fix: a manual sync transfers what you selected, and asks first

Selecting two folders on a server and pressing Sync to Local copied the whole
directory. Two movies became forty thousand files.

The panes have always let you select entries. `page.tsx` built its request from
`source.path` and never read `state.selected`, so the selection reached the
counter in the pane footer and nothing else. Every transfer was the whole
directory, every time.

A second bug in the same click, found on the way. The rail sets the direction
and starts the transfer in one handler:

    onDirection('rtl')
    onRun()

`setDirection` does not change the value the current render closed over, so
`run` built its request from the PREVIOUS direction. Pressing the arrow that
was not armed transferred the opposite way: "Sync to Local" copied local over
the server. With Mirror armed it would have deleted the wrong side. The
direction is now passed to the run rather than read back out of state.

Selections now become an rsync `--files-from` list. The trap there, confirmed
against rsync 3.4.1 rather than assumed:

    rsync -a    --files-from=list src/ dst/   ->  cd+++++++++ movieA/
    rsync -a -r --files-from=list src/ dst/   ->  cd+++++++++ movieA/
                                                  >f+++++++++ movieA/a.mkv

`--files-from` switches recursion off and `--archive` does not switch it back
on, so a selected folder would have copied as an empty folder and reported
success. `buildRsyncArgs` now forces `--recursive` whenever a file list is in
play. The list is NUL-separated (`--from0`), because a newline is legal in a
filename and a line-separated list would split one name into two paths that do
not exist.

Mirror plus a selection deletes only inside what was selected. Verified, not
assumed: the other reading of `--delete` here would empty the destination.

Everything previews and is approved now, mirror or not. Both the desktop and
the CLI skipped the dry run for a plain sync, on the reasoning that it "buys no
safety, because nothing is deleted either way". Deleting is not the only way to
regret a transfer, and this bug is the proof: by the time anything was on
screen it was already copying. The dialog says which it is, Sync or Mirror, and
carries the scope ("2 selected items" / "Whole folder") next to the counts,
because a count alone never says how many of what you asked for. Confirming
starts the request that was measured, not one rebuilt from whatever the panes
say by then.

All three interfaces:

- Desktop: the pane selection is sent, validated as entry names rather than
  paths. That list becomes a `--files-from` rooted at the source directory, so
  a renderer able to put `../` in it would be choosing which files leave the
  machine.
- CLI: `--only NAME`, repeatable, and a plain sync now previews and asks. Only
  where somebody is there to answer: a pipe, `--non-interactive` or `--yes`
  proceeds as before, so scheduled profile runs keep working. `--no-preview`
  restores the old skip-the-scan behaviour.
- TUI: it had a cursor and no way to select at all, and `s` started an
  immediate transfer of everything on screen. Space marks entries, `s` scans
  and asks before it moves anything.

Two smaller things this turned up:

- `--only` did not parse. It was missing from VALUE_FLAGS, so it consumed no
  value, the names fell through to the positionals, and the flag silently did
  nothing. Caught by running the built binary, not by reading it.
- The preview dialog's "Trust this pair from now on" checkbox is gone. It set
  renderer state that nothing read, and could not have worked if wired:
  saveProfile hard-codes `trustDeletes: false` on purpose, because unattended
  mirroring is the one way a delete list runs with nobody looking at it.

Verified against the real rsync and the real dev server. `--only movieA --only
movieB` over ssh: 4 files, not 7. The desktop driven in headless Chromium under
the app's real CSP: the preview request carries the ssh source, both names, and
does not start until approved. The TUI driven in a pty: marks render, the
confirm appears, `n` transfers nothing, `y` copies the two marked folders with
their contents and leaves the rest.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VScug5VRbcTuhiAoieeQ52

Author: ralyodio

apps/cli/src/commands/transfer.ts

@@ -1,4 +1,7 @@
 import { randomUUID } from 'node:crypto'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { createInterface } from 'node:readline/promises'
 import type { DiskPushStore } from '@diskpush/database'
 import { capabilityCacheKey } from '../resolve.js'
@@ -15,7 +18,7 @@ import { summarizeChanges, topologyOf } from '@diskpush/schemas'
 import { EXIT } from '../exit-codes.js'
 import { estimateRemaining, formatBytes, formatDuration, formatRate, pluralize, table } from '../format.js'
 import { failure, type Output } from '../output.js'
-import { flagValue, hasFlag, type ParsedArgv } from '../parse-argv.js'
+import { flagValue, flagValues, hasFlag, type ParsedArgv } from '../parse-argv.js'
 import { detectLocalCapabilities, optionsFromFlags, resolveEndpoint } from '../resolve.js'
 import type { RsyncCapabilities } from '@diskpush/rsync-core'
 
@@ -61,6 +64,39 @@ export async function runTransfer(
 
   if (alias.deleteMode !== 'off') options.deleteMode = alias.deleteMode
 
+  /*
+   * `--only NAME` narrows the transfer to entries inside the source directory,
+   * the CLI's version of ticking rows in the desktop's pane. It becomes an
+   * rsync `--files-from` list, which is why the names are checked here: a
+   * separator or a `..` would silently widen the transfer to somewhere the
+   * user did not name.
+   */
+  const only = flagValues(parsed, '--only')
+  let selectionCleanup: (() => void) | null = null
+  if (only.length > 0) {
+    const bad = only.find(
+      (name) => name.includes('/') || name.includes('\\') || name.includes('\0') || name === '.' || name === '..',
+    )
+    if (bad !== undefined) {
+      return failure(
+        output,
+        `--only takes a name inside the source directory, not a path: ${JSON.stringify(bad)}.`,
+        EXIT.usage,
+      )
+    }
+    const directory = mkdtempSync(join(tmpdir(), 'diskpush-only-'))
+    const listPath = join(directory, 'files-from')
+    // NUL-separated: a newline is legal in a filename, and a line-separated
+    // list would split one such name into two paths that do not exist.
+    writeFileSync(listPath, `${only.join('\0')}\0`)
+    options = { ...options, filesFrom: listPath, from0: true }
+    selectionCleanup = () => rmSync(directory, { recursive: true, force: true })
+    // Registered rather than called at each of this function's many returns:
+    // rsync has read the list long before the process ends, and one handler
+    // cannot be forgotten the way eight call sites can.
+    process.once('exit', selectionCleanup)
+  }
+
   const source = await resolveEndpoint(store, sourceInput)
   const destination = await resolveEndpoint(store, destinationInput)
   const topology = topologyOf(source.endpoint, destination.endpoint)
@@ -100,9 +136,20 @@ export async function runTransfer(
   }
 
   // --- preview ------------------------------------------------------------
-  // Mirror always previews before it can run. A plain sync previews only when
-  // asked, because its dry run costs a full scan for no safety benefit.
-  const wantsPreview = options.deleteMode !== 'off' || options.dryRun
+  /*
+   * Everything previews, not only a mirror.
+   *
+   * This used to skip the dry run for a plain sync, on the reasoning that it
+   * "costs a full scan for no safety benefit". Deleting is not the only way to
+   * regret a transfer: two named folders can turn into forty thousand files,
+   * and by the time anything is on screen it is already copying. A scan is
+   * cheap next to that.
+   *
+   * `--yes` still skips the question, which is what a script passes; the scan
+   * itself is skipped only by `--no-preview`, for someone who genuinely wants
+   * the old behaviour.
+   */
+  const wantsPreview = !hasFlag(parsed, '--no-preview')
   let preview: Awaited<ReturnType<typeof runPreview>> | null = null
 
   if (wantsPreview) {
@@ -147,6 +194,28 @@ export async function runTransfer(
     }
   }
 
+  /*
+   * A plain sync is approved too, but only where there is somebody to ask.
+   *
+   * A script that pipes us, passes --non-interactive, or passes --yes has
+   * already decided, and turning those into a refusal would break every
+   * scheduled profile run. The prompt is for the interactive case, which is
+   * the one where a surprise is possible.
+   */
+  if (options.deleteMode === 'off' && preview) {
+    const moving = preview.changes.filter((c) => c.action === 'add' || c.action === 'update').length
+    const asking = !hasFlag(parsed, '--yes') && !hasFlag(parsed, '--non-interactive') && process.stdin.isTTY
+
+    if (moving === 0) {
+      return finish(output, EXIT.ok, 'Nothing to transfer. The destination already matches.', {
+        changes: summarizeChanges(preview.changes),
+      })
+    }
+    if (asking && !(await confirm(`${alias.label} ${pluralize(moving, 'file')}?`))) {
+      return failure(output, `${alias.label} cancelled. Nothing was transferred.`, EXIT.refused)
+    }
+  }
+
   // --- run -----------------------------------------------------------------
   let plan: ExecutionPlan
   try {

apps/cli/src/parse-argv.test.ts

@@ -116,3 +116,28 @@ describe('commands', () => {
     expect(parsed.positionals).toEqual(['sync', './b/'])
   })
 })
+
+describe('--only', () => {
+  /*
+   * The bug: `--only` was not in VALUE_FLAGS, so it consumed nothing. Each
+   * name fell through to the positionals, `flagValues` came back empty, and
+   * `diskpush sync SRC DST --only movieA --only movieB` synced the whole
+   * directory anyway. Which is the exact bug --only exists to fix.
+   */
+  it('takes a value, and repeats', () => {
+    const parsed = parseArgv(['sync', 'dev:/srv/', './out/', '--only', 'movieA', '--only', 'movieB'])
+    expect(flagValues(parsed, '--only')).toEqual(['movieA', 'movieB'])
+    // The names are flag values, not endpoints.
+    expect(parsed.positionals).toEqual(['dev:/srv/', './out/'])
+  })
+
+  it('keeps a name with spaces in one piece', () => {
+    const parsed = parseArgv(['sync', 'dev:/srv/', './out/', '--only', 'The Movie (2019)'])
+    expect(flagValues(parsed, '--only')).toEqual(['The Movie (2019)'])
+  })
+
+  it('accepts the --only=NAME form too', () => {
+    const parsed = parseArgv(['sync', 'dev:/srv/', './out/', '--only=movieA'])
+    expect(flagValues(parsed, '--only')).toEqual(['movieA'])
+  })
+})

apps/cli/src/parse-argv.ts

@@ -33,6 +33,8 @@ export const VALUE_FLAGS = new Set([
   '--exclude-from',
   '--include-from',
   '--files-from',
+  // Repeatable: one entry name inside the source directory, per occurrence.
+  '--only',
   '--bwlimit',
   '--max-size',
   '--min-size',