cortex-sync 0.4.12 → 0.4.16

package/dist/cli.js

@@ -321,7 +321,8 @@ var GitHubBackend = class {
   apiBase;
   headers;
   url(path) {
-    return `${this.apiBase}/contents/${path}`;
+    const encoded = path.split("/").map(encodeURIComponent).join("/");
+    return `${this.apiBase}/contents/${encoded}`;
   }
   async getSha(path) {
     const res = await fetch(this.url(path), { headers: this.headers });
@@ -927,6 +928,7 @@ async function pullCommand(opts = {}) {
     if (mappingsDirty) await saveMappings(mappings);
   }
   async function* gen() {
+    let downloaded = 0;
     for (const path of toPull) {
       const blob = await backend.read("files/" + path);
       const content = decrypt(blob, derived);
@@ -950,11 +952,16 @@ async function pullCommand(opts = {}) {
         if (newEncodedDir !== oldEncodedDir) {
           relativePath = `projects/${newEncodedDir}/${m[3]}`;
         }
+        downloaded++;
+        process.stdout.write(`\r  Downloading\u2026 ${downloaded}/${toPull.length} files`);
         yield { relativePath, content: remappedContent };
       } else {
+        downloaded++;
+        process.stdout.write(`\r  Downloading\u2026 ${downloaded}/${toPull.length} files`);
         yield { relativePath: path, content };
       }
     }
+    if (toPull.length > 0) process.stdout.write("\n");
   }
   await adapter.putFiles(gen());
   await saveManifest(MANIFEST_PATH, remote);
@@ -1064,6 +1071,11 @@ function identifyProject(dir) {
 }
 
 // src/commands/sync.ts
+function isSafeGitHubPath(path) {
+  return path.split("/").every(
+    (c) => c.length > 0 && c !== "." && c !== ".." && c !== ".git" && !/[\x00-\x1f\x7f]/.test(c)
+  );
+}
 async function syncCommand(opts = {}) {
   const config = await loadConfig();
   const passphrase = await readPassphrase();
@@ -1072,7 +1084,7 @@ async function syncCommand(opts = {}) {
   const backend = resolveBackend(config, { target: opts.target });
   console.log(`Sync target: ${backend.name}${opts.target ? ` (${opts.target})` : ""}
 `);
-  console.log("Reading local files\u2026");
+  process.stdout.write("Reading local files\u2026");
   const local = emptyManifest("claude-code");
   const contents = /* @__PURE__ */ new Map();
   for await (const f of adapter.getFiles()) {
@@ -1082,8 +1094,10 @@ async function syncCommand(opts = {}) {
       size: f.content.length,
       encryptedSize: 0
     };
+    process.stdout.write(`\r  Reading\u2026 ${contents.size} files`);
   }
-  console.log(`  ${contents.size} files`);
+  process.stdout.write(`\r  ${contents.size} files read${" ".repeat(20)}
+`);
   local.projects = {};
   const seenDirs = /* @__PURE__ */ new Set();
   for (const [path, content] of contents) {
@@ -1122,11 +1136,29 @@ async function syncCommand(opts = {}) {
   console.log(
     `Diff \u2014 added: ${diff.added.length}, modified: ${diff.modified.length}, removed: ${diff.removed.length}, unchanged: ${diff.unchanged.length}`
   );
-  for (const path of [...diff.added, ...diff.modified]) {
+  const toUpload = [...diff.added, ...diff.modified];
+  let uploaded = 0;
+  let skipped = 0;
+  for (const path of toUpload) {
+    if (!isSafeGitHubPath(path)) {
+      skipped++;
+      continue;
+    }
     const content = contents.get(path);
     const enc = encrypt(content, derived);
     local.files[path].encryptedSize = enc.length;
-    await backend.write("files/" + path, enc);
+    try {
+      await backend.write("files/" + path, enc);
+    } catch (e) {
+      process.stdout.write("\n");
+      throw new Error(`Upload failed for "${path}": ${e.message}`);
+    }
+    uploaded++;
+    process.stdout.write(`\r  Uploading\u2026 ${uploaded}/${toUpload.length - skipped} files`);
+  }
+  if (toUpload.length > 0) process.stdout.write("\n");
+  if (skipped > 0) {
+    console.warn(`  \u26A0 Skipped ${skipped} file(s) with paths incompatible with GitHub (control chars, .git, etc.)`);
   }
   for (const path of diff.removed) {
     await backend.remove("files/" + path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortex-sync",
-  "version": "0.4.12",
+  "version": "0.4.16",
   "description": "Sync Claude Code sessions between machines with automatic path remapping and skill conversion",
   "license": "AGPL-3.0",
   "type": "module",