gipity 1.0.397 → 1.0.399

package/dist/commands/sandbox.js

@@ -6,6 +6,7 @@ import { resolveProjectContext, getConfigPath } from '../config.js';
 import { sync } from '../sync.js';
 import { error as clrError, dim } from '../colors.js';
 import { run } from '../helpers/index.js';
+import { createProgressReporter, withSpinner } from '../progress.js';
 const LANG_MAP = {
     js: 'javascript',
     javascript: 'javascript',
@@ -159,15 +160,20 @@ GCC/Rust).
     // Bidirectional + CAS, so it's a cheap manifest check when nothing changed.
     // Symmetric with the post-run pull below. Skip in one-off mode (no project).
     if (getConfigPath()) {
-        await sync({ interactive: false });
+        await sync({ interactive: false, progress: opts.json ? undefined : createProgressReporter() });
     }
-    const res = await post(`/projects/${config.projectGuid}/sandbox/execute`, {
+    // The run blocks until the sandbox finishes (up to the timeout); animate the
+    // wait, then clear the spinner so stdout/stderr is the result. JSON skips it.
+    const doRun = () => post(`/projects/${config.projectGuid}/sandbox/execute`, {
         code: source,
         language,
         timeout: isNaN(timeout) ? 30 : timeout,
         input_files: opts.input,
         cwd,
     });
+    const res = opts.json
+        ? await doRun()
+        : await withSpinner('Running in sandbox…', doRun, { done: null });
     // Pull sandbox-written outputs down to the local cwd automatically. The
     // server has already mirrored them into the project (VFS) and handed back
     // the exact list, so honoring it here means files land locally without a
@@ -175,7 +181,7 @@ GCC/Rust).
     // `filesChanged` flag. Skip in one-off mode (no local project to sync into).
     const pulledLocal = !!(res.data.outputFiles?.length && getConfigPath());
     if (pulledLocal) {
-        await sync({ interactive: false });
+        await sync({ interactive: false, progress: opts.json ? undefined : createProgressReporter() });
     }
     if (opts.json) {
         console.log(JSON.stringify({ ...res.data, filesSynced: pulledLocal }));

package/dist/commands/sync.js

@@ -12,7 +12,11 @@ export const syncCommand = new Command('sync')
     try {
         // JSON mode stays machine-clean; otherwise show live progress on a TTY.
         const progress = opts.json ? undefined : createProgressReporter();
-        const result = await sync({ plan: opts.plan, force: opts.force, prune: opts.prune, progress });
+        // confirmMerge arms the uncertain-merge guard: a first-time sync into a
+        // folder that has its own files prompts on a TTY, proceeds with --yes, and
+        // fail-safe ABORTS when non-interactive without --yes - so a script never
+        // merges an unexpected folder into the project silently.
+        const result = await sync({ plan: opts.plan, force: opts.force, prune: opts.prune, confirmMerge: true, progress });
         if (opts.json) {
             console.log(JSON.stringify(result));
         }
@@ -33,7 +37,9 @@ export const syncCommand = new Command('sync')
             for (const e of result.errors)
                 console.error(clrError(e));
         }
-        if (result.errors.length > 0)
+        // A refused merge or any sync error is a non-zero exit so scripts/CI can
+        // detect that nothing was applied.
+        if (result.aborted || result.errors.length > 0)
             process.exit(1);
     }
     catch (err) {

package/dist/helpers/command.js

@@ -10,9 +10,24 @@ import { error as clrError } from '../colors.js';
  * Usage:
  *   .action((name, opts) => run('Create', async () => { ... }))
  */
+/**
+ * Print a command error. Out-of-credits is a recoverable, user-actionable
+ * state, so flag it plainly (and keep the server's message, which carries the
+ * buy link) - that way an agent reading this output, e.g. Claude Code, can tell
+ * the user they're out of Gipity credits and where to top up rather than
+ * treating it as a hard failure. Does not exit; the caller decides.
+ */
+export function printCommandError(label, err) {
+    if (err?.code === 'INSUFFICIENT_CREDITS') {
+        console.error(clrError(`${label} failed - out of Gipity credits.`));
+        console.error(err.message);
+        return;
+    }
+    console.error(clrError(`${label} failed: ${err.message}`));
+}
 export function run(label, action) {
     action().catch((err) => {
-        console.error(clrError(`${label} failed: ${err.message}`));
+        printCommandError(label, err);
         process.exit(1);
     });
 }

package/dist/helpers/sync.js

@@ -3,6 +3,7 @@
  */
 import { sync } from '../sync.js';
 import { muted, error as clrError } from '../colors.js';
+import { createProgressReporter } from '../progress.js';
 /**
  * Sync local files with the server before an action (deploy, test, scaffold).
  * Respects --no-sync and --json flags. Non-interactive: bulk-deletion guard
@@ -14,7 +15,14 @@ import { muted, error as clrError } from '../colors.js';
 export async function syncBeforeAction(opts) {
     if (opts.sync === false)
         return;
-    const result = await sync({ interactive: false, force: opts.force });
+    // Pass a progress reporter so a large pre-action upload shows the transfer
+    // bar instead of a silent pause (the reporter is a no-op on non-TTY / when
+    // piped, so JSON and headless output stay clean).
+    const result = await sync({
+        interactive: false,
+        force: opts.force,
+        progress: opts.json ? undefined : createProgressReporter(),
+    });
     if (result.applied > 0 && !opts.json) {
         console.log(muted(`Synced ${result.applied} change${result.applied > 1 ? 's' : ''}`));
     }

package/dist/index.js

@@ -57,6 +57,24 @@ import { bold, dim, brand, muted, success } from './colors.js';
 import { normalizeAliases } from './flag-aliases.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(resolve(__dirname, '../package.json'), 'utf-8'));
+// Local builds stamp dist/build-info.json (git SHA + dirty flag) via the npm
+// `postbuild` hook, so `-v` can show whether the linked binary is your latest
+// code. It is intentionally absent from published installs: the npm `files`
+// allowlist ships only dist/**/*.js, so a released CLI prints a clean
+// `v1.0.398` with no dev marker. package.json `version` stays the source of
+// truth for the published release; this marker never touches it.
+function versionLabel() {
+    const base = `v${pkg.version}`;
+    try {
+        const info = JSON.parse(readFileSync(resolve(__dirname, 'build-info.json'), 'utf-8'));
+        if (info?.sha)
+            return `${base} (dev ${info.sha}${info.dirty ? ', modified' : ''})`;
+    }
+    catch {
+        // No build-info.json (published install or pre-build) → clean version.
+    }
+    return base;
+}
 // Custom -v/--version output: include auth status so agents know whether
 // the next CLI call will succeed. Intercepted before Commander parses,
 // because Commander's built-in `.version()` only prints a string and exits.
@@ -79,7 +97,7 @@ const pkg = JSON.parse(readFileSync(resolve(__dirname, '../package.json'), 'utf-
             authLine = `${success('Logged in')} as ${auth.email}`;
         }
         console.log('');
-        console.log(`${brand(bold('Gipity'))} ${muted(`v${pkg.version}`)}`);
+        console.log(`${brand(bold('Gipity'))} ${muted(versionLabel())}`);
         console.log(authLine);
         console.log('');
         process.exit(0);
@@ -150,7 +168,7 @@ program.configureHelp({
         const padOpt = (s) => s.padEnd(optColWidth);
         const lines = [];
         lines.push('');
-        lines.push(`${brand(bold('Gipity CLI'))} ${muted(`v${pkg.version}`)}`);
+        lines.push(`${brand(bold('Gipity CLI'))} ${muted(versionLabel())}`);
         lines.push(dim(GIPITY_TAGLINE));
         lines.push(dim('Hosting, databases, deploys, workflows - one place. Pair with Claude Code or use standalone.'));
         lines.push(dim('Works with Claude Code, Codex, Aider, or any AI coding tool - no MCP server needed.'));

package/dist/platform.js

@@ -0,0 +1,26 @@
+import { execSync } from 'child_process';
+/**
+ * Resolve a command to something Node's spawn/spawnSync can launch directly.
+ *
+ * On Windows, npm-installed CLIs (npm, npx, gipity, claude) are `.cmd` batch
+ * shims, not `.exe`s. Node's spawn without `shell: true` cannot launch a bare
+ * `npm` - it fails with ENOENT and a null exit status. Resolving the real path
+ * (preferring `.exe`, falling back to `.cmd`) lets us spawn without `shell: true`
+ * (which would otherwise require escaping arguments).
+ */
+export function resolveCommand(cmd) {
+    if (process.platform !== 'win32')
+        return cmd;
+    try {
+        const lines = execSync(`where ${cmd}`, { encoding: 'utf-8' })
+            .split(/\r?\n/)
+            .map(l => l.trim())
+            .filter(Boolean);
+        // Prefer .exe (native) over .cmd (npm shim)
+        return lines.find(l => l.endsWith('.exe')) || lines.find(l => l.endsWith('.cmd')) || cmd;
+    }
+    catch {
+        return `${cmd}.cmd`;
+    }
+}
+//# sourceMappingURL=platform.js.map

package/dist/progress.js

@@ -1,33 +1,57 @@
 // ── Gipity CLI Progress Reporter ────────────────────────────────────────
 // One central place for long-running terminal feedback, so commands don't
-// each reinvent status lines. Two channels:
+// each reinvent status lines. Three channels, one shared visual vocabulary:
 //
 //   phase(msg)              - a discrete step with no measurable size
 //                             (scanning, hashing). Prints one committed line.
-//   transfer(label, n, tot) - a determinate byte transfer. Renders a single
-//                             in-place bar that updates as bytes move.
+//   transfer(label, n, tot) - a DETERMINATE byte transfer. Renders a single
+//                             in-place bar that fills as bytes move.
+//   spinner(label)          - an INDETERMINATE wait (a server call where we
+//                             can't measure bytes: deploy, generate, chat).
+//                             Renders the SAME-width track as transfer(), but
+//                             with a short block that bounces left↔right plus
+//                             an elapsed timer, so a long wait never reads as
+//                             frozen. Settles to a committed ✓/✗ line.
 //
 // On a non-TTY (piped output, hook-driven sync, headless -p) the reporter is a
 // silent no-op - no `\r` spam in logs. Colors come from ./colors so the bar
 // matches the rest of the CLI (orange fill + percentage).
-import { brand, brandBold, muted, dim } from './colors.js';
+import { brand, brandBold, muted, dim, success, error as clrError } from './colors.js';
 import { formatSize } from './utils.js';
 const CLEAR_TO_EOL = '\x1b[K';
 const BAR_WIDTH = 18;
 const RENDER_THROTTLE_MS = 60;
+// Indeterminate bounce: a short block sliding across the same BAR_WIDTH track
+// the determinate bar fills. Frame cadence is slow enough to read, fast enough
+// to feel alive.
+const SPIN_BLOCK = 5;
+const SPIN_FRAME_MS = 90;
+/** Compact elapsed: "8s", "1m 04s". Keeps the timer narrow and glanceable. */
+function formatElapsed(ms) {
+    const s = Math.floor(ms / 1000);
+    if (s < 60)
+        return `${s}s`;
+    const m = Math.floor(s / 60);
+    return `${m}m ${String(s % 60).padStart(2, '0')}s`;
+}
 class TerminalProgress {
-    /** True while an in-place transfer line is on screen and not yet committed. */
+    /** True while an in-place transfer/spinner line is on screen and not committed. */
     liveOpen = false;
     lastRenderAt = 0;
     /** The label of the current transfer session; a change starts a fresh one. */
     barLabel = null;
     /** True once the current session hit 100% - late/overshoot ticks are dropped. */
     barSettled = false;
+    /** Active indeterminate spinner timer, if any. */
+    spinTimer = null;
     phase(message) {
+        this.stopSpinTimer();
         this.commitLive();
         process.stdout.write(`  ${muted(message)}\n`);
     }
     transfer(label, doneBytes, totalBytes) {
+        // A determinate transfer takes over the live line from any spinner.
+        this.stopSpinTimer();
         // A new label begins a fresh transfer session (e.g. downloads → uploads on
         // the same reporter). Within a session, once we've drawn the 100% frame we
         // drop any further ticks - download byte totals are estimated, so the wire
@@ -46,32 +70,115 @@ class TerminalProgress {
             return;
         this.lastRenderAt = now;
         this.liveOpen = true;
-        process.stdout.write('\r' + this.frame(label, doneBytes, totalBytes) + CLEAR_TO_EOL);
+        process.stdout.write('\r' + this.barFrame(label, doneBytes, totalBytes) + CLEAR_TO_EOL);
         if (finished) {
             this.commitLive();
             this.barSettled = true;
         }
     }
+    spinner(label) {
+        this.stopSpinTimer();
+        this.commitLive();
+        const startedAt = Date.now();
+        let tick = 0;
+        const draw = () => {
+            this.liveOpen = true;
+            process.stdout.write('\r' + this.spinFrame(label, tick++, Date.now() - startedAt) + CLEAR_TO_EOL);
+        };
+        draw();
+        this.spinTimer = setInterval(draw, SPIN_FRAME_MS);
+        // Don't let the animation keep the event loop (and process) alive on its own.
+        this.spinTimer.unref?.();
+        const settle = (icon, message) => {
+            this.stopSpinTimer();
+            if (this.liveOpen)
+                process.stdout.write('\r');
+            if (icon) {
+                // Replace the spinner line in place with a committed ✓/✗ result line.
+                const elapsed = muted(formatElapsed(Date.now() - startedAt));
+                process.stdout.write(`  ${icon}  ${muted(message ?? label)}  ${elapsed}${CLEAR_TO_EOL}\n`);
+            }
+            else if (this.liveOpen) {
+                // Silent stop: clear the spinner row but DON'T advance - leave the
+                // cursor at column 0 so the command's own result overwrites the row
+                // instead of leaving a blank line behind it.
+                process.stdout.write(CLEAR_TO_EOL);
+            }
+            this.liveOpen = false;
+        };
+        return {
+            succeed: (m) => settle(success('✓'), m),
+            fail: (m) => settle(clrError('✗'), m),
+            stop: () => settle(null),
+        };
+    }
     finish() {
+        this.stopSpinTimer();
         this.commitLive();
     }
+    stopSpinTimer() {
+        if (this.spinTimer) {
+            clearInterval(this.spinTimer);
+            this.spinTimer = null;
+        }
+    }
     commitLive() {
         if (!this.liveOpen)
             return;
         process.stdout.write('\n');
         this.liveOpen = false;
     }
-    frame(label, done, total) {
+    barFrame(label, done, total) {
         const pct = total > 0 ? Math.min(100, Math.floor((done / total) * 100)) : 100;
         const filled = Math.round((pct / 100) * BAR_WIDTH);
         const bar = brand('█'.repeat(filled)) + dim('░'.repeat(BAR_WIDTH - filled));
         const sizes = muted(`${formatSize(done)} / ${formatSize(total)}`);
         return `  ${muted(label)}  ${bar}  ${brandBold(`${pct}%`)}  ${sizes}`;
     }
+    spinFrame(label, tick, elapsedMs) {
+        // Ping-pong the block's left edge between 0 and (BAR_WIDTH - SPIN_BLOCK).
+        const span = BAR_WIDTH - SPIN_BLOCK;
+        const cycle = span * 2;
+        const phase = tick % cycle;
+        const pos = phase <= span ? phase : cycle - phase;
+        const bar = dim('░'.repeat(pos)) +
+            brand('█'.repeat(SPIN_BLOCK)) +
+            dim('░'.repeat(BAR_WIDTH - pos - SPIN_BLOCK));
+        return `  ${muted(label)}  ${bar}  ${muted(formatElapsed(elapsedMs))}`;
+    }
 }
-const NOOP = { phase() { }, transfer() { }, finish() { } };
+const NOOP_SPINNER = { succeed() { }, fail() { }, stop() { } };
+const NOOP = {
+    phase() { }, transfer() { }, finish() { },
+    spinner: () => NOOP_SPINNER,
+};
 /** A reporter that draws on a TTY and stays silent otherwise. */
 export function createProgressReporter() {
     return process.stdout.isTTY ? new TerminalProgress() : NOOP;
 }
+/**
+ * Run an indeterminate async operation behind the standard bouncing-block
+ * spinner: animate `label` while it's in flight, then settle. On success the
+ * line becomes a ✓ (`done`, or `label` if omitted) — or, when `done` is null,
+ * the spinner just clears silently (use this when the command prints its own
+ * result, e.g. a chat reply). On throw it becomes a ✗ and re-throws so the
+ * caller's own error handling still runs. On a non-TTY this is a silent
+ * pass-through. The single wrapper every command uses for a server call whose
+ * size/duration we can't measure (deploy, generate, chat, sandbox, …).
+ */
+export async function withSpinner(label, fn, opts = {}) {
+    const sp = (opts.reporter ?? createProgressReporter()).spinner(label);
+    try {
+        const result = await fn();
+        if (opts.done === null)
+            sp.stop();
+        else
+            sp.succeed(opts.done);
+        return result;
+    }
+    catch (e) {
+        sp.fail();
+        throw e;
+    }
+}
 //# sourceMappingURL=progress.js.map

package/dist/relay/daemon.js

@@ -21,6 +21,7 @@
  * See docs/feature-backlog/gipity-relay-phases.md (Phase A Step 7).
  */
 import { spawn } from 'child_process';
+import { resolveCommand } from '../platform.js';
 import { appendFileSync, mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, closeSync, openSync, unlinkSync } from 'fs';
 import { stat, readFile } from 'fs/promises';
 import { createInterface } from 'readline';
@@ -631,6 +632,12 @@ async function handleDispatch(d) {
     // prompt is correct (same authority as running `claude -p` in a local
     // terminal yourself).
     const args = ['claude', '-p', d.message, '--permission-mode', 'bypassPermissions'];
+    // Per-chat model: the user picked it with `/model` in the web CLI. `gipity
+    // claude` forwards --model straight through to the `claude` binary, which
+    // honors it on both a fresh session and a --resume. null => agent default.
+    if (d.model) {
+        args.push('--model', d.model);
+    }
     if (d.kind === 'resume' && d.remote_session_id) {
         args.push('--resume', d.remote_session_id);
     }
@@ -855,7 +862,10 @@ export async function killRunningForConv(convGuid) {
  *  resolution (the daemon itself doesn't chdir into projects).
  *  Non-blocking on failure - caller catches and logs. */
 async function spawnSync(cwd, timeoutMs) {
-    const cmd = process.env.GIPITY_RELAY_CLAUDE_CMD || 'gipity';
+    // resolveCommand: on Windows the bare `gipity` is a .cmd shim that spawn
+    // can't launch without an explicit path. An explicit env override is used
+    // verbatim (it may be a full path); only the default name is resolved.
+    const cmd = process.env.GIPITY_RELAY_CLAUDE_CMD || resolveCommand('gipity');
     return new Promise((resolve, reject) => {
         const child = spawn(cmd, ['sync', '--json'], {
             cwd,
@@ -901,7 +911,10 @@ async function spawnSync(cwd, timeoutMs) {
     });
 }
 export async function spawnGipityClaude(args, cwd, d) {
-    const cmd = process.env.GIPITY_RELAY_CLAUDE_CMD || 'gipity';
+    // resolveCommand: on Windows the bare `gipity` is a .cmd shim that spawn
+    // can't launch without an explicit path. An explicit env override is used
+    // verbatim (it may be a full path); only the default name is resolved.
+    const cmd = process.env.GIPITY_RELAY_CLAUDE_CMD || resolveCommand('gipity');
     // Inject stream-json flags here rather than at the call site so every
     // relay spawn path gets the same protocol. `--verbose` is required by
     // Claude Code when combining `-p` with `--output-format stream-json`.

package/dist/relay/onboarding.js

@@ -30,10 +30,13 @@ export function ensureDaemonRunning() {
     if (state.isDaemonRunning())
         return;
     try {
-        const child = spawn(resolveCliPath(), ['relay', 'run'], {
+        // Launch via the current Node binary + the CLI entry script. The previous
+        // `shell: true` on Windows ran the .js path through the shell, where the
+        // file association (Windows Script Host, not Node) would mis-handle it.
+        // process.execPath is cross-platform and needs no shell.
+        const child = spawn(process.execPath, [resolveCliPath(), 'relay', 'run'], {
             detached: true,
             stdio: 'ignore',
-            shell: process.platform === 'win32',
         });
         child.unref();
     }

package/dist/setup.js

@@ -5,6 +5,7 @@ import { resolve, join, dirname } from 'path';
 import { homedir } from 'os';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import { spawnSync } from 'child_process';
+import { resolveCommand } from './platform.js';
 import { SKILLS_CONTENT, BUILD_VS_NON_BUILD_RULE, DEFINITION_OF_DONE } from './knowledge.js';
 export { SKILLS_CONTENT };
 /** Canonical list of workstation artifacts that are NOT part of the project.
@@ -268,11 +269,15 @@ export function ensureGipityPluginInstalled() {
     // Refresh the marketplace clone so `install` resolves the current version,
     // then (re)install at user scope - idempotent, and upgrades an older or
     // project-scoped install to the current one at user scope.
-    spawnSync('claude', ['plugin', 'marketplace', 'update', GIPITY_MARKETPLACE_NAME], {
+    // resolveCommand: on Windows `claude` is a .cmd shim that spawn can't launch
+    // without an explicit path, so resolve it (otherwise the install silently
+    // ENOENTs and the plugin's hooks never land at user scope).
+    const claudeCmd = resolveCommand('claude');
+    spawnSync(claudeCmd, ['plugin', 'marketplace', 'update', GIPITY_MARKETPLACE_NAME], {
         stdio: 'ignore',
         timeout: 120_000,
     });
-    spawnSync('claude', ['plugin', 'install', GIPITY_PLUGIN_ID, '--scope', 'user'], {
+    spawnSync(claudeCmd, ['plugin', 'install', GIPITY_PLUGIN_ID, '--scope', 'user'], {
         stdio: 'ignore',
         timeout: 120_000,
     });
@@ -478,7 +483,10 @@ export function setupGitignore() {
     const entries = ['.gipity/', '.gipity.json'];
     if (existsSync(gitignorePath)) {
         let content = readFileSync(gitignorePath, 'utf-8');
-        const lines = content.split('\n');
+        // Split on \r?\n so a CRLF .gitignore (the Windows default) doesn't leave a
+        // trailing \r on each entry - otherwise `lines.includes('.gipity/')` never
+        // matches '.gipity/\r' and every run re-appends the entries as duplicates.
+        const lines = content.split(/\r?\n/);
         const toAdd = entries.filter(e => !lines.includes(e));
         if (toAdd.length > 0) {
             content = content.trimEnd() + '\n' + toAdd.join('\n') + '\n';

package/dist/sync.js

@@ -235,6 +235,11 @@ async function downloadAll(projectGuid, onBytes) {
         });
         extract.on('finish', () => resolve(files));
         extract.on('error', reject);
+        // pipe() does NOT forward source-stream errors to the destination, so a
+        // truncated/aborted HTTP body would otherwise surface as a clean tar
+        // 'finish' with a partial file set. Reject explicitly so a short download is
+        // an error the caller can recover from, never a silent partial.
+        stream.on('error', reject);
         stream.pipe(extract);
     });
 }
@@ -579,6 +584,60 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
             deferredDeletes: 0,
         };
     }
+    // Uncertain-merge guard (armed via confirmMerge): syncing INTO a populated
+    // directory we've never synced for this project (empty baseline + local files
+    // that would upload or collide). Local-only files get pushed UP into the
+    // project and same-path differences fork into conflict copies - a two-way
+    // merge that may be unintended. Nothing here can delete.
+    //
+    // Three ways to resolve it, so both outcomes are scriptable:
+    //   --yes / autoConfirm → proceed (merge confirmed)
+    //   interactive TTY      → prompt the user
+    //   non-interactive      → fail safe: ABORT rather than merge blindly
+    if (opts.confirmMerge &&
+        remote.size > 0 && // project already has files - a real merge target
+        Object.keys(baseline.files).length === 0 && // we've never synced this folder for it
+        (planned.uploads > 0 || planned.conflicts > 0) // and local content would push up or collide
+    ) {
+        const f = (n) => `${n} file${n === 1 ? '' : 's'}`;
+        const shape = [`    Server: ${f(remote.size)}   ·   Local: ${f(local.size)}`];
+        if (planned.downloads > 0)
+            shape.push(`    ↓ download ${f(planned.downloads)} from the project into this folder`);
+        if (planned.uploads > 0)
+            shape.push(`    ↑ upload ${f(planned.uploads)} from this folder INTO the project (they become part of it)`);
+        if (planned.conflicts > 0)
+            shape.push(`    ! ${f(planned.conflicts)} differ on both sides — both kept (your copy is renamed)`);
+        const abort = () => ({
+            plan: planned, applied: 0, skipped: planned.actions.length, errors: [],
+            summary: [
+                `This folder has files that haven't been synced with this project yet — merge not confirmed.`,
+                ...shape,
+                `Re-run with --yes to merge, or sync into an empty folder.`,
+            ].join('\n'),
+            deferredDeletes: 0, aborted: true,
+        });
+        if (getAutoConfirm()) {
+            // --yes: proceed with the merge; the caller reports the applied counts.
+        }
+        else if (interactive) {
+            const answer = await prompt([
+                '',
+                `  This folder has files that haven't been synced with this project yet.`,
+                `  Syncing here MERGES the two — nothing is deleted:`,
+                '',
+                ...shape,
+                '',
+                `  Continue? [y/N]: `,
+            ].join('\n'));
+            if (!/^(y|yes|continue)$/i.test(answer.trim()))
+                return abort();
+        }
+        else {
+            // Non-interactive and not confirmed: don't silently merge a folder we
+            // weren't told to. `--yes` opts in.
+            return abort();
+        }
+    }
     // Bulk-delete guard over the *planned* deletes.
     const knownFiles = local.size + remote.size;
     const deletesOk = await bulkDeleteGuard(planned, knownFiles, { ...opts, interactive });
@@ -590,8 +649,14 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
     // ── Pre-fetch remote bytes once for all downloads (conflict-originating
     //    remote versions are fetched on demand after 409). ──
     const downloadedBytes = new Map();
-    const needsBulkDownload = plannedToApply.some(a => a.kind === 'download' || a.kind === 'conflict');
-    if (needsBulkDownload) {
+    // Set when the download phase could not retrieve every byte the plan needs.
+    // A delete is only safe against a complete, authoritative view, so an
+    // incomplete download disarms the deletes pass below - this is what breaks
+    // the "truncated pull → files missing locally → next sync deletes them"
+    // amplification loop.
+    let downloadIncomplete = false;
+    const wantedDownloads = plannedToApply.filter(a => a.kind === 'download' || a.kind === 'conflict');
+    if (wantedDownloads.length) {
         // The tree endpoint streams the *whole* remote tree as one tar (the caller
         // then picks out only the paths it planned to apply), so the bytes that
         // actually move = the sum of every remote file's size. That's the honest
@@ -609,22 +674,46 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
             : undefined;
         try {
             const all = await downloadAll(config.projectGuid, onBytes);
-            for (const a of plannedToApply) {
-                if (a.kind === 'download' || a.kind === 'conflict') {
-                    const buf = all.get(a.path);
-                    if (buf)
-                        downloadedBytes.set(a.path, buf);
-                }
+            for (const a of wantedDownloads) {
+                const buf = all.get(a.path);
+                if (buf)
+                    downloadedBytes.set(a.path, buf);
             }
         }
         catch (err) {
-            errors.push(`Download batch failed: ${err.message}`);
+            // The bulk tar can truncate mid-stream on a large project (transport or
+            // proxy timeout) and either reject here or "finish" with a partial set.
+            // Either way we fall through to the single-file recovery below rather than
+            // proceeding on a half-empty tree - a partial download must never be
+            // mistaken for a complete one.
+            errors.push(`Bulk download incomplete (${err.message}); recovering files individually…`);
         }
         finally {
             // Settle the bar even if the extracted-byte tally fell short of the
             // estimate (the live line stays open until something hits 100% or finish()).
             p?.finish();
         }
+        // Recover whatever the bulk tar dropped over the reliable single-file
+        // endpoint. This is what lets a project whose tar keeps truncating still
+        // sync to completion - and what recovers a checkout left half-downloaded by
+        // an earlier truncated pull.
+        const missing = wantedDownloads.filter(a => !downloadedBytes.has(a.path));
+        if (missing.length) {
+            p?.phase(`Recovering ${missing.length} file${missing.length === 1 ? '' : 's'} the bulk download dropped…`);
+            for (const a of missing) {
+                let buf = null;
+                for (let attempt = 0; attempt < 3 && !buf; attempt++) {
+                    buf = await fetchOne(config.projectGuid, a.path);
+                }
+                if (buf)
+                    downloadedBytes.set(a.path, buf);
+            }
+        }
+        // Anything still missing is a hard failure: the plan needs bytes we could
+        // not retrieve. Mark the download incomplete so the deletes pass is skipped;
+        // the per-path "Download missing" errors below carry the detail.
+        if (wantedDownloads.some(a => !downloadedBytes.has(a.path)))
+            downloadIncomplete = true;
     }
     // ── Writes pass: uploads, downloads, conflicts (rename + download + upload copy) ──
     // We serialize conflicts; uploads run with bounded concurrency.
@@ -911,7 +1000,17 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
         }
     }
     // ── Deletes pass ──
+    // A delete is only safe against a complete, authoritative view. If the
+    // download phase couldn't retrieve everything it planned, the local tree is
+    // not a trustworthy deletion signal - this is exactly how a truncated pull
+    // turns "files we failed to fetch" into "delete those files." Skip ALL deletes
+    // this run and let a clean sync replan them once the pull succeeds.
+    let deletesSkippedIncomplete = 0;
     for (const a of plannedToApply) {
+        if (downloadIncomplete && (a.kind === 'delete-local' || a.kind === 'delete-remote')) {
+            deletesSkippedIncomplete++;
+            continue;
+        }
         if (a.kind === 'delete-local') {
             try {
                 unlinkSync(resolveInRoot(root, a.path));
@@ -977,6 +1076,10 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
             }
         }
     }
+    if (deletesSkippedIncomplete > 0) {
+        errors.push(`Skipped ${deletesSkippedIncomplete} deletion${deletesSkippedIncomplete === 1 ? '' : 's'} because the download was incomplete - ` +
+            `nothing was deleted. Re-run \`gipity sync\` once the pull finishes to apply any real deletions.`);
+    }
     // Clean up empty local directories after delete-local actions.
     cleanupEmptyDirs(root, config.ignore);
     baseline.lastFullSync = new Date().toISOString();