/workspace before execution.
What sync includes
Tracked files and nonignored untracked files are inputs. Usesync.include for safe ignored inputs and sync.exclude to narrow the selection:
sync.exclude when selection exceeds these limits.
Updates and deletes
Changed managed files are replaced. Exact deletes of previously managed paths propagate. Files created only on the guest, such as dependency caches and build outputs, survive source sync. The CLI freezes source bytes in a private local cache. It reuses hashes only while file identity, size, high-resolution timestamps and mode still match. Guest managed files are verified on each sync. You can remove the local source cache to reclaim space or force a fresh scan.Excluded paths
Secret paths, raw Git data, control files and build-output directories do not sync. These include.env*, .key and .pem files, .ssh, cloud credential directories, package-manager auth files, auth.json, credentials.json, target, node_modules and __pycache__. Explicit includes cannot bypass those exclusions.
bead also scans selected file contents for recognized provider credentials. A match rejects sync; remove the credential or exclude the file before retrying.
Use environment injection for dotenv values and artifact pulls for build results.
Git on the guest
The guest hasgit init and the selected files. History-dependent commands such as git log and git describe are unsupported. Version scripts can use BEAD_GIT_COMMIT and BEAD_GIT_BRANCH.
A dev invocation syncs once. To apply local edits, stop and start the service again.
