frontpage-host 0.1.2 → 0.1.3

package/AGENTS.md

@@ -66,12 +66,15 @@ frontpage use <subdomain>
 
 ## File sync recipe
 
-Allowlisted roots only: `src/`, `public/`, `content/`. Other paths never sync (including some platform-owned scaffold files).
+Allowlisted roots only: `src/`, `public/`, `content/`. Other paths never sync (including platform-owned scaffold/overlay files such as `BaseLayout.astro`, `Modules.astro`, and `src/components/extensions/**`). Do not store secrets in the site tree (`.env`, `*.pem`, `secrets/`, `credentials.json`) — the API rejects those paths.
 
 ```bash
+# Session start / before editing: refresh if tip may have moved
+frontpage status --json        # data.tipDrift === true → must pull
+# or just:
 frontpage pull
 # edit local allowlisted files
-frontpage diff --json          # data.dirty === true when local ≠ remote
+frontpage diff --json          # data.dirty / data.tipDrift; compares git blob SHAs (one list GET)
 frontpage push --message "…"
 # on exit 3 (CAS / active run): frontpage status --json → pull or wait → retry push
 # Review at https://<subdomain>.frontpage.host
@@ -80,12 +83,14 @@ frontpage push --message "…"
 
 Rules:
 
-1. **Pull before push** so `baseCommitSha` is set (CAS).
-2. **Do not push** while an agent run is active (`status` / `runs`).
-3. Push updates **staging** (subdomain). Production is unchanged until someone runs `publish`.
-4. Pushing module markup may auto-activate modules (same as the editor agent).
-5. Binaries use base64; do not UTF-8 round-trip them.
-6. Prefer reviewing the subdomain after push; only use `deploy wait` if you need to block until a build finishes.
+1. **Pull before edit** when the remote tip may have moved (UI agent, another machine, or you pushed elsewhere). Check `status --json` / `diff --json` → `tipDrift`, or pull at session start. Stale local trees are not auto-healed; CAS only blocks a bad **push**.
+2. **Pull before push** so `baseCommitSha` is set (CAS). Still required even if you already pulled to edit.
+3. **Do not push** while an agent run is active (`status` / `runs`).
+4. Push updates **staging** (subdomain). Production is unchanged until someone runs `publish`.
+5. Pushing module markup may auto-activate modules (same as the editor agent).
+6. Binaries use base64; do not UTF-8 round-trip them.
+7. Prefer reviewing the subdomain after push; only use `deploy wait` if you need to block until a build finishes.
+8. The **UI / canvas agent does not use this CLI** — it edits the live tip in-process. Only CLI checkouts need `pull`.
 
 ## Agent prompt loop
 

package/dist/commands/diff.js

@@ -1,9 +1,10 @@
-import { readFile, readdir, stat } from "node:fs/promises";
-import { createHash } from "node:crypto";
+import { readFile, readdir } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
 import { resolveSlug } from "../site.js";
 import { EXIT_OK, EXIT_USAGE, v1Get } from "../http/client.js";
 import { emitErr, emitOk, emitUsage, isJson } from "../runtime.js";
+import { readState } from "../state/frontpage-state.js";
+import { gitBlobSha, isGitBlobSha } from "../git-blob-sha.js";
 const ROOTS = ["src", "public", "content"];
 async function walkLocal(cwd) {
     const map = new Map();
@@ -27,7 +28,7 @@ async function walkLocal(cwd) {
                 if (!ROOTS.some((r) => rel === r || rel.startsWith(`${r}/`)))
                     continue;
                 const buf = await readFile(child);
-                map.set(rel, createHash("sha256").update(buf).digest("hex"));
+                map.set(rel, gitBlobSha(buf));
             }
         }
     }
@@ -35,32 +36,32 @@ async function walkLocal(cwd) {
         await walk(join(cwd, root));
     return map;
 }
-function remoteHash(file) {
-    const buf = file.encoding === "base64"
-        ? Buffer.from(file.content, "base64")
-        : Buffer.from(file.content, "utf8");
-    return createHash("sha256").update(buf).digest("hex");
+function assertRemoteBlobShas(files) {
+    for (const f of files) {
+        if (!isGitBlobSha(f.blobSha)) {
+            throw new Error("Remote file list is missing blobSha. Upgrade Frontpage (API) — this CLI requires git blob SHAs on GET /files and will not fall back to per-file downloads.");
+        }
+    }
 }
 export async function runDiff(args) {
     try {
         const { slug } = await resolveSlug(args);
         const cwd = process.cwd();
+        const state = await readState(cwd);
         const local = await walkLocal(cwd);
         const listing = await v1Get(`/api/v1/sites/${encodeURIComponent(slug)}/files`);
-        const remotePaths = new Set(listing.files.map((f) => f.path));
+        assertRemoteBlobShas(listing.files);
+        const remoteByPath = new Map(listing.files.map((f) => [f.path, f.blobSha]));
         const added = [];
         const modified = [];
         const deleted = [];
         for (const path of [...local.keys()].sort()) {
-            if (!remotePaths.has(path)) {
+            const remoteSha = remoteByPath.get(path);
+            if (!remoteSha) {
                 added.push(path);
                 continue;
             }
-            const encPath = path.split("/").map(encodeURIComponent).join("/");
-            const remote = await v1Get(`/api/v1/sites/${encodeURIComponent(slug)}/files/${encPath}`);
-            const rh = remoteHash(remote.file);
-            const lh = local.get(path);
-            if (rh !== lh)
+            if (remoteSha.toLowerCase() !== local.get(path).toLowerCase())
                 modified.push(path);
         }
         for (const f of listing.files) {
@@ -68,12 +69,16 @@ export async function runDiff(args) {
                 deleted.push(f.path);
         }
         const dirty = added.length + modified.length + deleted.length > 0;
-        void (await stat(cwd).catch(() => null));
+        const tipDrift = Boolean(state.baseCommitSha &&
+            listing.baseCommitSha &&
+            state.baseCommitSha !== listing.baseCommitSha);
         if (isJson()) {
             emitOk("diff", {
                 slug,
                 baseCommitSha: listing.baseCommitSha,
                 dirty,
+                tipDrift,
+                comparedWith: "blobSha",
                 added,
                 modified,
                 deleted,
@@ -92,6 +97,9 @@ export async function runDiff(args) {
         else {
             console.error(`# ${added.length + modified.length + deleted.length} difference(s) · tip ${(listing.baseCommitSha ?? "").slice(0, 7) || "?"} · A=local-only M=modified D=remote-only`);
         }
+        if (tipDrift) {
+            console.error("# tipDrift: remote tip moved since last pull — run frontpage pull before editing further");
+        }
         return EXIT_OK;
     }
     catch (err) {

package/dist/git-blob-sha.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Git blob object SHA-1 — same digest as `git hash-object` / GitHub tree `sha`.
+ * Header is `blob <byteLength>\0` followed by raw file bytes (not UTF-8 reinterpreted).
+ */
+export declare function gitBlobSha(content: Buffer): string;
+/** True when a remote list entry carries a usable git blob SHA. */
+export declare function isGitBlobSha(value: unknown): value is string;

package/dist/git-blob-sha.js

@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+/**
+ * Git blob object SHA-1 — same digest as `git hash-object` / GitHub tree `sha`.
+ * Header is `blob <byteLength>\0` followed by raw file bytes (not UTF-8 reinterpreted).
+ */
+export function gitBlobSha(content) {
+    const header = Buffer.from(`blob ${content.length}\0`, "utf8");
+    return createHash("sha1").update(header).update(content).digest("hex");
+}
+const BLOB_SHA_RE = /^[0-9a-f]{40}$/i;
+/** True when a remote list entry carries a usable git blob SHA. */
+export function isGitBlobSha(value) {
+    return typeof value === "string" && BLOB_SHA_RE.test(value);
+}

package/dist/registry.js

@@ -86,11 +86,14 @@ export const COMMANDS = [
     },
     {
         name: "diff",
-        summary: "Compare local allowlisted files to the remote tip",
+        summary: "Compare local allowlisted files to the remote tip (git blob SHA)",
         usage: "frontpage diff [--site <slug>] [--json]",
         topics: ["sync"],
         examples: ["frontpage diff --json"],
-        flags: ["--site <slug>", "JSON data.dirty is true when differences exist"],
+        flags: [
+            "--site <slug>",
+            "JSON data.dirty when local ≠ remote; data.tipDrift when last pull tip ≠ remote tip",
+        ],
     },
     {
         name: "ls",
@@ -326,21 +329,24 @@ export const TOPICS = {
   PUBLIC_CLI_ENABLED is server-side — the CLI cannot enable it.`,
     sync: `File sync
   frontpage use <subdomain>
+  frontpage status               # tipDrift when remote moved since last pull
   frontpage pull                 # downloads src/, public/, content/ into cwd
-  frontpage diff                 # local vs remote tip (--json → data.dirty)
+  frontpage diff                 # local vs remote via git blobSha (--json → dirty + tipDrift)
   frontpage push [--message …]   # uploads allowlisted files; CAS + active-run guard
   frontpage ls [prefix]
   frontpage cat <path>
   frontpage search <pattern>
-  frontpage status
   frontpage open                 # opens https://<slug>.frontpage.host/ (--prod is a no-op stub)
 
   Local state: .frontpage/state.json { slug, baseCommitSha }
-  Pull first so push can compare-and-swap on baseCommitSha.
-  Do not push while the editor agent is building (status / runs show active work).
+  Pull BEFORE EDITING when tip may have moved (UI agent / another checkout) — check tipDrift.
+  Pull before push so CAS has baseCommitSha. Do not push while the editor agent is building.
+  The UI/canvas agent does not use this CLI; only CLI checkouts need pull.
   Pushing module markup may auto-activate modules (same as the agent).
   tokens.ts may be auto-repaired at commit if it would break the build.
   Binaries use base64 (not utf8-corrupted).
+  Platform overlay files (BaseLayout, Modules, Analytics, extensions, …) are not syncable.
+  Do not store secrets in the site tree (.env, *.pem, secrets/, credentials.json) — rejected by the API.
 
   Staging vs production:
   - Push/prompt/edit update STAGING: https://<subdomain>.frontpage.host

package/llms.txt

@@ -8,7 +8,7 @@
 - Site id: subdomain only (frontpage use <subdomain>). Not custom domains.
 - Staging: https://<subdomain>.frontpage.host — push/prompt/edit update staging; no separate staging deploy step for agents
 - Production: custom domain after frontpage publish — NEVER publish/unpublish unless the user explicitly asks
-- Sync: allowlist src/ public/ content/; pull → edit → push (CAS); no push during active agent run; review on subdomain
+- Sync: allowlist src/ public/ content/; platform overlay + secret-like paths rejected; pull before edit if tip may have moved (status/diff tipDrift); pull → edit → diff (blobSha) → push (CAS); no push during active agent run; UI agent does not use CLI pull; review on subdomain
 - Machine: global --json / --quiet; exit 0/2/3/4/5 (see help exit-codes)
 - deploy wait = optional build wait only; it is NOT go-live / publish
 - No runs continue, domains, billing, members, MCP, or git remotes in v1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontpage-host",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Frontpage CLI — manage your site from the terminal",
   "type": "module",
   "bin": {