@narumitw/pi-sync 0.57.10 → 0.57.12

package/skills/configure-pi-sync/references/configuration.md

@@ -7,8 +7,8 @@ The configuration skill provides guidance only; the user performs settings chang
 - [Required backend shapes](#required-backend-shapes)
 - [Status display](#status-display)
 - [Secret scanning](#secret-scanning)
-- [Experimental Agent mode](#experimental-agent-mode)
-- [Experimental Continuous sync](#experimental-continuous-sync)
+- [Autonomous sync](#autonomous-sync)
+- [Continuous sync](#continuous-sync)
 - [Included content](#included-content)
 - [Unsupported old settings and recovery](#unsupported-old-settings-and-recovery)
 
@@ -26,11 +26,16 @@ Missing settings load as unconfigured without creating an agent directory, file,
 An explicit setup creates the file atomically.
 On POSIX, pi-sync creates and replaces it with mode `0600`.
 Pi-sync processes coordinate settings access through `pi-sync.json.mutation-lock`; lock-unaware editors are outside that serialization boundary and should not save the file while a pi-sync settings operation is running.
+Within one process, settings reads wait for earlier writes, including writes that have not acquired the lock yet.
+Replacement writes and flushes a private temporary file before renaming it over the canonical file; the active file is not moved away first.
 Credentials stay in this canonical private file and are never shown in menus, reviews, status, notifications, errors, logs, or completion metadata.
 
 A private `pi-sync.local.json` containing a valid version 3 document is copied byte-for-byte to `pi-sync.json`.
 The old file remains as a recovery copy.
 If both paths exist, `pi-sync.json` wins and the legacy file remains untouched.
+If an older interrupted replacement left `pi-sync.json` missing and a hidden `.pi-sync.json.*.schema-migration-source` or `.pi-sync.json.*.migration-retired` file remains, settings access stops instead of loading the legacy copy.
+Close every Pi process, preserve all recovery files, and review the retained settings before restoring the correct document to `pi-sync.json` with private permissions.
+Do not delete recovery evidence or accept defaults to bypass this check.
 
 ### Settings ownership and required fields
 
@@ -50,14 +55,20 @@ Global settings apply to all setups on this device; they are not remote policy.
 | Content/partial policy | `sync.mergeContent`, `sync.partialSync` | Enabling either requires version 5. |
 
 Do not downgrade version 4 or 5 merely because an option is turned off.
-The four automatic controls have separate effects: `automatic` enables startup observation and selected-content shutdown pushes when sessions are included; `automaticTransfer` enables one eligible startup transfer; `agentMode` authorizes autonomous merged sync and model disclosure; `continuous` adds recurring work only with Agent mode enabled.
+The four automatic controls have separate effects:
+
+- **Automatic sync** (`sync.automatic`) enables startup observation and selected-content shutdown pushes when sessions are included.
+- **Startup transfer** (`sync.automaticTransfer`) enables one eligible startup transfer.
+- **Autonomous sync** (`sync.agentMode`, unchanged) authorizes eligible startup and **Sync now** transfers without another transfer confirmation, plus model assistance and disclosure for supported conflicts.
+- **Continuous sync** (`sync.continuous`) adds recurring work only with Autonomous sync enabled.
+
 None of these controls is enabled by invoking the configuration skill.
 
 ### Editing in the manager
 
-Open `/sync` → **Settings** and choose **Sync content**, **Sync behavior**, **Storage & setups**, or **Advanced**.
-**All settings (search)** provides cross-category typing-to-search over the same rows.
-**Included paths** and **Compare included paths** are adjacent in Sync content; the latter compares path policies, not file contents.
+Open `/sync` → **Settings** to go directly to **Pi Sync Settings**.
+The screen has one searchable flat list with all 16 rows in their existing order and no category navigation or headings.
+**Included paths** and **Compare included paths** are adjacent; the latter compares path policies, not file contents.
 **Storage location** edits the current setup's coordinates, while **Manage sync setups** and **Manage storage connections** retain the catalog and affected-setup reviews.
 Returning from catalog management refreshes the rows; switching or removing the owning setup closes its old Settings screen.
 
@@ -65,7 +76,7 @@ Descriptions identify the owner: this setup, all setups on this device, or share
 Simple choices report Saving and the durable Saved or failed/rejected result, preserve the selected row and search during refresh, and restore their previous value if saving fails.
 Escape closes the screen without undoing successful saves.
 Complex values retain their input/review flows.
-This navigation change does not alter schema, defaults, automatic-sync behavior, or experimental opt-ins.
+This navigation change does not alter schema, defaults, automatic-sync behavior, or explicit opt-ins.
 
 The manager separates current state from transfer, inspection, and management actions.
 **Check remote status** and **View differences** invoke the existing read/check routes only when selected.
@@ -174,7 +185,7 @@ This check does not contact the server or discover setups configured only on oth
 Every setup requires `sync.include` and explicit `sync.automatic`.
 Setup asks for automatic sync with Off first; existing values are not rewritten.
 When enabled, the current setup receives one background startup check in TUI/RPC, including reload/new/resume/fork.
-Startup no longer performs automatic transfers or opens dialogs; review changes through `/sync`.
+Automatic sync alone does not perform startup transfers or open dialogs; review changes through `/sync`.
 Print/JSON skip startup checks.
 Checks compare local hashes and remote metadata against the last sync baseline, so revision changes and missing baselines require review rather than proving a file conflict.
 
@@ -214,14 +225,14 @@ It accepts:
 ### Status display
 
 The global `showStatus` setting accepts a boolean and defaults to `true` when omitted from an existing version 3 document.
-Set it through **/sync → Settings → Advanced → Show sync status**; changes are saved and applied immediately for every setup.
+Set it through **/sync → Settings → Show sync status**; changes are saved and applied immediately for every setup.
 When `false`, pi-sync clears and suppresses status text for background checks, manual and automatic transfers, and review attention.
 TUI review widgets and TUI/RPC notifications remain available, and lifecycle cleanup still clears any stale status owned by pi-sync.
 
 ### Debug startup timings
 
 The top-level user setting `debug` accepts only `true` or `false` and defaults to `false`.
-Edit `<getAgentDir()>/pi-sync.json` (normally `~/.pi/agent/pi-sync.json`) or use **/sync → Settings → Advanced → Debug startup timings**.
+Edit `<getAgentDir()>/pi-sync.json` (normally `~/.pi/agent/pi-sync.json`) or use **/sync → Settings → Debug startup timings**.
 UI changes save immediately through the existing ordered, atomic settings writer; both manual and UI changes take effect on the next session start, including `/reload`, new, resume, and fork.
 There is no project or environment override.
 
@@ -250,7 +261,7 @@ Set `debug` to `false` or remove it, then start a new session to disable reports
 ### Secret scanning
 
 The global `skipSecretScan` setting accepts a boolean and defaults to `false`, including when omitted from an existing version 3 document.
-Set it through **/sync → Settings → Advanced → Skip secret scan**; changes are saved immediately and apply to subsequent pushes for every sync setup, including automatic pushes.
+Set it through **/sync → Settings → Skip secret scan**; changes are saved immediately and apply to subsequent pushes for every sync setup, including automatic pushes.
 When `true`, pushes skip the local secret scan; other safety checks and confirmations remain unchanged.
 Enable it only after reviewing the destination and selected content because files containing secrets can be uploaded.
 `/sync doctor` still scans and reports possible secrets regardless of this setting.
@@ -290,8 +301,10 @@ RPC remains a read-only summary with the manual `sync.include` path.
 
 Every new snapshot stores the normalized included-content selection separately from the files that happened to exist.
 This preserves selected-but-missing paths without syncing `pi-sync.json`, storage credentials, automatic-sync preferences, or setup names.
-**Settings → Sync content → Compare included paths** opens the same review-first flow as a manager operation when local and remote lists differ.
-Adoption revalidates the remote head, immutable snapshot, reviewed storage coordinates, and local include list before one atomic settings update.
+**Settings → Compare included paths** opens the same review-first flow as a manager operation when local and remote lists differ.
+Adoption revalidates the remote head, immutable snapshot, and complete reviewed setup configuration, including the shared connection and credentials, before one atomic settings update.
+Cancelling the network check leaves the content list unchanged.
+A settings save that has started its atomic replacement can still finish; later cancellation does not undo it.
 The saved state changes only `sync.include`, preserves unknown settings fields, and never pulls files or writes sync state.
 Its explicit Continue action starts a fresh **Sync now** route, while **Done** leaves the reviewed settings change saved without implying a file operation.
 Keeping this device's list opens the reviewed force-push path and explicitly replaces the remote policy while preserving eligible unmanaged remote files.
@@ -310,7 +323,7 @@ Pull protects the currently open session file; restart Pi or resume a pulled ses
 ### Automatic startup transfer
 
 `sync.automaticTransfer` is optional and accepts only a boolean; absent means `false`.
-Set it through **/sync → Settings → Sync behavior → Startup transfer**.
+Set it through **/sync → Settings → Startup transfer**.
 It is separate from `sync.automatic`: the legacy setting retains observation and selected-content shutdown behavior.
 
 When explicitly enabled, one startup transfer waits for an idle boundary in TUI/RPC.
@@ -338,27 +351,30 @@ Turning **Startup transfer** off does not revert transfers or remove backups/jou
 For interrupted operations, follow [merge recovery](https://github.com/narumiruna/pi-extensions/blob/main/packages/pi-sync/docs/merge-implementation-audit.md).
 Unknown fields remain preserved and malformed/invalid files block saves, just as for the existing policy.
 
-### Experimental Agent mode
+<a id="experimental-agent-mode"></a>
 
-`sync.agentMode` is an optional per-setup boolean, default `false`, in settings versions 3, 4, and 5.
-Open **Settings → Sync behavior → Agent mode (experimental)** and review the setup, destination, selected paths, model disclosure, costs, and autonomous writes before enabling.
+### Autonomous sync
+
+Autonomous sync uses the unchanged `sync.agentMode` key, an optional per-setup boolean, default `false`, in settings versions 3, 4, and 5.
+Open **Settings → Autonomous sync** and review the setup, destination, selected paths, transfer authorization, model disclosure, costs, and autonomous writes before enabling.
 RPC users can explicitly set the same field in the private settings file.
 Setting it to `true` is authorization, not just a display preference.
 
-Agent mode authorizes one eligible merged sync at the next session start and the same autonomous flow from **Sync now** or `/sync sync`.
-It can publish and replace/delete selected content without another transfer confirmation.
+Autonomous sync authorizes one eligible merged sync at the next session startup and the same flow from **Sync now** or `/sync sync`, without another transfer confirmation.
+It can publish, replace, or delete selected local and remote content.
+The selected Pi model resolves supported text and settings conflicts; eligible conflict content is sent to its provider and may incur costs.
 It is independent of `sync.automatic` and `sync.automaticTransfer`; neither existing preference is changed.
-Disabling Startup transfer alone does not disable Agent mode.
+Disabling Startup transfer alone does not disable Autonomous sync.
 Saving never starts a transfer from Settings.
 The atomic write cannot be cancelled after its final cancellation check.
 A completed save remains in effect after cancellation or session replacement; reopen Settings to read the saved value.
 TUI/RPC are supported; print/JSON and shutdown do not start a resolver.
-Agent mode alone adds no polling or daemon.
+Autonomous sync alone adds no polling or daemon.
 Separately enabled Continuous sync provides recurring work while Pi remains open.
 
 An accepted baseline, matching included-content/local-field policies, and conditional or lease-protected publication remain required.
 First-source selection, policy migrations, explicit push/pull, and rollback keep their existing reviewed flows.
-`--yes` does not enable Agent mode or authorize model disclosure.
+`--yes` does not enable Autonomous sync or authorize model disclosure.
 Completed transfers never reload resources automatically.
 
 The resolver uses the initiating session's selected model through Pi's public provider/authentication registry.
@@ -371,14 +387,14 @@ Parent model prompts and tools are not changed.
 This is configuration isolation, not an OS sandbox or proof of semantic correctness.
 
 Eligible text is global `AGENTS.md` and `.md`/`.txt` files under `prompts/` or `skills/`.
-Global `settings.json` uses the existing strict JSON, numeric, coupled-field, unknown-field, and machine-local-field policies. In Agent mode, `packages` merges by source identity and selects the higher explicit SemVer version for each npm package present on both sides, even when one side has not changed from the verified ancestor. No registry lookup occurs. Equal SemVer precedence does not select a winner: one-sided source edits are preserved, and divergent edits require atomic selection. Package filters must match. An existing local or remote array keeps its JSON spelling when it matches the merged result. Accepted settings files keep their bytes unless a package override is required; that override changes only the `packages` value. The ordered npm identity list can change on one side, or identically on both sides; conflicting order or membership changes retain atomic selection. This preserves insertion positions and resource precedence. Non-npm entries must remain unchanged across all three versions for per-package merging. Changed Git refs and local path aliases retain atomic selection instead of being combined as separate sources. Delete/upgrade conflicts, duplicate identities, incompatible filters, version ranges and tags also retain the existing atomic selection rules when deterministic merging is not possible. Other arrays and nested objects remain atomic.
+Global `settings.json` uses the existing strict JSON, numeric, coupled-field, unknown-field, and machine-local-field policies. With Autonomous sync enabled, `packages` merges by source identity and selects the higher explicit SemVer version for each npm package present on both sides, even when one side has not changed from the verified ancestor. No registry lookup occurs. Equal SemVer precedence does not select a winner: one-sided source edits are preserved, and divergent edits require atomic selection. Package filters must match. An existing local or remote array keeps its JSON spelling when it matches the merged result. Accepted settings files keep their bytes unless a package override is required; that override changes only the `packages` value. The ordered npm identity list can change on one side, or identically on both sides; conflicting order or membership changes retain atomic selection. This preserves insertion positions and resource precedence. Non-npm entries must remain unchanged across all three versions for per-package merging. Changed Git refs and local path aliases retain atomic selection instead of being combined as separate sources. Delete/upgrade conflicts, duplicate identities, incompatible filters, version ranges and tags also retain the existing atomic selection rules when deterministic merging is not possible. Other arrays and nested objects remain atomic.
 Code/scripts, keybindings, binaries, unknown formats, session histories, deletion/modification conflicts, path collisions, and session-root transitions are not model-resolved.
 Existing deterministic merges still follow their own explicit settings.
 Unsupported or refused groups remain unresolved; only an explicitly enabled `partialSync` policy permits progress around them.
 Preserving versions does not mean a conflict is resolved.
 
 A verified accepted ancestor is required.
-Enabling Agent mode cannot recover historical ancestor bytes that were never retained.
+Enabling Autonomous sync cannot recover historical ancestor bytes that were never retained.
 If the original accepted bytes are still available on both sides, a conflict-free sync can seed the text ancestors for future runs; otherwise use the existing reviewed recovery flow rather than inventing a base from current edits.
 
 Bounds are 8 KiB per input file, 16 conflict paths/units, 24 KiB of serialized model evidence, 16 KiB of candidate output, 8,192 maximum output tokens (or the selected model's smaller positive output limit), and one provider request per candidate attempt. A separately confirmed refusal retry can request the same candidate evidence again.
@@ -391,7 +407,7 @@ These limits are not an exact currency spending cap; in-flight disclosure or cha
 
 The existing possible-secret scanner always checks model evidence, even when `skipSecretScan` permits uploads without scanning.
 It is a heuristic, not a guarantee that all secrets are detected.
-Do not enable Agent mode for content you cannot disclose to the selected provider.
+Do not enable Autonomous sync for content you cannot disclose to the selected provider.
 Provider errors and model reasoning are not copied into status or persistent records.
 
 Pi sessions sharing one agent directory use one local resolver claim.
@@ -410,7 +426,7 @@ They can contain merged text; retain them as private data.
 Different candidates are retained without automatic retention pruning.
 Ordinary **Sync now** and `/sync sync` reuse a valid cached refusal without another provider request.
 The manager's **Retry refused model result…** action separately reviews the setup, destination, conflict paths, selected model, disclosure and cost before one fresh request for that exact refusal.
-It requires foreground TUI/RPC, Agent mode, an accepted baseline and no pending journal; use ordinary Sync now or reviewed recovery first when those prerequisites are absent.
+It requires foreground TUI/RPC, Autonomous sync, an accepted baseline and no pending journal; use ordinary Sync now or reviewed recovery first when those prerequisites are absent.
 Changed evidence, settings, model, session or cached bytes invalidate the review without disclosure.
 A repeated refusal, invalid response or failed pre-publication replacement retains the original result.
 A complete validated result replaces the active candidate only after the original refusal is archived privately in the same directory.
@@ -425,23 +441,25 @@ Pi-sync's cross-process operation lock excludes other pi-sync transfers, not arb
 Pi file mutation queues coordinate participating writers only within one process.
 Checks near rename reduce stale writes but do not provide an atomic compare-and-swap against another Pi process or editor.
 Session JSONL is not rewritten by the model; other active session writers remain subject to the existing protection limitations.
-Do not use Agent mode as a guarantee of lossless live editing.
+Do not use Autonomous sync as a guarantee of lossless live editing.
 
-Turn Agent mode Off to prevent subsequent requests and invalidate pending authorization.
+Turn Autonomous sync Off to prevent subsequent requests and invalidate pending authorization.
 Keep backups, snapshots, conflicts and pending journals; disabling does not undo completed work or erase history.
 Unknown publication outcomes use the existing journal reconciliation and never authorize blind republishing.
 Pending journals can be reconciled on a read/check/write/verify backend because recovery does not publish.
-New autonomous transfers still require conditional or lease-protected publication; turn Agent mode Off before a reviewed manual transfer on a weaker backend.
+New autonomous transfers still require conditional or lease-protected publication; turn Autonomous sync Off before a reviewed manual transfer on a weaker backend.
 If recovery is blocked, retain evidence and use the existing reviewed recovery routes.
 Finish/reconcile pending merge journals before a downgrade.
 No Pi core changes or other extension are required.
 
-### Experimental Continuous sync
+<a id="experimental-continuous-sync"></a>
+
+### Continuous sync
 
 `sync.continuous` is an optional per-setup boolean, default `false`, in settings versions 3, 4 and 5.
-Open **Settings → Sync behavior → Continuous sync (experimental)** after enabling Agent mode.
+Open **Settings → Continuous sync** after enabling Autonomous sync.
 RPC users can set the field explicitly in the private settings file.
-Existing Agent mode consent does not enable recurring requests.
+Existing Autonomous sync consent does not enable recurring requests.
 
 The separate review names the setup, storage connection, destination, included paths, recurring costs and automatic writes.
 An elected idle session uses its selected Pi model; a different session can use a different provider/model.
@@ -453,8 +471,8 @@ Reopen Settings to read the saved value.
 
 Monitoring starts at an eligible TUI/RPC session startup, after awaited local transaction recovery, or after a foreground `/sync` command or manager closes.
 It replaces the duplicate one-shot startup transfer, not the legacy shutdown policy.
-Turning Continuous sync off stops its work without disabling Agent mode.
-Turning Agent mode off also stops monitoring; a saved Continuous sync On value remains ineffective until Agent mode is enabled again.
+Turning Continuous sync off stops its work without disabling Autonomous sync.
+Turning Autonomous sync off also stops monitoring; a saved Continuous sync On value remains ineffective until Autonomous sync is enabled again.
 
 A control-file change during monitoring is detected by a watcher or the five-second local control check.
 If monitoring is already off, external enablement requires the next session start or a foreground `/sync` command.
@@ -553,14 +571,14 @@ Preserve journals, backups and unresolved versions when proof is unavailable.
 
 Turn Continuous sync off and drain its owner before downgrade.
 Reconcile pending transfers with the current release.
-Existing Agent mode and shutdown preferences remain separately effective.
+Existing Autonomous sync and shutdown preferences remain separately effective.
 Private scheduler records are separate from baseline/journal formats and remain retained; no automatic filesystem rollback or state migration is performed.
 
 For implementation evidence and test scope, see [Continuous sync verification](https://github.com/narumiruna/pi-extensions/blob/main/packages/pi-sync/docs/continuous-sync-verification.md).
 
 ### Settings field merge and machine-local fields
 
-`sync.mergeSettings` is experimental, defaults to `false`, and is available in the owning Settings screen.
+`sync.mergeSettings` is an explicit opt-in, defaults to `false`, and is available through **Settings → Merge settings fields** for the current setup.
 With a verified accepted ancestor, global `settings.json` root fields merge conservatively: absent differs from null, arrays/nested objects are atomic, and provider/model and other coupled fields form one unit.
 Unknown fields are preserved.
 Pi accepts plain UTF-8 JSON with an optional BOM, not JSONC; duplicate/prototype-sensitive keys, invalid encodings, migration-dependent syntax, and over-bound inputs require directional review.
@@ -609,8 +627,8 @@ Never reinterpret portable snapshots with an old binary.
 
 ### Content merge and partial progress
 
-`sync.mergeContent` and `sync.partialSync` are independent experimental booleans, both default `false`.
-The owning **Advanced → Content merge / partial progress** setting offers Off, Merge only, Merge + partial, and Partial only and confirms an explicit settings-version-5 upgrade.
+`sync.mergeContent` and `sync.partialSync` are independent opt-in booleans, both default `false`.
+The owning **Settings → Content merge / partial progress** setting offers Off, Merge only, Merge + partial, and Partial only and confirms an explicit settings-version-5 upgrade.
 Manual configuration must also declare version 5.
 Settings version 5 retains the portable-policy behavior of version 4; moving from a legacy setup can require the existing separately confirmed directional policy migration.
 Disabling options retains the schema and recovery evidence.

package/src/backends/s3/s3-client.ts

@@ -193,7 +193,12 @@ export class S3Client {
     extraHeaders: Record<string, string> = {},
   ) {
     const url = new URL(this.endpoint.toString());
-    url.pathname = posixJoin(url.pathname, this.config.destination.bucket, encodeKey(key));
+    // Preserve escaped endpoint bytes without decoding or double-encoding them.
+    // SigV4 requires uppercase escape hex, including existing endpoint escapes.
+    const endpointPath = url.pathname
+      .replace(/%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9._~/%-]/gu, encodeKey)
+      .replace(/%[0-9A-Fa-f]{2}/gu, (escaped) => escaped.toUpperCase());
+    url.pathname = posixJoin(endpointPath, encodeKey(this.config.destination.bucket), encodeKey(key));
     const send = async (sessionToken: string | undefined) => {
       const transportSignal = this.transportSignal();
       const headers = await signedHeaders({
@@ -213,6 +218,8 @@ export class S3Client {
           method,
           headers,
           body: body ? new Uint8Array(body) : undefined,
+          // Never forward signed headers or snapshot bodies to an unreviewed URL.
+          redirect: "error",
           signal: transportSignal,
         });
       } catch (error) {

package/src/commands/command-execution.ts

@@ -231,8 +231,12 @@ async function migrateStateDirectory(ctx: ExtensionCommandContext, options: Comm
 
 async function initConfig(ctx: ExtensionCommandContext, signal?: AbortSignal) {
   const configPath = localConfigPath();
-  if (await readLocalConfigObject()) {
-    ctx.ui.notify(`Config already exists: ${await activeLocalConfigPath()}`, "info");
+  const existing = await readLocalConfigObject();
+  throwIfAborted(signal);
+  if (existing) {
+    const activePath = await activeLocalConfigPath();
+    throwIfAborted(signal);
+    ctx.ui.notify(`Config already exists: ${activePath}`, "info");
     return;
   }
 
@@ -242,7 +246,8 @@ async function initConfig(ctx: ExtensionCommandContext, signal?: AbortSignal) {
     await showSetupWizard(ctx, signal);
     return;
   }
-  await createLocalConfigDocument(localConfigTemplate());
+  await createLocalConfigDocument(localConfigTemplate(), signal);
+  throwIfAborted(signal);
   ctx.ui.notify(`Created ${configPath}. Add a storage connection and sync setup before syncing.`, "info");
 }
 
@@ -261,11 +266,11 @@ async function showConfig(ctx: ExtensionCommandContext, options: CommandOptions)
       ...storageLines,
       `storage path: ${config.storagePath}`,
       `automatic sync: ${automaticSyncSummary(config.automatic)}`,
-      `settings field merge: ${config.mergeSettings ? "On (experimental)" : "Off"}`,
+      `settings field merge: ${config.mergeSettings ? "On" : "Off"}`,
       `machine-local settings.json fields: ${(config.localFields ?? []).map(safeTerminalText).join(", ") || "none"}`,
       `startup transfer: ${startupTransferSummary(config)}`,
-      `agent mode: ${config.agentMode ? "On (experimental)" : "Off"}`,
-      `continuous sync: ${config.continuous ? (config.agentMode ? "On (experimental)" : "paused; Agent mode is Off") : "Off"}`,
+      `autonomous sync: ${config.agentMode ? "On" : "Off"}`,
+      `continuous sync: ${config.continuous ? (config.agentMode ? "On" : "paused; Autonomous sync is Off") : "Off"}`,
       `included content: ${config.include.join(", ") || "none"}`,
       `sessions: ${config.include.includes("sessions") ? "included" : "not included"}`,
       `settings file: ${localConfigPath()}`,

package/src/commands/command.ts

@@ -236,7 +236,7 @@ export function usage() {
     `Automatic sync: ${AUTOMATIC_SYNC_DESCRIPTION}`,
     `Startup transfer: ${STARTUP_TRANSFER_DESCRIPTION}`,
     "Automatic transfer at startup is a separate opt-in: one conflict-free established-baseline transfer at idle in TUI/RPC, with conditional/lease publication and no resource reload.",
-    "Experimental Continuous sync is a separate default-Off opt-in in Settings. It requires Agent mode, monitors while Pi is open, and can incur recurring network/model costs. Safety blocks and durable automatic request limits remain.",
+    "Continuous sync is a separate default-Off opt-in in Settings. It requires Autonomous sync, monitors while Pi is open, and can incur recurring network/model costs. Safety blocks and durable automatic request limits remain.",
     "Settings: use /sync init or edit storage connections and sync setups in ~/.pi/agent/pi-sync.json (or the configured Pi agent directory). Version 1 and version 2 settings are unsupported and are never rewritten.",
   ].join("\n");
 }

package/src/paths.ts

@@ -45,7 +45,12 @@ export function assertWithinRoot(root: string, target: string, label = target) {
 }
 
 export function encodeKey(key: string) {
-  return key.split("/").map(encodeURIComponent).join("/");
+  // SigV4 permits only RFC 3986 unreserved characters and key separators.
+  return key
+    .split("/")
+    .map(encodeURIComponent)
+    .join("/")
+    .replace(/[!'()*]/gu, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
 }
 
 export function posixJoin(...parts: string[]) {