@rigxyz/tapd 0.6.5 → 0.6.8

package/dist/index.d.ts

@@ -9,19 +9,28 @@ import { GetBindingResponse, PrepareUploadRequest, PrepareUploadResponse, Comple
  *      bulky generated artifacts (per design doc § "Large File Policy").
  *      Bulky media/archives are re-included under the top-level
  *      `attachments/` folder (chat attachments must sync).
- *      A user CAN override these via `!pattern` in their .tapignore.
+ *      A user CAN override the non-secret ones (dependencies, media, …)
+ *      via `!pattern` in their .tapignore.
  *   2. Project .tapignore.
- *   3. Always-excluded paths — Tap's own local metadata. These cannot be
- *      re-enabled by `!pattern`; the relay would reject the upload anyway
- *      (validateRigPath rejects reserved paths).
+ *   3. Secrets + conflict sidecars (NON_OVERRIDABLE_IGNORE_LINES), added
+ *      again after the project file. The .tapignore itself syncs from
+ *      other members, so a `!.env` there would otherwise make every
+ *      member's daemon upload their own .env.
+ *   4. Always-excluded paths — Tap's own local metadata, plus the paths
+ *      that never sync between members (core isNeverSyncPath: .git,
+ *      agent/MCP config). Matched case-insensitively, never re-enabled by
+ *      `!pattern`; the relay refuses them anyway (validateRigPath rejects
+ *      reserved paths, the change route refuses never-sync ones).
  */
 
 declare const BUILTIN_IGNORE_LINES: ReadonlyArray<string>;
 declare function loadIgnore(rootDir: string): Ignore;
 /**
  * Hard-exclude check that runs in addition to .tapignore. Tap's own
- * local metadata is invisible to sync no matter what the user puts in
- * their .tapignore — including `!pattern` overrides.
+ * local metadata and the never-sync paths (.git, agent/MCP config) are
+ * invisible to sync no matter what the user puts in their .tapignore —
+ * including `!pattern` overrides. Case-insensitive: on APFS `.RIG/` is
+ * `.rig/`.
  */
 declare function isAlwaysExcluded(posixPath: string): boolean;
 
@@ -287,6 +296,10 @@ declare function hashFile(absPath: string): Promise<string>;
  *   7. Populate .rig/tap/state.local.db with last_applied_change_id
  *      per path, and the resulting cursor.
  *
+ * `deferUpload` stops after step 3a (plus an empty state DB): the binding
+ * exists and the config is on disk, and the daemon's first scan uploads
+ * everything (`tapd start` pushes whatever the relay doesn't know yet).
+ *
  * Returns a summary with the binding, the owner token (so the caller
  * CLI can print it once), upload + change counts, and any walker
  * warnings (oversized files / symlinks / invalid paths). Caller is
@@ -302,6 +315,15 @@ type InitOptions = {
     deviceLabel?: string;
     /** Org slug to scope the new binding to. Caller must already be a member. */
     org?: string;
+    /** Create the binding as this kind (the relay defaults to `'rig'`). */
+    kind?: "rig" | "space";
+    /**
+     * Create the binding and write the local config, but leave the initial
+     * upload to the daemon's first scan (`tapd start` pushes every file the
+     * relay doesn't know yet). For a brand-new folder that should be usable
+     * the moment its binding exists — a new space in the desktop app.
+     */
+    deferUpload?: boolean;
     /** Test seam: override fetch (used to drive the in-process relay). */
     fetch?: typeof fetch;
 };
@@ -316,6 +338,8 @@ type InitResult = {
     warnings: WalkResult["warnings"];
     /** Cursor written to state.local.db after the initial submit. */
     cursor: string;
+    /** True when the upload was left to the daemon's first scan (`deferUpload`). */
+    deferredUpload: boolean;
 };
 declare class AlreadyInitializedError extends Error {
     readonly path: string;
@@ -419,15 +443,27 @@ declare function revoke(opts: {
 /**
  * Apply remote change events to the local filesystem.
  *
- * Phase 2 keeps this simple: last-write-wins, no conflict materialization
- * (Phase 4 adds it). Echo suppression is handled via the state DB:
- * if the remote event's hash matches our last_seen_hash for the path,
- * we know it's our own write coming back through the poll loop and skip
- * the download.
+ * Echo suppression is handled via the state DB: an event at or before the
+ * path's last_applied_change_id (our own push coming back, or a version
+ * already superseded here), or whose hash matches our last_seen_hash, is
+ * skipped without a download.
+ *
+ * A change made on both sides is first three-way merged (merge.ts) against
+ * the version this device last synced; a clean merge becomes the file and
+ * is uploaded on top of the remote change. Otherwise the remote stays the
+ * file and the local edit moves to a `.conflict-from.<this device>.<chg>`
+ * copy — a local copy that hasn't seen a newer remote version must never
+ * replace it (the 2026-09-30 clear-harbor incident). Identical bytes on
+ * both sides are not a conflict.
  *
  * Materialization is atomic: download to `<file>.tap-tmp.<rand>` then
  * `rename` into place. Atomic on POSIX; on Windows, `fs.rename` falls
  * back to MoveFileEx-style replace.
+ *
+ * Files from other members are treated like downloads: never executable
+ * (the event's `executable` bit is ignored), quarantined on macOS so
+ * Gatekeeper checks them before they run, and never-sync paths (.git,
+ * agent/MCP config — core isNeverSyncPath) are not applied at all.
  */
 
 /** State-DB meta key — running count of conflicts surfaced by `tapd status`. */
@@ -450,8 +486,8 @@ declare function conflictSidecarPath(path: string, ev: {
  * Apply mode.
  *
  * - `primary`: the local copy has write authority. Local-divergence
- *   guards protect unpushed edits (sidecars, keep-on-delete, refuse to
- *   clobber a dir) on the assumption scanAndPush carries them upstream.
+ *   guards protect unpushed edits (conflict copies, keep-on-delete,
+ *   refuse to clobber a dir).
  * - `mirror`: a read-only import of another binding. The mount has no
  *   local authority, so **remote always wins** across every event type —
  *   every divergence guard flips to remote-authoritative. There is no
@@ -473,8 +509,8 @@ type ApplyResult = {
     errors: ReadonlyArray<ApplyEventError>;
 };
 /**
- * One iteration of the apply loop: poll `GET /changes?after=<cursor>`,
- * materialize each event, update the cursor.
+ * One iteration of the apply loop: page through `GET /changes?after=<cursor>`
+ * until caught up, materialize each event, update the cursor.
  *
  * Per-event errors (hash mismatch, file/directory collision, disk full,
  * etc.) are caught, logged, and recorded to the state DB — the cursor
@@ -492,6 +528,62 @@ declare function applyOnce(opts: {
     mode?: ApplyMode;
 }): Promise<ApplyResult>;
 
+/**
+ * Line-based three-way merge for a file changed on both sides (layer 0:
+ * deterministic, no AI). The applier tries it before falling back to a
+ * conflict copy: base = the version this device last synced, ours = the
+ * local file, theirs = the remote version being applied.
+ *
+ * The merge itself is node-diff3's `diff3Merge` (overlapping or touching
+ * hunks are a conflict; the same change on both sides is not). Two things
+ * are layered around it:
+ *
+ * - Only text it can't corrupt: valid UTF-8, no NUL, ≤ 1 MB per side, and
+ *   not a format where a clean line merge can still be wrong (TOML, YAML,
+ *   lockfiles, CSV/TSV). A merged `.json` must still parse.
+ * - Bounded work. node-diff3's LCS slows down sharply on many repeated
+ *   lines (a 5,000-line doc that is one-third blank lines takes seconds),
+ *   and this runs on the daemon's event loop. So the lines all three
+ *   versions share at the start and end are set aside, the rest is cut at
+ *   lines that occur exactly once in every version and in the same order
+ *   (a merge can't move them), and each piece is merged on its own. Text
+ *   still too repetitive to merge quickly gives up — a conflict copy,
+ *   never a hang.
+ *
+ * Line endings: if every version uses one style, lines are compared
+ * without it and the result takes the style a side switched to (ours if
+ * both did), else the base's. A file mixing styles is merged as raw lines.
+ * The trailing newline follows the same rule.
+ */
+
+/**
+ * One auto-merge: this device's edit to `path` and another member's change
+ * `theirsChangeId`, both made on top of `baseChangeId`. Successive merges
+ * into an edit not yet uploaded update one record (`theirsChangeId` is
+ * then the newest remote change merged in). `changeId` is the upload that
+ * carried the merged file, once it went up.
+ */
+type MergeRecord = {
+    path: string;
+    at: string;
+    baseChangeId: string | null;
+    theirsChangeId: string;
+    theirsDeviceId: string | null;
+    /** The local bytes before the merge (not stored on the relay). */
+    oursHash: string;
+    resultHash: string;
+    changeId?: string;
+};
+declare function readMerges(stateDb: StateDb): MergeRecord[];
+type MergeResult = {
+    ok: true;
+    bytes: Buffer;
+} | {
+    ok: false;
+    reason: string;
+};
+declare function mergeText(path: string, base: Buffer, ours: Buffer, theirs: Buffer): MergeResult;
+
 /**
  * Claude Code context provider (Context Layer § 4, docs/context-layer-design-doc.md).
  *
@@ -557,8 +649,11 @@ type IntentAssignment = {
 
 type NotSyncedFile = {
     path: string;
-    reason: "quota_exceeded" | "file_too_large";
-    /** Hash of the refused bytes; absent for walker-level oversize skips. */
+    reason: "quota_exceeded" | "file_too_large" | "owner_only" | "protected";
+    /**
+     * Hash of the refused bytes; absent for walker-level oversize skips and
+     * for refused deletes/mkdirs/rmdirs.
+     */
     hash?: string;
     size?: number;
     /** The space's byte limit, for quota_exceeded. */
@@ -595,6 +690,8 @@ declare function scanAndPush(opts: {
      * map and the batch simply carries no intent.
      */
     resolveIntents?: (changedPaths: ReadonlyArray<string>) => Promise<Map<string, IntentAssignment>>;
+    /** Internal: this is the re-scan that uploads merges a stale_base refusal produced. */
+    afterMerge?: boolean;
 }): Promise<ScanAndPushResult>;
 
 /**
@@ -742,6 +839,19 @@ type SubscriptionHandle = {
     stop(): Promise<void>;
     /** Force one apply cycle now (through the mutex). */
     applyNow(): Promise<ApplyResult>;
+    /**
+     * Apply every remote change, then run `fn` before any other apply
+     * starts — so an upload only ever goes out from a tree that has seen the
+     * relay's latest. `{ ok: false }` (fn not run) when the changes couldn't
+     * be fetched.
+     */
+    catchUpThen<T>(fn: () => Promise<T>): Promise<{
+        ok: true;
+        value: T;
+    } | {
+        ok: false;
+        error: unknown;
+    }>;
     /** Underlying state DB. Caller MUST NOT close it — stop() does. */
     stateDb: StateDb;
 };
@@ -914,6 +1024,12 @@ declare function subscribe(opts: SseSubscriberOptions): SseSubscriber;
  * subscription.ts; this file wires the pieces together and owns the
  * primary writer.
  *
+ * Every upload goes through the primary subscription's catchUpThen: remote
+ * changes are applied first, under the same lock. When they can't be
+ * fetched (relay down, offline) nothing is uploaded — a copy that hasn't
+ * seen the latest remote changes must not be pushed over them — and the
+ * push is retried.
+ *
  * Critical invariant: import mount points are HARD-excluded from the
  * primary writer (watcher `ignored` + walker `excludePaths`), so a
  * mirrored subtree is never re-uploaded into the primary's own binding
@@ -982,4 +1098,4 @@ type DaemonHandle = {
 };
 declare function start(opts: StartOptions): Promise<DaemonHandle>;
 
-export { type AddImportOptions, type AddImportResult, AlreadyInitializedError, AlreadyJoinedError, type ApplyMode, type ApplyResult, BINDING_CONFIG_PATH, BUILTIN_IGNORE_LINES, type BindingConfig, type DaemonHandle, type ImportHandle, type ImportMountFile, type ImportSpec, ImportTokenScopeError, type ImportValidationError, ImportValidationFailed, type InitOptions, type InitResult, InvalidInviteUrlError, type JoinOptions, type JoinResult, type LocalPathState, type MintInviteOptions, NotInitializedError, type NotSyncedFile, RelayClient, type RelayClientOptions, RelayError, type RemoveImportResult, STATE_KEY_CONFLICT_COUNT, type ScanAndPushResult, type SseSubscriber, type SseSubscriberOptions, type StartOptions, type StartSubscriptionOptions, type StateDb, type SubscriptionConfig, type SubscriptionHandle, type WalkFile, type WalkResult, type WalkWarning, addImport, applyOnce, bindingConfigFile, conflictSidecarPath, createBinding, hashFile, importMountFile, importStateDbPath, importsDir, init, isAlwaysExcluded, join, list as listInvites, loadIgnore, loadImportMounts, mint as mintInvite, normalizeImportPath, openStateDb, parseInviteUrl, primaryStateDbPath, readBindingConfig, readImportMount, readNotSynced, removeImport, revoke as revokeInvite, scanAndPush, subscribe as sseSubscribe, start, startSubscription, validateImportName, validateImportPath, validateImports, walk, writeBindingConfig, writeImportMount };
+export { type AddImportOptions, type AddImportResult, AlreadyInitializedError, AlreadyJoinedError, type ApplyMode, type ApplyResult, BINDING_CONFIG_PATH, BUILTIN_IGNORE_LINES, type BindingConfig, type DaemonHandle, type ImportHandle, type ImportMountFile, type ImportSpec, ImportTokenScopeError, type ImportValidationError, ImportValidationFailed, type InitOptions, type InitResult, InvalidInviteUrlError, type JoinOptions, type JoinResult, type LocalPathState, type MergeRecord, type MintInviteOptions, NotInitializedError, type NotSyncedFile, RelayClient, type RelayClientOptions, RelayError, type RemoveImportResult, STATE_KEY_CONFLICT_COUNT, type ScanAndPushResult, type SseSubscriber, type SseSubscriberOptions, type StartOptions, type StartSubscriptionOptions, type StateDb, type SubscriptionConfig, type SubscriptionHandle, type WalkFile, type WalkResult, type WalkWarning, addImport, applyOnce, bindingConfigFile, conflictSidecarPath, createBinding, hashFile, importMountFile, importStateDbPath, importsDir, init, isAlwaysExcluded, join, list as listInvites, loadIgnore, loadImportMounts, mergeText, mint as mintInvite, normalizeImportPath, openStateDb, parseInviteUrl, primaryStateDbPath, readBindingConfig, readImportMount, readMerges, readNotSynced, removeImport, revoke as revokeInvite, scanAndPush, subscribe as sseSubscribe, start, startSubscription, validateImportName, validateImportPath, validateImports, walk, writeBindingConfig, writeImportMount };

package/dist/index.js

@@ -26,6 +26,7 @@ import {
   list,
   loadIgnore,
   loadImportMounts,
+  mergeText,
   mint,
   normalizeImportPath,
   openStateDb,
@@ -33,6 +34,7 @@ import {
   primaryStateDbPath,
   readBindingConfig,
   readImportMount,
+  readMerges,
   readNotSynced,
   removeImport,
   revoke,
@@ -46,7 +48,7 @@ import {
   walk,
   writeBindingConfig,
   writeImportMount
-} from "./chunk-7RKYNS5V.js";
+} from "./chunk-S5AVBVLP.js";
 export {
   AlreadyInitializedError,
   AlreadyJoinedError,
@@ -74,6 +76,7 @@ export {
   list as listInvites,
   loadIgnore,
   loadImportMounts,
+  mergeText,
   mint as mintInvite,
   normalizeImportPath,
   openStateDb,
@@ -81,6 +84,7 @@ export {
   primaryStateDbPath,
   readBindingConfig,
   readImportMount,
+  readMerges,
   readNotSynced,
   removeImport,
   revoke as revokeInvite,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigxyz/tapd",
-  "version": "0.6.5",
+  "version": "0.6.8",
   "description": "Local daemon for the hosted Tap relay — watches files, hashes content, uploads/downloads objects, applies remote changes. Pairs with @rigxyz/cli for shared-rig sync.",
   "license": "MIT",
   "author": "Dylan Bourgeois <dtsbourg@gmail.com>",
@@ -40,7 +40,8 @@
   "dependencies": {
     "chokidar": "^4.0.1",
     "ignore": "^5.3.0",
-    "kleur": "^4.1.5"
+    "kleur": "^4.1.5",
+    "node-diff3": "3.2.1"
   },
   "devDependencies": {
     "@tap/core": "workspace:*",