feat!: rewrite as a typed plugin + CLI with overrides and selective session sync

The published scripts had fallen four months behind the version actually in
daily use, and the whole-database session sync they shipped stops being viable
once opencode.db passes a gigabyte. This replaces both.

Architecture
- One core, two entry points: an OpenCode plugin and an opencode-sync CLI.
  The CLI stays because a plugin cannot repair the configuration that prevents
  the plugin from loading.
- Rewritten in TypeScript and published to npm as opencode-github-sync.

Per-machine overrides
- opencode-sync.overrides.jsonc is deep-merged into the config after a pull
  and subtracted again before a push, using git show HEAD: as the baseline
  rather than the working copy. An overridden key is therefore invisible to
  sync in both directions, and the machine keeps its own settings throughout.
- Without an overrides file the config is copied byte for byte, so comments and
  formatting survive untouched.

Selective session sync
- Sessions are exported individually as gzipped JSON shards, chosen by time
  window, include list, project directory and per-session size cap. Different
  sessions are different files, so git merges them unaided; the same session
  edited twice resolves by 	ime_updated. Import is a transactional upsert.
- The internal �vent log is excluded: largest table by row count, irrelevant
  to resuming a conversation.

Correctness
- Pushes are verified by reading the remote head back; git push can exit zero
  without the remote moving.
- Symlinks and Windows junctions are refused rather than followed.
- File and directory replacements are atomic.
- A cross-process lock covers the plugin, the CLI and every OpenCode window.
- Line endings are pinned to LF; 	ext=auto alone rewrote skill shell scripts
  to CRLF on Windows.
- Commit messages use a stable pseudonym, so a corporate asset-tag hostname
  cannot reach the repository.

Credentials are opt-in and refused on public repositories. 82 tests run against
a real bare git repository simulating two machines, on Node 20/22/24 across
Linux, macOS and Windows.

Author: doomsday616

.gitattributes

@@ -0,0 +1,5 @@
+# Keep the source tree LF everywhere so a Windows checkout does not produce
+# spurious whole-file diffs.
+* text=auto eol=lf
+*.png binary
+*.svg text eol=lf

.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: ${{ matrix.os }} · node ${{ matrix.node }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # Windows and macOS are both first-class targets, and the path,
+        # line-ending and process-signal behaviour genuinely differs between
+        # them — so both are tested rather than assumed.
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        # Node 22 is the oldest release with a built-in SQLite driver, so the
+        # session tests only have full coverage from there upwards.
+        node: [20, 22, 24]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - name: Configure git identity
+        run: |
+          git config --global user.name "CI"
+          git config --global user.email "ci@example.com"
+          git config --global init.defaultBranch main
+
+      - run: npm ci
+
+      - run: npm run lint
+
+      - run: npm run typecheck
+
+      - run: npm test
+
+      - run: npm run build
+
+  package:
+    name: package contents
+    runs-on: ubuntu-latest
+    needs: check
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Verify the published tarball
+        run: |
+          npm pack --dry-run
+          # The plugin and CLI entry points must both survive packing.
+          test -f dist/plugin/index.js
+          test -f dist/cli/index.js
+          test -f dist/core/index.js

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: npm
+
+      - run: npm ci
+      - run: npm run check
+      - run: npm run build
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create the GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true

.gitignore

@@ -1,5 +1,7 @@
 node_modules/
-scripts/node_modules/
+dist/
+coverage/
+*.tsbuildinfo
 .DS_Store
 Thumbs.db
-desktop.ini
+.vitest-tmp/

CHANGELOG.md

@@ -0,0 +1,50 @@
+# Changelog
+
+## 3.0.0
+
+Complete rewrite. The previous release was a set of shell-wrapped Node scripts;
+this is a typed library with two entry points and a real test suite.
+
+### Added
+- **OpenCode plugin.** Startup pull, optional push on idle, and an
+  `opencode_sync` tool. The CLI remains, because a plugin cannot repair the
+  configuration that stops the plugin from loading.
+- **Per-machine overrides.** `opencode-sync.overrides.jsonc` is deep-merged into
+  the config after every pull and subtracted again before every push, so an
+  overridden key is invisible to sync in both directions.
+- **Selective session sync.** Sessions are exported one at a time as gzipped
+  JSON shards, selected by time window, explicit include list, project directory
+  and per-session size cap. Import is a transactional upsert; the newer
+  `time_updated` wins.
+- `opencode-sync init` / `link` for one-command setup through the GitHub CLI.
+- `--dry-run` on push and pull.
+- `extraPaths` for syncing arbitrary additional files.
+- Cross-platform CI on Node 20/22/24 across Linux, macOS and Windows.
+
+### Changed
+- Rewritten in TypeScript, published to npm as `opencode-github-sync`.
+- New terminal UI with colour that degrades correctly for pipes, `NO_COLOR`
+  and non-truecolor terminals.
+- Commit messages now use a stable pseudonym rather than the raw hostname, so a
+  corporate asset tag can never reach the repository.
+- Line endings are pinned to LF in the worktree; `text=auto` alone was rewriting
+  shell scripts inside skills to CRLF on Windows.
+- Credential syncing is opt-in and refused on public repositories.
+
+### Removed
+- Whole-database session sync and the Git LFS dependency. Committing
+  `opencode.db` stops being viable once it passes a gigabyte, and copying it
+  alongside a live write-ahead log risks capturing torn data.
+- The shell/`.cmd` wrapper scripts, replaced by a real `bin` entry.
+
+### Fixed
+- A push is now verified by reading the remote head back; `git push` can exit
+  zero without the remote moving.
+- Symlinks and Windows junctions are refused instead of followed.
+- File and directory replacements are atomic, so an interrupted sync cannot
+  leave a half-written config.
+- Nested `.git` directories left behind by skill installs are stripped from the
+  staging copy, so skill contents are committed as files rather than as unusable
+  gitlinks.
+- A cross-process lock prevents concurrent syncs from the plugin, the CLI and
+  multiple OpenCode windows.