wispy-cli 1.2.3 → 1.3.0

package/bin/wispy.mjs

@@ -156,6 +156,135 @@ if (args[0] === "disconnect") {
   process.exit(0);
 }
 
+// ── sync sub-command ──────────────────────────────────────────────────────────
+if (args[0] === "sync") {
+  const { SyncManager } = await import(
+    path.join(__dirname, "..", "core", "sync.mjs")
+  );
+
+  const sub = args[1]; // push | pull | status | auto | (undefined = bidirectional)
+
+  const green  = (s) => `\x1b[32m${s}\x1b[0m`;
+  const red    = (s) => `\x1b[31m${s}\x1b[0m`;
+  const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
+  const cyan   = (s) => `\x1b[36m${s}\x1b[0m`;
+  const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
+  const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
+
+  // Parse flags
+  const strategyIdx = args.indexOf("--strategy");
+  const strategy = strategyIdx !== -1 ? args[strategyIdx + 1] : null;
+  const memoryOnly   = args.includes("--memory-only");
+  const sessionsOnly = args.includes("--sessions-only");
+  const remoteUrlIdx = args.indexOf("--remote");
+  const remoteUrlArg = remoteUrlIdx !== -1 ? args[remoteUrlIdx + 1] : null;
+  const tokenIdx = args.indexOf("--token");
+  const tokenArg = tokenIdx !== -1 ? args[tokenIdx + 1] : null;
+
+  // Load config (or use overrides)
+  const cfg = await SyncManager.loadConfig();
+  const remoteUrl = remoteUrlArg ?? cfg.remoteUrl;
+  const token     = tokenArg ?? cfg.token;
+
+  // ── auto enable/disable ──
+  if (sub === "auto") {
+    const enable  = !args.includes("--off");
+    const disable = args.includes("--off");
+    if (disable) {
+      await SyncManager.disableAuto();
+      console.log(`\n${yellow("⏸")}  Auto-sync ${bold("disabled")}.\n`);
+    } else if (!remoteUrl) {
+      console.log(`\n${red("✗")} No remote URL configured.`);
+      console.log(dim(`   Use: wispy sync auto --remote https://vps.com:18790 --token <token>\n`));
+      process.exit(1);
+    } else {
+      await SyncManager.enableAuto(remoteUrl, token ?? "");
+      console.log(`\n${green("✓")}  Auto-sync ${bold("enabled")}.`);
+      console.log(`   Remote: ${cyan(remoteUrl)}`);
+      console.log(dim("   Sessions and memory will be synced automatically.\n"));
+    }
+    process.exit(0);
+  }
+
+  // ── status ──
+  if (sub === "status") {
+    if (!remoteUrl) {
+      console.log(`\n${red("✗")} No remote configured. Set via sync.json or --remote flag.\n`);
+      process.exit(1);
+    }
+    console.log(`\n🔄 ${bold("Sync Status")}\n`);
+    console.log(`   Remote: ${cyan(remoteUrl)}`);
+    const mgr = new SyncManager({ remoteUrl, token, strategy: strategy ?? "newer-wins" });
+    const s = await mgr.status(remoteUrl, token);
+    console.log(`   Connection: ${s.reachable ? green("✅ reachable") : red("✗ unreachable")}\n`);
+
+    const fmt = (label, info) => {
+      const parts = [];
+      if (info.localOnly > 0)  parts.push(`${yellow(info.localOnly + " local only")}`);
+      if (info.remoteOnly > 0) parts.push(`${cyan(info.remoteOnly + " remote only")}`);
+      if (info.inSync > 0)     parts.push(`${green(info.inSync + " in sync")}`);
+      console.log(`   ${bold(label.padEnd(14))} ${parts.join(", ") || dim("(empty)")}`);
+    };
+    fmt("Memory:",     s.memory);
+    fmt("Sessions:",   s.sessions);
+    fmt("Cron:",       s.cron);
+    fmt("Workstreams:",s.workstreams);
+    fmt("Permissions:",s.permissions);
+
+    const needPull = (s.memory.remoteOnly + s.sessions.remoteOnly + s.cron.remoteOnly + s.workstreams.remoteOnly + s.permissions.remoteOnly);
+    const needPush = (s.memory.localOnly + s.sessions.localOnly + s.cron.localOnly + s.workstreams.localOnly + s.permissions.localOnly);
+    if (needPull > 0 || needPush > 0) {
+      console.log(`\n   Action needed: ${needPull > 0 ? `pull ${yellow(needPull)} file(s)` : ""} ${needPush > 0 ? `push ${yellow(needPush)} file(s)` : ""}`.trimEnd());
+      console.log(dim("   Run 'wispy sync' to synchronize."));
+    } else {
+      console.log(`\n   ${green("✓")} Everything in sync!`);
+    }
+    console.log("");
+    process.exit(0);
+  }
+
+  // For push/pull/sync we need a remote URL
+  if (!remoteUrl) {
+    console.log(`\n${red("✗")} No remote configured.`);
+    console.log(dim("   Set remoteUrl in ~/.wispy/sync.json or use --remote <url>\n"));
+    process.exit(1);
+  }
+
+  const opts = { strategy: strategy ?? cfg.strategy ?? "newer-wins", memoryOnly, sessionsOnly };
+  const mgr = new SyncManager({ remoteUrl, token, ...opts });
+
+  if (sub === "push") {
+    console.log(`\n📤 ${bold("Pushing")} to ${cyan(remoteUrl)}...`);
+    const result = await mgr.push(remoteUrl, token, opts);
+    console.log(`   Pushed:  ${green(result.pushed)}`);
+    console.log(`   Skipped: ${dim(result.skipped)}`);
+    if (result.errors.length) result.errors.forEach(e => console.log(`   ${red("✗")} ${e}`));
+    console.log(`\n${result.errors.length === 0 ? green("✓ Done") : yellow("⚠ Done with errors")}.\n`);
+
+  } else if (sub === "pull") {
+    console.log(`\n📥 ${bold("Pulling")} from ${cyan(remoteUrl)}...`);
+    const result = await mgr.pull(remoteUrl, token, opts);
+    console.log(`   Pulled:    ${green(result.pulled)}`);
+    console.log(`   Skipped:   ${dim(result.skipped)}`);
+    if (result.conflicts) console.log(`   Conflicts: ${yellow(result.conflicts)} (saved as .conflict-* files)`);
+    if (result.errors.length) result.errors.forEach(e => console.log(`   ${red("✗")} ${e}`));
+    console.log(`\n${result.errors.length === 0 ? green("✓ Done") : yellow("⚠ Done with errors")}.\n`);
+
+  } else {
+    // Bidirectional sync (default)
+    console.log(`\n🔄 ${bold("Syncing")} with ${cyan(remoteUrl)}...`);
+    const result = await mgr.sync(remoteUrl, token, opts);
+    console.log(`   Pushed:    ${green(result.pushed)}`);
+    console.log(`   Pulled:    ${green(result.pulled)}`);
+    console.log(`   Skipped:   ${dim(result.skipped)}`);
+    if (result.conflicts) console.log(`   Conflicts: ${yellow(result.conflicts)} (saved as .conflict-* files)`);
+    if (result.errors.length) result.errors.forEach(e => console.log(`   ${red("✗")} ${e}`));
+    console.log(`\n${result.errors.length === 0 ? green("✓ Done") : yellow("⚠ Done with errors")}.\n`);
+  }
+
+  process.exit(0);
+}
+
 // ── deploy sub-command ────────────────────────────────────────────────────────
 if (args[0] === "deploy") {
   const { DeployManager } = await import(
@@ -805,7 +934,7 @@ if (serveMode || telegramMode || discordMode || slackMode) {
 const isInteractiveStart = !args.some(a =>
   ["--serve", "--telegram", "--discord", "--slack", "--server",
    "status", "setup", "init", "connect", "disconnect", "deploy",
-   "cron", "audit", "log", "server", "node", "channel"].includes(a)
+   "cron", "audit", "log", "server", "node", "channel", "sync"].includes(a)
 );
 
 if (isInteractiveStart) {

package/core/engine.mjs

@@ -24,6 +24,7 @@ import { SubAgentManager } from "./subagents.mjs";
 import { PermissionManager } from "./permissions.mjs";
 import { AuditLog, EVENT_TYPES } from "./audit.mjs";
 import { Harness } from "./harness.mjs";
+import { SyncManager, getSyncManager } from "./sync.mjs";
 
 const MAX_TOOL_ROUNDS = 10;
 const MAX_CONTEXT_CHARS = 40_000;
@@ -40,6 +41,7 @@ export class WispyEngine {
     this.permissions = new PermissionManager(config.permissions ?? {});
     this.audit = new AuditLog(WISPY_DIR);
     this.harness = new Harness(this.tools, this.permissions, this.audit, config);
+    this.sync = null; // SyncManager, initialized lazily
     this._initialized = false;
     this._workMdContent = null;
     this._workMdLoaded = false;
@@ -93,6 +95,15 @@ export class WispyEngine {
       this.tools.registerMCP(this.mcpManager);
     }
 
+    // Initialize sync manager (if configured)
+    try {
+      this.sync = await getSyncManager();
+      // Auto-sync on startup: pull any new data from remote
+      if (this.sync?.auto && this.sync.remoteUrl) {
+        this.sync.pull(this.sync.remoteUrl, this.sync.token).catch(() => {});
+      }
+    } catch { /* sync is optional */ }
+
     this._initialized = true;
     return this;
   }

package/core/index.mjs

@@ -20,3 +20,4 @@ export { WispyServer } from "./server.mjs";
 export { NodeManager, CAPABILITIES } from "./nodes.mjs";
 export { Harness, Receipt, HarnessResult, computeUnifiedDiff } from "./harness.mjs";
 export { DeployManager } from "./deploy.mjs";
+export { SyncManager, getSyncManager, sha256 } from "./sync.mjs";

package/core/memory.mjs

@@ -39,7 +39,8 @@ export class MemoryManager {
   }
 
   /**
-   * Save (overwrite) a memory file
+   * Save (overwrite) a memory file.
+   * If auto-sync is enabled, pushes the file to remote (non-blocking).
    */
   async save(key, content, metadata = {}) {
     await this._ensureDir();
@@ -55,6 +56,14 @@ export class MemoryManager {
       : `_Last updated: ${ts}_\n\n`;
 
     await writeFile(filePath, header + content, "utf8");
+
+    // Auto-sync: push to remote if configured (fire-and-forget)
+    try {
+      const { getSyncManager } = await import("./sync.mjs");
+      const syncMgr = await getSyncManager();
+      if (syncMgr?.auto) syncMgr.pushFile(filePath);
+    } catch { /* sync is optional */ }
+
     return { key, path: filePath };
   }
 

package/core/server.mjs

@@ -7,11 +7,71 @@
 
 import { createServer } from "node:http";
 import path from "node:path";
-import { readFile, writeFile, mkdir } from "node:fs/promises";
-import { randomBytes, createHmac } from "node:crypto";
+import { readFile, writeFile, mkdir, readdir, stat } from "node:fs/promises";
+import { randomBytes, createHmac, createHash } from "node:crypto";
 
 import { WISPY_DIR } from "./config.mjs";
 
+// ── Sync helpers ──────────────────────────────────────────────────────────────
+
+const SYNC_PATTERNS = [
+  (f) => f.startsWith("memory/") && f.endsWith(".md"),
+  (f) => f.startsWith("sessions/") && f.endsWith(".json"),
+  (f) => f === "cron/jobs.json",
+  (f) => /^workstreams\/[^/]+\/work\.md$/.test(f),
+  (f) => f === "permissions.json",
+];
+
+function isSyncable(relPath) {
+  return SYNC_PATTERNS.some(fn => fn(relPath));
+}
+
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+function isPathSafe(relPath) {
+  // Reject absolute paths and path traversal
+  if (path.isAbsolute(relPath)) return false;
+  if (relPath.includes("..")) return false;
+  if (relPath.includes("\0")) return false;
+  return true;
+}
+
+async function scanSyncableFiles(baseDir) {
+  const entries = [];
+  await _scanDir(baseDir, baseDir, entries);
+  return entries;
+}
+
+async function _scanDir(baseDir, dir, entries) {
+  let items;
+  try {
+    items = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const item of items) {
+    const fullPath = path.join(dir, item.name);
+    const relPath = path.relative(baseDir, fullPath).replace(/\\/g, "/");
+    if (item.isDirectory()) {
+      if (["node_modules", ".git", ".npm"].includes(item.name)) continue;
+      await _scanDir(baseDir, fullPath, entries);
+    } else if (item.isFile() && isSyncable(relPath)) {
+      try {
+        const content = await readFile(fullPath);
+        const fileStat = await stat(fullPath);
+        entries.push({
+          path: relPath,
+          hash: sha256(content),
+          modifiedAt: fileStat.mtime.toISOString(),
+          size: content.length,
+        });
+      } catch { /* skip */ }
+    }
+  }
+}
+
 const SERVER_CONFIG_FILE = path.join(WISPY_DIR, "server.json");
 const DEFAULT_PORT = 18790;
 const DEFAULT_HOST = "127.0.0.1";
@@ -335,6 +395,96 @@ export class WispyServer {
       }
     }
 
+    // ── Sync ────────────────────────────────────────────────────────────────
+
+    // GET /api/sync/manifest — list all syncable files with hash + mtime
+    if (pathname === "/api/sync/manifest" && method === "GET") {
+      const files = await scanSyncableFiles(WISPY_DIR);
+      return jsonResponse(res, 200, { files });
+    }
+
+    // GET /api/sync/file?path=<relPath> — download a file
+    if (pathname === "/api/sync/file" && method === "GET") {
+      const relPath = url.searchParams.get("path");
+      if (!relPath) return errorResponse(res, 400, "path required");
+      if (!isPathSafe(relPath)) return errorResponse(res, 400, "invalid path");
+      if (!isSyncable(relPath)) return errorResponse(res, 400, "path not syncable");
+
+      const fullPath = path.join(WISPY_DIR, relPath);
+      try {
+        const content = await readFile(fullPath);
+        const fileStat = await stat(fullPath);
+        return jsonResponse(res, 200, {
+          path: relPath,
+          content: content.toString("base64"),
+          encoding: "base64",
+          modifiedAt: fileStat.mtime.toISOString(),
+          hash: sha256(content),
+          size: content.length,
+        });
+      } catch {
+        return errorResponse(res, 404, "File not found");
+      }
+    }
+
+    // POST /api/sync/file — upload a file
+    if (pathname === "/api/sync/file" && method === "POST") {
+      const body = await readBody(req);
+      const { path: relPath, content, encoding = "base64", modifiedAt } = body;
+      if (!relPath || content == null) return errorResponse(res, 400, "path and content required");
+      if (!isPathSafe(relPath)) return errorResponse(res, 400, "invalid path");
+      if (!isSyncable(relPath)) return errorResponse(res, 400, "path not syncable");
+
+      const fullPath = path.join(WISPY_DIR, relPath);
+      await mkdir(path.dirname(fullPath), { recursive: true });
+      const buf = Buffer.from(content, encoding === "base64" ? "base64" : "utf8");
+      await writeFile(fullPath, buf);
+      if (modifiedAt) {
+        const mtime = new Date(modifiedAt);
+        const { utimes } = await import("node:fs/promises");
+        await utimes(fullPath, mtime, mtime).catch(() => {});
+      }
+      return jsonResponse(res, 200, { success: true, path: relPath, size: buf.length });
+    }
+
+    // POST /api/sync/bulk — upload multiple files at once
+    if (pathname === "/api/sync/bulk" && method === "POST") {
+      const body = await readBody(req);
+      const files = body.files ?? [];
+      if (!Array.isArray(files)) return errorResponse(res, 400, "files must be an array");
+
+      const results = [];
+      for (const file of files) {
+        const { path: relPath, content, encoding = "base64", modifiedAt } = file;
+        if (!relPath || content == null) {
+          results.push({ path: relPath, success: false, error: "missing path or content" });
+          continue;
+        }
+        if (!isPathSafe(relPath) || !isSyncable(relPath)) {
+          results.push({ path: relPath, success: false, error: "invalid or non-syncable path" });
+          continue;
+        }
+        try {
+          const fullPath = path.join(WISPY_DIR, relPath);
+          await mkdir(path.dirname(fullPath), { recursive: true });
+          const buf = Buffer.from(content, encoding === "base64" ? "base64" : "utf8");
+          await writeFile(fullPath, buf);
+          if (modifiedAt) {
+            const mtime = new Date(modifiedAt);
+            const { utimes } = await import("node:fs/promises");
+            await utimes(fullPath, mtime, mtime).catch(() => {});
+          }
+          results.push({ path: relPath, success: true, size: buf.length });
+        } catch (err) {
+          results.push({ path: relPath, success: false, error: err.message });
+        }
+      }
+
+      const succeeded = results.filter(r => r.success).length;
+      const failed = results.filter(r => !r.success).length;
+      return jsonResponse(res, 200, { success: failed === 0, received: files.length, succeeded, failed, results });
+    }
+
     // ── Audit ───────────────────────────────────────────────────────────────
     if (pathname === "/api/audit" && method === "GET") {
       const filter = {};

package/core/session.mjs

@@ -116,6 +116,7 @@ export class SessionManager {
 
   /**
    * Save a session to disk.
+   * If auto-sync is enabled, pushes the file to remote (non-blocking).
    */
   async save(id) {
     const session = this._sessions.get(id);
@@ -123,6 +124,13 @@ export class SessionManager {
     await mkdir(SESSIONS_DIR, { recursive: true });
     const filePath = path.join(SESSIONS_DIR, `${id}.json`);
     await writeFile(filePath, JSON.stringify(session.toJSON(), null, 2) + "\n", "utf8");
+
+    // Auto-sync: push to remote if configured (fire-and-forget)
+    try {
+      const { getSyncManager } = await import("./sync.mjs");
+      const syncMgr = await getSyncManager();
+      if (syncMgr?.auto) syncMgr.pushFile(filePath);
+    } catch { /* sync is optional */ }
   }
 
   /**

package/core/sync.mjs

@@ -0,0 +1,682 @@
+/**
+ * core/sync.mjs — Sync manager for Wispy
+ *
+ * Syncs sessions, memory, cron jobs, workstreams, and permissions
+ * between local and remote wispy instances via HTTP API.
+ *
+ * Protocol:
+ *   1. Build local manifest (path → { hash, modifiedAt, size })
+ *   2. Fetch remote manifest from GET /api/sync/manifest
+ *   3. Compare → compute what to push / pull
+ *   4. Transfer only changed files
+ *   5. Report summary
+ */
+
+import path from "node:path";
+import { readFile, writeFile, mkdir, readdir, stat } from "node:fs/promises";
+import { createHash } from "node:crypto";
+
+import { WISPY_DIR } from "./config.mjs";
+
+const SYNC_CONFIG_FILE = path.join(WISPY_DIR, "sync.json");
+
+// File patterns that are syncable (relative to WISPY_DIR)
+const SYNC_PATTERNS = [
+  { glob: "memory",         match: (f) => f.startsWith("memory/") && f.endsWith(".md") },
+  { glob: "sessions",       match: (f) => f.startsWith("sessions/") && f.endsWith(".json") },
+  { glob: "cron/jobs.json", match: (f) => f === "cron/jobs.json" },
+  { glob: "workstreams",    match: (f) => f.match(/^workstreams\/[^/]+\/work\.md$/) },
+  { glob: "permissions.json", match: (f) => f === "permissions.json" },
+];
+
+/**
+ * Compute SHA-256 hash of a string or Buffer
+ */
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+/**
+ * @typedef {Object} FileEntry
+ * @property {string} path       - relative path within WISPY_DIR
+ * @property {string} hash       - SHA-256 of content
+ * @property {string} modifiedAt - ISO timestamp
+ * @property {number} size       - byte size
+ */
+
+/**
+ * @typedef {Object} SyncResult
+ * @property {number} pushed
+ * @property {number} pulled
+ * @property {number} skipped
+ * @property {number} conflicts
+ * @property {string[]} errors
+ * @property {Object} details
+ */
+
+export class SyncManager {
+  /**
+   * @param {object} config
+   * @param {string} [config.remoteUrl]
+   * @param {string} [config.token]
+   * @param {'newer-wins'|'local-wins'|'remote-wins'} [config.strategy]
+   * @param {boolean} [config.auto]
+   */
+  constructor(config = {}) {
+    this.remoteUrl = config.remoteUrl ?? null;
+    this.token = config.token ?? null;
+    this.strategy = config.strategy ?? "newer-wins";
+    this.auto = config.auto ?? false;
+  }
+
+  // ── Config persistence ──────────────────────────────────────────────────────
+
+  static async loadConfig() {
+    try {
+      const raw = await readFile(SYNC_CONFIG_FILE, "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+
+  static async saveConfig(cfg) {
+    await mkdir(WISPY_DIR, { recursive: true });
+    await writeFile(SYNC_CONFIG_FILE, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  }
+
+  static async fromConfig() {
+    const cfg = await SyncManager.loadConfig();
+    return new SyncManager(cfg);
+  }
+
+  // ── Local manifest ──────────────────────────────────────────────────────────
+
+  /**
+   * Scan WISPY_DIR and build manifest for syncable files.
+   * @param {object} [opts]
+   * @param {boolean} [opts.memoryOnly]
+   * @param {boolean} [opts.sessionsOnly]
+   * @returns {Promise<FileEntry[]>}
+   */
+  async buildLocalManifest(opts = {}) {
+    const entries = [];
+    await this._scanDir(WISPY_DIR, WISPY_DIR, entries, opts);
+    return entries;
+  }
+
+  async _scanDir(baseDir, dir, entries, opts = {}) {
+    let items;
+    try {
+      items = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+
+    for (const item of items) {
+      const fullPath = path.join(dir, item.name);
+      const relPath = path.relative(baseDir, fullPath).replace(/\\/g, "/");
+
+      if (item.isDirectory()) {
+        // Skip node_modules, .git, etc.
+        if (["node_modules", ".git", ".npm"].includes(item.name)) continue;
+        await this._scanDir(baseDir, fullPath, entries, opts);
+      } else if (item.isFile()) {
+        // Check if syncable
+        const syncable = SYNC_PATTERNS.some(p => p.match(relPath));
+        if (!syncable) continue;
+
+        // Apply filters
+        if (opts.memoryOnly && !relPath.startsWith("memory/")) continue;
+        if (opts.sessionsOnly && !relPath.startsWith("sessions/")) continue;
+
+        try {
+          const content = await readFile(fullPath);
+          const fileStat = await stat(fullPath);
+          entries.push({
+            path: relPath,
+            hash: sha256(content),
+            modifiedAt: fileStat.mtime.toISOString(),
+            size: content.length,
+          });
+        } catch {
+          // Skip unreadable files
+        }
+      }
+    }
+  }
+
+  // ── HTTP helpers ────────────────────────────────────────────────────────────
+
+  async _fetch(url, opts = {}) {
+    const { default: fetch } = await import("node:fetch").catch(async () => {
+      // Node 18+ has built-in fetch
+      return { default: globalThis.fetch };
+    });
+
+    const headers = {
+      "Content-Type": "application/json",
+      ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}),
+      ...opts.headers,
+    };
+
+    const response = await fetch(url, { ...opts, headers });
+    return response;
+  }
+
+  async _getRemoteManifest(remoteUrl, token) {
+    const url = `${remoteUrl}/api/sync/manifest`;
+    const res = await this._fetchWithAuth(url, {}, token);
+    if (!res.ok) {
+      throw new Error(`Failed to get remote manifest: ${res.status} ${res.statusText}`);
+    }
+    const data = await res.json();
+    return data.files ?? [];
+  }
+
+  async _downloadFile(remoteUrl, token, relPath) {
+    const url = `${remoteUrl}/api/sync/file?path=${encodeURIComponent(relPath)}`;
+    const res = await this._fetchWithAuth(url, {}, token);
+    if (!res.ok) {
+      throw new Error(`Failed to download ${relPath}: ${res.status}`);
+    }
+    return res.json(); // { path, content, modifiedAt, hash, encoding }
+  }
+
+  async _uploadFile(remoteUrl, token, entry) {
+    const url = `${remoteUrl}/api/sync/file`;
+    const res = await this._fetchWithAuth(url, {
+      method: "POST",
+      body: JSON.stringify(entry),
+    }, token);
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`Failed to upload ${entry.path}: ${res.status} ${text}`);
+    }
+    return res.json();
+  }
+
+  async _uploadBulk(remoteUrl, token, files) {
+    const url = `${remoteUrl}/api/sync/bulk`;
+    const res = await this._fetchWithAuth(url, {
+      method: "POST",
+      body: JSON.stringify({ files }),
+    }, token);
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`Bulk upload failed: ${res.status} ${text}`);
+    }
+    return res.json();
+  }
+
+  async _fetchWithAuth(url, opts = {}, tokenOverride = null) {
+    const token = tokenOverride ?? this.token;
+    const headers = {
+      "Content-Type": "application/json",
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...(opts.headers ?? {}),
+    };
+
+    // Use native fetch (Node 18+) or fallback
+    const fetchFn = globalThis.fetch;
+    if (!fetchFn) {
+      throw new Error("fetch not available. Node 18+ required.");
+    }
+
+    return fetchFn(url, { ...opts, headers });
+  }
+
+  // ── Core operations ─────────────────────────────────────────────────────────
+
+  /**
+   * Push local state to remote.
+   * @param {string} remoteUrl
+   * @param {string} token
+   * @param {object} [opts]
+   * @returns {Promise<SyncResult>}
+   */
+  async push(remoteUrl, token, opts = {}) {
+    const local = await this.buildLocalManifest(opts);
+    const remote = await this._getRemoteManifest(remoteUrl, token);
+    const remoteMap = new Map(remote.map(f => [f.path, f]));
+
+    const toUpload = [];
+    let skipped = 0;
+
+    for (const localFile of local) {
+      const remoteFile = remoteMap.get(localFile.path);
+      if (!remoteFile) {
+        toUpload.push(localFile);
+        continue;
+      }
+      if (localFile.hash === remoteFile.hash) {
+        skipped++;
+        continue;
+      }
+      // Both exist, different content
+      const strategy = opts.strategy ?? this.strategy;
+      if (strategy === "local-wins") {
+        toUpload.push(localFile);
+      } else if (strategy === "remote-wins") {
+        skipped++;
+      } else {
+        // newer-wins: push only if local is newer
+        const localMtime = new Date(localFile.modifiedAt).getTime();
+        const remoteMtime = new Date(remoteFile.modifiedAt).getTime();
+        if (localMtime > remoteMtime) {
+          toUpload.push(localFile);
+        } else {
+          skipped++;
+        }
+      }
+    }
+
+    // Upload files
+    const errors = [];
+    let pushed = 0;
+
+    if (toUpload.length > 0) {
+      // Prepare payload with content
+      const files = [];
+      for (const f of toUpload) {
+        try {
+          const content = await readFile(path.join(WISPY_DIR, f.path));
+          files.push({
+            path: f.path,
+            content: content.toString("base64"),
+            encoding: "base64",
+            modifiedAt: f.modifiedAt,
+            hash: f.hash,
+          });
+        } catch (err) {
+          errors.push(`Read failed for ${f.path}: ${err.message}`);
+        }
+      }
+
+      if (files.length > 0) {
+        try {
+          await this._uploadBulk(remoteUrl, token, files);
+          pushed = files.length;
+        } catch (err) {
+          // Fallback: upload one by one
+          for (const file of files) {
+            try {
+              await this._uploadFile(remoteUrl, token, file);
+              pushed++;
+            } catch (e) {
+              errors.push(`Upload failed for ${file.path}: ${e.message}`);
+            }
+          }
+        }
+      }
+    }
+
+    return {
+      pushed,
+      pulled: 0,
+      skipped,
+      conflicts: 0,
+      errors,
+      details: { uploaded: toUpload.map(f => f.path) },
+    };
+  }
+
+  /**
+   * Pull remote state to local.
+   * @param {string} remoteUrl
+   * @param {string} token
+   * @param {object} [opts]
+   * @returns {Promise<SyncResult>}
+   */
+  async pull(remoteUrl, token, opts = {}) {
+    const local = await this.buildLocalManifest(opts);
+    const remote = await this._getRemoteManifest(remoteUrl, token);
+    const localMap = new Map(local.map(f => [f.path, f]));
+
+    const toDownload = [];
+    let skipped = 0;
+    let conflicts = 0;
+
+    for (const remoteFile of remote) {
+      const localFile = localMap.get(remoteFile.path);
+      if (!localFile) {
+        toDownload.push(remoteFile);
+        continue;
+      }
+      if (localFile.hash === remoteFile.hash) {
+        skipped++;
+        continue;
+      }
+      // Both exist, different content
+      const strategy = opts.strategy ?? this.strategy;
+      if (strategy === "remote-wins") {
+        toDownload.push(remoteFile);
+      } else if (strategy === "local-wins") {
+        skipped++;
+      } else {
+        // newer-wins
+        const localMtime = new Date(localFile.modifiedAt).getTime();
+        const remoteMtime = new Date(remoteFile.modifiedAt).getTime();
+        if (remoteMtime > localMtime) {
+          toDownload.push(remoteFile);
+        } else if (localMtime === remoteMtime) {
+          // Same timestamp, different content → conflict
+          conflicts++;
+          const conflictPath = path.join(WISPY_DIR, remoteFile.path + `.conflict-${Date.now()}`);
+          try {
+            const downloaded = await this._downloadFile(remoteUrl, token, remoteFile.path);
+            const content = Buffer.from(downloaded.content, downloaded.encoding === "base64" ? "base64" : "utf8");
+            await mkdir(path.dirname(conflictPath), { recursive: true });
+            await writeFile(conflictPath, content);
+          } catch {}
+        } else {
+          skipped++;
+        }
+      }
+    }
+
+    // Download files
+    const errors = [];
+    let pulled = 0;
+
+    for (const remoteFile of toDownload) {
+      try {
+        const downloaded = await this._downloadFile(remoteUrl, token, remoteFile.path);
+        const content = Buffer.from(
+          downloaded.content,
+          downloaded.encoding === "base64" ? "base64" : "utf8"
+        );
+        const localPath = path.join(WISPY_DIR, remoteFile.path);
+        await mkdir(path.dirname(localPath), { recursive: true });
+        await writeFile(localPath, content);
+        // Restore mtime
+        const mtime = new Date(remoteFile.modifiedAt);
+        const { utimes } = await import("node:fs/promises");
+        await utimes(localPath, mtime, mtime).catch(() => {});
+        pulled++;
+      } catch (err) {
+        errors.push(`Download failed for ${remoteFile.path}: ${err.message}`);
+      }
+    }
+
+    return {
+      pushed: 0,
+      pulled,
+      skipped,
+      conflicts,
+      errors,
+      details: { downloaded: toDownload.map(f => f.path) },
+    };
+  }
+
+  /**
+   * Bidirectional sync — push local-only/newer files, pull remote-only/newer files.
+   * @param {string} remoteUrl
+   * @param {string} token
+   * @param {object} [opts]
+   * @returns {Promise<SyncResult>}
+   */
+  async sync(remoteUrl, token, opts = {}) {
+    const local = await this.buildLocalManifest(opts);
+    const remote = await this._getRemoteManifest(remoteUrl, token);
+
+    const localMap = new Map(local.map(f => [f.path, f]));
+    const remoteMap = new Map(remote.map(f => [f.path, f]));
+
+    const toUpload = [];
+    const toDownload = [];
+    let skipped = 0;
+    let conflicts = 0;
+    const errors = [];
+    const strategy = opts.strategy ?? this.strategy;
+
+    // Check local files
+    for (const localFile of local) {
+      const remoteFile = remoteMap.get(localFile.path);
+      if (!remoteFile) {
+        toUpload.push(localFile);
+        continue;
+      }
+      if (localFile.hash === remoteFile.hash) {
+        skipped++;
+        continue;
+      }
+      // Both exist, different content
+      const localMtime = new Date(localFile.modifiedAt).getTime();
+      const remoteMtime = new Date(remoteFile.modifiedAt).getTime();
+
+      if (strategy === "local-wins") {
+        toUpload.push(localFile);
+      } else if (strategy === "remote-wins") {
+        toDownload.push(remoteFile);
+      } else if (localMtime === remoteMtime) {
+        // Conflict
+        conflicts++;
+        // Keep both: rename remote as conflict copy
+        const conflictPath = remoteFile.path + `.conflict-${Date.now()}`;
+        toDownload.push({ ...remoteFile, path: conflictPath });
+      } else if (localMtime > remoteMtime) {
+        toUpload.push(localFile);
+      } else {
+        toDownload.push(remoteFile);
+      }
+    }
+
+    // Check remote-only files
+    for (const remoteFile of remote) {
+      if (!localMap.has(remoteFile.path)) {
+        toDownload.push(remoteFile);
+      }
+    }
+
+    // Upload
+    let pushed = 0;
+    if (toUpload.length > 0) {
+      const files = [];
+      for (const f of toUpload) {
+        try {
+          const content = await readFile(path.join(WISPY_DIR, f.path));
+          files.push({
+            path: f.path,
+            content: content.toString("base64"),
+            encoding: "base64",
+            modifiedAt: f.modifiedAt,
+            hash: f.hash,
+          });
+        } catch (err) {
+          errors.push(`Read failed for ${f.path}: ${err.message}`);
+        }
+      }
+      if (files.length > 0) {
+        try {
+          await this._uploadBulk(remoteUrl, token, files);
+          pushed = files.length;
+        } catch (err) {
+          for (const file of files) {
+            try {
+              await this._uploadFile(remoteUrl, token, file);
+              pushed++;
+            } catch (e) {
+              errors.push(`Upload failed for ${file.path}: ${e.message}`);
+            }
+          }
+        }
+      }
+    }
+
+    // Download
+    let pulled = 0;
+    for (const remoteFile of toDownload) {
+      try {
+        const downloaded = await this._downloadFile(remoteUrl, token, remoteFile.path);
+        const content = Buffer.from(
+          downloaded.content,
+          downloaded.encoding === "base64" ? "base64" : "utf8"
+        );
+        const localPath = path.join(WISPY_DIR, remoteFile.path);
+        await mkdir(path.dirname(localPath), { recursive: true });
+        await writeFile(localPath, content);
+        const mtime = new Date(remoteFile.modifiedAt);
+        const { utimes } = await import("node:fs/promises");
+        await utimes(localPath, mtime, mtime).catch(() => {});
+        pulled++;
+      } catch (err) {
+        errors.push(`Download failed for ${remoteFile.path}: ${err.message}`);
+      }
+    }
+
+    return {
+      pushed,
+      pulled,
+      skipped,
+      conflicts,
+      errors,
+      details: {
+        uploaded: toUpload.map(f => f.path),
+        downloaded: toDownload.map(f => f.path),
+      },
+    };
+  }
+
+  /**
+   * Dry-run: show what would sync without doing it.
+   * @param {string} remoteUrl
+   * @param {string} token
+   * @param {object} [opts]
+   * @returns {Promise<object>} status info
+   */
+  async status(remoteUrl, token, opts = {}) {
+    let remote;
+    let reachable = true;
+    try {
+      remote = await this._getRemoteManifest(remoteUrl, token);
+    } catch (err) {
+      reachable = false;
+      remote = [];
+    }
+
+    const local = await this.buildLocalManifest(opts);
+    const localMap = new Map(local.map(f => [f.path, f]));
+    const remoteMap = new Map(remote.map(f => [f.path, f]));
+
+    const byType = (prefix, checkFn) => {
+      const files = local.filter(f => checkFn ? checkFn(f.path) : f.path.startsWith(prefix));
+      const remoteFiles = remote.filter(f => checkFn ? checkFn(f.path) : f.path.startsWith(prefix));
+
+      const localOnly = files.filter(f => !remoteMap.has(f.path));
+      const remoteOnly = remoteFiles.filter(f => !localMap.has(f.path));
+      const inSync = files.filter(f => {
+        const r = remoteMap.get(f.path);
+        return r && r.hash === f.hash;
+      });
+
+      return { localOnly: localOnly.length, remoteOnly: remoteOnly.length, inSync: inSync.length };
+    };
+
+    return {
+      reachable,
+      remoteUrl,
+      memory: byType("memory/"),
+      sessions: byType("sessions/"),
+      cron: byType(null, f => f === "cron/jobs.json"),
+      workstreams: byType(null, f => /^workstreams\//.test(f)),
+      permissions: byType(null, f => f === "permissions.json"),
+    };
+  }
+
+  // ── Selective sync helpers ──────────────────────────────────────────────────
+
+  async pushMemory(remoteUrl, token) {
+    return this.push(remoteUrl, token, { memoryOnly: true });
+  }
+
+  async pullMemory(remoteUrl, token) {
+    return this.pull(remoteUrl, token, { memoryOnly: true });
+  }
+
+  async pushSessions(remoteUrl, token) {
+    return this.push(remoteUrl, token, { sessionsOnly: true });
+  }
+
+  async pullSessions(remoteUrl, token) {
+    return this.pull(remoteUrl, token, { sessionsOnly: true });
+  }
+
+  async pushCron(remoteUrl, token) {
+    return this.push(remoteUrl, token, { cronOnly: true });
+  }
+
+  async pullCron(remoteUrl, token) {
+    return this.pull(remoteUrl, token, { cronOnly: true });
+  }
+
+  // ── Single-file push (for auto-sync) ───────────────────────────────────────
+
+  /**
+   * Push a single file to remote (used for auto-sync hooks).
+   * Non-blocking: fires and forgets.
+   */
+  pushFile(absolutePath) {
+    if (!this.remoteUrl || !this.token) return;
+    const relPath = path.relative(WISPY_DIR, absolutePath).replace(/\\/g, "/");
+
+    // Check it's a syncable path
+    const syncable = SYNC_PATTERNS.some(p => p.match(relPath));
+    if (!syncable) return;
+
+    // Fire and forget
+    (async () => {
+      try {
+        const content = await readFile(absolutePath);
+        const fileStat = await stat(absolutePath);
+        await this._uploadFile(this.remoteUrl, this.token, {
+          path: relPath,
+          content: content.toString("base64"),
+          encoding: "base64",
+          modifiedAt: fileStat.mtime.toISOString(),
+          hash: sha256(content),
+        });
+      } catch {
+        // Silent fail for background auto-sync
+      }
+    })();
+  }
+
+  /**
+   * Enable auto-sync: save config and set auto=true.
+   */
+  static async enableAuto(remoteUrl, token) {
+    const cfg = await SyncManager.loadConfig();
+    cfg.auto = true;
+    cfg.remoteUrl = remoteUrl;
+    cfg.token = token;
+    await SyncManager.saveConfig(cfg);
+  }
+
+  /**
+   * Disable auto-sync.
+   */
+  static async disableAuto() {
+    const cfg = await SyncManager.loadConfig();
+    cfg.auto = false;
+    await SyncManager.saveConfig(cfg);
+  }
+}
+
+/**
+ * Get or create a singleton SyncManager from ~/.wispy/sync.json
+ * Returns null if not configured.
+ */
+let _instance = null;
+export async function getSyncManager() {
+  if (_instance) return _instance;
+  const cfg = await SyncManager.loadConfig();
+  if (!cfg.remoteUrl) return null;
+  _instance = new SyncManager(cfg);
+  return _instance;
+}
+
+/**
+ * Hash a file content Buffer
+ */
+export { sha256 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wispy-cli",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "🌿 Wispy — AI workspace assistant with trustworthy execution (harness, receipts, approvals, diffs)",
   "license": "MIT",
   "author": "Minseo & Poropo",