.committedHead && head && (backend.sameRevision(head.revision, journal.expectedHead.revision) || backend.matchesUncommittedRecoveryHead?.(head, journal.expectedHead))) {
     await validate();
     const local = await createSnapshot(config.snapshotIdentity, snapshotOptions);
     if (!sameHashes(fileHashMap(local), fileHashMap(journal.before)) || syncStateFingerprint(await readStateForConfig(config)) !== journal.stateIdentity) {
@@ -1743,4 +1802,4 @@ export {
   createSyncDecision,
   mergeSync
 };
-//# sourceMappingURL=chunk-NLS2NV3K.ts.map
+//# sourceMappingURL=chunk-QDPED3XJ.ts.map