freestyle-sync 0.1.2 → 0.1.4

package/dist/main.js

@@ -0,0 +1,1319 @@
+#!/usr/bin/env node
+import "dotenv/config";
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { cp, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import path from "node:path";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { freestyle } from "freestyle";
+import { collectEnvironment, discoverContextCandidates, hardenRemoteSecrets, isProtectedRemotePath, shouldSkipContextDirectory } from "./plugins/auth-context.js";
+import { npmNativeDepsPlugin } from "./plugins/npm-native-deps.js";
+const execFileAsync = promisify(execFile);
+const CACHE_VERSION = 1;
+const SENSITIVE_PREFERENCES_VERSION = 2;
+const ARCHIVE_CHUNK_CHARS = 1024 * 1024;
+class Progress {
+    current = 0;
+    total;
+    constructor(total) {
+        this.total = total;
+    }
+    step(message) {
+        this.current += 1;
+        console.log(`[${this.current}/${this.total}] ${message}`);
+    }
+}
+main().catch((error) => {
+    console.error(`vmpush: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+});
+async function main() {
+    const options = await parseArgs(process.argv.slice(2));
+    const progress = new Progress(options.dryRun ? 2 : options.install ? 12 : 11);
+    if (options.dryRun) {
+        console.log("vmpush dry run");
+    }
+    progress.step("Scanning project files");
+    const cache = await readCache(options.cachePath, options);
+    const projectEntries = await scanProject(options.projectRoot, options.includeGitDir);
+    const projectCurrent = digestMap(projectEntries);
+    const projectChanges = diffEntries(projectEntries, cache.projectFiles);
+    progress.step("Detecting auth and agent context");
+    let envExports = options.includeAuth ? collectEnvironment(options.envKeys) : {};
+    let contextCandidates = await discoverContextCandidates(options);
+    if (!options.dryRun) {
+        const selection = await selectSensitiveSync(options, contextCandidates, envExports);
+        contextCandidates = selection.contextCandidates;
+        envExports = selection.envExports;
+    }
+    const envHash = hashString(renderEnvFile(envExports));
+    const contextEntries = await scanContextCandidates(contextCandidates);
+    const contextCurrent = digestMapByRemotePath(contextEntries);
+    const contextChanges = diffContextEntries(contextEntries, cache.contextFiles);
+    printPlan(options, projectChanges, contextChanges, envExports, cache);
+    if (options.dryRun) {
+        return;
+    }
+    progress.step("Preparing Freestyle VM");
+    const { vm, vmId } = await getOrCreateVm(options, cache.snapshotId);
+    console.log(`Uploading to VM: ${vmId}`);
+    progress.step(`Uploading project changes to ${vmId}`);
+    await ensureRemoteBase(vm, options.remoteProjectDir);
+    const projectResult = await syncProject(vm, vmId, options, projectChanges);
+    progress.step(`Running remote fixups on ${vmId}`);
+    await runRemoteFixups(vm, options);
+    progress.step(`Uploading auth/context changes to ${vmId}`);
+    const contextResult = await syncContext(vm, vmId, contextChanges);
+    progress.step(`Installing environment files on ${vmId}`);
+    await installEnvironment(vm, envExports, envHash, cache.envHash);
+    progress.step(`Writing resume metadata on ${vmId}`);
+    await writeRemoteResumeFiles(vm, options, vmId, envExports);
+    await hardenRemoteRoot(vm);
+    if (options.install) {
+        progress.step(`Running install command on ${vmId}`);
+        await runInstall(vm, options.projectRoot, options.remoteProjectDir);
+    }
+    let snapshotId = cache.snapshotId;
+    if (options.snapshot) {
+        progress.step(`Creating snapshot cache for ${vmId}`);
+        await warmVsCodeServerCache(vm).catch((error) => {
+            console.warn(`VS Code Server cache warm-up skipped: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        try {
+            const snapshot = await vm.snapshot({ name: `vmpush-${path.basename(options.projectRoot)}-${Date.now()}` });
+            snapshotId = snapshot.snapshotId;
+        }
+        catch (error) {
+            console.warn(`Snapshot cache skipped: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    else {
+        progress.step("Skipping snapshot cache");
+    }
+    progress.step("Saving local sync cache");
+    await writeCache(options.cachePath, {
+        version: CACHE_VERSION,
+        projectRoot: options.projectRoot,
+        remoteProjectDir: options.remoteProjectDir,
+        vmId,
+        snapshotId,
+        projectFiles: projectCurrent,
+        contextFiles: contextCurrent,
+        envHash,
+        updatedAt: new Date().toISOString(),
+    });
+    progress.step(`Syncing local VS Code Copilot state for ${vmId}`);
+    const localCopilotResult = await syncLocalCopilotForRemoteWorkspaces(vm, options, vmId, contextCandidates);
+    console.log("");
+    console.log(`VM ready: ${vmId}`);
+    console.log(`Project: ${options.remoteProjectDir}`);
+    console.log(`Project files: ${projectResult.uploaded} uploaded, ${projectResult.removed} removed, ${projectResult.unchanged} unchanged`);
+    console.log(`Context files: ${contextResult.uploaded} uploaded, ${contextResult.unchanged} unchanged`);
+    if (snapshotId) {
+        console.log(`Snapshot cache: ${snapshotId}`);
+    }
+    if (localCopilotResult.status === "copied") {
+        console.log(`Copilot sidebar state: copied to ${localCopilotResult.count} VS Code Remote workspace${localCopilotResult.count === 1 ? "" : "s"}`);
+    }
+    else if (localCopilotResult.status === "pending") {
+        console.log(`Copilot sidebar state: ${localCopilotResult.reason}`);
+    }
+    console.log(`SSH: npx freestyle vm ssh ${vmId}`);
+    if (options.autoSsh) {
+        await connectToVm(vm, vmId, options, contextCandidates);
+    }
+}
+async function parseArgs(args) {
+    const options = {
+        projectRoot: process.cwd(),
+        cachePath: "",
+        remoteProjectDir: "",
+        name: "",
+        yes: false,
+        dryRun: false,
+        includeAuth: true,
+        includeAgentContext: true,
+        includeGitDir: true,
+        includeAllCopilotWorkspaces: false,
+        resetContextPrefs: false,
+        snapshot: true,
+        install: false,
+        autoSsh: true,
+        envKeys: [],
+    };
+    const positional = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--help" || arg === "-h") {
+            printHelp();
+            process.exit(0);
+        }
+        else if (arg === "--yes" || arg === "-y") {
+            options.yes = true;
+        }
+        else if (arg === "--dry-run") {
+            options.dryRun = true;
+        }
+        else if (arg === "--no-auth") {
+            options.includeAuth = false;
+        }
+        else if (arg === "--no-agent-context") {
+            options.includeAgentContext = false;
+        }
+        else if (arg === "--no-git-dir") {
+            options.includeGitDir = false;
+        }
+        else if (arg === "--all-copilot-workspaces") {
+            options.includeAllCopilotWorkspaces = true;
+        }
+        else if (arg === "--reset-context-prefs") {
+            options.resetContextPrefs = true;
+        }
+        else if (arg === "--no-snapshot" || arg === "--skip-snapshot") {
+            options.snapshot = false;
+        }
+        else if (arg === "--install") {
+            options.install = true;
+        }
+        else if (arg === "--no-ssh") {
+            options.autoSsh = false;
+        }
+        else if (arg === "--vm-id") {
+            options.vmId = readOptionValue(args, ++index, arg);
+        }
+        else if (arg === "--name") {
+            options.name = readOptionValue(args, ++index, arg);
+        }
+        else if (arg === "--remote-dir") {
+            options.remoteProjectDir = normalizeRemotePath(readOptionValue(args, ++index, arg));
+        }
+        else if (arg === "--cache") {
+            options.cachePath = path.resolve(readOptionValue(args, ++index, arg));
+        }
+        else if (arg === "--idle-timeout") {
+            options.idleTimeoutSeconds = Number(readOptionValue(args, ++index, arg));
+            if (!Number.isInteger(options.idleTimeoutSeconds) || options.idleTimeoutSeconds < 1) {
+                throw new Error("--idle-timeout must be a positive integer");
+            }
+        }
+        else if (arg === "--include-env") {
+            options.envKeys.push(readOptionValue(args, ++index, arg));
+        }
+        else if (arg.startsWith("--")) {
+            throw new Error(`unknown option: ${arg}`);
+        }
+        else {
+            positional.push(arg);
+        }
+    }
+    if (positional.length > 1) {
+        throw new Error("expected at most one project path");
+    }
+    options.projectRoot = path.resolve(positional[0] ?? options.projectRoot);
+    const projectStats = await stat(options.projectRoot).catch(() => null);
+    if (!projectStats?.isDirectory()) {
+        throw new Error(`project path is not a directory: ${options.projectRoot}`);
+    }
+    const projectName = sanitizeName(path.basename(options.projectRoot));
+    options.name ||= `vmpush-${projectName}`;
+    options.remoteProjectDir ||= defaultRemoteProjectDir(options.projectRoot);
+    options.cachePath ||= path.join(options.projectRoot, ".vmpush", "cache.json");
+    return options;
+}
+function printHelp() {
+    console.log(`vmpush uploads the current project into a Freestyle VM.
+
+Usage:
+	vmpush [project-dir] [options]
+
+Options:
+	--vm-id <id>             Sync into an existing Freestyle VM.
+	--name <name>            Name for a newly created VM. Defaults to vmpush-<project>.
+    --remote-dir <path>      Remote project directory. Defaults to the local absolute path.
+	--cache <path>           Snapshot/hash cache path. Defaults to .vmpush/cache.json.
+	--include-env <name>     Always copy an environment variable. Repeatable.
+	--install                Run detected dependency install command after sync.
+    --no-ssh                 Do not automatically open VS Code/Cursor or SSH after sync.
+	--idle-timeout <seconds> Set VM idle timeout when creating/starting.
+	--no-auth                Do not copy auth files or token-like environment variables.
+	--no-agent-context       Do not copy Copilot, Claude, or Codex conversation state.
+	--no-git-dir             Exclude the local .git directory from project sync.
+    --all-copilot-workspaces Include Copilot chat state for every VS Code workspace.
+    --reset-context-prefs    Re-prompt for saved auth/conversation preferences.
+    --no-snapshot, --skip-snapshot
+                             Do not snapshot the VM after sync.
+	--dry-run                Show what would sync without creating or changing a VM.
+	-y, --yes                Approve copying discovered sensitive auth/context files.
+	-h, --help               Show this help.
+`);
+}
+function readOptionValue(args, index, option) {
+    const value = args[index];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`${option} requires a value`);
+    }
+    return value;
+}
+async function readCache(cachePath, options) {
+    try {
+        const parsed = JSON.parse(await readFile(cachePath, "utf8"));
+        if (parsed.version === CACHE_VERSION && parsed.projectRoot === options.projectRoot && parsed.remoteProjectDir === options.remoteProjectDir) {
+            return {
+                ...parsed,
+                projectFiles: parsed.projectFiles ?? {},
+                contextFiles: parsed.contextFiles ?? {},
+            };
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            console.warn(`Ignoring unreadable cache ${cachePath}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return {
+        version: CACHE_VERSION,
+        projectRoot: options.projectRoot,
+        remoteProjectDir: options.remoteProjectDir,
+        projectFiles: {},
+        contextFiles: {},
+    };
+}
+async function writeCache(cachePath, cache) {
+    await mkdir(path.dirname(cachePath), { recursive: true });
+    await writeFile(cachePath, `${JSON.stringify(cache, null, 2)}\n`, "utf8");
+}
+async function scanProject(projectRoot, includeGitDir) {
+    const entries = [];
+    await walk(projectRoot, "", entries, {
+        skipDirectory(relativePath, name) {
+            if (!includeGitDir && relativePath === ".git")
+                return true;
+            return false;
+        },
+    });
+    return entries.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+async function walk(root, relativePath, entries, options) {
+    const absolutePath = path.join(root, relativePath);
+    const dir = await import("node:fs/promises").then((fs) => fs.readdir(absolutePath, { withFileTypes: true }));
+    for (const dirent of dir) {
+        const childRelativePath = relativePath ? path.join(relativePath, dirent.name) : dirent.name;
+        const normalizedRelativePath = toPosix(childRelativePath);
+        const childAbsolutePath = path.join(root, childRelativePath);
+        if (dirent.isDirectory()) {
+            if (options.skipDirectory(normalizedRelativePath, dirent.name)) {
+                continue;
+            }
+            await walk(root, childRelativePath, entries, options);
+            continue;
+        }
+        if (dirent.isFile() || dirent.isSymbolicLink()) {
+            entries.push(await digestEntry(childAbsolutePath, normalizedRelativePath));
+        }
+    }
+}
+async function digestEntry(absolutePath, relativePath) {
+    const stats = await import("node:fs/promises").then((fs) => fs.lstat(absolutePath));
+    if (stats.isSymbolicLink()) {
+        const target = await import("node:fs/promises").then((fs) => fs.readlink(absolutePath));
+        return {
+            absolutePath,
+            relativePath,
+            kind: "symlink",
+            mode: stats.mode,
+            size: target.length,
+            hash: hashString(`symlink:${target}`),
+        };
+    }
+    return {
+        absolutePath,
+        relativePath,
+        kind: "file",
+        mode: stats.mode,
+        size: stats.size,
+        hash: await hashFile(absolutePath),
+    };
+}
+function digestMap(entries) {
+    return Object.fromEntries(entries.map((entry) => [entry.relativePath, stripLocal(entry)]));
+}
+function digestMapByRemotePath(entries) {
+    return Object.fromEntries(entries.map((entry) => [entry.remotePath, stripLocal(entry)]));
+}
+function stripLocal(entry) {
+    return {
+        hash: entry.hash,
+        kind: entry.kind,
+        mode: entry.mode,
+        size: entry.size,
+    };
+}
+function diffEntries(entries, previous) {
+    const changed = entries.filter((entry) => previous[entry.relativePath]?.hash !== entry.hash);
+    const currentKeys = new Set(entries.map((entry) => entry.relativePath));
+    const removed = Object.keys(previous).filter((relativePath) => !currentKeys.has(relativePath));
+    return { changed, removed, unchanged: entries.length - changed.length };
+}
+function diffContextEntries(entries, previous) {
+    const changed = entries.filter((entry) => previous[entry.remotePath]?.hash !== entry.hash);
+    const currentKeys = new Set(entries.map((entry) => entry.remotePath));
+    const removed = Object.keys(previous).filter((remotePath) => !currentKeys.has(remotePath) && !isProtectedRemotePath(remotePath));
+    return { changed, removed, unchanged: entries.length - changed.length };
+}
+async function scanContextCandidates(candidates) {
+    const entries = [];
+    for (const candidate of candidates) {
+        const stats = await import("node:fs/promises").then((fs) => fs.lstat(candidate.source));
+        if (stats.isFile()) {
+            const local = await digestEntry(candidate.source, path.basename(candidate.source));
+            entries.push({
+                ...local,
+                remotePath: candidate.remoteRoot,
+                label: candidate.label,
+                sensitive: candidate.sensitive,
+            });
+        }
+        else if (stats.isDirectory()) {
+            const candidateEntries = [];
+            await walk(candidate.source, "", candidateEntries, {
+                skipDirectory(relativePath, name) {
+                    return shouldSkipContextDirectory(relativePath, name);
+                },
+            });
+            for (const local of candidateEntries) {
+                if (local.kind === "symlink")
+                    continue;
+                const remotePath = `${candidate.remoteRoot}/${local.relativePath}`;
+                if (isProtectedRemotePath(remotePath))
+                    continue;
+                entries.push({
+                    ...local,
+                    remotePath,
+                    label: candidate.label,
+                    sensitive: candidate.sensitive,
+                });
+            }
+        }
+    }
+    return entries.sort((left, right) => left.remotePath.localeCompare(right.remotePath));
+}
+async function selectSensitiveSync(options, candidates, envExports) {
+    if (options.yes || (!options.includeAuth && !options.includeAgentContext)) {
+        return { contextCandidates: candidates, envExports };
+    }
+    const sensitiveCandidates = candidates.filter((candidate) => candidate.sensitive);
+    const envKeys = Object.keys(envExports).sort();
+    if (sensitiveCandidates.length === 0 && envKeys.length === 0) {
+        return { contextCandidates: candidates, envExports };
+    }
+    const preferencesPath = getPreferencesPath(options);
+    const preferences = options.resetContextPrefs ? emptySensitivePreferences() : await readSensitivePreferences(preferencesPath);
+    const contextGroups = groupContextCandidates(candidates);
+    const missingContextGroups = contextGroups.filter((group) => group.sensitive && preferences.context[group.key] === undefined);
+    const missingEnvKeys = envKeys.filter((key) => preferences.env[key] === undefined);
+    if (missingContextGroups.length === 0 && missingEnvKeys.length === 0) {
+        return applySensitivePreferences(candidates, envExports, preferences);
+    }
+    if (!process.stdin.isTTY) {
+        throw new Error("refusing to copy new sensitive data without an interactive terminal; rerun with --yes, --no-auth, --no-agent-context, or answer prompts once to save preferences");
+    }
+    console.log(`Choose which local auth and conversation context to copy into the VM. Default is no. Choices are saved in ${preferencesPath}.`);
+    const readline = createInterface({ input, output });
+    try {
+        for (const group of missingContextGroups) {
+            preferences.context[group.key] = await askYesNo(readline, await contextGroupQuestion(group));
+        }
+        for (const key of missingEnvKeys) {
+            preferences.env[key] = await askYesNo(readline, `Include environment variable ${key}? [y/N] `);
+        }
+        await writeSensitivePreferences(preferencesPath, preferences);
+        const selection = applySensitivePreferences(candidates, envExports, preferences);
+        console.log(`Selected ${selection.contextCandidates.length}/${candidates.length} context item${candidates.length === 1 ? "" : "s"} and ${Object.keys(selection.envExports).length}/${envKeys.length} environment variable${envKeys.length === 1 ? "" : "s"}.`);
+        return selection;
+    }
+    finally {
+        readline.close();
+    }
+}
+function groupContextCandidates(candidates) {
+    const groups = new Map();
+    for (const candidate of candidates) {
+        const group = groups.get(candidate.preferenceKey);
+        if (group) {
+            group.candidates.push(candidate);
+            group.sensitive ||= candidate.sensitive;
+        }
+        else {
+            groups.set(candidate.preferenceKey, {
+                key: candidate.preferenceKey,
+                promptLabel: candidate.promptLabel,
+                candidates: [candidate],
+                sensitive: candidate.sensitive,
+            });
+        }
+    }
+    return [...groups.values()];
+}
+async function contextGroupQuestion(group) {
+    const size = await estimateCandidatesSize(group.candidates);
+    const sizeLabel = size > 0 ? `, about ${formatBytes(size)}` : "";
+    if (group.candidates.length === 1) {
+        return `Include ${group.promptLabel} (${group.candidates[0].source}${sizeLabel})? [y/N] `;
+    }
+    const noun = group.promptLabel.toLowerCase().includes("workspace") ? "workspaces" : "locations";
+    return `Include ${group.promptLabel} (${group.candidates.length} ${noun}${sizeLabel})? [y/N] `;
+}
+async function estimateCandidatesSize(candidates) {
+    let total = 0;
+    for (const candidate of candidates) {
+        total += await estimatePathSize(candidate.source);
+    }
+    return total;
+}
+async function estimatePathSize(source) {
+    try {
+        const stats = await stat(source);
+        if (stats.isFile())
+            return stats.size;
+        if (!stats.isDirectory())
+            return 0;
+        const entries = [];
+        await walk(source, "", entries, {
+            skipDirectory(relativePath, name) {
+                return shouldSkipContextDirectory(relativePath, name);
+            },
+        });
+        return entries.reduce((total, entry) => total + entry.size, 0);
+    }
+    catch {
+        return 0;
+    }
+}
+function applySensitivePreferences(candidates, envExports, preferences) {
+    const contextCandidates = candidates.filter((candidate) => !candidate.sensitive || preferences.context[candidate.preferenceKey] === true);
+    const selectedEnv = {};
+    for (const [key, value] of Object.entries(envExports)) {
+        if (preferences.env[key] === true) {
+            selectedEnv[key] = value;
+        }
+    }
+    return { contextCandidates, envExports: selectedEnv };
+}
+function emptySensitivePreferences() {
+    return { version: SENSITIVE_PREFERENCES_VERSION, context: {}, env: {} };
+}
+function getPreferencesPath(options) {
+    return path.join(path.dirname(options.cachePath), "preferences.json");
+}
+async function readSensitivePreferences(preferencesPath) {
+    try {
+        const parsed = JSON.parse(await readFile(preferencesPath, "utf8"));
+        if (parsed.version === SENSITIVE_PREFERENCES_VERSION) {
+            return {
+                version: SENSITIVE_PREFERENCES_VERSION,
+                context: parsed.context ?? {},
+                env: parsed.env ?? {},
+                updatedAt: parsed.updatedAt,
+            };
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            console.warn(`Ignoring unreadable preferences ${preferencesPath}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return emptySensitivePreferences();
+}
+async function writeSensitivePreferences(preferencesPath, preferences) {
+    await mkdir(path.dirname(preferencesPath), { recursive: true });
+    await writeFile(preferencesPath, `${JSON.stringify({ ...preferences, updatedAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
+}
+async function askYesNo(readline, question) {
+    const answer = await readline.question(question);
+    return /^y(es)?$/i.test(answer.trim());
+}
+function printPlan(options, projectChanges, contextChanges, envExports, cache) {
+    const source = options.vmId ? `existing VM ${options.vmId}` : cache.snapshotId ? `snapshot ${cache.snapshotId}` : "a new VM";
+    console.log(`Syncing ${options.projectRoot} to ${source}`);
+    console.log(`Remote project: ${options.remoteProjectDir}`);
+    console.log(`Project files: ${projectChanges.changed.length} changed, ${projectChanges.removed.length} removed, ${projectChanges.unchanged} unchanged`);
+    console.log(`Context files: ${contextChanges.changed.length} changed, ${contextChanges.removed.length} removed, ${contextChanges.unchanged} unchanged`);
+    console.log(`Estimated upload: ${formatBytes(totalEntrySize(projectChanges.changed))} project, ${formatBytes(totalEntrySize(contextChanges.changed))} context`);
+    if (Object.keys(envExports).length > 0) {
+        console.log(`Environment exports: ${Object.keys(envExports).length}`);
+    }
+}
+function totalEntrySize(entries) {
+    return entries.reduce((total, entry) => total + entry.size, 0);
+}
+async function getOrCreateVm(options, snapshotId) {
+    if (options.vmId) {
+        const { vm } = await freestyle.vms.get({ vmId: options.vmId });
+        await vm.start(options.idleTimeoutSeconds ? { idleTimeoutSeconds: options.idleTimeoutSeconds } : undefined);
+        return { vm, vmId: options.vmId };
+    }
+    console.log(snapshotId ? `Creating VM from snapshot ${snapshotId}...` : "Creating Freestyle VM...");
+    const result = await freestyle.vms.create({
+        name: options.name,
+        snapshotId: snapshotId ?? undefined,
+        idleTimeoutSeconds: options.idleTimeoutSeconds,
+    });
+    return { vm: result.vm, vmId: result.vmId };
+}
+async function warmVsCodeServerCache(vm) {
+    const commit = await localVsCodeCommit();
+    if (!commit)
+        return;
+    const script = `
+set -eu
+commit=${shellQuote(commit)}
+machine=$(uname -m)
+case "$machine" in
+    x86_64|amd64) arch=x64 ;;
+    aarch64|arm64) arch=arm64 ;;
+    armv7l|armv8l) arch=armhf ;;
+    *) echo "unsupported VS Code Server architecture: $machine" >&2; exit 0 ;;
+esac
+bin_dir=/root/.vscode-server/bin/$commit
+cli_server_dir=/root/.vscode-server/cli/servers/Stable-$commit/server
+if { [ -x "$bin_dir/server.sh" ] || [ -x "$bin_dir/bin/code-server" ]; } && [ -x "$cli_server_dir/bin/code-server" ]; then
+    echo "VS Code Server $commit already cached"
+    exit 0
+fi
+tmp=$(mktemp -d /tmp/vmpush-vscode-server.XXXXXX)
+trap 'rm -rf "$tmp"' EXIT
+url=https://update.code.visualstudio.com/commit:$commit/server-linux-$arch/stable
+archive=$tmp/server.tgz
+if command -v curl >/dev/null 2>&1; then
+    curl -fsSL "$url" -o "$archive"
+elif command -v wget >/dev/null 2>&1; then
+    wget -qO "$archive" "$url"
+else
+    echo "curl or wget is required to cache VS Code Server" >&2
+    exit 0
+fi
+tar -xzf "$archive" -C "$tmp"
+extracted=$(find "$tmp" -mindepth 1 -maxdepth 1 -type d | head -n 1)
+if [ -z "$extracted" ]; then
+    echo "VS Code Server archive did not contain a directory" >&2
+    exit 1
+fi
+if ! { [ -x "$bin_dir/server.sh" ] || [ -x "$bin_dir/bin/code-server" ]; }; then
+    mkdir -p "$bin_dir"
+    cp -a "$extracted"/. "$bin_dir"/
+    touch "$bin_dir/0"
+fi
+if [ ! -x "$cli_server_dir/bin/code-server" ]; then
+    mkdir -p "$cli_server_dir"
+    cp -a "$extracted"/. "$cli_server_dir"/
+fi
+echo "Cached VS Code Server $commit for linux-$arch"
+`;
+    const result = await checkedExec(vm, script);
+    if (result.stdout?.trim())
+        console.log(result.stdout.trim());
+}
+async function localVsCodeCommit() {
+    try {
+        const { stdout } = await execFileAsync("code", ["--version"]);
+        const commit = stdout.split(/\r?\n/)[1]?.trim();
+        return /^[0-9a-f]{40}$/i.test(commit ?? "") ? commit : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function ensureRemoteBase(vm, remoteProjectDir) {
+    await checkedExec(vm, `mkdir -p ${shellQuote(remoteProjectDir)} /root/.vmpush`);
+}
+async function syncProject(vm, vmId, options, changes) {
+    if (changes.changed.length > 0) {
+        console.log(`VM ${vmId}: uploading ${changes.changed.length} changed project files...`);
+        const archive = await createProjectArchive(options.projectRoot, changes.changed);
+        try {
+            await uploadArchiveInChunks(vm, vmId, archive, "/tmp/vmpush-project.tgz", "project");
+            await checkedExec(vm, `mkdir -p ${shellQuote(options.remoteProjectDir)} && tar --no-same-owner --no-same-permissions -xzf /tmp/vmpush-project.tgz -C ${shellQuote(options.remoteProjectDir)} && rm -f /tmp/vmpush-project.tgz`);
+        }
+        finally {
+            await rm(path.dirname(archive), { recursive: true, force: true });
+        }
+    }
+    if (changes.removed.length > 0) {
+        console.log(`VM ${vmId}: removing ${changes.removed.length} deleted project files...`);
+        const removeList = Buffer.from(changes.removed.join("\0") + "\0");
+        await vm.fs.writeFile("/tmp/vmpush-remove-list", removeList);
+        await checkedExec(vm, `cd ${shellQuote(options.remoteProjectDir)} && xargs -0 rm -f -- < /tmp/vmpush-remove-list && rm -f /tmp/vmpush-remove-list`);
+    }
+    return {
+        uploaded: changes.changed.length,
+        removed: changes.removed.length,
+        unchanged: changes.unchanged,
+    };
+}
+async function runRemoteFixups(vm, options) {
+    for (const plugin of [npmNativeDepsPlugin]) {
+        try {
+            await plugin.afterProjectSync({ vm, options });
+        }
+        catch (error) {
+            console.warn(`Remote fixup ${plugin.name} skipped: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+async function syncContext(vm, vmId, changes) {
+    if (changes.removed.length > 0) {
+        console.log(`VM ${vmId}: removing ${changes.removed.length} deleted auth/context files...`);
+        await checkedExec(vm, changes.removed.map((remotePath) => `rm -f -- ${shellQuote(remotePath)}`).join("\n"));
+    }
+    if (changes.changed.length === 0) {
+        return { uploaded: 0, removed: changes.removed.length, unchanged: changes.unchanged };
+    }
+    console.log(`VM ${vmId}: uploading ${changes.changed.length} changed auth/context files...`);
+    const archive = await createContextArchive(changes.changed);
+    try {
+        await uploadArchiveInChunks(vm, vmId, archive, "/tmp/vmpush-context.tgz", "context");
+        await checkedExec(vm, "tar --no-same-owner --no-same-permissions -xzf /tmp/vmpush-context.tgz -C / && rm -f /tmp/vmpush-context.tgz");
+    }
+    finally {
+        await rm(path.dirname(archive), { recursive: true, force: true });
+    }
+    await hardenRemoteSecrets(vm, changes.changed.map((entry) => entry.remotePath));
+    return { uploaded: changes.changed.length, removed: changes.removed.length, unchanged: changes.unchanged };
+}
+async function installEnvironment(vm, envExports, envHash, previousHash) {
+    if (Object.keys(envExports).length === 0 || envHash === previousHash)
+        return;
+    await checkedExec(vm, "mkdir -p /root/.vmpush");
+    await vm.fs.writeTextFile("/root/.vmpush/env.sh", renderEnvFile(envExports));
+    await checkedExec(vm, "chmod 700 /root/.vmpush && chmod 600 /root/.vmpush/env.sh && grep -qxF 'test -f /root/.vmpush/env.sh && . /root/.vmpush/env.sh' /root/.profile || printf '\n%s\n' 'test -f /root/.vmpush/env.sh && . /root/.vmpush/env.sh' >> /root/.profile");
+}
+async function writeRemoteResumeFiles(vm, options, vmId, envExports) {
+    const manifest = {
+        vmId,
+        project: options.remoteProjectDir,
+        syncedAt: new Date().toISOString(),
+        env: Object.keys(envExports).sort(),
+        installCommand: await detectInstallCommand(options.projectRoot),
+    };
+    await checkedExec(vm, `mkdir -p ${shellQuote(`${options.remoteProjectDir}/.vmpush`)} /root/.vmpush`);
+    await vm.fs.writeTextFile(`${options.remoteProjectDir}/.vmpush/remote.json`, `${JSON.stringify(manifest, null, 2)}\n`);
+    await vm.fs.writeTextFile("/root/.vmpush/resume.sh", `#!/usr/bin/env bash
+set -euo pipefail
+test -f /root/.vmpush/env.sh && . /root/.vmpush/env.sh
+cd ${shellQuote(options.remoteProjectDir)}
+exec "$SHELL" -l
+`);
+    await vm.fs.writeTextFile("/root/.vmpush/profile.sh", renderRemoteProfile(options.remoteProjectDir));
+    await checkedExec(vm, "chmod 700 /root/.vmpush && chmod +x /root/.vmpush/resume.sh && chmod 600 /root/.vmpush/profile.sh && grep -qxF 'test -f /root/.vmpush/profile.sh && . /root/.vmpush/profile.sh' /root/.profile || printf '\n%s\n' 'test -f /root/.vmpush/profile.sh && . /root/.vmpush/profile.sh' >> /root/.profile");
+}
+function renderRemoteProfile(remoteProjectDir) {
+    return `# Generated by vmpush. Loaded by /root/.profile.
+test -f /root/.vmpush/env.sh && . /root/.vmpush/env.sh
+if [ -d ${shellQuote(remoteProjectDir)} ]; then
+    cd ${shellQuote(remoteProjectDir)}
+fi
+`;
+}
+async function syncLocalCopilotForRemoteWorkspaces(vm, options, vmId, contextCandidates) {
+    const sourceCopilotDir = selectedCurrentCopilotSource(contextCandidates);
+    if (!sourceCopilotDir || !(await exists(sourceCopilotDir))) {
+        return { status: "skipped", count: 0, reason: "Copilot current workspace state is not selected." };
+    }
+    const destinations = await findRemoteWorkspaceCopilotDestinations(vmId, options.remoteProjectDir);
+    if (destinations.length === 0) {
+        return {
+            status: "pending",
+            count: 0,
+            reason: "open this VM folder in VS Code once, then rerun vmpush to copy sidebar history.",
+        };
+    }
+    await copyCopilotState(sourceCopilotDir, destinations);
+    await copyCopilotWorkspaceStateKeys(sourceCopilotDir, destinations);
+    await copyCopilotStateToRemoteServer(vm, sourceCopilotDir, destinations);
+    return { status: "copied", count: destinations.length };
+}
+function selectedCurrentCopilotSource(contextCandidates) {
+    return contextCandidates.find((candidate) => candidate.preferenceKey === "context:copilot-current-workspace")?.source;
+}
+async function findRemoteWorkspaceCopilotDestinations(vmId, remoteProjectDir) {
+    const destinations = [];
+    for (const codeRoot of codeUserRoots(homedir())) {
+        const workspaceStorage = path.join(codeRoot, "workspaceStorage");
+        const workspaceDirs = await listDirectories(workspaceStorage);
+        for (const workspaceDir of workspaceDirs) {
+            if (await isRemoteWorkspaceStorageForVmProject(workspaceDir, vmId, remoteProjectDir)) {
+                destinations.push(path.join(workspaceDir, "GitHub.copilot-chat"));
+            }
+        }
+    }
+    return destinations;
+}
+async function syncLocalCopilotForRemoteUri(vm, contextCandidates, remoteWorkspaceUri) {
+    const sourceCopilotDir = selectedCurrentCopilotSource(contextCandidates);
+    if (!sourceCopilotDir || !(await exists(sourceCopilotDir)))
+        return { status: "skipped", count: 0 };
+    for (let attempt = 0; attempt < 20; attempt += 1) {
+        const destinations = [];
+        for (const codeRoot of codeUserRoots(homedir())) {
+            const workspaceStorage = path.join(codeRoot, "workspaceStorage");
+            const workspaceDirs = await listDirectories(workspaceStorage);
+            for (const workspaceDir of workspaceDirs) {
+                if (await isWorkspaceStorageForRemoteUri(workspaceDir, remoteWorkspaceUri)) {
+                    destinations.push(path.join(workspaceDir, "GitHub.copilot-chat"));
+                }
+            }
+        }
+        if (destinations.length > 0) {
+            await copyCopilotState(sourceCopilotDir, destinations);
+            await copyCopilotWorkspaceStateKeys(sourceCopilotDir, destinations);
+            await copyCopilotStateToRemoteServer(vm, sourceCopilotDir, destinations);
+            return { status: "copied", count: destinations.length };
+        }
+        await delay(500);
+    }
+    return { status: "pending", count: 0 };
+}
+async function copyCopilotState(sourceCopilotDir, destinations) {
+    for (const destination of destinations) {
+        await rm(destination, { recursive: true, force: true });
+        await mkdir(path.dirname(destination), { recursive: true });
+        await cp(sourceCopilotDir, destination, { recursive: true, force: true });
+        await sanitizeCopilotTranscripts(destination);
+        await copyCoreChatState(sourceCopilotDir, destination);
+    }
+}
+async function copyCoreChatState(sourceCopilotDir, destinationCopilotDir) {
+    const sourceWorkspaceDir = path.dirname(sourceCopilotDir);
+    const destinationWorkspaceDir = path.dirname(destinationCopilotDir);
+    const sessionIds = await copiedCopilotSessionIds(destinationCopilotDir);
+    for (const sessionId of sessionIds) {
+        const sourceChatSession = path.join(sourceWorkspaceDir, "chatSessions", `${sessionId}.jsonl`);
+        if (await exists(sourceChatSession)) {
+            const destinationChatSession = path.join(destinationWorkspaceDir, "chatSessions", `${sessionId}.jsonl`);
+            await mkdir(path.dirname(destinationChatSession), { recursive: true });
+            await cp(sourceChatSession, destinationChatSession, { force: true });
+            await trimTranscriptToCompletedTurn(destinationChatSession);
+        }
+        const sourceEditingSession = path.join(sourceWorkspaceDir, "chatEditingSessions", sessionId);
+        if (await exists(sourceEditingSession)) {
+            const destinationEditingSession = path.join(destinationWorkspaceDir, "chatEditingSessions", sessionId);
+            await rm(destinationEditingSession, { recursive: true, force: true });
+            await mkdir(path.dirname(destinationEditingSession), { recursive: true });
+            await cp(sourceEditingSession, destinationEditingSession, { recursive: true, force: true });
+        }
+    }
+}
+async function copiedCopilotSessionIds(copilotDir) {
+    const transcripts = await listFiles(path.join(copilotDir, "transcripts"));
+    return transcripts
+        .filter((transcript) => transcript.endsWith(".jsonl"))
+        .map((transcript) => path.basename(transcript, ".jsonl"));
+}
+async function sanitizeCopilotTranscripts(copilotDir) {
+    const transcriptsDir = path.join(copilotDir, "transcripts");
+    const entries = await listFiles(transcriptsDir);
+    for (const transcript of entries.filter((entry) => entry.endsWith(".jsonl"))) {
+        await trimTranscriptToCompletedTurn(transcript);
+    }
+}
+async function trimTranscriptToCompletedTurn(transcriptPath) {
+    const content = await readFile(transcriptPath, "utf8").catch(() => undefined);
+    if (!content)
+        return;
+    const lines = content.trimEnd().split("\n");
+    let lastCompletedLine = -1;
+    for (let index = 0; index < lines.length; index += 1) {
+        try {
+            const event = JSON.parse(lines[index]);
+            if (event.type === "assistant.turn_end")
+                lastCompletedLine = index;
+        }
+        catch {
+            break;
+        }
+    }
+    if (lastCompletedLine >= 0 && lastCompletedLine < lines.length - 1) {
+        await writeFile(transcriptPath, `${lines.slice(0, lastCompletedLine + 1).join("\n")}\n`, "utf8");
+    }
+}
+async function listFiles(directory) {
+    const result = [];
+    async function visit(current) {
+        const dirents = await import("node:fs/promises").then((fs) => fs.readdir(current, { withFileTypes: true })).catch(() => []);
+        for (const dirent of dirents) {
+            const child = path.join(current, dirent.name);
+            if (dirent.isDirectory())
+                await visit(child);
+            else if (dirent.isFile())
+                result.push(child);
+        }
+    }
+    await visit(directory);
+    return result;
+}
+async function copyCopilotWorkspaceStateKeys(sourceCopilotDir, destinations) {
+    const sourceStateDb = path.join(path.dirname(sourceCopilotDir), "state.vscdb");
+    if (!(await exists(sourceStateDb)))
+        return;
+    for (const destination of destinations) {
+        const destinationStateDb = path.join(path.dirname(destination), "state.vscdb");
+        if (!(await exists(destinationStateDb)))
+            continue;
+        await mergeWorkspaceStateKeys(sourceStateDb, destinationStateDb).catch((error) => {
+            console.warn(`Copilot sidebar state database merge skipped: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        await normalizeCopiedChatIndex(destination).catch((error) => {
+            console.warn(`Copilot sidebar index normalization skipped: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    }
+}
+async function mergeWorkspaceStateKeys(sourceStateDb, destinationStateDb) {
+    await execFileAsync("sqlite3", [
+        destinationStateDb,
+        `PRAGMA busy_timeout=5000;
+ATTACH DATABASE ${sqliteLiteral(sourceStateDb)} AS source_state;
+INSERT OR REPLACE INTO ItemTable(key, value)
+SELECT key, value FROM source_state.ItemTable
+WHERE key IN (
+    'GitHub.copilot-chat',
+    'chat.ChatSessionStore.index',
+    'memento/interactive-session-view-copilot',
+    'workbench.panel.chat',
+    'workbench.panel.chat.numberOfVisibleViews'
+) OR key LIKE 'chat.%';
+DETACH DATABASE source_state;`,
+    ]);
+}
+function sqliteLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+async function normalizeCopiedChatIndex(copilotDir) {
+    const stateDb = path.join(path.dirname(copilotDir), "state.vscdb");
+    if (!(await exists(stateDb)))
+        return;
+    const { stdout } = await execFileAsync("sqlite3", [stateDb, "SELECT value FROM ItemTable WHERE key='chat.ChatSessionStore.index';"]);
+    if (!stdout.trim())
+        return;
+    const index = JSON.parse(stdout);
+    if (!index.entries)
+        return;
+    for (const sessionId of Object.keys(index.entries)) {
+        const transcriptPath = path.join(copilotDir, "transcripts", `${sessionId}.jsonl`);
+        const lastCompletedTimestamp = await lastCompletedTurnTimestamp(transcriptPath);
+        if (!lastCompletedTimestamp) {
+            delete index.entries[sessionId];
+            continue;
+        }
+        const entry = index.entries[sessionId];
+        entry.lastResponseState = 1;
+        entry.hasPendingEdits = false;
+        entry.lastMessageDate = lastCompletedTimestamp;
+        const timing = typeof entry.timing === "object" && entry.timing !== null ? entry.timing : {};
+        timing.lastRequestEnded = lastCompletedTimestamp;
+        entry.timing = timing;
+    }
+    await execFileAsync("sqlite3", [
+        stateDb,
+        `INSERT OR REPLACE INTO ItemTable(key, value) VALUES ('chat.ChatSessionStore.index', ${sqliteLiteral(JSON.stringify(index))});`,
+    ]);
+}
+async function lastCompletedTurnTimestamp(transcriptPath) {
+    const content = await readFile(transcriptPath, "utf8").catch(() => undefined);
+    if (!content)
+        return undefined;
+    const lines = content.trimEnd().split("\n");
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+        try {
+            const event = JSON.parse(lines[index]);
+            if (event.type === "assistant.turn_end" && event.timestamp)
+                return Date.parse(event.timestamp);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+async function copyCopilotStateToRemoteServer(vm, sourceCopilotDir, localDestinations) {
+    const workspaceIds = localDestinations.map((destination) => path.basename(path.dirname(destination)));
+    if (workspaceIds.length === 0)
+        return;
+    const archive = await createRemoteServerWorkspaceStateArchive(sourceCopilotDir, localDestinations);
+    try {
+        await uploadArchiveInChunks(vm, "vscode-server", archive, "/tmp/vmpush-copilot-chat.tgz", "copilot-chat");
+        const baseDir = "/root/.vscode-server/data/User/workspaceStorage";
+        const commands = [`mkdir -p ${shellQuote(baseDir)}`];
+        for (const workspaceId of workspaceIds) {
+            commands.push(`mkdir -p ${shellQuote(`${baseDir}/${workspaceId}`)} && rm -rf ${shellQuote(`${baseDir}/${workspaceId}/GitHub.copilot-chat`)}`);
+        }
+        commands.push(`tar --no-same-owner --no-same-permissions -xzf /tmp/vmpush-copilot-chat.tgz -C ${shellQuote(baseDir)}`);
+        commands.push("rm -f /tmp/vmpush-copilot-chat.tgz");
+        await checkedExec(vm, commands.join("\n"));
+    }
+    finally {
+        await rm(path.dirname(archive), { recursive: true, force: true });
+    }
+}
+async function createRemoteServerWorkspaceStateArchive(sourceCopilotDir, localDestinations) {
+    const tempDir = await mkdtemp(path.join(tmpdir(), "vmpush-copilot-"));
+    const stagingDir = path.join(tempDir, "staging");
+    const archivePath = path.join(tempDir, "copilot-chat.tgz");
+    await mkdir(stagingDir, { recursive: true });
+    for (const destination of localDestinations) {
+        const workspaceId = path.basename(path.dirname(destination));
+        const workspaceDir = path.join(stagingDir, workspaceId);
+        await mkdir(workspaceDir, { recursive: true });
+        await cp(sourceCopilotDir, path.join(workspaceDir, "GitHub.copilot-chat"), { recursive: true, force: true });
+        await sanitizeCopilotTranscripts(path.join(workspaceDir, "GitHub.copilot-chat"));
+        await copyCoreChatState(sourceCopilotDir, path.join(workspaceDir, "GitHub.copilot-chat"));
+        const stateDb = path.join(path.dirname(destination), "state.vscdb");
+        if (await exists(stateDb)) {
+            await cp(stateDb, path.join(workspaceDir, "state.vscdb"), { force: true });
+        }
+    }
+    await createTar(["--no-xattrs", "-czf", archivePath, "-C", stagingDir, "."]);
+    return archivePath;
+}
+async function isRemoteWorkspaceStorageForVmProject(workspaceDir, vmId, remoteProjectDir) {
+    try {
+        const raw = await readFile(path.join(workspaceDir, "workspace.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        const workspaceUri = parsed.folder ?? parsed.workspace;
+        if (!workspaceUri?.startsWith("vscode-remote://"))
+            return false;
+        const decodedUri = decodeURIComponent(workspaceUri);
+        return decodedUri.includes(vmId) && remoteWorkspacePath(decodedUri) === remoteProjectDir;
+    }
+    catch {
+        return false;
+    }
+}
+async function isWorkspaceStorageForRemoteUri(workspaceDir, remoteWorkspaceUri) {
+    try {
+        const raw = await readFile(path.join(workspaceDir, "workspace.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        const workspaceUri = parsed.folder ?? parsed.workspace;
+        return workspaceUri === remoteWorkspaceUri;
+    }
+    catch {
+        return false;
+    }
+}
+function remoteWorkspacePath(decodedRemoteUri) {
+    const hostEnd = decodedRemoteUri.indexOf("/", "vscode-remote://".length);
+    if (hostEnd === -1)
+        return "/";
+    return normalizeRemotePath(decodedRemoteUri.slice(hostEnd));
+}
+async function runInstall(vm, projectRoot, remoteProjectDir) {
+    const installCommand = await detectInstallCommand(projectRoot);
+    if (!installCommand) {
+        console.log("No dependency install command detected.");
+        return;
+    }
+    console.log(`Running install: ${installCommand}`);
+    await checkedExec(vm, `cd ${shellQuote(remoteProjectDir)} && ${installCommand}`, 20 * 60 * 1000);
+}
+async function detectInstallCommand(projectRoot) {
+    if (await exists(path.join(projectRoot, "pnpm-lock.yaml")))
+        return "corepack enable && pnpm install";
+    if (await exists(path.join(projectRoot, "yarn.lock")))
+        return "corepack enable && yarn install";
+    if (await exists(path.join(projectRoot, "package-lock.json")))
+        return "npm install";
+    if (await exists(path.join(projectRoot, "requirements.txt")))
+        return "python3 -m pip install -r requirements.txt";
+    if (await exists(path.join(projectRoot, "pyproject.toml")))
+        return "python3 -m pip install -e .";
+    if (await exists(path.join(projectRoot, "Cargo.toml")))
+        return "cargo fetch";
+    if (await exists(path.join(projectRoot, "go.mod")))
+        return "go mod download";
+    return undefined;
+}
+async function createProjectArchive(projectRoot, entries) {
+    const tempDir = await mkdtemp(path.join(tmpdir(), "vmpush-"));
+    const listPath = path.join(tempDir, "files.list");
+    const archivePath = path.join(tempDir, "project.tgz");
+    await writeFile(listPath, Buffer.from(entries.map((entry) => entry.relativePath).join("\0") + "\0"));
+    await createTar(["--null", "--no-xattrs", "-T", listPath, "-czf", archivePath, "-C", projectRoot]);
+    return archivePath;
+}
+async function createContextArchive(entries) {
+    const tempDir = await mkdtemp(path.join(tmpdir(), "vmpush-context-"));
+    const stagingDir = path.join(tempDir, "staging");
+    const archivePath = path.join(tempDir, "context.tgz");
+    await mkdir(stagingDir, { recursive: true });
+    for (const entry of entries) {
+        const relativeRemotePath = entry.remotePath.replace(/^\/+/, "");
+        const destination = path.join(stagingDir, ...relativeRemotePath.split("/"));
+        await mkdir(path.dirname(destination), { recursive: true });
+        await writeFile(destination, await readFile(entry.absolutePath));
+    }
+    await createTar(["--no-xattrs", "-czf", archivePath, "-C", stagingDir, "."]);
+    return archivePath;
+}
+async function createTar(args) {
+    await execFileAsync("tar", args, {
+        env: {
+            ...process.env,
+            COPYFILE_DISABLE: "1",
+        },
+    });
+}
+async function uploadArchiveInChunks(vm, vmId, archivePath, remoteArchivePath, label) {
+    const archive = await readFile(archivePath);
+    const encoded = archive.toString("base64");
+    const chunkCount = Math.max(1, Math.ceil(encoded.length / ARCHIVE_CHUNK_CHARS));
+    const chunkDir = `/tmp/vmpush-${label}-${Date.now()}.chunks`;
+    console.log(`VM ${vmId}: streaming ${formatBytes(archive.length)} ${label} archive in ${chunkCount} chunk${chunkCount === 1 ? "" : "s"}...`);
+    await checkedExec(vm, `rm -rf ${shellQuote(chunkDir)} && mkdir -p ${shellQuote(chunkDir)}`);
+    const width = String(chunkCount - 1).length;
+    for (let index = 0; index < chunkCount; index += 1) {
+        const start = index * ARCHIVE_CHUNK_CHARS;
+        const chunk = encoded.slice(start, start + ARCHIVE_CHUNK_CHARS);
+        const chunkName = `${String(index).padStart(width, "0")}.b64`;
+        await vm.fs.writeTextFile(`${chunkDir}/${chunkName}`, chunk);
+        if (chunkCount > 1 && ((index + 1) % 10 === 0 || index + 1 === chunkCount)) {
+            console.log(`VM ${vmId}: uploaded ${index + 1}/${chunkCount} ${label} archive chunks`);
+        }
+    }
+    await checkedExec(vm, `cat ${shellQuote(chunkDir)}/*.b64 | base64 -d > ${shellQuote(remoteArchivePath)} && rm -rf ${shellQuote(chunkDir)}`);
+}
+async function mkdirRemote(vm, directories) {
+    for (const chunk of chunkArray(directories, 50)) {
+        await checkedExec(vm, `mkdir -p ${chunk.map(shellQuote).join(" ")}`);
+    }
+}
+async function hardenRemoteRoot(vm) {
+    await checkedExec(vm, "chown root:root /root && chmod 700 /root");
+}
+async function checkedExec(vm, command, timeoutMs) {
+    const result = await vm.exec({ command, timeoutMs });
+    if (result.statusCode && result.statusCode !== 0) {
+        throw new Error(`remote command failed (${result.statusCode}): ${command}\n${result.stderr ?? result.stdout ?? ""}`);
+    }
+    return result;
+}
+async function connectToVm(vm, vmId, options, contextCandidates) {
+    const editorScheme = await detectEditorScheme();
+    if (!editorScheme) {
+        await sshIntoVm(vmId);
+        return;
+    }
+    await openRemoteEditor(vm, vmId, editorScheme, options.remoteProjectDir, contextCandidates);
+}
+async function detectEditorScheme() {
+    const envText = Object.entries(process.env)
+        .filter(([key]) => key.startsWith("VSCODE_") || key.startsWith("CURSOR") || key === "TERM_PROGRAM")
+        .map(([key, value]) => `${key}=${value ?? ""}`)
+        .join("\n")
+        .toLowerCase();
+    if (envText.includes("cursor"))
+        return "cursor";
+    if (!envText.includes("term_program=vscode") && !envText.includes("vscode_"))
+        return undefined;
+    const parentCommands = await processCommandChain(process.ppid);
+    if (parentCommands.some((command) => command.toLowerCase().includes("cursor")))
+        return "cursor";
+    return "vscode";
+}
+async function processCommandChain(startPid) {
+    const commands = [];
+    let pid = startPid;
+    for (let depth = 0; depth < 20 && pid > 1; depth += 1) {
+        try {
+            const { stdout } = await execFileAsync("ps", ["-p", String(pid), "-o", "ppid=", "-o", "comm="]);
+            const line = stdout.trim();
+            if (!line)
+                break;
+            const match = line.match(/^(\d+)\s+(.+)$/);
+            if (!match)
+                break;
+            pid = Number(match[1]);
+            commands.push(match[2]);
+        }
+        catch {
+            break;
+        }
+    }
+    return commands;
+}
+async function openRemoteEditor(vm, vmId, scheme, remoteProjectDir, contextCandidates) {
+    console.log(`Opening ${scheme === "cursor" ? "Cursor" : "VS Code"} Remote SSH window for VM ${vmId}...`);
+    const { identity, identityId } = await freestyle.identities.create();
+    await identity.permissions.vms.grant({ vmId });
+    const { token, tokenId } = await identity.tokens.create();
+    const remoteWorkspaceUri = `vscode-remote://ssh-remote%2B${vmId}%2C${token}@${vmId}.vm-ssh.freestyle.sh${encodeRemotePath(remoteProjectDir)}`;
+    const uri = `${scheme}://vscode-remote/ssh-remote+${vmId},${token}@${vmId}.vm-ssh.freestyle.sh${encodeRemotePath(remoteProjectDir)}?windowId=_blank`;
+    try {
+        const preseedResult = await preseedLocalCopilotForRemoteUri(vm, contextCandidates, scheme, remoteWorkspaceUri);
+        if (preseedResult.status === "copied") {
+            console.log(`Prepared Copilot sidebar state for ${scheme === "cursor" ? "Cursor" : "VS Code"}.`);
+        }
+        await openUri(uri);
+    }
+    catch (error) {
+        await identity.tokens.revoke({ tokenId }).catch(() => undefined);
+        await freestyle.identities.delete({ identityId }).catch(() => undefined);
+        throw error;
+    }
+    await delay(5000);
+    const copilotResult = await syncLocalCopilotForRemoteUri(vm, contextCandidates, remoteWorkspaceUri);
+    if (copilotResult.status === "copied") {
+        console.log(`Copied Copilot sidebar state to opened ${scheme === "cursor" ? "Cursor" : "VS Code"} workspace.`);
+    }
+    else if (copilotResult.status === "pending") {
+        console.log("Copilot sidebar state: opened the editor, but the workspace storage bucket was not created yet. Reload the window after it finishes connecting, then rerun vmpush if needed.");
+    }
+    console.log(`Opened ${scheme === "cursor" ? "Cursor" : "VS Code"}. SSH identity ${identityId} remains active for the editor session.`);
+}
+async function preseedLocalCopilotForRemoteUri(vm, contextCandidates, scheme, remoteWorkspaceUri) {
+    const sourceCopilotDir = selectedCurrentCopilotSource(contextCandidates);
+    if (!sourceCopilotDir || !(await exists(sourceCopilotDir)))
+        return { status: "skipped", count: 0 };
+    const workspaceId = md5(remoteWorkspaceUri);
+    const destinations = [];
+    for (const codeRoot of codeUserRootsForScheme(homedir(), scheme)) {
+        const workspaceDir = path.join(codeRoot, "workspaceStorage", workspaceId);
+        await mkdir(workspaceDir, { recursive: true });
+        await writeFile(path.join(workspaceDir, "workspace.json"), `${JSON.stringify({ folder: remoteWorkspaceUri }, null, 2)}\n`, "utf8");
+        await ensureWorkspaceStateDb(path.join(workspaceDir, "state.vscdb"));
+        destinations.push(path.join(workspaceDir, "GitHub.copilot-chat"));
+    }
+    await copyCopilotState(sourceCopilotDir, destinations);
+    await copyCopilotWorkspaceStateKeys(sourceCopilotDir, destinations);
+    await copyCopilotStateToRemoteServer(vm, sourceCopilotDir, destinations);
+    return { status: "copied", count: destinations.length };
+}
+async function ensureWorkspaceStateDb(stateDb) {
+    await execFileAsync("sqlite3", [stateDb, "CREATE TABLE IF NOT EXISTS ItemTable (key TEXT UNIQUE ON CONFLICT REPLACE, value BLOB);"]);
+}
+function codeUserRootsForScheme(home, scheme) {
+    if (scheme === "cursor") {
+        return [
+            path.join(home, "Library", "Application Support", "Cursor", "User"),
+            path.join(home, ".config", "Cursor", "User"),
+        ];
+    }
+    return [
+        path.join(home, "Library", "Application Support", "Code", "User"),
+        path.join(home, ".config", "Code", "User"),
+    ];
+}
+function codeUserRoots(home) {
+    return [
+        path.join(home, "Library", "Application Support", "Code", "User"),
+        path.join(home, "Library", "Application Support", "Code - Insiders", "User"),
+        path.join(home, "Library", "Application Support", "Cursor", "User"),
+        path.join(home, ".config", "Code", "User"),
+        path.join(home, ".config", "Code - Insiders", "User"),
+        path.join(home, ".config", "Cursor", "User"),
+    ];
+}
+async function listDirectories(directory) {
+    try {
+        const dirents = await import("node:fs/promises").then((fs) => fs.readdir(directory, { withFileTypes: true }));
+        return dirents.filter((dirent) => dirent.isDirectory()).map((dirent) => path.join(directory, dirent.name));
+    }
+    catch {
+        return [];
+    }
+}
+function encodeRemotePath(remoteProjectDir) {
+    return remoteProjectDir.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+}
+async function openUri(uri) {
+    if (process.platform === "darwin") {
+        await execFileAsync("open", [uri]);
+    }
+    else if (process.platform === "win32") {
+        await execFileAsync("cmd", ["/c", "start", "", uri]);
+    }
+    else {
+        await execFileAsync("xdg-open", [uri]);
+    }
+}
+async function sshIntoVm(vmId) {
+    console.log(`Connecting to VM ${vmId}...`);
+    const exitCode = await new Promise((resolve, reject) => {
+        const child = spawn("npx", ["freestyle", "vm", "ssh", vmId], { stdio: "inherit" });
+        child.on("error", reject);
+        child.on("exit", (code) => resolve(code));
+    });
+    if (exitCode && exitCode !== 0) {
+        throw new Error(`ssh exited with status ${exitCode}`);
+    }
+}
+async function hashFile(filePath) {
+    const hash = createHash("sha256");
+    await new Promise((resolve, reject) => {
+        const stream = createReadStream(filePath);
+        stream.on("data", (chunk) => hash.update(chunk));
+        stream.on("error", reject);
+        stream.on("end", resolve);
+    });
+    return hash.digest("hex");
+}
+function hashString(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function md5(value) {
+    return createHash("md5").update(value).digest("hex");
+}
+function renderEnvFile(envExports) {
+    const lines = ["# Generated by vmpush. Contains local auth tokens."];
+    for (const key of Object.keys(envExports).sort()) {
+        lines.push(`export ${key}=${shellQuote(envExports[key])}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function normalizeRemotePath(value) {
+    const normalized = path.posix.normalize(value.replace(/\\/g, "/"));
+    if (!normalized.startsWith("/")) {
+        throw new Error("--remote-dir must be an absolute VM path");
+    }
+    return normalized;
+}
+function defaultRemoteProjectDir(projectRoot) {
+    return normalizeRemotePath(toPosix(projectRoot));
+}
+function sanitizeName(value) {
+    return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+}
+function toPosix(value) {
+    return value.split(path.sep).join(path.posix.sep);
+}
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+}
+async function delay(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function exists(filePath) {
+    try {
+        await stat(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function chunkArray(items, size) {
+    const chunks = [];
+    for (let index = 0; index < items.length; index += size) {
+        chunks.push(items.slice(index, index + size));
+    }
+    return chunks;
+}