gipity 1.0.409 → 1.0.410

package/dist/sync.js

@@ -21,9 +21,10 @@
  * `name (conflict from <host> YYYY-MM-DD-HHMMSS).ext` and then uploaded on
  * the next pass so every client sees it. No content merging, ever.
  */
-import { writeFileSync, mkdirSync, existsSync, statSync, unlinkSync, readdirSync, rmdirSync, readFileSync, renameSync, openSync, closeSync, utimesSync } from 'fs';
+import { writeFileSync, mkdirSync, existsSync, statSync, lstatSync, unlinkSync, readdirSync, rmdirSync, readFileSync, renameSync, openSync, closeSync, utimesSync, realpathSync } from 'fs';
 import { join, relative, dirname, extname, resolve, sep } from 'path';
 import { hostname } from 'os';
+import { createHash } from 'crypto';
 import { get, del, downloadStream, ApiError } from './api.js';
 import { requireConfig, shouldIgnore, getConfigPath } from './config.js';
 import { formatSize, prompt, getAutoConfirm } from './utils.js';
@@ -263,9 +264,33 @@ function normalizeTreePath(p) {
 export function resolveInRoot(root, relPath) {
     const rootResolved = resolve(root);
     const full = resolve(rootResolved, relPath);
+    // Fast lexical pre-filter.
     if (full !== rootResolved && !full.startsWith(rootResolved + sep)) {
         throw new Error(`Refusing path outside project root: ${relPath}`);
     }
+    // Symlink-aware containment (FIX M6a): a lexical check can't see that a
+    // symlinked directory INSIDE the project points its real location outside the
+    // root, so a remote-supplied path could still write/rename/delete outside the
+    // project - and the relay daemon runs sync unattended. Resolve the nearest
+    // existing ancestor (the leaf may not exist yet) with realpath and assert its
+    // real path is still inside the project's real root. Realpath failures (root or
+    // ancestors that don't exist yet) fall through to the lexical result - there's
+    // no symlink to escape through when nothing exists.
+    try {
+        const rootReal = realpathSync(rootResolved);
+        let ancestor = full;
+        while (!existsSync(ancestor) && dirname(ancestor) !== ancestor)
+            ancestor = dirname(ancestor);
+        const ancestorReal = realpathSync(ancestor);
+        if (ancestorReal !== rootReal && !ancestorReal.startsWith(rootReal + sep)) {
+            throw new Error(`Refusing path outside project root (symlink escape): ${relPath}`);
+        }
+    }
+    catch (e) {
+        if (e instanceof Error && /outside project root/.test(e.message))
+            throw e;
+        // else: realpath couldn't resolve (nonexistent root/ancestor) - keep lexical result.
+    }
     return full;
 }
 async function fetchRemote(projectGuid) {
@@ -346,46 +371,36 @@ async function downloadAll(projectGuid, onBytes) {
     const stream = await downloadStream(`/projects/${projectGuid}/files/tree?content=tar`);
     return extractTarToMap(stream, DOWNLOAD_IDLE_MS, onBytes);
 }
-async function fetchOne(projectGuid, path) {
-    // Exact single-file read first. `/files/read` is the exact-path endpoint
-    // (what `gipity file cat` uses); it returns text content, reliable for the
-    // config/code files that actually hit a restore. Binary falls through to the
-    // tar path below, which now resolves an exact file path server-side (the
-    // /files/tree endpoint stats a non-directory `path` and packs that one file
-    // under its full name). Before that fix the tar endpoint treated `path` as a
-    // DIRECTORY prefix, so a single file came back empty and a dropped binary
-    // (e.g. an agent-generated image) could never be recovered.
-    try {
-        const res = await get(`/projects/${projectGuid}/files/read?path=${encodeURIComponent(path)}`);
-        const content = res?.data?.content;
-        if (typeof content === 'string' && isTextMime(res?.data?.mime, path)) {
-            return Buffer.from(content, 'utf-8');
-        }
-    }
-    catch {
-        /* fall through to the tar path */
-    }
+async function fetchOne(projectGuid, path, expectedSha) {
+    // Byte-exact single-file recovery over the tar path only (FIX M3). We used to
+    // prefer `/files/read` for text-extension files, but that returns the content as
+    // a JSON *string* which we re-encoded as UTF-8 - a non-UTF-8 file (latin-1
+    // .csv/.txt) came back replacement-mangled, and the downloads pass then recorded
+    // the REMOTE sha against those wrong bytes, so the next sync uploaded the
+    // corruption over the good remote copy. The tar path packs the raw stored blob
+    // (the /files/tree endpoint stats a non-directory `path` and packs that one file
+    // under its full name), so the buffer is identical regardless of encoding. It's
+    // idle-guarded like the bulk path so a stalled single file can't wedge the sync.
     try {
         const stream = await downloadStream(`/projects/${projectGuid}/files/tree?content=tar&path=${encodeURIComponent(path)}`);
-        // Same idle-guarded extraction as the bulk path; keep only the one entry we
-        // asked for. The recovery path must not hang either, or a single stalled file
-        // wedges the whole sync.
         const want = normalizeTreePath(path);
         const files = await extractTarToMap(stream, DOWNLOAD_IDLE_MS, undefined, (p) => p === want);
-        return files.get(want) ?? null;
+        const buf = files.get(want) ?? null;
+        // Verify the bytes against the expected content hash when the caller knows it
+        // (the recovery path records this sha into the baseline). A mismatch means a
+        // truncated/partial entry - treat it as a failed fetch and leave the file for
+        // the tar/next run rather than writing bytes that don't match what we'll record.
+        if (buf && expectedSha) {
+            const sha = createHash('sha256').update(buf).digest('hex');
+            if (sha !== expectedSha)
+                return null;
+        }
+        return buf;
     }
     catch {
         return null;
     }
 }
-// Treat a file as text (safe to round-trip through `/files/read`'s string body)
-// from its mime or, failing that, a code/config extension. Binary needs the
-// byte-exact tar path.
-function isTextMime(mime, path) {
-    if (mime && (mime.startsWith('text/') || /(json|javascript|xml|yaml|x-sh|sql)/.test(mime)))
-        return true;
-    return /\.(js|mjs|cjs|ts|tsx|jsx|json|yaml|yml|sql|md|txt|html|css|svg|csv|env|sh|toml|ini)$/i.test(path);
-}
 // ─── Classification ────────────────────────────────────────────
 function classifyLocal(info, base) {
     if (!info && !base)
@@ -426,6 +441,22 @@ export function conflictedCopyName(path) {
 // ─── Plan ─────────────────────────────────────────────────────
 export function plan(local, remote, baseline) {
     const actions = [];
+    const baselineDrops = [];
+    const baselineAdopts = [];
+    // Record the agreed (content-match) state into the baseline when it's missing or
+    // stale, so a locally-and-remotely-identical file is a known synced pair going
+    // forward. Size/mtime mirror what the scanner records (they key its hash cache);
+    // serverVersion + sha come from the agreed remote/local state. (FIX M1)
+    const adoptIfNeeded = (p, L, R) => {
+        const entry = {
+            size: L.size, mtime: L.mtime, sha256: L.sha256, serverVersion: R.serverVersion,
+        };
+        const b = baseline[p];
+        if (!b || b.sha256 !== entry.sha256 || b.serverVersion !== entry.serverVersion
+            || b.size !== entry.size || b.mtime !== entry.mtime) {
+            baselineAdopts.push({ path: p, entry });
+        }
+    };
     const allPaths = new Set([...local.keys(), ...remote.keys(), ...Object.keys(baseline)]);
     for (const path of allPaths) {
         const L = local.get(path);
@@ -451,15 +482,16 @@ export function plan(local, remote, baseline) {
         // unchanged × unchanged → noop
         if (lSide === 'unchanged' && rSide === 'unchanged')
             continue;
-        // unchanged × modified → download, but ONLY if the remote genuinely advanced.
-        // Guards a read-after-write race: right after a local write+push, the push can
-        // advance the local baseline to the new version while the remote tree API still
-        // serves the OLD bytes (stale read). That makes remote look "modified" vs an
-        // already-updated baseline, and a blind download would silently clobber the
-        // just-written local file with a stale older version. A real remote change
-        // always carries a strictly newer serverVersion; an equal/older one is stale.
+        // unchanged × modified → download. server_version is per-NODE, not per-path:
+        // a server-side delete+recreate mints a fresh node whose counter restarts at 1,
+        // so the old `R.serverVersion <= B.serverVersion` guard wrongly treated a
+        // genuine recreate (e.g. remote v1 vs baseline v5) as a stale read and skipped
+        // it forever. Skip ONLY a true no-op re-read - the same node version AND the
+        // same content. Since rSide 'modified' already means the sha differs from
+        // baseline (or the remote sha is unknown), a regressed/equal counter with
+        // different bytes falls through to a real download. (FIX H7a)
         if (lSide === 'unchanged' && rSide === 'modified') {
-            if (B && R.serverVersion <= B.serverVersion)
+            if (B && R.serverVersion === B.serverVersion && R.sha256 === B.sha256)
                 continue;
             actions.push({ path, kind: 'download', remoteSize: R.size });
             continue;
@@ -476,8 +508,10 @@ export function plan(local, remote, baseline) {
         }
         // modified × modified → conflict (or noop if content happens to match)
         if (lSide === 'modified' && rSide === 'modified') {
-            if (shasMatch)
+            if (shasMatch) {
+                adoptIfNeeded(path, L, R);
                 continue;
+            }
             actions.push({
                 path, kind: 'conflict',
                 localSize: L.size, remoteSize: R.size,
@@ -497,8 +531,10 @@ export function plan(local, remote, baseline) {
         }
         // added × added → noop if shas match, else conflict
         if (lSide === 'added' && rSide === 'added') {
-            if (shasMatch)
+            if (shasMatch) {
+                adoptIfNeeded(path, L, R);
                 continue;
+            }
             actions.push({
                 path, kind: 'conflict',
                 localSize: L.size, remoteSize: R.size,
@@ -508,9 +544,12 @@ export function plan(local, remote, baseline) {
             });
             continue;
         }
-        // deleted × absent → baseline is stale, drop it silently (no action)
-        if (lSide === 'deleted' && rSide === 'absent')
+        // deleted × absent → baseline is stale, drop it (no action). Actually pruning
+        // the entry (FIX H7b) stops it accumulating and masking a future recreate.
+        if (lSide === 'deleted' && rSide === 'absent') {
+            baselineDrops.push(path);
             continue;
+        }
         // deleted × unchanged → delete remote. Use the remote's CURRENT version for
         // the optimistic-delete check, not the baseline's: the content can be equal
         // (rSide 'unchanged' is sha-based) while the server version moved ahead - the
@@ -520,11 +559,12 @@ export function plan(local, remote, baseline) {
             actions.push({ path, kind: 'delete-remote', remoteSize: R.size, expectedServerVersion: R.serverVersion });
             continue;
         }
-        // deleted × modified → remote wins, restore locally — but only if the remote
-        // actually advanced past the baseline. A stale (older/equal) remote read must
-        // not resurrect a file the user intentionally deleted.
+        // deleted × modified → remote wins, restore locally. Skip ONLY a true no-op
+        // re-read (same node version AND same content); a regressed counter is a
+        // delete+recreate (fresh node, restarted counter), which is a genuine remote
+        // change to restore, not a stale read to ignore. (FIX H7a)
         if (lSide === 'deleted' && rSide === 'modified') {
-            if (B && R.serverVersion <= B.serverVersion)
+            if (B && R.serverVersion === B.serverVersion && R.sha256 === B.sha256)
                 continue;
             actions.push({
                 path, kind: 'download', remoteSize: R.size,
@@ -532,9 +572,11 @@ export function plan(local, remote, baseline) {
             });
             continue;
         }
-        // deleted × deleted → noop, drop baseline
-        if (lSide === 'deleted' && rSide === 'deleted')
+        // deleted × deleted → noop, drop baseline (FIX H7b: actually prune it)
+        if (lSide === 'deleted' && rSide === 'deleted') {
+            baselineDrops.push(path);
             continue;
+        }
         // Remaining combinations are impossible given baseline semantics.
     }
     const uploads = actions.filter(a => a.kind === 'upload').length;
@@ -542,7 +584,7 @@ export function plan(local, remote, baseline) {
     const deletesLocal = actions.filter(a => a.kind === 'delete-local').length;
     const deletesRemote = actions.filter(a => a.kind === 'delete-remote').length;
     const conflicts = actions.filter(a => a.kind === 'conflict').length;
-    return { actions, uploads, downloads, deletesLocal, deletesRemote, conflicts };
+    return { actions, uploads, downloads, deletesLocal, deletesRemote, conflicts, baselineDrops, baselineAdopts };
 }
 // ─── Apply ─────────────────────────────────────────────────────
 function formatAction(a) {
@@ -731,11 +773,21 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
             return abort();
         }
     }
-    // Bulk-delete guard over the *planned* deletes.
-    const knownFiles = local.size + remote.size;
-    const deletesOk = await bulkDeleteGuard(planned, knownFiles, { ...opts, interactive });
-    // Filter actions based on guard
-    const plannedToApply = deletesOk ? planned.actions : planned.actions.filter(a => a.kind !== 'delete-local' && a.kind !== 'delete-remote');
+    // Bulk-delete guard over the *planned* deletes. Count DISTINCT paths across
+    // local ∪ remote (FIX M7): summing the two sizes double-counts every synced
+    // file, roughly doubling the denominator so the "delete ≥25% of the tree"
+    // trip-wire needed ~50% before it fired. A set union reflects the real tree size.
+    const knownFiles = new Set([...local.keys(), ...remote.keys()]).size;
+    // Pre-authorized deletions (FIX M5): a caller that owns a specific set of paths
+    // (e.g. `gipity remove` deleting a kit's files) whitelists them so they bypass
+    // the guard, while any OTHER pending deletion is still counted and guarded.
+    const whitelist = new Set((opts.deleteWhitelist ?? []).map(normalizeTreePath));
+    const isDelete = (a) => a.kind === 'delete-local' || a.kind === 'delete-remote';
+    const guardDeletesLocal = planned.actions.filter(a => a.kind === 'delete-local' && !whitelist.has(a.path)).length;
+    const guardDeletesRemote = planned.actions.filter(a => a.kind === 'delete-remote' && !whitelist.has(a.path)).length;
+    const deletesOk = await bulkDeleteGuard({ ...planned, deletesLocal: guardDeletesLocal, deletesRemote: guardDeletesRemote }, knownFiles, { ...opts, interactive });
+    // Filter actions based on guard - but always keep the caller's whitelisted deletes.
+    const plannedToApply = deletesOk ? planned.actions : planned.actions.filter(a => !isDelete(a) || whitelist.has(a.path));
     const skippedByGuard = planned.actions.length - plannedToApply.length;
     const errors = [];
     let applied = 0;
@@ -794,9 +846,13 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
         if (missing.length) {
             p?.phase(`Recovering ${missing.length} file${missing.length === 1 ? '' : 's'} the bulk download dropped…`);
             for (const a of missing) {
+                // Verify against the remote's content hash: the downloads pass records
+                // this sha into the baseline, so bytes that don't match it must be
+                // rejected (FIX M3) rather than written and then re-uploaded as corruption.
+                const expectedSha = remote.get(a.path)?.sha256 ?? undefined;
                 let buf = null;
                 for (let attempt = 0; attempt < 3 && !buf; attempt++) {
-                    buf = await fetchOne(config.projectGuid, a.path);
+                    buf = await fetchOne(config.projectGuid, a.path, expectedSha);
                 }
                 if (buf)
                     downloadedBytes.set(a.path, buf);
@@ -813,6 +869,52 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
     const uploadQueue = plannedToApply.filter(a => a.kind === 'upload');
     const downloadQueue = plannedToApply.filter(a => a.kind === 'download');
     const conflictQueue = plannedToApply.filter(a => a.kind === 'conflict');
+    // Conflict downgrade shared by the download TOCTOU guard and init-/complete-time
+    // CAS rejections: remote wins the canonical path - rename local out of the way,
+    // restore the server copy, re-upload the rename as a brand-new path so the local
+    // edit survives as a conflicted copy on every client.
+    const downgradeToConflict = async (a, full, currentServerVersion) => {
+        const currentBytes = await fetchOne(config.projectGuid, a.path);
+        const renamedRel = conflictedCopyName(a.path);
+        let renamedFull;
+        try {
+            renamedFull = resolveInRoot(root, renamedRel);
+        }
+        catch (e) {
+            errors.push(e.message);
+            return;
+        }
+        try {
+            renameSync(full, renamedFull);
+        }
+        catch (e) {
+            errors.push(`Rename failed for ${a.path}: ${e.message}`);
+            return;
+        }
+        if (currentBytes) {
+            mkdirSync(dirname(full), { recursive: true });
+            writeFileSync(full, currentBytes);
+            const stat = statSync(full);
+            baseline.files[a.path] = {
+                size: stat.size, mtime: stat.mtime.toISOString(),
+                sha256: '', // will re-hash on next sync
+                serverVersion: currentServerVersion ?? 0,
+            };
+        }
+        try {
+            const result = await uploadOneFile(config.projectGuid, renamedFull, renamedRel, { expectedServerVersion: null });
+            const stat = statSync(renamedFull);
+            const { sha256 } = await hashFile(renamedFull);
+            baseline.files[renamedRel] = {
+                size: stat.size, mtime: stat.mtime.toISOString(),
+                sha256, serverVersion: result.serverVersion,
+            };
+        }
+        catch (e) {
+            errors.push(`Conflict-copy upload failed for ${renamedRel}: ${e.message}`);
+        }
+        applied++;
+    };
     // Handle downloads first (no network writes) - fills local fs with remote changes.
     for (const a of downloadQueue) {
         const buf = downloadedBytes.get(a.path);
@@ -828,6 +930,29 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
             errors.push(e.message);
             continue;
         }
+        // Pull TOCTOU guard (FIX H8): the whole-tree tar download between scan and
+        // this write can take a long time, and a local edit landing in that window
+        // would be silently clobbered by the remote bytes. Re-hash the on-disk file
+        // now and compare to what the plan saw at scan time (the local scan sha, or
+        // the baseline sha it was derived from). If it moved, the newer local edit
+        // must not be lost - downgrade to the conflict path so the remote lands as
+        // the canonical copy and the local edit is preserved as a conflicted copy.
+        if (existsSync(full)) {
+            const scanSha = local.get(a.path)?.sha256 ?? baseline.files[a.path]?.sha256;
+            const remoteSha = remote.get(a.path)?.sha256 ?? undefined;
+            let currentSha;
+            try {
+                currentSha = (await hashFile(full)).sha256;
+            }
+            catch { /* unreadable - fall through to overwrite */ }
+            // Clobber only if the on-disk bytes moved since the scan (or a file appeared
+            // in a path we scanned as absent) AND they don't already equal the remote
+            // bytes we're about to write (no point conflicting on an identical file).
+            if (currentSha !== undefined && currentSha !== scanSha && currentSha !== remoteSha) {
+                await downgradeToConflict(a, full, remote.get(a.path).serverVersion);
+                continue;
+            }
+        }
         mkdirSync(dirname(full), { recursive: true });
         writeFileSync(full, buf);
         const stat = statSync(full);
@@ -908,51 +1033,6 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
     const onBytes = p
         ? (delta) => { sentBytes += delta; p.transfer(uploadLabel, sentBytes, totalUploadBytes); }
         : undefined;
-    // Conflict downgrade shared by init-time and complete-time CAS rejections:
-    // remote moved under us, so remote wins the canonical path - rename local,
-    // restore the server copy, re-upload the rename as a brand-new path.
-    const downgradeToConflict = async (a, full, currentServerVersion) => {
-        const currentBytes = await fetchOne(config.projectGuid, a.path);
-        const renamedRel = conflictedCopyName(a.path);
-        let renamedFull;
-        try {
-            renamedFull = resolveInRoot(root, renamedRel);
-        }
-        catch (e) {
-            errors.push(e.message);
-            return;
-        }
-        try {
-            renameSync(full, renamedFull);
-        }
-        catch (e) {
-            errors.push(`Rename failed for ${a.path}: ${e.message}`);
-            return;
-        }
-        if (currentBytes) {
-            mkdirSync(dirname(full), { recursive: true });
-            writeFileSync(full, currentBytes);
-            const stat = statSync(full);
-            baseline.files[a.path] = {
-                size: stat.size, mtime: stat.mtime.toISOString(),
-                sha256: '', // will re-hash on next sync
-                serverVersion: currentServerVersion ?? 0,
-            };
-        }
-        try {
-            const result = await uploadOneFile(config.projectGuid, renamedFull, renamedRel, { expectedServerVersion: null });
-            const stat = statSync(renamedFull);
-            const { sha256 } = await hashFile(renamedFull);
-            baseline.files[renamedRel] = {
-                size: stat.size, mtime: stat.mtime.toISOString(),
-                sha256, serverVersion: result.serverVersion,
-            };
-        }
-        catch (e) {
-            errors.push(`Conflict-copy upload failed for ${renamedRel}: ${e.message}`);
-        }
-        applied++;
-    };
     for (let chunkStart = 0; chunkStart < uploadQueue.length; chunkStart += UPLOAD_INIT_BATCH_SIZE) {
         const chunk = uploadQueue.slice(chunkStart, chunkStart + UPLOAD_INIT_BATCH_SIZE);
         // Stat + hash once per file; the same numbers feed init, the baseline,
@@ -1105,12 +1185,32 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
             continue;
         }
         if (a.kind === 'delete-local') {
+            // Only drop the baseline entry when the file is actually gone. A locked file
+            // (Windows EBUSY/EPERM) that survives the unlink must KEEP its baseline: with
+            // no baseline the next sync sees added×absent and re-uploads it, reverting the
+            // remote deletion. ENOENT counts as success (already gone). (FIX M4)
+            let full;
+            try {
+                full = resolveInRoot(root, a.path);
+            }
+            catch (e) {
+                errors.push(e.message);
+                continue;
+            }
             try {
-                unlinkSync(resolveInRoot(root, a.path));
+                unlinkSync(full);
+                delete baseline.files[a.path];
+                applied++;
+            }
+            catch (err) {
+                if (err.code === 'ENOENT') {
+                    delete baseline.files[a.path];
+                    applied++;
+                }
+                else {
+                    errors.push(`Could not delete local ${a.path}: ${err.message} - left in place, will retry next sync`);
+                }
             }
-            catch { /* already gone or outside root */ }
-            delete baseline.files[a.path];
-            applied++;
         }
         else if (a.kind === 'delete-remote') {
             try {
@@ -1175,6 +1275,15 @@ async function syncInner(projectGuid, root, ignore, opts, interactive) {
     }
     // Clean up empty local directories after delete-local actions.
     cleanupEmptyDirs(root, config.ignore);
+    // Adopt agreed content-match state into the baseline, and prune stale entries.
+    // `plan()` is pure, so it emits these as lists and the mutation happens here.
+    // Adopting (FIX M1) makes sync convergent - a locally+remotely-identical file
+    // becomes a known synced pair, so a later delete propagates instead of
+    // resurrecting. Pruning (FIX H7b) stops stale entries masking a later recreate.
+    for (const { path, entry } of planned.baselineAdopts)
+        baseline.files[path] = entry;
+    for (const path of planned.baselineDrops)
+        delete baseline.files[path];
     baseline.lastFullSync = new Date().toISOString();
     writeBaseline(baseline);
     p?.finish();
@@ -1232,6 +1341,18 @@ export async function pushFile(filePath) {
     const rel = relative(root, filePath).replace(/\\/g, '/');
     if (shouldIgnore(rel, effectiveIgnore(root, config.ignore)))
         return;
+    // Skip symlinks (FIX M6b): `walkLocal` (the full-sync scanner) ignores symlink
+    // dirents, so if the push path followed a link and uploaded it, the next full
+    // sync would see a remote path with no local counterpart and plan delete-remote
+    // - churn, and eventual remote loss. Both sides must agree symlinks are out of
+    // scope. lstat (not stat) so we inspect the link itself, not its target.
+    try {
+        if (lstatSync(filePath).isSymbolicLink())
+            return;
+    }
+    catch {
+        return; /* gone/unreadable - nothing to push */
+    }
     // Serialize against `gipity sync` and other concurrent pushes by holding the
     // same per-project lock `sync()` uses. Both paths read-modify-write the shared
     // baseline; without a common lock, a burst of PostToolUse pushes (each a

package/dist/updater/shim.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Thin launcher. Resolves the user-local install at ~/.gipity/local/, exec's
 // it, and kicks off a detached background updater. Modeled on Claude Code.
-import { spawn, spawnSync } from 'child_process';
+import { spawnCommand, spawnSyncCommand } from '../platform.js';
 import { existsSync, readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, resolve, join } from 'path';
@@ -22,7 +22,7 @@ const isDevLink = existsSync(join(pkgRoot, 'src'));
 function startBackgroundUpdater() {
     const checkScript = join(__dirname, 'check.js');
     try {
-        const child = spawn(process.execPath, [checkScript], {
+        const child = spawnCommand(process.execPath, [checkScript], {
             detached: true,
             stdio: 'ignore',
             env: process.env,
@@ -36,7 +36,7 @@ function startBackgroundUpdater() {
 }
 function execLocal() {
     const args = process.argv.slice(2);
-    const res = spawnSync(process.execPath, [LOCAL_ENTRY, ...args], {
+    const res = spawnSyncCommand(process.execPath, [LOCAL_ENTRY, ...args], {
         stdio: 'inherit',
         env: process.env,
     });
@@ -48,7 +48,7 @@ function execSelf() {
     // so the user is never blocked (they can retry via `gipity update --force`).
     const ownEntry = resolve(__dirname, '..', 'index.js');
     const args = process.argv.slice(2);
-    const res = spawnSync(process.execPath, [ownEntry, ...args], {
+    const res = spawnSyncCommand(process.execPath, [ownEntry, ...args], {
         stdio: 'inherit',
         env: process.env,
     });

package/dist/upload.js

@@ -109,7 +109,7 @@ export class UploadConflictError extends Error {
 /**
  * Upload one local file to a project's virtual path via the presigned-S3 flow.
  * Handles single-part PUT and multipart fan-out, server-driven resume, and
- * skip-if-identical (unless overwrite=true forces a new version).
+ * skip-if-identical (a byte-identical file at the same path is a no-op).
  */
 export async function uploadOneFile(projectGuid, localPath, virtualPath, opts = {}) {
     const { sha256, size } = await hashFile(localPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gipity",
-  "version": "1.0.409",
+  "version": "1.0.410",
   "description": "The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.",
   "bin": {
     "gipity": "dist/updater/shim.js",
@@ -13,9 +13,12 @@
     "postbuild": "node scripts/gen-build-info.mjs",
     "dev": "tsc --watch",
     "test": "npm run test:smoke",
-    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/platform.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/api-401-retry.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
-    "test:e2e": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-live.test.js dist/__tests__/cli-e2e-sync-live.test.js dist/__tests__/cli-e2e-services-media-live.test.js dist/__tests__/cli-e2e-workflow-live.test.js dist/__tests__/cli-e2e-sandbox-live.test.js dist/__tests__/cli-e2e-page-fetch-live.test.js dist/__tests__/cli-e2e-page-test-live.test.js",
+    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/platform.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/api-401-retry.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-storage.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
+    "test:smoke:quick": "node scripts/smoke-quick.mjs",
+    "test:e2e": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-live.test.js dist/__tests__/cli-e2e-sync-live.test.js dist/__tests__/cli-e2e-sync-stress-live.test.js dist/__tests__/cli-e2e-rollback-live.test.js dist/__tests__/cli-e2e-services-media-live.test.js dist/__tests__/cli-e2e-workflow-live.test.js dist/__tests__/cli-e2e-sandbox-live.test.js dist/__tests__/cli-e2e-page-fetch-live.test.js dist/__tests__/cli-e2e-page-test-live.test.js",
     "test:e2e:sync": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sync-live.test.js",
+    "test:e2e:sync-stress": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sync-stress-live.test.js",
+    "test:e2e:rollback": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-rollback-live.test.js",
     "test:e2e:sandbox": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sandbox-live.test.js"
   },
   "dependencies": {