pull --out silently overwrites existing files without --overwrite

.github/workflows/ci.yml

@@ -2,18 +2,23 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'fix/**']
   pull_request:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        node: [20, 22]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: ${{ matrix.node }}
           cache: pnpm
       - uses: oven-sh/setup-bun@v2
         with:
@@ -22,4 +27,4 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm test
       - name: Bundle for npm and smoke it
-        run: pnpm build:npm && node packages/cli/bin/vibi.mjs --version
+        run: pnpm build:npm && node packages/cli/dist/vibi.mjs --version && node packages/cli/dist/vibi.mjs --help

package.json

@@ -5,7 +5,7 @@
   "packageManager": "[email protected]",
   "scripts": {
     "typecheck": "pnpm -r typecheck",
-    "test": "tsx --test packages/shared/test/*.test.ts packages/cli/test/*.test.ts",
+    "test": "node scripts/test.mjs",
     "build:npm": "pnpm --filter vibi build:npm",
     "build:host": "pnpm --filter vibi build:tui:host && pnpm --filter vibi build:host",
     "build": "pnpm --filter vibi build:tui && pnpm --filter vibi build"

packages/cli/src/commands/pull.ts

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { writeFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import {
   harnessName,
   listRemoteSessionsResponseSchema,
@@ -172,7 +172,7 @@ async function pullTarget(config: Config, key: LocalUserKey, target: Target, opt
   });
   onProgress?.({ phase: 'installing' });
   if (opts.out) {
-    writeFileSync(opts.out, content, { mode: 0o600 });
+    writeOutputTrace(opts.out, content, opts.overwrite);
     onProgress?.({ phase: 'done' });
     return `Wrote ${content.length} bytes of plaintext (${target.description}) to ${opts.out}.`;
   }
@@ -206,6 +206,15 @@ async function pullTarget(config: Config, key: LocalUserKey, target: Target, opt
 }
 
 /** The install report for the terminal: what happened, then how to resume, as a command to copy. */
+export function writeOutputTrace(file: string, content: Buffer, overwrite = false): void {
+  try {
+    writeFileSync(file, content, { mode: 0o600, flag: overwrite ? 'w' : 'wx' });
+  } catch (error) {
+    if (overwrite || (error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+    if (!readFileSync(file).equals(content)) throw new InstallConflict(file);
+  }
+}
+
 function formatPullMessage(message: string): string {
   const [head, ...rest] = message.split('\n');
   return [

packages/cli/test/install.test.ts

@@ -17,10 +17,11 @@ after(async () => {
 const meta = { title: 't', cwd: '/work/x', model: '', messageCount: 1, sourcePath: '', startedAt: null };
 
 test('Claude Code project directories are encoded the way Claude Code does it', () => {
-  assert.equal(encodeClaudeProjectDir('/Users/hongyinluo/Desktop/cybermind'), '-Users-hongyinluo-Desktop-cybermind');
-  assert.equal(encodeClaudeProjectDir('/Users/me/my_app.v2'), '-Users-me-my-app-v2');
+  const prefix = process.platform === 'win32' ? `${path.parse(process.cwd()).root[0]}--` : '-';
+  assert.equal(encodeClaudeProjectDir('/Users/hongyinluo/Desktop/cybermind'), `${prefix}Users-hongyinluo-Desktop-cybermind`);
+  assert.equal(encodeClaudeProjectDir('/Users/me/my_app.v2'), `${prefix}Users-me-my-app-v2`);
   const file = installPathFor({ harness: 'claude', harnessSessionId: 'abc', harnessUpdatedAt: '2026-10-01T10:00:00Z', metadata: meta, home, projectDir: '/work/x' });
-  assert.equal(file, path.join(home, '.claude', 'projects', '-work-x', 'abc.jsonl'));
+  assert.equal(file, path.join(home, '.claude', 'projects', `${prefix}work-x`, 'abc.jsonl'));
 });
 
 test('other harnesses keep their original file names and date folders', () => {

packages/cli/test/output.test.ts

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { test } from 'node:test';
+import { writeOutputTrace } from '../src/commands/pull';
+import { InstallConflict } from '../src/harnesses/install';
+
+test('pull output preserves different existing content until overwrite is explicit', () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), 'vibi-output-'));
+  try {
+    const file = path.join(dir, 'trace.jsonl');
+    writeOutputTrace(file, Buffer.from('first'));
+    writeOutputTrace(file, Buffer.from('first'));
+    assert.throws(() => writeOutputTrace(file, Buffer.from('second')), InstallConflict);
+    assert.equal(readFileSync(file, 'utf8'), 'first');
+    writeOutputTrace(file, Buffer.from('second'), true);
+    assert.equal(readFileSync(file, 'utf8'), 'second');
+    const empty = path.join(dir, 'empty');
+    writeFileSync(empty, '');
+    assert.throws(() => writeOutputTrace(empty, Buffer.from('data')), InstallConflict);
+    assert.throws(() => writeOutputTrace(path.join(dir, 'missing', 'trace'), Buffer.from('data')), /ENOENT/);
+  } finally { rmSync(dir, {recursive: true, force: true}); }
+});

scripts/test.mjs

@@ -0,0 +1,11 @@
+import { spawnSync } from 'node:child_process';
+import { readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+const files = ['packages/shared/test', 'packages/cli/test'].flatMap((dir) =>
+  readdirSync(new URL(`../${dir}/`, import.meta.url)).filter((name) => name.endsWith('.test.ts')).sort().map((name) => `${dir}/${name}`)
+);
+const result = spawnSync(process.execPath, ['--import', 'tsx', '--test', ...files], {cwd: root, stdio: 'inherit'});
+if (result.error) throw result.error;
+process.exit(result.status ?? 1);