@superblocksteam/vite-plugin-file-sync 2.0.162 → 2.0.163-next.0

package/dist/sync-service/index.js

@@ -1,13 +1,13 @@
 import { randomUUID } from "node:crypto";
+import * as fs from "node:fs/promises";
+import path from "node:path";
 import { normalizePath } from "vite";
 import { SyncronizationStatus, } from "@superblocksteam/library-shared/types";
-import { addTracingToMethods, TracedEventEmitter, } from "@superblocksteam/shared";
-import { BadRequestError } from "@superblocksteam/shared";
-import { unwrapResponseDto } from "@superblocksteam/shared";
+import { addTracingToMethods, TracedEventEmitter, BadRequestError, unwrapResponseDto, } from "@superblocksteam/shared";
 import { applyErrorHandling, } from "../errors/error-handler.js";
 import { makeServerError } from "../errors/make-server-error.js";
 import { POLICY_GATE_RUN_SYNC_BLOCKED_ERROR, policyGateRunRegistry, } from "../policy-gate-run-registry.js";
-import { getErrorMeta } from "../util/logger.js";
+import { getErrorMeta, } from "../util/logger.js";
 import { OperationQueue } from "../util/operation-queue.js";
 import { withResolvers } from "../util/with-resolvers.js";
 import { classifyCheckpointResult } from "./checkpoint-result.js";
@@ -15,6 +15,7 @@ import { downloadApplicationDirectory } from "./download.js";
 import { hasSwapFiles, discardAllDrafts, commitAllDrafts, getDraftInfo, createDraft, generateDraftDiff, createDraftMarkerOnly, createDraftDelete, cleanUpDraftsDirectory, } from "./draft-helpers.js";
 import { recordDraftStateReport } from "./draft-state-report-metrics.js";
 import { HashCache } from "./hash-cache.js";
+import { validatePageReferences } from "./page-reference-guard.js";
 import { snapshotLocalDirectory, snapshotLocalDirectoryWithDrafts, } from "./snapshot/take-snapshot.js";
 import { uploadDirectorySnapshot } from "./snapshot/upload-snapshot.js";
 const SYNC_INTERVAL_MS = 10_000;
@@ -115,6 +116,16 @@ export class SyncService extends TracedEventEmitter {
     draftStateReports = new Map();
     /** This will be defined if (and only if) a sync is currently pending */
     pendingSyncUp;
+    /**
+     * The sync most recently handed to `syncOperationQueue`.
+     *
+     * A timer clears `pendingSyncUp` before it enqueues, so an empty pending
+     * slot does not mean nothing newer is outstanding: a second save can arm and
+     * fire its own timer while the first sync waits its turn in the queue. This
+     * is how a sync that finds the slot empty tells "I am the newest" from "a
+     * newer one is already queued ahead of me".
+     */
+    lastEnqueuedSyncUp;
     handledAutosyncUploads = new WeakSet();
     latestAutosyncPreparation;
     latestAutosyncUpload;
@@ -128,6 +139,7 @@ export class SyncService extends TracedEventEmitter {
     _rpcClient;
     _logger;
     _moduleInvalidationCallback;
+    pageReferenceResolver;
     removeManualCommitsEnabled;
     constructor(config) {
         super(config.tracer);
@@ -149,12 +161,16 @@ export class SyncService extends TracedEventEmitter {
                 operation: "syncing current directory to server",
             },
             hasLocalDraftChanges: { operation: "checking for local draft changes" },
-            commitLocalDraftChanges: { operation: "committing local draft changes" },
+            commitLocalDraftChanges: {
+                operation: "committing local draft changes",
+                rethrow: true,
+            },
         });
         const methods = [
             "downloadDirectory",
             "uploadDirectory",
             "syncCurrentDirectoryWithDraftsNow",
+            "syncCurrentDirectoryWithDraftsNowIfChanged",
             "uploadDirectoryNowIfNeeded",
             "scheduleUploadDirectory",
             "performUploadDirectory",
@@ -238,6 +254,9 @@ export class SyncService extends TracedEventEmitter {
     setModuleInvalidationCallback(callback) {
         this._moduleInvalidationCallback = callback;
     }
+    setPageReferenceResolver(resolver) {
+        this.pageReferenceResolver = resolver;
+    }
     /**
      * Pulls the application down from the server.
      */
@@ -297,15 +316,7 @@ export class SyncService extends TracedEventEmitter {
             }
         });
     }
-    /**
-     * Request a sync of the local application directory to the server.
-     *
-     * This method is asynchronous, in the sense that it does not wait for the sync to complete. It simply schedules
-     * a sync to happen in the future. The returned promise resolves as soon as the method has collected enough information
-     * to schedule the sync. So the caller must wait for the returned promise to resolve before performing any filesystem
-     * operations.
-     * This method is also idempotent.
-     */
+    /** Resolves after scheduling, not uploading. Await before filesystem changes. */
     uploadDirectory(source) {
         if (this._autoSyncPaused) {
             this.getLogger().info("[sync-service] Auto-sync paused (migration in progress), skipping upload");
@@ -367,14 +378,18 @@ export class SyncService extends TracedEventEmitter {
      * Requests an immediate sync of the local application directory to the server, if there are any pending changes.
      * If there are no pending changes, the method returns immediately.
      *
+     * @param options.reclaimAfterHandback - Whether this drain may take back an
+     * edit lock this session handed back. Pass it only from a call site a user
+     * action is behind; see {@link PendingSyncUpState.reclaimAfterHandback}.
      * @returns the dbfs hash of the most recent sync
      */
-    uploadDirectoryNowIfNeeded(source) {
+    uploadDirectoryNowIfNeeded(source, options) {
         if (!this.pendingSyncUp) {
             this.getLogger().info("[sync-service] No pending sync, skipping");
             return Promise.resolve({
                 directoryHash: this.lastSyncedDirectoryHash || "",
                 commitId: undefined,
+                localNoPending: true,
             });
         }
         const directorySnapshot = this.pendingSyncUp.directorySnapshot;
@@ -383,7 +398,7 @@ export class SyncService extends TracedEventEmitter {
         this.latestAutosyncPreparation = preparation;
         this.latestAutosyncUpload = undefined;
         return this.fsOperation(async () => {
-            const completedPromise = this.scheduleUploadDirectory(directorySnapshot, true, this.generationNumberSequence?.currentValue, source);
+            const completedPromise = this.scheduleUploadDirectory(directorySnapshot, true, this.generationNumberSequence?.currentValue, source, { reclaimAfterHandback: options?.reclaimAfterHandback ?? false });
             return await this.trackAutosyncUpload(completedPromise, source, preparation);
         });
     }
@@ -405,7 +420,50 @@ export class SyncService extends TracedEventEmitter {
             return result;
         });
     }
-    scheduleUploadDirectory(directorySnapshot, performNow, generationNumber, source) {
+    /**
+     * Flushes the current directory for teardown without creating a redundant
+     * setApplicationHash request when disk already matches the last successful
+     * sync. Termination can race application or branch deletion; avoiding the
+     * no-op request prevents that expected teardown from looking like lost work,
+     * while a genuinely changed directory still attempts its final upload.
+     */
+    syncCurrentDirectoryWithDraftsNowIfChanged(source) {
+        if (this._autoSyncPaused) {
+            this.getLogger().info("[sync-service] Auto-sync paused (migration in progress), skipping final upload");
+            return Promise.resolve({
+                directoryHash: this.lastSyncedDirectoryHash || "",
+            });
+        }
+        return this.fsOperation(async () => {
+            const directorySnapshot = await snapshotLocalDirectoryWithDrafts(this.appRootDirPath);
+            // Debounce clears pendingSyncUp before performUploadDirectory runs, so
+            // an in-flight upload can still rewrite lastSyncedDirectoryHash after a
+            // skip. Drain that queue first; fs-outer/sync-inner is the same nesting
+            // as flipTemplate. Clear the timer before waiting so it cannot enqueue
+            // a stale snapshot behind this barrier; keep pendingSyncUp so skip can
+            // still settle its promise.
+            if (this.pendingSyncUp) {
+                clearTimeout(this.pendingSyncUp.timeoutId);
+            }
+            await this.syncOperationQueue.enqueue(async () => undefined);
+            if (directorySnapshot.hash === this.lastSyncedDirectoryHash) {
+                const result = { directoryHash: directorySnapshot.hash };
+                if (this.pendingSyncUp) {
+                    this.pendingSyncUp.resolve(result);
+                    this.pendingSyncUp = undefined;
+                }
+                this.status = SyncServiceStatus.IDLE;
+                this.setSynchronizationStatus(SyncronizationStatus.IN_SYNC, source);
+                this.getLogger().info(`[sync-service] Current directory already synchronized, skipping final upload (source=${source})`);
+                return result;
+            }
+            const completedPromise = this.scheduleUploadDirectory(directorySnapshot, true, this.generationNumberSequence?.currentValue, source);
+            const result = await completedPromise;
+            this.getLogger().info("[sync-service] Changed current directory synchronized during final flush");
+            return result;
+        });
+    }
+    scheduleUploadDirectory(directorySnapshot, performNow, generationNumber, source, options) {
         if (performNow && this.pendingSyncUp) {
             // There is already a sync pending, cancel it so that we can schedule a new one, to be performed immediately
             clearTimeout(this.pendingSyncUp.timeoutId);
@@ -418,7 +476,13 @@ export class SyncService extends TracedEventEmitter {
             // server classifies the commit by it.
             this.pendingSyncUp.directorySnapshot = directorySnapshot;
             this.pendingSyncUp.generationNumber = generationNumber;
-            if (!performNow && this.removeManualCommitsEnabled) {
+            // A sync kept pending after a skip has no timer (see
+            // `keepSkippedSyncPending`), so a save joining it arms one whichever
+            // debounce is in force; otherwise the snapshot only leaves on an
+            // explicit drain.
+            if (!performNow &&
+                (this.removeManualCommitsEnabled ||
+                    this.pendingSyncUp.timeoutId === undefined)) {
                 this.armPendingSyncTimeout(this.nextAutosyncDelayMs(this.pendingSyncUp.burstStartedAt));
             }
         }
@@ -433,6 +497,8 @@ export class SyncService extends TracedEventEmitter {
                 completed: completedPromise,
                 directorySnapshot,
                 generationNumber,
+                performNow,
+                reclaimAfterHandback: options?.reclaimAfterHandback ?? false,
                 reject,
                 resolve,
                 source,
@@ -464,10 +530,44 @@ export class SyncService extends TracedEventEmitter {
         pendingSyncUp.timeoutId = setTimeout(() => {
             void (async () => {
                 this.pendingSyncUp = undefined;
+                this.lastEnqueuedSyncUp = pendingSyncUp;
                 await this.syncOperationQueue.enqueue(async () => {
                     try {
-                        const isLockValid = await this.lockService.ensureLockForWrite();
+                        // Only a sync a user action is behind may take back a lock this
+                        // session handed over, and the call site says so. A debounced
+                        // save is not evidence its user came back to the keyboard — a tab
+                        // left open reconnects its socket by itself — and after a handback
+                        // the lock is free, so letting one reclaim would hand the app to
+                        // somebody who walked away (APPS-4840).
+                        const isLockValid = await this.lockService.ensureLockForWrite({
+                            reclaimAfterHandback: pendingSyncUp.reclaimAfterHandback,
+                        });
                         if (!isLockValid) {
+                            if (!pendingSyncUp.performNow) {
+                                // Nothing is waiting on this one, and not holding the lock is
+                                // its ordinary answer: the session it belonged to handed the
+                                // lock back, or another client holds it. Failing it took the
+                                // sandbox down with it — nothing awaits this promise, so the
+                                // rejection was unhandled, and the dev server turns an
+                                // unhandled rejection into `process.exit` (ENG-6808).
+                                //
+                                // Skipped, not synced: the status stays LOCAL_AHEAD, the
+                                // last-synced hash is left alone, and the snapshot stays
+                                // pending so the next save or an explicit drain still sends
+                                // it.
+                                this.getLogger().info(`[sync-service] Skipping autosync, this session does not hold the edit lock (source=${pendingSyncUp.source})`);
+                                this.keepSkippedSyncPending(pendingSyncUp);
+                                return;
+                            }
+                            // Its caller hears about this one, but the local files are ahead
+                            // either way, so the snapshot is retained on both branches. A
+                            // drain that finds nothing pending hands back the last synced
+                            // hash without asking the server, and a failed accept followed
+                            // by a confident "DBFS is current" is how stale files reach an
+                            // API run.
+                            if (this.retentionFor(pendingSyncUp).kind === "retain") {
+                                this.retainAsPendingSync(this.forkPendingSyncForRetry(pendingSyncUp));
+                            }
                             throw new Error("Lock is not valid");
                         }
                         const result = await this.performUploadDirectory(
@@ -486,6 +586,112 @@ export class SyncService extends TracedEventEmitter {
             })();
         }, timeoutDelayMs);
     }
+    /**
+     * Where the snapshot of a sync that could not have the lock belongs.
+     *
+     * Keeping it matters because the timer cleared `pendingSyncUp` before the
+     * sync ran: `uploadDirectoryNowIfNeeded` drains only what is pending and
+     * otherwise hands back the last synced hash, so an editor calling
+     * `ensureFilesSynced` before running an API would be told DBFS is current
+     * while the status says LOCAL_AHEAD, and run against stale files.
+     *
+     * Only the newest outstanding snapshot may be kept. Snapshots are
+     * whole-directory and `performUploadDirectory` sets the application hash to
+     * whatever it uploads, so parking an older one behind a newer upload reverts
+     * the server files to it once something drains. An empty pending slot does
+     * not establish newest: a save that landed while this one waited its turn
+     * may already have fired its own timer and queued behind it, emptying the
+     * slot on the way. That is what `lastEnqueuedSyncUp` answers.
+     */
+    retentionFor(enqueued) {
+        if (this._autoSyncPaused) {
+            // A migration paused autosync while this waited its turn; it wants the
+            // queues empty, and the pod restarts with a fresh service on success.
+            return { kind: "discarded" };
+        }
+        if (this.pendingSyncUp) {
+            // A save landed while this waited its turn and opened a new pending
+            // sync, which carries everything this one had.
+            return { kind: "superseded", by: this.pendingSyncUp };
+        }
+        if (this.lastEnqueuedSyncUp && this.lastEnqueuedSyncUp !== enqueued) {
+            // A save landed, armed its timer, and fired it, so the newer snapshot is
+            // queued behind this one rather than sitting in the pending slot. It
+            // still carries everything this one had, and it uploads after this
+            // returns, so retaining this one would leave an older snapshot drainable
+            // over the top of it.
+            return { kind: "superseded", by: this.lastEnqueuedSyncUp };
+        }
+        return { kind: "retain" };
+    }
+    /**
+     * Park a snapshot in the pending slot, without a timer.
+     *
+     * Re-arming one would retry every interval for as long as the lock stays
+     * handed back, which for a pod nobody came back to is until it is reaped.
+     * Instead the snapshot leaves on the next save, which arms a timer as it
+     * joins (see `scheduleUploadDirectory`), or on an explicit drain. The burst
+     * clock restarts so that save gets an ordinary debounce rather than firing
+     * at once because the original burst's max wait has long passed.
+     */
+    retainAsPendingSync(toRetain) {
+        toRetain.timeoutId = undefined;
+        toRetain.burstStartedAt = performance.now();
+        this.pendingSyncUp = toRetain;
+    }
+    /**
+     * Retain a skipped sync's snapshot and settle its promise, which for a
+     * superseded one is the newer sync's outcome.
+     *
+     * Only for the skip path: a sync that fails settles its own promise through
+     * the caller's `catch`, and must not also adopt another sync's outcome.
+     */
+    keepSkippedSyncPending(skipped) {
+        const retention = this.retentionFor(skipped);
+        if (retention.kind === "superseded") {
+            retention.by.completed.then(skipped.resolve, skipped.reject);
+            return;
+        }
+        if (retention.kind === "retain") {
+            this.retainAsPendingSync(skipped);
+        }
+    }
+    /**
+     * Copy a sync whose promise is already spoken for, so its snapshot can be
+     * retained without that promise coming along.
+     *
+     * A failed sync's promise is rejected for its caller, and a retained sync's
+     * is handed to whatever picks the snapshot up next: a save coalescing into
+     * it is returned this promise, and the final flush resolves it. Both would
+     * be no-ops against the settled one.
+     *
+     * The copy is a plain trailing snapshot. Nothing awaits it, and the claim to
+     * reclaim a handed-back lock belonged to the user action that failed, not to
+     * whoever happens to save next.
+     */
+    forkPendingSyncForRetry(settled) {
+        const { promise: completed, resolve, reject, } = withResolvers();
+        // Whoever picks this up brings its own reporting, through
+        // `trackAutosyncUpload`. Until then the promise needs a handler of its
+        // own: an unhandled rejection is what the dev server turns into
+        // `process.exit`, which is the failure this whole path exists to avoid.
+        void completed.catch((error) => {
+            logSyncError(this.getLogger(), error, "[sync-service] Retained snapshot failed to synchronize");
+        });
+        return {
+            burstStartedAt: settled.burstStartedAt,
+            completed,
+            directorySnapshot: settled.directorySnapshot,
+            generationNumber: settled.generationNumber,
+            performNow: false,
+            reclaimAfterHandback: false,
+            reject,
+            resolve,
+            source: settled.source,
+            syncTime: settled.syncTime,
+            timeoutId: undefined,
+        };
+    }
     cancelPendingSync() {
         if (this.pendingSyncUp) {
             clearTimeout(this.pendingSyncUp.timeoutId);
@@ -519,11 +725,7 @@ export class SyncService extends TracedEventEmitter {
         this._autoSyncPaused = false;
         this.status = SyncServiceStatus.IDLE;
     }
-    /**
-     * Takes a snapshot of an arbitrary local directory and uploads it to DBFS.
-     * Used by the git deploy flow to upload a worktree snapshot for a main branch commit.
-     * Does NOT create any internal commits — the caller is responsible for that.
-     */
+    /** Uploads a directory snapshot to DBFS without creating an internal commit. */
     async uploadSnapshotToDbfs(localDirectoryPath) {
         const snapshot = await snapshotLocalDirectory(localDirectoryPath);
         await this._rpcClient.call(async (rpcClient) => {
@@ -645,6 +847,7 @@ export class SyncService extends TracedEventEmitter {
             return {
                 checkpointSkipped,
                 commitId,
+                degradedMode,
                 directoryHash: directorySnapshot.hash,
             };
         }
@@ -678,7 +881,14 @@ export class SyncService extends TracedEventEmitter {
         return this.fsOperation(async () => {
             const directorySnapshot = await snapshotLocalDirectoryWithDrafts(this.appRootDirPath);
             return this.syncOperationQueue.enqueue(async () => {
-                const isLockValid = await this.lockService.ensureLockForWrite();
+                // A migration runs off the editor's migrate banner (`/sb-migrate-to-
+                // fullstack`), so a user is behind this write and it may take back a
+                // lock this session handed over. It fails loudly when it cannot: a
+                // migration half applied in silence is worse than one that reports it
+                // could not run.
+                const isLockValid = await this.lockService.ensureLockForWrite({
+                    reclaimAfterHandback: true,
+                });
                 if (!isLockValid) {
                     throw new Error("Lock is not valid");
                 }
@@ -716,7 +926,14 @@ export class SyncService extends TracedEventEmitter {
         return this.fsOperation(async () => {
             const directorySnapshot = await snapshotLocalDirectoryWithDrafts(this.appRootDirPath);
             return this.syncOperationQueue.enqueue(async () => {
-                const isLockValid = await this.lockService.ensureLockForWrite();
+                // A migration runs off the editor's migrate banner (`/sb-migrate-to-
+                // fullstack`), so a user is behind this write and it may take back a
+                // lock this session handed over. It fails loudly when it cannot: a
+                // migration half applied in silence is worse than one that reports it
+                // could not run.
+                const isLockValid = await this.lockService.ensureLockForWrite({
+                    reclaimAfterHandback: true,
+                });
                 if (!isLockValid) {
                     throw new Error("Lock is not valid");
                 }
@@ -730,11 +947,6 @@ export class SyncService extends TracedEventEmitter {
             });
         });
     }
-    /**
-     * Resolve datasource integration IDs (UUIDs) to plugin IDs.
-     * Used by migration preflight to classify whether UUID-backed steps map to
-     * supported SDK integration types.
-     */
     async getIntegrationPluginIds(integrationIds) {
         const uniqueIntegrationIds = [...new Set(integrationIds)];
         if (uniqueIntegrationIds.length === 0) {
@@ -802,29 +1014,146 @@ export class SyncService extends TracedEventEmitter {
      * @returns A promise that resolves when the draft edit or addition is created.
      */
     async createDraftFile(filePath, draftContent) {
-        // Normalize path for cross-platform compatibility (Windows)
-        const normalizedFilePath = normalizePath(filePath);
-        this.getLogger().info(`[sync-service] Creating draft file: ${normalizedFilePath}`);
+        await this.applyDraftChanges([{ filePath, content: draftContent }]);
+    }
+    async applyDraftChanges(changes) {
+        const normalized = changes.map((change) => {
+            const filePath = normalizePath(change.filePath);
+            const fullPath = path.resolve(this.appRootDirPath, filePath);
+            const relativePath = path.relative(this.appRootDirPath, fullPath);
+            if (relativePath === ".." ||
+                relativePath.startsWith(`..${path.sep}`) ||
+                path.isAbsolute(relativePath)) {
+                throw new Error(`Cannot change a path outside the app root: ${filePath}`);
+            }
+            if (change.content === undefined && relativePath === "") {
+                throw new Error("Cannot delete the app root");
+            }
+            return { ...change, filePath: normalizePath(relativePath) };
+        });
         await this.fsOperation(async () => {
-            const path = await import("node:path");
-            const fullPath = path.join(this.appRootDirPath, normalizedFilePath);
-            const type = await createDraft(fullPath, draftContent, this.appRootDirPath);
-            if (type === "edit") {
-                this.getLogger().info(`[sync-service] Draft edit created for: ${normalizedFilePath}`);
+            const requestedPaths = new Set();
+            for (const change of normalized) {
+                if (requestedPaths.has(change.filePath)) {
+                    throw new Error(`Cannot change ${change.filePath} more than once in the same batch`);
+                }
+                requestedPaths.add(change.filePath);
+            }
+            const expanded = [];
+            const directories = new Set();
+            const realAppRootDirPath = await fs.realpath(this.appRootDirPath);
+            for (const change of normalized) {
+                if (change.content !== undefined) {
+                    expanded.push(change);
+                    continue;
+                }
+                const fullPath = path.resolve(this.appRootDirPath, change.filePath);
+                let stats;
+                try {
+                    stats = await fs.lstat(fullPath);
+                }
+                catch (error) {
+                    if (error instanceof Error &&
+                        "code" in error &&
+                        error.code === "ENOENT") {
+                        expanded.push(change);
+                        continue;
+                    }
+                    throw error;
+                }
+                if (stats.isSymbolicLink()) {
+                    throw new Error(`Cannot delete symbolic link: ${change.filePath}`);
+                }
+                if (!stats.isFile() && !stats.isDirectory()) {
+                    throw new Error(`Cannot delete unsupported file type: ${change.filePath}`);
+                }
+                // `lstat` only describes the last segment of the path. A parent
+                // directory can still be a symbolic link pointing somewhere else, and
+                // deleting through it would remove a file outside the app root.
+                const realPath = await fs.realpath(fullPath);
+                const realRelativePath = path.relative(realAppRootDirPath, realPath);
+                if (realRelativePath === ".." ||
+                    realRelativePath.startsWith(`..${path.sep}`) ||
+                    path.isAbsolute(realRelativePath)) {
+                    throw new Error(`Cannot delete a path outside the app root: ${change.filePath}`);
+                }
+                if (!stats.isDirectory()) {
+                    expanded.push(change);
+                    continue;
+                }
+                const entries = await fs.readdir(fullPath, {
+                    recursive: true,
+                    withFileTypes: true,
+                });
+                const offender = entries.find((entry) => !entry.isFile() && !entry.isDirectory());
+                if (offender) {
+                    const offenderPath = normalizePath(path.relative(this.appRootDirPath, path.resolve(offender.parentPath, offender.name)));
+                    const kind = offender.isSymbolicLink()
+                        ? "a symbolic link"
+                        : "an unsupported file type";
+                    throw new Error(`Cannot delete ${change.filePath}: it contains ${kind} at ${offenderPath}`);
+                }
+                directories.add(fullPath);
+                for (const entry of entries) {
+                    const entryPath = path.resolve(entry.parentPath, entry.name);
+                    if (entry.isDirectory())
+                        directories.add(entryPath);
+                    if (entry.isFile()) {
+                        expanded.push({
+                            filePath: normalizePath(path.relative(this.appRootDirPath, entryPath)),
+                        });
+                    }
+                }
             }
-            else {
-                this.getLogger().info(`[sync-service] Draft addition created for: ${normalizedFilePath}`);
+            const seen = new Set();
+            for (const change of expanded) {
+                if (seen.has(change.filePath)) {
+                    throw new Error(`Cannot change ${change.filePath} more than once in the same batch`);
+                }
+                seen.add(change.filePath);
             }
-            // Invalidate Vite's module graph for this file
-            if (this._moduleInvalidationCallback) {
-                this._moduleInvalidationCallback(normalizedFilePath);
-                this.getLogger().info(`[sync-service] Triggered Vite module invalidation for: ${normalizedFilePath}`);
+            for (const change of expanded) {
+                if (change.content === undefined)
+                    continue;
+                const fullPath = path.resolve(this.appRootDirPath, change.filePath);
+                if ([...directories].some((directory) => fullPath === directory ||
+                    fullPath.startsWith(`${directory}${path.sep}`))) {
+                    throw new Error(`Cannot write ${change.filePath} because its directory is being deleted`);
+                }
+            }
+            if (this.pageReferenceResolver) {
+                await validatePageReferences({
+                    appRoot: this.appRootDirPath,
+                    changes: expanded,
+                    resolver: this.pageReferenceResolver,
+                });
+            }
+            let mutationStarted = false;
+            try {
+                for (const change of expanded) {
+                    const fullPath = path.join(this.appRootDirPath, change.filePath);
+                    mutationStarted = true;
+                    if (change.content === undefined) {
+                        await createDraftDelete(fullPath, this.appRootDirPath);
+                        this.getLogger().info(`[sync-service] Draft deletion created for: ${change.filePath}`);
+                    }
+                    else {
+                        const type = await createDraft(fullPath, change.content, this.appRootDirPath);
+                        this.getLogger().info(`[sync-service] Draft ${type === "edit" ? "edit" : "addition"} created for: ${change.filePath}`);
+                        this._moduleInvalidationCallback?.(change.filePath);
+                    }
+                }
+                for (const directory of [...directories].sort((left, right) => right.length - left.length)) {
+                    mutationStarted = true;
+                    await fs.rmdir(directory);
+                }
+            }
+            finally {
+                if (mutationStarted && (await hasSwapFiles(this.appRootDirPath))) {
+                    this.notifyDraftStateChanged(true);
+                }
             }
         });
-        this.getLogger().info("[sync-service] Draft file created", {
-            filePath: normalizedFilePath,
-        });
-        this.notifyDraftStateChanged(true);
     }
     /**
      * Creates the marker file only for a draft edit or addition.
@@ -847,11 +1176,7 @@ export class SyncService extends TracedEventEmitter {
      * @returns A promise that resolves when the draft deletion is created.
      */
     async createDraftDelete(filePath) {
-        await this.fsOperation(async () => {
-            const fullPath = `${this.appRootDirPath}/${filePath}`;
-            await createDraftDelete(fullPath, this.appRootDirPath);
-        });
-        this.notifyDraftStateChanged(true);
+        await this.applyDraftChanges([{ filePath }]);
     }
     /**
      * Discards all local draft changes by restoring original files and removing draft additions.
@@ -866,7 +1191,11 @@ export class SyncService extends TracedEventEmitter {
             this.getLogger().info("[sync-service] Local draft changes discarded");
         });
         await this.uploadDirectory(source);
-        await this.uploadDirectoryNowIfNeeded(source);
+        // A reject is a click in the editor, so it may take back a lock this
+        // session handed back (ENG-6808).
+        await this.uploadDirectoryNowIfNeeded(source, {
+            reclaimAfterHandback: true,
+        });
         this.notifyDraftStateChanged(false);
     }
     /**
@@ -889,6 +1218,11 @@ export class SyncService extends TracedEventEmitter {
         });
         const uploadResult = await this.uploadCommittedDraftForSource(source, checkpointAttemptId);
         const result = uploadResult.result;
+        // commitAllDrafts above already removed the local markers, so there is no
+        // draft on disk regardless of how the checkpoint turned out. Report that
+        // before classifying the result: a server left on isDraft=true blocks git
+        // sync until the next reconnect. The rejection below still happens before
+        // the RPC caller advances the chat or waits on this report.
         this.notifyDraftStateChanged(false);
         this.getLogger().info(`[sync-service] commitLocalDraftChanges upload result commitId=${result.commitId ?? "none"}`);
         if (source === "ai:accept") {
@@ -900,6 +1234,13 @@ export class SyncService extends TracedEventEmitter {
                 commitId: result.commitId,
                 outcome: this.aiAcceptCheckpointOutcomeFromLog(checkpointLog),
             });
+            // A missing commitId is a failed checkpoint unless this drain never
+            // reached the server (localNoPending). Hash-only server responses,
+            // including blocked Superblocks users, have neither commitId nor a
+            // by-design skip reason and must reject.
+            if (checkpointLog.level === "warn" && !result.localNoPending) {
+                throw new Error("AI accept checkpoint upload completed without a commit ID");
+            }
         }
         if (result.commitId) {
             return { commitId: result.commitId };
@@ -913,7 +1254,12 @@ export class SyncService extends TracedEventEmitter {
     }
     async uploadCommittedDraft(source) {
         await this.uploadDirectory(source);
-        return await this.uploadDirectoryNowIfNeeded(source);
+        // An accept is a click in the editor, so it may take back a lock this
+        // session handed back (ENG-6808). This is the write the reported session
+        // lost: the user came back and hit Accept against a lock nobody held.
+        return await this.uploadDirectoryNowIfNeeded(source, {
+            reclaimAfterHandback: true,
+        });
     }
     async uploadCommittedDraftWithRetry(source, checkpointAttemptId) {
         for (let attempt = 1;; attempt++) {