@udondan/avanti 0.12.1 → 0.13.0

package/README.md

@@ -1,4 +1,4 @@
-# avanti
+# Avanti!
 
 A stateful package manager for arbitrary text files. Declare what you need and where to get it; avanti fetches, diffs, and writes with full version history, atomic rollbacks, and diff-before-apply safety.
 
@@ -79,15 +79,16 @@ npx @udondan/avanti --help
 avanti [options] [command]
 
 Options:
-  -c, --config <path|url>     path or remote spec for config file (default: auto-detected)
-  -w, --working-dir <path>    working directory for resolving paths (default: current directory)
+  -c, --config <path|url>          path or remote spec for config file (default: auto-detected)
+  -w, --working-dir <path>         working directory for resolving paths (default: current directory)
 
 Commands:
-  diff [pullId]               Show diff between remote sources and local files, or vs a past pull
-  pull [--yes]                Pull remote sources and write to local files
-  log [file]                  Show pull history for the current project
-  revert [pullId] [--yes]     Atomically revert all project files to a past pull state
-  reset [--yes]               Restore all tracked files to their pre-avanti state
+  diff [pullId]                    Show diff between remote sources and local files, or vs a past pull
+  pull [--yes] [--accept-changes]  Pull remote sources and write to local files
+  lock [--force]                   Pin SHA values for all remote sources in the config
+  log [file]                       Show pull history for the current project
+  revert [pullId] [--yes]          Atomically revert all project files to a past pull state
+  reset [--yes]                    Restore all tracked files to their pre-avanti state
 ```
 
 ### `avanti diff`
@@ -98,8 +99,35 @@ Shows a colored git-diff-like output of what would change. Exits `0` if no chang
 
 Fetches all sources, shows the diff, and prompts for confirmation before writing. Use `--yes` to skip the prompt.
 
+If any source has a `sha` field and the fetched content's SHA no longer matches, the pull is aborted with a mismatch error. Use `--accept-changes` to review the diff, confirm, and automatically update the SHA values in the config file.
+
 When avanti has previously synced a directory from a remote source and a file is no longer present in that source, the file is treated as stale: if avanti created it, it is deleted; if it existed before avanti first touched it, the original content is restored. Stale file changes appear in the diff before you confirm.
 
+### `avanti lock`
+
+Fetches all remote sources and writes a SHA-256 fingerprint for each one into the config file. Comments and formatting are preserved.
+
+```sh
+avanti lock           # pin all unpinned remote sources
+avanti lock --force   # overwrite existing SHA values with fresh ones
+```
+
+Once a source is pinned, `avanti pull` will verify the fetched content's SHA before applying any changes. If the upstream changed unexpectedly, avanti aborts with a clear error pointing to the affected source:
+
+```text
+SHA mismatch for github:org/standards:company-rules.md
+  expected: abc123...
+  got:      def456...
+
+Run `avanti pull --accept-changes` to review the diff and update SHA values.
+```
+
+`avanti diff` shows a `⚠ SHA mismatch` warning inline for any source that no longer matches its pinned SHA.
+
+SHA is computed over the raw fetched content of each source, before any `replace` or `post` processing. Each file's path and content are fed into the hash in sorted order, separated by null bytes — so renames and additions affect the fingerprint even for single-file sources. Pull history records the observed SHA for every source, so `avanti log` shows a full audit trail of what changed and when.
+
+Excluded from SHA pinning: local paths and `raw:` sources (their content is either authored locally or inline in the config, so changes are always visible).
+
 ## History
 
 Every successful `avanti pull` that writes at least one file is recorded in a local history store. This lets you inspect what changed, preview past states, revert the whole project, or fully undo all avanti changes.
@@ -287,27 +315,34 @@ src: ~/templates/file.txt
 src: /absolute/path/file.txt
 ```
 
-**Map** — for exec, gitlab, github, bitbucket, git, s3, vault, raw:
+**Map** — for exec, gitlab, github, bitbucket, git, s3, vault, http, raw:
 
 ```yaml
 src:
   exec: <shell command>          # stdout becomes file content; target required
+  sha: abc123...                 # optional SHA-256 to verify stdout (see below)
 
 src:
   raw: |                         # inline content; target required
     your content here
 
+src:
+  http: https://example.com/file.txt  # explicit http/https URL with optional SHA
+  sha: abc123...
+
 src:
   gitlab:
     project: group/repo          # GitLab project path
     file: path/to/file.txt       # file or directory in repo
     ref: main                    # branch, tag, or $latest (optional)
+    sha: abc123...               # optional SHA-256 fingerprint
 
 src:
   github:
     repo: owner/repo             # GitHub owner/repo
     file: path/to/file.txt       # file or directory in repo
     ref: main                    # branch, tag, or $latest (optional)
+    sha: abc123...               # optional SHA-256 fingerprint
 
 src:
   bitbucket:
@@ -315,22 +350,32 @@ src:
     repo: my-repo                # repository slug
     file: path/to/file.txt       # file or directory in repo
     ref: main                    # branch, tag, or $latest (optional)
+    sha: abc123...               # optional SHA-256 fingerprint
 
 src:
   git:
     repo: https://github.com/org/repo.git  # any git remote (HTTPS or SSH)
     file: path/to/file.txt                 # file or directory in repo
     ref: main                              # branch, tag, or commit hash (optional)
+    sha: abc123...                         # optional SHA-256 fingerprint
 
 src:
   s3: s3://my-bucket/path/to/file.txt      # S3 URI; end with / for a prefix sync
+  sha: abc123...                           # optional SHA-256 fingerprint
 
 src:
   vault:
     path: secret/myapp/config   # Vault KV path (mount/subpath)
     field: db_password          # specific field to extract (optional; omit for full JSON)
+    sha: abc123...              # optional SHA-256 fingerprint
 ```
 
+#### SHA pinning
+
+The optional `sha` field pins a source to a specific content fingerprint. When present, avanti verifies the SHA-256 of the raw fetched content matches before writing anything. This makes your config act as a selective lockfile — only sources you care about get pinned, and changes are surfaced explicitly rather than applied silently.
+
+Use `avanti lock` to compute and write SHA values automatically. Use `avanti pull --accept-changes` to review a mismatch and update the pinned SHA. Local paths and `raw:` sources do not support `sha` (changes to those are inherently visible).
+
 ### Directory Sources
 
 Any source type that references a path (local, GitLab, GitHub, Bitbucket, git, S3) can point to a directory instead of a single file. End the path with `/` to declare it a directory explicitly; without a trailing slash the tool probes the remote to decide.

package/dist/cli.js

@@ -5,6 +5,7 @@ const commander_1 = require("commander");
 const diff_1 = require("./commands/diff");
 const pull_1 = require("./commands/pull");
 const log_1 = require("./commands/log");
+const lock_1 = require("./commands/lock");
 const revert_1 = require("./commands/revert");
 const reset_1 = require("./commands/reset");
 const package_json_1 = require("../package.json");
@@ -17,6 +18,7 @@ program
     .option('-w, --working-dir <path>', 'working directory for resolving relative paths (default: current directory)');
 program.addCommand((0, diff_1.diffCommand)());
 program.addCommand((0, pull_1.pullCommand)());
+program.addCommand((0, lock_1.lockCommand)());
 program.addCommand((0, log_1.logCommand)());
 program.addCommand((0, revert_1.revertCommand)());
 program.addCommand((0, reset_1.resetCommand)());

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;AACA,yCAAoC;AACpC,0CAA8C;AAC9C,0CAA8C;AAC9C,wCAA4C;AAC5C,8CAAkD;AAClD,4CAAgD;AAChD,kDAA0C;AAE1C,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CACV,kEAAkE,CACnE;KACA,OAAO,CAAC,sBAAO,CAAC;KAChB,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CACL,0BAA0B,EAC1B,6EAA6E,CAC9E,CAAC;AAEJ,OAAO,CAAC,UAAU,CAAC,IAAA,kBAAW,GAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,IAAA,kBAAW,GAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,IAAA,gBAAU,GAAE,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,IAAA,sBAAa,GAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,IAAA,oBAAY,GAAE,CAAC,CAAC;AAEnC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;AACA,yCAAoC;AACpC,0CAA8C;AAC9C,0CAA8C;AAC9C,wCAA4C;AAC5C,0CAA8C;AAC9C,8CAAkD;AAClD,4CAAgD;AAChD,kDAA0C;AAE1C,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CACV,kEAAkE,CACnE;KACA,OAAO,CAAC,sBAAO,CAAC;KAChB,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CACL,0BAA0B,EAC1B,6EAA6E,CAC9E,CAAC;AAEJ,OAAO,CAAC,UAAU,CAAC,IAAA,kBAAW,GAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,IAAA,kBAAW,GAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,IAAA,kBAAW,GAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,IAAA,gBAAU,GAAE,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,IAAA,sBAAa,GAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,IAAA,oBAAY,GAAE,CAAC,CAAC;AAEnC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/commands/diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,wBAAgB,WAAW,IAAI,OAAO,CAyErC"}
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,wBAAgB,WAAW,IAAI,OAAO,CAkFrC"}

package/dist/commands/diff.js

@@ -60,6 +60,13 @@ function diffCommand() {
         for (const entry of config.files) {
             try {
                 const result = await (0, sources_1.fetchSource)(entry, workingDir, vars);
+                for (const rec of result.sourceRecords) {
+                    if (!rec.matched) {
+                        console.error(`⚠  SHA mismatch for ${rec.sourceLabel}\n` +
+                            `   expected: ${rec.expectedSha}\n` +
+                            `   got:      ${rec.observedSha}`);
+                    }
+                }
                 for (const [relPath, rawContent] of result.files) {
                     let content = rawContent;
                     if (entry.replace?.length)

package/dist/commands/diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAoC;AACpC,2CAA6B;AAC7B,sCAA8E;AAC9E,wCAAyC;AACzC,mDAAqD;AACrD,6CAA+C;AAC/C,kCAKiB;AAEjB,wCAA4C;AAE5C,SAAgB,WAAW;IACzB,OAAO,IAAI,mBAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CACV,0FAA0F,CAC3F;SACA,QAAQ,CACP,UAAU,EACV,uDAAuD,CACxD;SACA,MAAM,CACL,KAAK,EAAE,MAA0B,EAAE,QAAiB,EAAE,GAAY,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,IAAA,0BAAiB,EAClC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAA4B,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,UAE5B,CAAC;QACd,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAElB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,kBAAkB,CAChB,MAAM,EACN,IAAA,2BAAkB,EAAC,UAAU,CAAC,EAC9B,UAAU,CACX,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAA,mBAAU,EAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAW,EAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;gBAC1D,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjD,IAAI,OAAO,GAAG,UAAU,CAAC;oBACzB,IAAI,KAAK,CAAC,OAAO,EAAE,MAAM;wBACvB,OAAO,GAAG,IAAA,sBAAY,EAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACvD,IAAI,KAAK,CAAC,IAAI;wBAAE,OAAO,GAAG,IAAA,gBAAS,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC/D,MAAM,UAAU,GAAG,IAAA,wBAAiB,EAClC,KAAK,EACL,OAAO,EACP,UAAU,EACV,IAAI,CACL,CAAC;oBACF,QAAQ,CAAC,IAAI,CAAC,IAAA,kBAAW,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CACX,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;gBACF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAA,iBAAU,EAAC,QAAQ,CAAC,CAAC;QAErB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CACF,CAAC;AACN,CAAC;AAzED,kCAyEC;AAED,SAAS,kBAAkB,CACzB,MAAc,EACd,UAAkB,EAClB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,wBAAc,CAChC,IAAA,2BAAkB,EAAC,UAAU,CAAC,EAC9B,UAAU,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnD,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI;YAAE,SAAS;QACzC,KAAK,CAAC,IAAI,CAAC,IAAA,kBAAW,EAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,oFAAoF;IACpF,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QACnD,sEAAsE;QACtE,KAAK,CAAC,IAAI,CAAC,IAAA,wBAAiB,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAA,iBAAU,EAAC,KAAK,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAoC;AACpC,2CAA6B;AAC7B,sCAA8E;AAC9E,wCAAyC;AACzC,mDAAqD;AACrD,6CAA+C;AAC/C,kCAKiB;AAEjB,wCAA4C;AAE5C,SAAgB,WAAW;IACzB,OAAO,IAAI,mBAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CACV,0FAA0F,CAC3F;SACA,QAAQ,CACP,UAAU,EACV,uDAAuD,CACxD;SACA,MAAM,CACL,KAAK,EAAE,MAA0B,EAAE,QAAiB,EAAE,GAAY,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,IAAA,0BAAiB,EAClC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAA4B,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,UAE5B,CAAC;QACd,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAElB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,kBAAkB,CAChB,MAAM,EACN,IAAA,2BAAkB,EAAC,UAAU,CAAC,EAC9B,UAAU,CACX,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAA,mBAAU,EAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAW,EAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;gBAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACvC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;wBACjB,OAAO,CAAC,KAAK,CACX,uBAAuB,GAAG,CAAC,WAAW,IAAI;4BACxC,gBAAgB,GAAG,CAAC,WAAW,IAAI;4BACnC,gBAAgB,GAAG,CAAC,WAAW,EAAE,CACpC,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjD,IAAI,OAAO,GAAG,UAAU,CAAC;oBACzB,IAAI,KAAK,CAAC,OAAO,EAAE,MAAM;wBACvB,OAAO,GAAG,IAAA,sBAAY,EAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACvD,IAAI,KAAK,CAAC,IAAI;wBAAE,OAAO,GAAG,IAAA,gBAAS,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC/D,MAAM,UAAU,GAAG,IAAA,wBAAiB,EAClC,KAAK,EACL,OAAO,EACP,UAAU,EACV,IAAI,CACL,CAAC;oBACF,QAAQ,CAAC,IAAI,CAAC,IAAA,kBAAW,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CACX,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;gBACF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAA,iBAAU,EAAC,QAAQ,CAAC,CAAC;QAErB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CACF,CAAC;AACN,CAAC;AAlFD,kCAkFC;AAED,SAAS,kBAAkB,CACzB,MAAc,EACd,UAAkB,EAClB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,wBAAc,CAChC,IAAA,2BAAkB,EAAC,UAAU,CAAC,EAC9B,UAAU,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnD,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI;YAAE,SAAS;QACzC,KAAK,CAAC,IAAI,CAAC,IAAA,kBAAW,EAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,oFAAoF;IACpF,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QACnD,sEAAsE;QACtE,KAAK,CAAC,IAAI,CAAC,IAAA,wBAAiB,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAA,iBAAU,EAAC,KAAK,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC"}

package/dist/commands/lock.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function lockCommand(): Command;
+//# sourceMappingURL=lock.d.ts.map

package/dist/commands/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/commands/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,WAAW,IAAI,OAAO,CAkFrC"}

package/dist/commands/lock.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockCommand = void 0;
+const commander_1 = require("commander");
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const sources_1 = require("../sources");
+const config_writeback_1 = require("../config-writeback");
+function lockCommand() {
+    return new commander_1.Command('lock')
+        .description('Compute and pin SHA values for all remote sources in the config')
+        .option('--force', 'overwrite existing SHA values')
+        .action(async (options, cmd) => {
+        const opts = options;
+        const configPath = (0, config_1.resolveConfigPath)(cmd.parent?.opts().config);
+        const rawWorkingDir = cmd.parent?.opts().workingDir;
+        const workingDir = rawWorkingDir
+            ? path.resolve(rawWorkingDir)
+            : process.cwd();
+        if ((0, config_1.isRemoteConfigSpec)(configPath)) {
+            console.error('avanti lock requires a local config file.');
+            process.exit(2);
+        }
+        let config;
+        try {
+            config = await (0, config_1.loadConfig)(configPath);
+        }
+        catch (err) {
+            console.error(err.message);
+            process.exit(2);
+        }
+        const vars = config.variables ?? {};
+        const toPin = new Map(); // label → sha
+        let hasError = false;
+        let remoteSourceCount = 0;
+        for (const entry of config.files) {
+            try {
+                const result = await (0, sources_1.fetchSource)(entry, workingDir, vars);
+                remoteSourceCount += result.sourceRecords.length;
+                for (const rec of result.sourceRecords) {
+                    if (!opts.force && rec.expectedSha !== undefined)
+                        continue;
+                    toPin.set(rec.sourceLabel, rec.observedSha);
+                }
+            }
+            catch (err) {
+                console.error(`Error processing ${JSON.stringify(entry.src)}: ${err.message}`);
+                hasError = true;
+            }
+        }
+        if (toPin.size === 0) {
+            if (hasError)
+                process.exit(2);
+            if (remoteSourceCount === 0) {
+                console.log('No SHA-pinnable remote sources found in config.');
+            }
+            else {
+                console.log('All remote sources already have SHA values pinned. Use --force to overwrite.');
+            }
+            process.exit(0);
+        }
+        if (hasError) {
+            console.error('Aborting: one or more sources failed to fetch. No changes written.');
+            process.exit(2);
+        }
+        const pinned = (0, config_writeback_1.writeUpdatedShas)(configPath, toPin);
+        if (pinned) {
+            for (const [label, sha] of toPin) {
+                console.log(`  pinned  ${label}  ${sha.slice(0, 16)}`);
+            }
+            console.log(`\nPinned ${toPin.size} source(s).`);
+        }
+        else {
+            console.log('All SHA values are already up to date.');
+        }
+        process.exit(0);
+    });
+}
+exports.lockCommand = lockCommand;
+//# sourceMappingURL=lock.js.map

package/dist/commands/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/commands/lock.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAoC;AACpC,2CAA6B;AAC7B,sCAA8E;AAC9E,wCAAyC;AACzC,0DAAuD;AAEvD,SAAgB,WAAW;IACzB,OAAO,IAAI,mBAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CACV,iEAAiE,CAClE;SACA,MAAM,CAAC,SAAS,EAAE,+BAA+B,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,GAAY,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,OAA8B,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAA,0BAAiB,EAClC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAA4B,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,UAAgC,CAAC;QAC1E,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAElB,IAAI,IAAA,2BAAkB,EAAC,UAAU,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAA,mBAAU,EAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,cAAc;QACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAW,EAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;gBAC1D,iBAAiB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACvC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;wBAAE,SAAS;oBAC3D,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CACX,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;gBACF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,8EAA8E,CAC/E,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,oEAAoE,CACrE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,mCAAgB,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAEnD,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAlFD,kCAkFC"}

package/dist/commands/log.js

@@ -62,6 +62,18 @@ function showPullHistory(history) {
         for (const ref of pull.files) {
             const label = ref.wasNew ? '(new file)' : '(modified)';
             console.log(`  ${ref.absolutePath}  → v${ref.version}  ${label}`);
+            if (ref.sources && ref.sources.length > 0) {
+                for (const s of ref.sources) {
+                    const shaShort = s.observedSha.slice(0, 16);
+                    if (s.accepted && s.expectedSha) {
+                        const prevShort = s.expectedSha.slice(0, 16);
+                        console.log(`    ${s.label}  sha:${shaShort}  ⚠ accepted (was: ${prevShort})`);
+                    }
+                    else {
+                        console.log(`    ${s.label}  sha:${shaShort}`);
+                    }
+                }
+            }
         }
         console.log('');
     }
@@ -76,6 +88,8 @@ function showFileHistory(history, filePath, workingDir) {
         return;
     }
     console.log(`${absolutePath}\n`);
+    const pulls = history.listPulls();
+    const pullsById = new Map(pulls.map((p) => [p.pullId, p]));
     const versions = [...fileHistory.versions].reverse();
     for (const v of versions) {
         const vLabel = `v${v.version}`;
@@ -89,6 +103,22 @@ function showFileHistory(history, filePath, workingDir) {
         if (v.isOriginal)
             suffix = '  (original, before avanti)';
         console.log(`  ${vLabel.padEnd(4)}  ${ts}  ${pullRef}${suffix}`);
+        if (v.pullId) {
+            const pullEntry = pullsById.get(v.pullId);
+            const fileRef = pullEntry?.files.find((f) => f.absolutePath === absolutePath && f.version === v.version);
+            if (fileRef?.sources && fileRef.sources.length > 0) {
+                for (const s of fileRef.sources) {
+                    const shaShort = s.observedSha.slice(0, 16);
+                    if (s.accepted && s.expectedSha) {
+                        const prevShort = s.expectedSha.slice(0, 16);
+                        console.log(`         ${s.label}  sha:${shaShort}  ⚠ accepted (was: ${prevShort})`);
+                    }
+                    else {
+                        console.log(`         ${s.label}  sha:${shaShort}`);
+                    }
+                }
+            }
+        }
     }
 }
 function formatTimestamp(iso) {

package/dist/commands/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAoC;AACpC,2CAA6B;AAC7B,sCAAkE;AAClE,wCAA4C;AAE5C,SAAgB,UAAU;IACxB,OAAO,IAAI,mBAAO,CAAC,KAAK,CAAC;SACtB,WAAW,CAAC,2CAA2C,CAAC;SACxD,QAAQ,CAAC,QAAQ,EAAE,0CAA0C,CAAC;SAC9D,MAAM,CAAC,CAAC,IAAwB,EAAE,QAAiB,EAAE,GAAY,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,IAAA,0BAAiB,EAClC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAA4B,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,UAAgC,CAAC;QAC1E,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,OAAO,GAAG,IAAI,wBAAc,CAChC,IAAA,2BAAkB,EAAC,UAAU,CAAC,EAC9B,UAAU,CACX,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAxBD,gCAwBC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,KAAK,EAAE,KAAK,UAAU,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,YAAY,QAAQ,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAAuB,EACvB,QAAgB,EAChB,UAAkB;IAElB,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEvC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,kBAAkB,YAAY,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ;YACnB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,CAAC,CAAC,4BAA4B,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACxE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,cAAc;YAAE,MAAM,GAAG,aAAa,CAAC;QACrE,IAAI,CAAC,CAAC,UAAU;YAAE,MAAM,GAAG,6BAA6B,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;IACxE,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG;QAClE,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAoC;AACpC,2CAA6B;AAC7B,sCAAkE;AAClE,wCAA0D;AAE1D,SAAgB,UAAU;IACxB,OAAO,IAAI,mBAAO,CAAC,KAAK,CAAC;SACtB,WAAW,CAAC,2CAA2C,CAAC;SACxD,QAAQ,CAAC,QAAQ,EAAE,0CAA0C,CAAC;SAC9D,MAAM,CAAC,CAAC,IAAwB,EAAE,QAAiB,EAAE,GAAY,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,IAAA,0BAAiB,EAClC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAA4B,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,UAAgC,CAAC;QAC1E,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,OAAO,GAAG,IAAI,wBAAc,CAChC,IAAA,2BAAkB,EAAC,UAAU,CAAC,EAC9B,UAAU,CACX,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAxBD,gCAwBC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,KAAK,EAAE,KAAK,UAAU,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,YAAY,QAAQ,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;YAClE,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5C,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;wBAChC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC7C,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,KAAK,SAAS,QAAQ,sBAAsB,SAAS,GAAG,CAClE,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,QAAQ,EAAE,CAAC,CAAC;oBACjD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAAuB,EACvB,QAAgB,EAChB,UAAkB;IAElB,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEvC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,kBAAkB,YAAY,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAChC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ;YACnB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,CAAC,CAAC,4BAA4B,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACxE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,cAAc;YAAE,MAAM,GAAG,aAAa,CAAC;QACrE,IAAI,CAAC,CAAC,UAAU;YAAE,MAAM,GAAG,6BAA6B,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;QAEjE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,SAAS,EAAE,KAAK,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAClE,CAAC;YACF,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5C,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;wBAChC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC7C,OAAO,CAAC,GAAG,CACT,YAAY,CAAC,CAAC,KAAK,SAAS,QAAQ,sBAAsB,SAAS,GAAG,CACvE,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS,QAAQ,EAAE,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;IACxE,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG;QAClE,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3E,CAAC;AACJ,CAAC"}

package/dist/commands/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8DpC,wBAAgB,WAAW,IAAI,OAAO,CAoKrC"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmGpC,wBAAgB,WAAW,IAAI,OAAO,CAoSrC"}

package/dist/commands/pull.js

@@ -34,14 +34,28 @@ const diff_1 = require("../diff");
 const writer_1 = require("../writer");
 const history_1 = require("../history");
 const prompt_1 = require("../prompt");
+const config_writeback_1 = require("../config-writeback");
 async function runFetchLoop(config, workingDir) {
     const vars = config.variables ?? {};
     const writeTargets = [];
     const allDiffs = [];
+    const shaErrors = [];
+    const seenShaErrorLabels = new Set();
+    const sourceRecordsByTarget = new Map();
     let hasError = false;
     for (const entry of config.files) {
         try {
             const result = await (0, sources_1.fetchSource)(entry, workingDir, vars);
+            for (const rec of result.sourceRecords) {
+                if (!rec.matched && !seenShaErrorLabels.has(rec.sourceLabel)) {
+                    seenShaErrorLabels.add(rec.sourceLabel);
+                    shaErrors.push({
+                        sourceLabel: rec.sourceLabel,
+                        expectedSha: rec.expectedSha,
+                        observedSha: rec.observedSha,
+                    });
+                }
+            }
             for (const [relPath, rawContent] of result.files) {
                 let content = rawContent;
                 if (entry.replace?.length)
@@ -51,6 +65,9 @@ async function runFetchLoop(config, workingDir) {
                 const targetPath = (0, diff_1.resolveTargetPath)(entry, relPath, workingDir, vars);
                 allDiffs.push((0, diff_1.computeDiff)(targetPath, content));
                 writeTargets.push({ targetPath, content, mode: entry.mode });
+                if (result.sourceRecords.length > 0) {
+                    sourceRecordsByTarget.set(targetPath, result.sourceRecords);
+                }
             }
         }
         catch (err) {
@@ -58,13 +75,22 @@ async function runFetchLoop(config, workingDir) {
             hasError = true;
         }
     }
-    return { writeTargets, allDiffs, hasError };
+    return { writeTargets, allDiffs, hasError, shaErrors, sourceRecordsByTarget };
+}
+function printShaErrors(errors) {
+    for (const e of errors) {
+        console.error(`SHA mismatch for ${e.sourceLabel}\n` +
+            `  expected: ${e.expectedSha}\n` +
+            `  got:      ${e.observedSha}`);
+    }
 }
 function pullCommand() {
     return new commander_1.Command('pull')
         .description('Pull remote sources and write to local files')
         .option('-y, --yes', 'skip confirmation prompt')
+        .option('--accept-changes', 'accept SHA mismatches, update SHA values in config, and apply changes')
         .action(async (options, cmd) => {
+        const opts = options;
         const configPath = (0, config_1.resolveConfigPath)(cmd.parent?.opts().config);
         const rawWorkingDir = cmd.parent?.opts().workingDir;
         const workingDir = rawWorkingDir
@@ -82,11 +108,17 @@ function pullCommand() {
         const historyAvailable = history.ensureStorageDir();
         const pullId = historyAvailable ? history.openPullSession() : null;
         const firstPass = await runFetchLoop(config, workingDir);
-        let { writeTargets, allDiffs } = firstPass;
+        let { writeTargets, allDiffs, sourceRecordsByTarget } = firstPass;
         if (firstPass.hasError) {
             console.error('Aborting due to errors.');
             process.exit(2);
         }
+        // SHA validation — abort unless --accept-changes
+        if (firstPass.shaErrors.length > 0 && !opts.acceptChanges) {
+            printShaErrors(firstPass.shaErrors);
+            console.error('\nRun `avanti pull --accept-changes` to review the diff and update SHA values.');
+            process.exit(2);
+        }
         // Detect self-config update: only applies to local config files
         if (!(0, config_1.isRemoteConfigSpec)(configPath)) {
             const configIdx = writeTargets.findIndex((t) => t.targetPath === configPath);
@@ -100,16 +132,28 @@ function pullCommand() {
                         console.error('Aborting due to errors in re-evaluated config.');
                         process.exit(2);
                     }
-                    // Ensure the config file write is present in the final targets.
-                    // The new config may or may not reference itself; either way we
-                    // must write the updated config that was fetched in the first pass.
+                    if (second.shaErrors.length > 0 && !opts.acceptChanges) {
+                        printShaErrors(second.shaErrors);
+                        console.error('\nRun `avanti pull --accept-changes` to review the diff and update SHA values.');
+                        process.exit(2);
+                    }
                     const configInSecond = second.writeTargets.findIndex((t) => t.targetPath === configPath);
                     if (configInSecond === -1) {
                         second.writeTargets.push(writeTargets[configIdx]);
                         second.allDiffs.push(allDiffs[configIdx]);
+                        const firstPassRecords = sourceRecordsByTarget.get(configPath);
+                        if (firstPassRecords) {
+                            second.sourceRecordsByTarget.set(configPath, firstPassRecords);
+                        }
                     }
                     writeTargets = second.writeTargets;
                     allDiffs = second.allDiffs;
+                    sourceRecordsByTarget = second.sourceRecordsByTarget;
+                    const existingLabels = new Set(firstPass.shaErrors.map((e) => e.sourceLabel));
+                    for (const e of second.shaErrors) {
+                        if (!existingLabels.has(e.sourceLabel))
+                            firstPass.shaErrors.push(e);
+                    }
                 }
                 catch (err) {
                     console.warn(`Warning: updated config is invalid, skipping re-evaluation: ${err.message}`);
@@ -148,26 +192,81 @@ function pullCommand() {
         const hasChanges = allDiffs.some((d) => d.hasChanges) ||
             staleDiffs.some((d) => d.hasChanges);
         (0, diff_1.printDiffs)([...allDiffs, ...staleDiffs]);
-        if (!hasChanges) {
+        // Show SHA mismatch summary when using --accept-changes
+        if (opts.acceptChanges && firstPass.shaErrors.length > 0) {
+            console.error('');
+            printShaErrors(firstPass.shaErrors);
+        }
+        if (!hasChanges && firstPass.shaErrors.length === 0) {
             console.log('Nothing to do.');
             process.exit(0);
         }
-        const yes = options.yes ?? false;
+        const yes = opts.yes ?? false;
         if (!yes) {
-            const ok = await (0, prompt_1.confirm)('Apply changes? [y/N] ');
+            const promptMsg = opts.acceptChanges && firstPass.shaErrors.length > 0
+                ? 'Accept new SHA values and apply changes? [y/N] '
+                : 'Apply changes? [y/N] ';
+            const ok = await (0, prompt_1.confirm)(promptMsg);
             if (!ok) {
                 console.log('Aborted.');
                 process.exit(0);
             }
         }
+        // Warn when --accept-changes is used with a remote config: SHA values
+        // cannot be written back, so the mismatch will recur on the next pull.
+        if (opts.acceptChanges &&
+            firstPass.shaErrors.length > 0 &&
+            (0, config_1.isRemoteConfigSpec)(configPath)) {
+            console.warn('Warning: config is remote; SHA values cannot be written back. ' +
+                'Mismatches accepted for this session only.');
+        }
+        // Pre-apply SHA updates to the config write target in-memory so that both
+        // history and the on-disk file reflect the final pinned state in one pass.
+        const shaUpdates = opts.acceptChanges &&
+            firstPass.shaErrors.length > 0 &&
+            !(0, config_1.isRemoteConfigSpec)(configPath)
+            ? new Map(firstPass.shaErrors.map((e) => [e.sourceLabel, e.observedSha]))
+            : null;
+        let configShaPreApplied = false;
+        if (shaUpdates !== null) {
+            const configTargetIdx = writeTargets.findIndex((t) => t.targetPath === configPath);
+            if (configTargetIdx !== -1) {
+                const patched = (0, config_writeback_1.applyUpdatedShas)(writeTargets[configTargetIdx].content, shaUpdates);
+                if (patched !== null) {
+                    writeTargets[configTargetIdx] = {
+                        ...writeTargets[configTargetIdx],
+                        content: patched,
+                    };
+                    // Recompute diff so staging and atomicWrite both see SHA-patched content,
+                    // even when the original content diff was empty.
+                    allDiffs[configTargetIdx] = (0, diff_1.computeDiff)(writeTargets[configTargetIdx].targetPath, patched);
+                    configShaPreApplied = true;
+                }
+            }
+        }
         // Stage history versions before atomicWrite so v0 is captured before overwrite
         const stagedFileRefs = [];
         if (pullId) {
+            const acceptedShaLabels = new Set(firstPass.shaErrors.map((e) => e.sourceLabel));
             for (let i = 0; i < writeTargets.length; i++) {
-                if (!allDiffs[i].hasChanges)
+                const targetPath = writeTargets[i].targetPath;
+                const records = sourceRecordsByTarget.get(targetPath);
+                const hasAcceptedSha = opts.acceptChanges &&
+                    records?.some((r) => !r.matched && acceptedShaLabels.has(r.sourceLabel));
+                if (!allDiffs[i].hasChanges && !hasAcceptedSha)
                     continue;
                 try {
-                    const { fileRef } = history.stageFileVersion(pullId, writeTargets[i].targetPath, writeTargets[i].content, allDiffs[i].isNew);
+                    const sourceShaRecords = records !== undefined
+                        ? records.map((r) => ({
+                            label: r.sourceLabel,
+                            observedSha: r.observedSha,
+                            expectedSha: r.expectedSha,
+                            accepted: !r.matched &&
+                                (opts.acceptChanges ?? false) &&
+                                acceptedShaLabels.has(r.sourceLabel),
+                        }))
+                        : undefined;
+                    const { fileRef } = history.stageFileVersion(pullId, targetPath, writeTargets[i].content, allDiffs[i].isNew, sourceShaRecords);
                     stagedFileRefs.push(fileRef);
                 }
                 catch {
@@ -176,17 +275,29 @@ function pullCommand() {
             }
         }
         try {
-            (0, writer_1.atomicWrite)([...writeTargets, ...staleToRestore], staleToDelete);
-            const written = writeTargets.filter((_, i) => allDiffs[i].hasChanges).length +
-                staleToRestore.length +
-                staleToDelete.length;
+            const changedTargets = writeTargets.filter((_, i) => allDiffs[i].hasChanges);
+            (0, writer_1.atomicWrite)([...changedTargets, ...staleToRestore], staleToDelete);
+            const written = changedTargets.length + staleToRestore.length + staleToDelete.length;
             console.log(`Wrote ${written} file(s).`);
         }
         catch (err) {
             console.error(`Write failed: ${err.message}`);
             process.exit(2);
         }
-        // Only record to pulls.jsonl if at least one file was actually written
+        // SHA writeback: write updated sha values into config file after all writes complete.
+        // Skipped when config was a write target and already patched in-memory above.
+        if (shaUpdates !== null && !configShaPreApplied) {
+            try {
+                const pinned = (0, config_writeback_1.writeUpdatedShas)(configPath, shaUpdates);
+                if (pinned)
+                    console.log(`Updated ${shaUpdates.size} SHA pin(s) in config.`);
+            }
+            catch (err) {
+                console.warn(`Warning: could not update SHA values in config: ${err.message}`);
+            }
+        }
+        // Only record to pulls.jsonl if at least one file was staged (written or
+        // SHA-accepted via --accept-changes with no content diff)
         if (pullId && stagedFileRefs.length > 0) {
             try {
                 history.closePullSession(pullId, (0, config_1.normalizeConfigKey)(configPath), stagedFileRefs);