[elemdos]

During two-way development, an automatic file import could overwrite a newer CMS edit even when a separate stale primo push was rejected. The watcher imported the full site without expected_revision; a file writeback/reimport could therefore delete and recreate the edited page entries from older local content.

Automatic two-way site imports now send the last verified CMS revision. Receipts from successful imports and transaction-bound exports advance that revision; unresolved local conflicts do not. A CMS edit after the receipt makes the server reject the import atomically. A missing export receipt pauses an already verified two-way session before changing files. Files-author and CMS-author behavior remain unchanged.

Refs primocms/primo#1239 and primocms/primo#1241. Two-way sync remains experimental; this is a targeted safeguard for automatic site imports, not a claim that every startup/library conflict is resolved.

Validation: both new regressions fail against upstream and pass with this change; four existing sync-conflict tests also pass. A disposable workflow using the actual built CLI reproduced the lost CMS edit before the fix. Repeated runs with the guard preserve the CMS edit, all five content values, and section IDs through client editing and republication. That workflow still flags the independent primo-mcp publication-hydration issue.

Security follow-up: removes extract-zip and replaces every server-export extraction call with full metadata validation before file creation. Rejects symlinks, special files, traversal, duplicate/case aliases, Windows reserved names/streams and existing links/files. A symlink-then-file exploit overwrites a disposable sentinel with the old dependency; the replacement refuses the archive without writing. Regular nested/binary exports preserve normal umask-based asset readability. Twenty-six ZIP cases also run against the installed CLI package across all five native CMS runners. Upgrades Chokidar to 4 (literal directory watch paths; removes vulnerable braces), esbuild to a patched floor, and vulnerable compatible transitive locks. Full npm audit is clean.

Final rc.2 installed-package testing passes all 187 CLI tests without skips on Node 22.13.0 and 24.0.0. The final handoff also checks an actual active-workspace edit passing through the upgraded watcher with section IDs retained. All work remains draft; no merge, tag, package/release publication or deployment.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}