@cellajs/cli 0.3.3 → 0.4.0

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env tsx
 
 // src/cella-cli.ts
-import { existsSync as existsSync13, statSync as statSync3 } from "fs";
-import { join as join19, resolve as resolve8 } from "path";
-import process9 from "process";
+import { existsSync as existsSync12, statSync as statSync3 } from "fs";
+import { join as join17, resolve as resolve7 } from "path";
+import process8 from "process";
 
 // src/cli.ts
 import process5 from "process";
@@ -77,7 +77,7 @@ var cellaConfigSchema = z.object({
     releaseBase: z.string().min(1).optional(),
     packageJsonSync: z.array(z.enum(PACKAGE_JSON_SYNC_KEYS)).optional(),
     syncWithPackages: z.boolean().optional(),
-    fileLinkMode: z.enum(["commit", "file", "local"]).optional()
+    fileLinkMode: z.enum(["commit", "file"]).optional()
   }).strict(),
   overrides: z.object({
     ignored: z.array(z.string()).optional(),
@@ -101,11 +101,6 @@ function errorMessage(error) {
 
 // src/utils/managed-files.ts
 var CONFIG_FILE = "cella/cella.config.ts";
-var LEGACY_CONFIG_FILE = "cella.config.ts";
-var CONFIG_FILE_PATHS = [CONFIG_FILE, LEGACY_CONFIG_FILE];
-function isConfigFile(filePath) {
-  return CONFIG_FILE_PATHS.includes(filePath);
-}
 function isPackageJson(filePath) {
   return filePath === "package.json" || filePath.endsWith("/package.json");
 }
@@ -114,7 +109,7 @@ function isGeneratedFile(filePath) {
   return segments.includes("gen") || (segments.at(-1) ?? "").includes(".gen.");
 }
 function isManagedFile(filePath) {
-  return isPackageJson(filePath) || filePath === "pnpm-lock.yaml" || isConfigFile(filePath);
+  return isPackageJson(filePath) || filePath === "pnpm-lock.yaml" || filePath === CONFIG_FILE;
 }
 
 // src/utils/module-territory.ts
@@ -162,7 +157,6 @@ function resolveAppModuleFolders(repoPath) {
 var DEFAULT_UPSTREAM_REMOTE = "cella-upstream";
 var DEFAULT_BRANCH = "main";
 var DEFAULT_SYNC_PREFIX = "cella/sync";
-var DEFAULT_RELEASE_BASE = "main";
 var DEFAULT_PACKAGE_JSON_SYNC = ["dependencies", "devDependencies"];
 function isUpstreamRepo(repoPath) {
   return JSON.parse(readFileSync(join2(repoPath, "package.json"), "utf8")).name === "cella";
@@ -171,7 +165,7 @@ function isTemporarySyncBranch(branch) {
   return branch.startsWith(`${DEFAULT_SYNC_PREFIX}/`);
 }
 function resolveReleaseBase(settings) {
-  return settings.releaseBase ?? DEFAULT_RELEASE_BASE;
+  return settings.releaseBase ?? DEFAULT_BRANCH;
 }
 function buildTemporarySyncBranch() {
   const now = /* @__PURE__ */ new Date();
@@ -219,14 +213,13 @@ ${z2.prettifyError(result.error)}`);
 }
 
 // src/utils/display.ts
-import { writeFileSync } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { resolve as resolve2 } from "path";
 import process4 from "process";
 
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.3.3",
+  version: "0.4.0",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and syncing with upstream Cella.",
@@ -281,6 +274,7 @@ var package_default = {
     "@pierre/diffs": "^1.5.1",
     commander: "^15.0.0",
     "ts-morph": "^28.0.0",
+    yaml: "^2.9.1",
     zod: "^4.6.5"
   },
   devDependencies: {
@@ -349,44 +343,12 @@ var package_default = {
 };
 
 // src/utils/display.ts
-var NAME = "cella cli";
 var VERSION = package_default.version;
 var DIVIDER = "\u2500".repeat(60);
 var MENU_DIVIDER = "\u2500".repeat(40);
 var COMMIT_LIST_MAX = 50;
 var warningMark = colors_default.yellow("\u26A0");
 var checkMark = colors_default.green("\u2713");
-var TerminalSpinner = class {
-  constructor(text, isSilent) {
-    this.text = text;
-    this.enabled = !isSilent && !!process4.stdout.isTTY;
-  }
-  text;
-  frames = ["-", "\\", "|", "/"];
-  frameIndex = 0;
-  timer = null;
-  enabled;
-  start() {
-    if (!this.enabled || this.timer) return this;
-    this.render();
-    this.timer = setInterval(() => {
-      this.frameIndex = (this.frameIndex + 1) % this.frames.length;
-      this.render();
-    }, 80);
-    return this;
-  }
-  stop() {
-    if (this.timer) {
-      clearInterval(this.timer);
-      this.timer = null;
-    }
-    if (!this.enabled) return;
-    process4.stdout.write("\r\x1B[2K");
-  }
-  render() {
-    process4.stdout.write(`\r${colors_default.cyan(this.frames[this.frameIndex])} ${this.text}`);
-  }
-};
 var activeSpinner = null;
 var jsonMode = false;
 function setJsonMode(enabled) {
@@ -397,42 +359,48 @@ function setJsonMode(enabled) {
 `);
   };
   console.info = toStderr;
-  console.log = toStderr;
   console.warn = toStderr;
 }
 function writeStdout(text) {
   process4.stdout.write(text.endsWith("\n") ? text : `${text}
 `);
 }
-function getHeader() {
-  const right = "cellajs.com";
-  const visibleLeft = `\u29C8 ${NAME} v${VERSION}`;
-  const padding = Math.max(1, 60 - visibleLeft.length - right.length);
-  return `${colors_default.cyan(`\u29C8 ${NAME}`)}${colors_default.dim(` \xB7 v${VERSION}`)}${colors_default.cyan(`${" ".repeat(padding)}${right}`)}`;
-}
 function printHeader() {
+  const left = "\u29C8 cella cli";
+  const right = "cellajs.com";
+  const padding = Math.max(1, 60 - `${left} v${VERSION}`.length - right.length);
   console.info();
-  console.info(getHeader());
+  console.info(`${colors_default.cyan(left)}${colors_default.dim(` \xB7 v${VERSION}`)}${colors_default.cyan(`${" ".repeat(padding)}${right}`)}`);
   console.info(DIVIDER);
   console.info();
 }
-function printStep(label, detail) {
-  console.info(`${checkMark} ${label}`);
-  if (detail) {
-    console.info(`  ${colors_default.dim(detail)}`);
-    console.info();
-  }
-}
 function createSpinner(text) {
-  const isTestEnv = !!getEnv("VITEST") || getEnv("NODE_ENV") === "test";
-  activeSpinner = new TerminalSpinner(text, isTestEnv || jsonMode);
-  activeSpinner.start();
-  return activeSpinner;
+  const enabled = !jsonMode && !getEnv("VITEST") && getEnv("NODE_ENV") !== "test" && !!process4.stdout.isTTY;
+  const frames = ["-", "\\", "|", "/"];
+  let frame = 0;
+  let timer;
+  const spinner = {
+    text,
+    stop() {
+      clearInterval(timer);
+      if (enabled) process4.stdout.write("\r\x1B[2K");
+    }
+  };
+  const render = () => process4.stdout.write(`\r${colors_default.cyan(frames[frame++ % frames.length])} ${spinner.text}`);
+  if (enabled) {
+    render();
+    timer = setInterval(render, 80);
+  }
+  activeSpinner = spinner;
+  return spinner;
 }
 function spinnerSuccess(message, detail) {
   stopSpinner();
-  if (message) {
-    printStep(message, detail);
+  if (!message) return;
+  console.info(`${checkMark} ${message}`);
+  if (detail) {
+    console.info(`  ${colors_default.dim(detail)}`);
+    console.info();
   }
 }
 function spinnerFail(message) {
@@ -455,16 +423,8 @@ function hyperlink(label, url) {
   const safeUrl = url.replace(/[\x00-\x1f\x7f]/g, "");
   return `\x1B]8;;${safeUrl}\x07${label}\x1B]8;;\x07`;
 }
-function getVsCodeOpenFileLink(filePath, options) {
-  const { forkPath } = options;
-  if (!forkPath) return filePath;
-  const absolutePath = resolve2(forkPath, filePath);
-  const url = `vscode://file${absolutePath}`;
-  return hyperlink(filePath, url);
-}
 function formatFetchedUpstreamDetail(commitCount, commits, upstreamGitHubUrl, maxShownCommits = COMMIT_LIST_MAX) {
-  const commitLabel = commitCount === 1 ? "1 new commit" : `${commitCount} new commits`;
-  const lines = [`${commitLabel} since last merge`];
+  const lines = [`${plural(commitCount, "new commit")} since last merge`];
   const shown = commits.slice(0, maxShownCommits);
   for (const commit of shown) {
     const shortHash = commit.hash.slice(0, 7);
@@ -477,32 +437,22 @@ function formatFetchedUpstreamDetail(commitCount, commits, upstreamGitHubUrl, ma
   }
   return lines.join("\n");
 }
-function getFileLink(filePath, commitHash, options) {
-  const { upstreamGitHubUrl, upstreamBranch, fileLinkMode = "commit" } = options;
-  const mode = fileLinkMode === "local" ? "file" : fileLinkMode;
-  if (!upstreamGitHubUrl) {
-    return { label: commitHash?.slice(0, 9) || "" };
-  }
-  if (mode === "file" && upstreamBranch) {
-    const url = `${upstreamGitHubUrl}/blob/${upstreamBranch}/${filePath}`;
-    return { label: filePath.split("/").pop() || filePath, url };
-  }
-  if (commitHash) {
-    const url = `${upstreamGitHubUrl}/commit/${commitHash}`;
-    return { label: commitHash.slice(0, 9), url };
-  }
-  return { label: "" };
-}
 function printSectionHeader(title) {
   console.info();
   console.info(title);
   console.info(DIVIDER);
   console.info();
 }
-function formatFileDateInfo(filePath, commit, date, linkOptions) {
-  const link = getFileLink(filePath, commit, linkOptions);
-  const linkLabel = link.label ? hyperlink(link.label, link.url) : "";
-  return date ? colors_default.dim(` \u2260 ${date} ${linkLabel}`) : "";
+function formatFileDateInfo(filePath, commit, date, options) {
+  if (!date) return "";
+  const { upstreamGitHubUrl: url, upstreamBranch, fileLinkMode = "commit" } = options;
+  let link = commit?.slice(0, 9) ?? "";
+  if (url && fileLinkMode === "file" && upstreamBranch) {
+    link = hyperlink(filePath.split("/").pop() || filePath, `${url}/blob/${upstreamBranch}/${filePath}`);
+  } else if (url) {
+    link = commit ? hyperlink(link, `${url}/commit/${commit}`) : "";
+  }
+  return colors_default.dim(` \u2260 ${date} ${link}`);
 }
 function formatMergeInProgressDetail(conflictCount, autoMergedFiles, linkOptions, maxFiles = 100) {
   const lines = [`${conflictCount} conflicts to resolve in IDE`];
@@ -511,10 +461,10 @@ function formatMergeInProgressDetail(conflictCount, autoMergedFiles, linkOptions
   }
   lines.push("");
   lines.push(`  auto-merged files (${autoMergedFiles.length}):`);
+  const { forkPath } = linkOptions;
   const shown = autoMergedFiles.slice(0, maxFiles);
   for (const filePath of shown) {
-    const fileLink = getVsCodeOpenFileLink(filePath, linkOptions);
-    lines.push(`  - ${fileLink}`);
+    lines.push(`  - ${forkPath ? hyperlink(filePath, `vscode://file${resolve2(forkPath, filePath)}`) : filePath}`);
   }
   if (autoMergedFiles.length > shown.length) {
     lines.push(`  ... + ${autoMergedFiles.length - shown.length} more`);
@@ -543,30 +493,25 @@ var summaryStatusConfig = {
   },
   ignored: { ...statusConfig.ignored, description: "protected by ignored config" }
 };
-var statusOrder = Object.keys(statusConfig);
 function printSummary(summary, title = "summary") {
   printSectionHeader(colors_default.cyan(title));
-  const maxCount = Math.max(...statusOrder.map((status) => summary[status]), summary.managed);
+  const maxCount = Math.max(...Object.values(summary));
   const countWidth = String(maxCount).length + 1;
-  const printLine = (status, count) => {
-    const { icon, label, color, description } = summaryStatusConfig[status];
-    const countStr = color(String(count).padStart(countWidth));
-    const desc = description ? colors_default.dim(description) : "";
-    console.info(`  ${icon} ${countStr}  ${label.padEnd(15)}${desc}`);
-  };
-  printLine("managed", summary.managed);
-  printLine("ignored", summary.ignored);
-  console.info();
-  printLine("identical", summary.identical);
-  console.info();
-  printLine("ahead", summary.ahead);
-  printLine("local", summary.local);
-  printLine("drifted", summary.drifted);
-  console.info();
-  printLine("diverged", summary.diverged);
-  printLine("pinned", summary.pinned);
-  console.info();
-  printLine("behind", summary.behind);
+  const groups = [
+    ["managed", "ignored"],
+    ["identical"],
+    ["ahead", "local", "drifted"],
+    ["diverged", "pinned"],
+    ["behind"]
+  ];
+  for (const group of groups) {
+    if (group !== groups[0]) console.info();
+    for (const status of group) {
+      const { icon, label, color, description } = summaryStatusConfig[status];
+      const countStr = color(String(summary[status]).padStart(countWidth));
+      console.info(`  ${icon} ${countStr}  ${label.padEnd(15)}${description ? colors_default.dim(description) : ""}`);
+    }
+  }
 }
 function printFileSection(files, title, linkOptions, options) {
   if (files.length === 0) return;
@@ -600,14 +545,13 @@ function printFileGroup(files, status, linkOptions, options) {
 function findProtectedBehind(files) {
   return files.filter((file) => file.upstreamChanged && !isManagedFile(file.path));
 }
-var PROTECTED_BEHIND_HINT = "pinned/ignored files where upstream also changed since the last sync; the fork side wins on conflict, so diff each against upstream (analyze --open-diff <path>) and adopt what you need.";
+var PROTECTED_BEHIND_HINT = "pinned/ignored files where upstream also changed since the last sync; the fork side wins on conflict, so diff each against upstream and adopt what you need.";
 function protectionIcon(file) {
   return file.isIgnored ? statusConfig.ignored.icon : statusConfig.pinned.icon;
 }
 function formatUpstreamChangedLines(file) {
   if (file.upstreamChangedLines === void 0) return "";
-  const n = file.upstreamChangedLines;
-  return colors_default.yellow(` \xB7 ${n} ${n === 1 ? "line" : "lines"} changed upstream`);
+  return colors_default.yellow(` \xB7 ${plural(file.upstreamChangedLines, "line")} changed upstream`);
 }
 function protectedDiffHints(source, paths) {
   const range = source?.upstreamDiffRange;
@@ -622,7 +566,7 @@ function protectedDiffHints(source, paths) {
 }
 function formatUpstreamLinesAbsent(file) {
   const n = file.upstreamLinesAbsent ?? 0;
-  return n > 0 ? colors_default.yellow(` \xB7 ${n} upstream ${n === 1 ? "line" : "lines"} absent`) : "";
+  return n > 0 ? colors_default.yellow(` \xB7 ${plural(n, "upstream line")} absent`) : "";
 }
 function printAnalysisFileGroups(files, linkOptions, diffSource) {
   const protectedBehind = findProtectedBehind(files);
@@ -634,7 +578,7 @@ function printAnalysisFileGroups(files, linkOptions, diffSource) {
     suffix: formatUpstreamLinesAbsent,
     hint: [
       "these files have fork changes but are protected (pinned); upstream did not change them since the last sync.",
-      "pinned files keep the fork side on every conflict; a count here is upstream content the fork never received, deliberately or not: diff and decide."
+      "pinned files keep the fork copy whole; a count here is upstream content the fork never received, deliberately or not: `analyze --unpinned` shows what a merge would bring in."
     ]
   });
   printFileSection(protectedBehind, `${warningMark} ${colors_default.yellow("protected but behind upstream")}`, linkOptions, {
@@ -659,30 +603,6 @@ function printAnalysisFileGroups(files, linkOptions, diffSource) {
     dateSource: "upstream"
   });
 }
-function writeLogFile(forkPath, files) {
-  const logPath = join3(forkPath, "cella-sync.log");
-  const lines = [
-    `cella sync analysis: ${(/* @__PURE__ */ new Date()).toISOString()}`,
-    DIVIDER,
-    "",
-    `complete file list (${files.length} files)`,
-    DIVIDER,
-    ""
-  ];
-  const sortedFiles = [...files].sort((a, b) => {
-    const aOrder = statusOrder.indexOf(a.status);
-    const bOrder = statusOrder.indexOf(b.status);
-    if (aOrder !== bOrder) return aOrder - bOrder;
-    return a.path.localeCompare(b.path);
-  });
-  for (const file of sortedFiles) {
-    const config = statusConfig[file.status];
-    const icon = config.icon.replace(/\x1b\[[0-9;]*m/g, "");
-    lines.push(`  ${icon} ${config.label.padEnd(12)} ${file.path}`);
-  }
-  writeFileSync(logPath, lines.join("\n"), "utf8");
-  return logPath;
-}
 function printSyncComplete(result, options = {}) {
   const updated = result.files.filter((file) => file.status === "behind" || file.status === "diverged").length;
   const diverged = result.files.filter((file) => file.status === "diverged").length;
@@ -708,7 +628,7 @@ function printProtectedConflicts(result) {
   console.info();
   console.info(
     `${warningMark} ${colors_default.yellow(
-      `${paths.length} protected ${paths.length === 1 ? "file kept" : "files kept"} the fork version, dropping upstream changes:`
+      `${plural(paths.length, "protected file kept", "protected files kept")} the fork version, dropping upstream changes:`
     )}`
   );
   for (const path of paths) {
@@ -718,8 +638,8 @@ function printProtectedConflicts(result) {
   }
   for (const line of [PROTECTED_BEHIND_HINT, ...protectedDiffHints(result, paths)]) console.info(colors_default.dim(`  ${line}`));
 }
-function plural(count, singular, pluralForm = `${singular}s`) {
-  return `${count} ${count === 1 ? singular : pluralForm}`;
+function plural(count2, singular, pluralForm = `${singular}s`) {
+  return `${count2} ${count2 === 1 ? singular : pluralForm}`;
 }
 function shellPath(path) {
   return /^[\w./@+-]+$/.test(path) ? path : `'${path.replace(/'/g, `'\\''`)}'`;
@@ -727,7 +647,7 @@ function shellPath(path) {
 function printIgnoredUpstreamChanges(result) {
   const groups = result.ignoredUpstreamChanges ?? [];
   if (groups.length === 0) return;
-  const total = groups.reduce((count, group) => count + group.paths.length, 0);
+  const total = groups.reduce((count2, group) => count2 + group.paths.length, 0);
   console.info();
   console.info(
     `${warningMark} ${colors_default.yellow(`ignored paths changed upstream \xB7 ${plural(total, "file")} under ${plural(groups.length, "entry", "entries")}`)}`
@@ -775,11 +695,10 @@ function findMaskingPins(files) {
 function printMaskingPinWarning(files) {
   const masking = findMaskingPins(files);
   if (masking.length === 0) return;
-  const many = masking.length > 1;
   console.info();
   console.info(
     `${warningMark} ${colors_default.yellow(
-      `${masking.length} pinned ${many ? "files match" : "file matches"} the previous upstream but changed upstream:`
+      `${plural(masking.length, "pinned file matches", "pinned files match")} the previous upstream but changed upstream:`
     )}`
   );
   console.info(colors_default.yellow("  the pin keeps the old fork copy and silently drops those upstream changes:"));
@@ -791,49 +710,27 @@ function printMaskingPinWarning(files) {
   );
   console.info();
 }
-function printFlagWarnings(options) {
-  const { hard, unpinned } = options;
-  if (!hard && !unpinned) return;
-  if (hard) {
-    console.info(colors_default.yellow("\u26A0 --hard used: drifted files were treated as behind, overwriting with incoming."));
-  }
-  if (unpinned) {
-    console.info(
-      colors_default.yellow(
-        "\u26A0 --unpinned used: pinned files in cella/cella.config.ts were ignored, this can result in more drifts."
-      )
-    );
-  }
-  console.info(colors_default.yellow("  be extra careful and cherry-pick what you want only."));
-  console.info();
-}
 function printEngineReports(result, title) {
   printSummary(result.summary, title);
   printIgnoredUpstreamChanges(result);
   printUpstreamOverrideChanges(result);
   printMaskingPinWarning(result.files);
 }
-function printLogFileReport(config, files) {
-  if (!config.logFile) return;
-  const logPath = writeLogFile(config.forkPath, files);
-  console.info();
-  console.info(colors_default.dim(`full file list written to: ${logPath}`));
-}
 
 // src/utils/overrides.ts
 import { existsSync as existsSync5 } from "fs";
-import { join as join7 } from "path";
+import { join as join6 } from "path";
 
 // src/utils/git.ts
 import { execFile } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { mkdir as mkdir2, readdir, rmdir, unlink } from "fs/promises";
-import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "path";
 import { promisify } from "util";
 
 // src/utils/manifest.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname, join as join4 } from "path";
+import { dirname, join as join3 } from "path";
 var MANIFEST_FILE = "cella/cella.manifest.json";
 function parseSyncManifest(raw) {
   try {
@@ -847,7 +744,7 @@ function parseSyncManifest(raw) {
 }
 async function readSyncManifest(cwd) {
   try {
-    return parseSyncManifest(await readFile(join4(cwd, MANIFEST_FILE), "utf8"));
+    return parseSyncManifest(await readFile(join3(cwd, MANIFEST_FILE), "utf8"));
   } catch {
     return null;
   }
@@ -857,7 +754,7 @@ async function readManifestBase(cwd) {
   return manifest ? manifest.upstream.commit.toLowerCase() : null;
 }
 async function writeSyncManifest(cwd, manifest) {
-  const manifestPath = join4(cwd, MANIFEST_FILE);
+  const manifestPath = join3(cwd, MANIFEST_FILE);
   await mkdir(dirname(manifestPath), { recursive: true });
   await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
@@ -878,9 +775,8 @@ async function git(args, cwd, options = {}) {
     ...options.skipEditor ? { GIT_EDITOR: "true" } : {},
     ...options.env
   };
-  const maxBuffer = options.maxBuffer ?? MAX_BUFFER;
   try {
-    const { stdout } = await execFileAsync("git", args, { cwd, env, maxBuffer });
+    const { stdout } = await execFileAsync("git", args, { cwd, env, maxBuffer: MAX_BUFFER });
     return stdout.trim();
   } catch (error) {
     if (options.ignoreErrors) return "";
@@ -890,6 +786,9 @@ async function git(args, cwd, options = {}) {
     throw error;
   }
 }
+async function revParse(cwd, ref) {
+  return await git(["rev-parse", "-q", "--verify", ref], cwd, { ignoreErrors: true }) || null;
+}
 async function getCurrentBranch(cwd) {
   return git(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
 }
@@ -903,7 +802,7 @@ async function createBranchFrom(cwd, branch, startPoint) {
   await git(["switch", "-c", branch, "--no-track", startPoint], cwd);
 }
 async function branchExists(cwd, branch) {
-  return await git(["rev-parse", "-q", "--verify", `refs/heads/${branch}`], cwd, { ignoreErrors: true }) !== "";
+  return await revParse(cwd, `refs/heads/${branch}`) !== null;
 }
 async function getBranchWorktree(cwd, branch) {
   const output = await git(["worktree", "list", "--porcelain"], cwd, { ignoreErrors: true });
@@ -968,7 +867,7 @@ async function stageAll(cwd) {
   await git(["add", "-A"], cwd);
 }
 async function mergeInProgress(cwd) {
-  return await git(["rev-parse", "-q", "--verify", "MERGE_HEAD"], cwd, { ignoreErrors: true }) !== "";
+  return await revParse(cwd, "MERGE_HEAD") !== null;
 }
 async function getShortSha(cwd, ref) {
   return git(["rev-parse", "--short", ref], cwd);
@@ -978,16 +877,9 @@ async function getWorkingTreeChangeCount(cwd) {
   if (!status) return 0;
   return status.split("\n").filter(Boolean).length;
 }
-async function remoteExists(cwd, remoteName) {
-  const remotes = await git(["remote"], cwd);
-  return remotes.split("\n").includes(remoteName);
-}
 async function ensureRemote(cwd, remoteName, url) {
-  if (await remoteExists(cwd, remoteName)) {
-    await git(["remote", "set-url", remoteName, url], cwd);
-  } else {
-    await git(["remote", "add", remoteName, url], cwd);
-  }
+  await git(["remote", "add", remoteName, url], cwd, { ignoreErrors: true });
+  await git(["remote", "set-url", remoteName, url], cwd);
 }
 async function fetchRemote(cwd, remoteName) {
   await git(["fetch", remoteName], cwd);
@@ -1014,7 +906,7 @@ async function resolveUpstreamCommit(cwd, remoteName, ref) {
   if (ref.startsWith("-")) return null;
   const tagRef = `refs/${remoteName}/tags/${ref}`;
   for (const candidate of [`refs/remotes/${remoteName}/${ref}`, tagRef, ref]) {
-    const sha = await git(["rev-parse", "-q", "--verify", `${candidate}^{commit}`], cwd, { ignoreErrors: true });
+    const sha = await revParse(cwd, `${candidate}^{commit}`);
     if (!sha) continue;
     const release = candidate === tagRef && releaseTagPattern.test(ref) ? { tag: ref, ref: tagRef } : void 0;
     return { sha, release };
@@ -1048,9 +940,9 @@ async function countCommitsBetween(cwd, fromRef, toRef) {
   const output = await git(["rev-list", "--count", `${fromRef}..${toRef}`], cwd);
   return Number.parseInt(output.trim(), 10) || 0;
 }
-async function listCommitsBetween(cwd, fromRef, toRef, options = {}) {
-  const { skip, limit } = options;
+async function listCommitsBetween(cwd, fromRef, toRef, limit) {
   const args = ["log", "--format=%H%x1f%s%x1f%ar", "--reverse", `${fromRef}..${toRef}`];
+  if (limit) args.push(`-n${limit}`);
   const output = await git(args, cwd, { ignoreErrors: true });
   if (!output) return [];
   const commits = [];
@@ -1060,61 +952,32 @@ async function listCommitsBetween(cwd, fromRef, toRef, options = {}) {
     if (!hash || !message || !date) continue;
     commits.push({ hash, message, date });
   }
-  const start = Math.max(0, skip ?? 0);
-  return limit && limit > 0 ? commits.slice(start, start + limit) : commits.slice(start);
+  return commits;
 }
 async function getFileChangeInfo(cwd, fromRef, toRef) {
   const info = /* @__PURE__ */ new Map();
-  try {
-    const output = await git(["log", "--name-only", "--format=%h %ct %ar", `${fromRef}..${toRef}`], cwd, {
-      ignoreErrors: true
-    });
-    if (!output.trim()) return info;
-    const lines = output.split("\n");
-    let currentHash = "";
-    let currentDate = "";
-    let currentTimestamp = 0;
-    for (const line of lines) {
-      if (!line) continue;
-      const match = line.match(/^([a-f0-9]{7,})\s+(\d+)\s+(.+)$/);
-      if (match) {
-        currentHash = match[1];
-        currentTimestamp = Number(match[2]);
-        currentDate = match[3];
-      } else if (currentHash && currentDate && !info.has(line)) {
-        info.set(line, { date: currentDate, hash: currentHash, timestamp: currentTimestamp });
-      }
+  const output = await git(["log", "--name-only", "--format=%h %ct %ar", `${fromRef}..${toRef}`], cwd, {
+    ignoreErrors: true
+  });
+  if (!output) return info;
+  let currentHash = "";
+  let currentDate = "";
+  let currentTimestamp = 0;
+  for (const line of output.split("\n")) {
+    if (!line) continue;
+    const match = line.match(/^([a-f0-9]{7,})\s+(\d+)\s+(.+)$/);
+    if (match) {
+      currentHash = match[1];
+      currentTimestamp = Number(match[2]);
+      currentDate = match[3];
+    } else if (currentHash && currentDate && !info.has(line)) {
+      info.set(line, { date: currentDate, hash: currentHash, timestamp: currentTimestamp });
     }
-  } catch {
   }
   return info;
 }
 async function isClean(cwd) {
-  const status = await git(["status", "--porcelain"], cwd);
-  return !status;
-}
-async function assertClean(cwd, subject = "working directory") {
-  if (!await isClean(cwd)) {
-    throw new Error(`${subject} has uncommitted changes. please commit or stash before syncing.`);
-  }
-}
-async function createWorktree(cwd, worktreePath, commitRef) {
-  await git(["worktree", "add", "--detach", worktreePath, commitRef], cwd);
-}
-async function removeWorktree(cwd, worktreePath) {
-  await git(["worktree", "remove", worktreePath, "--force"], cwd, { ignoreErrors: true });
-  await git(["worktree", "prune"], cwd, { ignoreErrors: true });
-}
-async function listWorktrees(cwd) {
-  const output = await git(["worktree", "list", "--porcelain"], cwd);
-  const lines = output.split("\n");
-  const paths = [];
-  for (const line of lines) {
-    if (line.startsWith("worktree ")) {
-      paths.push(line.slice(9));
-    }
-  }
-  return paths;
+  return await getWorkingTreeChangeCount(cwd) === 0;
 }
 async function merge(cwd, ref) {
   try {
@@ -1140,8 +1003,8 @@ async function fileExistsAtRef(cwd, ref, filePath) {
   const result = await git(["ls-tree", "--name-only", ref, "--", filePath], cwd, { ignoreErrors: true });
   return result !== "";
 }
-async function checkoutFromRef(cwd, ref, filePath) {
-  await git(["checkout", ref, "--", filePath], cwd);
+async function checkoutFromRef(cwd, ref, paths) {
+  await git(["checkout", ref, "--", ...paths], cwd);
 }
 async function restoreWorktreeFromRef(cwd, ref, filePath) {
   await git(["restore", `--source=${ref}`, "--worktree", "--", filePath], cwd);
@@ -1162,6 +1025,10 @@ async function listIdenticalToRef(cwd, ref) {
   const differs = new Set(nulSeparated(changed));
   return new Set(nulSeparated(tracked).filter((path) => !differs.has(path)));
 }
+async function listChangedSinceRef(cwd, ref, paths) {
+  const out = await git(["--literal-pathspecs", "diff", "--name-only", "--no-renames", "-z", ref, "--", ...paths], cwd);
+  return out.split("\0").filter(Boolean);
+}
 async function getMergeBase(cwd, ref1, ref2) {
   return git(["merge-base", ref1, ref2], cwd);
 }
@@ -1170,30 +1037,17 @@ async function getFileChanges(cwd, baseRef, targetRef) {
     ignoreErrors: true
   });
   const changes = /* @__PURE__ */ new Map();
-  if (!output) return changes;
   const hashOrNull = (hash) => hash === "0".repeat(40) ? null : hash;
   for (const line of output.split("\n")) {
-    if (!line) continue;
-    const renameMatch = line.match(/^:\d+ \d+ ([a-f0-9]+) ([a-f0-9]+) R\d*\s+(.+)\t(.+)$/);
-    if (renameMatch) {
-      const [, baseHash, targetHash, oldPath, newPath] = renameMatch;
-      changes.set(newPath, {
-        status: "R",
-        baseHash: hashOrNull(baseHash),
-        targetHash: hashOrNull(targetHash),
-        oldPath
-      });
-      continue;
-    }
-    const match = line.match(/^:\d+ \d+ ([a-f0-9]+) ([a-f0-9]+) ([ADMT])\t(.+)$/);
-    if (match) {
-      const [, baseHash, targetHash, status, filePath] = match;
-      changes.set(filePath, {
-        status,
-        baseHash: hashOrNull(baseHash),
-        targetHash: hashOrNull(targetHash)
-      });
-    }
+    const m = line.match(/^:\d+ \d+ ([a-f0-9]+) ([a-f0-9]+) ([ADMRT])\d*\t([^\t]+)(?:\t(.+))?$/);
+    if (!m) continue;
+    const status = m[3];
+    changes.set(m[5] ?? m[4], {
+      status,
+      baseHash: hashOrNull(m[1]),
+      targetHash: hashOrNull(m[2]),
+      ...status === "R" ? { oldPath: m[4] } : {}
+    });
   }
   return changes;
 }
@@ -1228,38 +1082,23 @@ async function getFileHashesAtRef(cwd, ref) {
   }
   return hashes;
 }
-async function restoreToHead(cwd, filePath) {
-  await git(["checkout", "HEAD", "--", filePath], cwd);
-}
-async function batchRestoreToHead(cwd, filePaths) {
-  if (filePaths.length === 0) return;
-  await git(["checkout", "HEAD", "--", ...filePaths], cwd);
-}
-async function gitRm(cwd, filePath) {
-  await git(["rm", "-f", "--", filePath], cwd, { ignoreErrors: true });
-}
-async function batchGitRm(cwd, filePaths) {
-  if (filePaths.length === 0) return;
-  await git(["rm", "-f", "--", ...filePaths], cwd, { ignoreErrors: true });
+async function gitRm(cwd, paths, options = {}) {
+  await git(["rm", ...options.cached ? ["--cached"] : [], "-f", "--", ...paths], cwd, { ignoreErrors: true });
 }
 async function getStagedNewFiles(cwd) {
   const output = await git(["diff", "--cached", "--name-only", "--diff-filter=A"], cwd, { ignoreErrors: true });
   return output ? output.split("\n").filter(Boolean) : [];
 }
-async function batchUnstageFiles(cwd, filePaths) {
-  if (filePaths.length === 0) return;
-  await git(["rm", "--cached", "-f", "--", ...filePaths], cwd, { ignoreErrors: true });
-}
 async function gitMv(cwd, oldPath, newPath) {
-  const newDir = dirname2(join5(cwd, newPath));
+  const newDir = dirname2(join4(cwd, newPath));
   await mkdir2(newDir, { recursive: true });
   await git(["mv", "-f", oldPath, newPath], cwd);
 }
 async function fileExistsInWorktree(cwd, filePath) {
-  return existsSync3(join5(cwd, filePath));
+  return existsSync3(join4(cwd, filePath));
 }
 async function removeFileFromWorktree(cwd, filePath) {
-  const fullPath = join5(cwd, filePath);
+  const fullPath = join4(cwd, filePath);
   try {
     await unlink(fullPath);
     await cleanupEmptyParentDirs(cwd, dirname2(filePath));
@@ -1267,12 +1106,12 @@ async function removeFileFromWorktree(cwd, filePath) {
   }
 }
 async function removeFileFully(cwd, filePath) {
-  await gitRm(cwd, filePath);
+  await gitRm(cwd, [filePath]);
   await removeFileFromWorktree(cwd, filePath);
 }
 async function cleanupEmptyParentDirs(cwd, relativePath) {
   if (!relativePath || relativePath === ".") return;
-  const fullPath = join5(cwd, relativePath);
+  const fullPath = join4(cwd, relativePath);
   try {
     const entries = await readdir(fullPath);
     if (entries.length === 0) {
@@ -1284,21 +1123,14 @@ async function cleanupEmptyParentDirs(cwd, relativePath) {
 }
 async function storeLastSyncRef(cwd, upstreamHash) {
   await git(["update-ref", "refs/cella/last-sync", upstreamHash], cwd);
-  const head = await git(["rev-parse", "HEAD"], cwd, { ignoreErrors: true });
-  if (head) {
-    await git(["update-ref", "refs/cella/last-sync-head", head], cwd);
-  }
+  const head = await revParse(cwd, "HEAD");
+  if (head) await git(["update-ref", "refs/cella/last-sync-head", head], cwd);
 }
 async function stagePath(cwd, path) {
   await git(["add", "--", path], cwd, { ignoreErrors: true });
 }
 async function getStoredSyncRef(cwd) {
-  const ref = await git(["rev-parse", "refs/cella/last-sync"], cwd, { ignoreErrors: true });
-  return ref || null;
-}
-async function getStoredSyncHead(cwd) {
-  const ref = await git(["rev-parse", "refs/cella/last-sync-head"], cwd, { ignoreErrors: true });
-  return ref || null;
+  return revParse(cwd, "refs/cella/last-sync");
 }
 async function readManifestAtRef(cwd, ref) {
   const raw = await git(["show", `${ref}:${MANIFEST_FILE}`], cwd, { ignoreErrors: true });
@@ -1320,57 +1152,13 @@ async function readPackageVersionAtRef(cwd, ref) {
   }
 }
 async function commitObjectExists(cwd, sha) {
-  try {
-    await git(["cat-file", "-e", `${sha}^{commit}`], cwd);
-    return true;
-  } catch {
-    return false;
-  }
+  return await revParse(cwd, `${sha}^{commit}`) !== null;
 }
 async function getRootCommit(cwd, ref) {
   const out = await git(["rev-list", "--max-parents=0", ref], cwd, { ignoreErrors: true });
   const roots = out.split("\n").filter(Boolean);
   return roots.length > 0 ? roots[roots.length - 1] : null;
 }
-var SCAFFOLD_CANDIDATE_LIMIT = 400;
-var SCAFFOLD_SCORE_CONCURRENCY = 10;
-var SCAFFOLD_MATCH_MAX_DIFF_RATIO = 0.3;
-async function inferScaffoldBase(cwd, headRef, upstreamRef) {
-  const root = await getRootCommit(cwd, headRef);
-  if (!root) return null;
-  const rootDate = await git(["show", "-s", "--format=%cI", root], cwd, { ignoreErrors: true });
-  if (!rootDate) return null;
-  const before = new Date(new Date(rootDate).getTime() + 24 * 60 * 60 * 1e3).toISOString();
-  const revList = await git(
-    ["rev-list", `--max-count=${SCAFFOLD_CANDIDATE_LIMIT}`, `--before=${before}`, upstreamRef],
-    cwd,
-    { ignoreErrors: true }
-  );
-  const candidates = revList.split("\n").filter(Boolean);
-  if (candidates.length === 0) return null;
-  const totalPaths = (await git(["ls-tree", "-r", "--name-only", root], cwd)).split("\n").filter(Boolean).length;
-  if (totalPaths === 0) return null;
-  let best = null;
-  outer: for (let i = 0; i < candidates.length; i += SCAFFOLD_SCORE_CONCURRENCY) {
-    const chunk = candidates.slice(i, i + SCAFFOLD_SCORE_CONCURRENCY);
-    const scores = await Promise.all(
-      chunk.map(async (sha) => {
-        try {
-          const out = await git(["diff-tree", "-r", "--name-only", sha, root], cwd);
-          return { sha, diff: out ? out.split("\n").length : 0 };
-        } catch {
-          return { sha, diff: Number.POSITIVE_INFINITY };
-        }
-      })
-    );
-    for (const score of scores) {
-      if (!best || score.diff < best.diff) best = score;
-      if (best.diff === 0) break outer;
-    }
-  }
-  if (!best || best.diff / totalPaths > SCAFFOLD_MATCH_MAX_DIFF_RATIO) return null;
-  return best.sha;
-}
 async function readRootTrailerBase(cwd, headRef) {
   const root = await getRootCommit(cwd, headRef);
   if (!root) return null;
@@ -1409,8 +1197,7 @@ async function ensureSyncBase(cwd, headRef, upstreamRef) {
     () => getStoredSyncRef(cwd),
     () => readManifestBaseAtRef(cwd, headRef),
     () => readManifestBase(cwd),
-    () => readRootTrailerBase(cwd, headRef),
-    () => inferScaffoldBase(cwd, headRef, upstreamRef)
+    () => readRootTrailerBase(cwd, headRef)
   ];
   let baseSha = null;
   for (const source of sources) {
@@ -1425,7 +1212,7 @@ async function ensureSyncBase(cwd, headRef, upstreamRef) {
       `no common ancestor between the fork and '${upstreamRef}', and no sync base could be determined.
 
 This fork has unrelated history with upstream (typical for a create-cella scaffold, or after
-upstream squashed its history) and no recorded or inferable base commit exists after fetching
+upstream squashed its history) and no recorded base commit exists after fetching
 upstream. Seed it manually with the upstream commit the fork was created from, then re-run sync:
 
   git update-ref refs/cella/last-sync <upstream-sha>
@@ -1448,9 +1235,9 @@ async function isAncestor(cwd, ancestor, descendant) {
 async function getLegacySyncRef(cwd, headRef) {
   const storedRef = await getStoredSyncRef(cwd);
   if (!storedRef) return null;
-  const storedHead = await getStoredSyncHead(cwd);
+  const storedHead = await revParse(cwd, "refs/cella/last-sync-head");
   if (storedHead) {
-    const currentHead = await git(["rev-parse", headRef], cwd, { ignoreErrors: true });
+    const currentHead = await revParse(cwd, headRef);
     if (currentHead && currentHead === storedHead) return null;
   }
   return storedRef;
@@ -1468,7 +1255,7 @@ async function getEffectiveMergeBase(cwd, headRef, upstreamRef) {
   return { base: gitBase, isStale: false, storedRef: recorded };
 }
 async function withTemporarySyncBaseGraft(cwd, headRef, baseSha, fn) {
-  const headSha = await git(["rev-parse", headRef], cwd, { ignoreErrors: true });
+  const headSha = await revParse(cwd, headRef);
   if (!headSha || !await commitObjectExists(cwd, baseSha)) return fn();
   if (await isAncestor(cwd, baseSha, headSha)) return fn();
   const existingReplacement = await git(["replace", "-l", headSha], cwd, { ignoreErrors: true });
@@ -1486,7 +1273,7 @@ async function withTemporarySyncBaseGraft(cwd, headRef, baseSha, fn) {
 // src/utils/migration-notes.ts
 import { existsSync as existsSync4 } from "fs";
 import { mkdir as mkdir3, readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname3, join as join6 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 var NOTES_DIR = "cella/migrations";
 var PENDING_FILE = "cella/cella.migrations.json";
 var NOTE_ID = /^\d{8}T\d{4}-[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -1541,17 +1328,14 @@ async function arrivedNoteIds(cwd, from, to) {
   const known = new Set(before);
   return after.filter((id) => !known.has(id));
 }
-async function readPending(cwd, syncRef) {
-  const path = join6(cwd, PENDING_FILE);
+async function readPending(cwd) {
+  const path = join5(cwd, PENDING_FILE);
   if (!existsSync4(path)) return [];
   const parsed = JSON.parse(await readFile2(path, "utf8"));
-  if (Array.isArray(parsed.pending)) return parsed.pending.filter((id) => typeof id === "string");
-  if (!Array.isArray(parsed.applied) || !syncRef) return [];
-  const applied = new Set(parsed.applied);
-  return (await listNoteIds(cwd, syncRef)).filter((id) => !applied.has(id));
+  return Array.isArray(parsed.pending) ? parsed.pending.filter((id) => typeof id === "string") : [];
 }
 async function writePending(cwd, ids) {
-  const path = join6(cwd, PENDING_FILE);
+  const path = join5(cwd, PENDING_FILE);
   const pending = [...new Set(ids)].sort();
   if (pending.length === 0) {
     await rm(path, { force: true });
@@ -1572,9 +1356,12 @@ function formatNotesLine(total, open, arrived, options = {}) {
 }
 
 // src/utils/overrides.ts
+function normalizeEntry(entry) {
+  return entry.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+}
 function isUnderAnyFolder(filePath, folders) {
   return folders.some((folder) => {
-    const entry = folder.replace(/\/+$/, "");
+    const entry = normalizeEntry(folder);
     return filePath === entry || filePath.startsWith(`${entry}/`);
   });
 }
@@ -1585,13 +1372,17 @@ function isPinned(filePath, config) {
   if (isManagedFile(filePath)) return true;
   return isUnderAnyFolder(filePath, config.overrides?.pinned || []);
 }
-function groupIgnoredUpstreamChanges(files, ignored) {
-  const entries = [...new Set(ignored.map((entry) => entry.replace(/\/+$/, "")).filter(Boolean))];
+function entryMatcher(list) {
+  const entries = [...new Set(list.map(normalizeEntry).filter(Boolean))];
   const mostSpecificFirst = [...entries].sort((a, b) => b.length - a.length);
+  return [entries, (path) => mostSpecificFirst.find((entry) => isUnderAnyFolder(path, [entry]))];
+}
+function groupIgnoredUpstreamChanges(files, ignored) {
+  const [entries, findEntry] = entryMatcher(ignored);
   const groups = /* @__PURE__ */ new Map();
   for (const file of files) {
     if (!file.upstreamOnly || isManagedFile(file.path) || isGeneratedFile(file.path)) continue;
-    const entry = mostSpecificFirst.find((candidate) => isUnderAnyFolder(file.path, [candidate]));
+    const entry = findEntry(file.path);
     if (!entry) continue;
     const group = groups.get(entry) ?? { entry, paths: [], added: 0, deleted: 0 };
     group.paths.push(file.path);
@@ -1603,11 +1394,10 @@ function groupIgnoredUpstreamChanges(files, ignored) {
   return entries.flatMap((entry) => groups.get(entry) ?? []);
 }
 function groupProtectedUpstreamChanges(paths, config) {
-  const entries = [...config.overrides?.pinned ?? [], ...config.overrides?.ignored ?? []].map((entry) => entry.replace(/\/+$/, "")).filter(Boolean);
-  const mostSpecificFirst = [...new Set(entries)].sort((a, b) => b.length - a.length);
+  const [, findEntry] = entryMatcher([...config.overrides?.pinned ?? [], ...config.overrides?.ignored ?? []]);
   const groups = /* @__PURE__ */ new Map();
   for (const path of paths) {
-    const entry = mostSpecificFirst.find((candidate) => isUnderAnyFolder(path, [candidate])) ?? path;
+    const entry = findEntry(path) ?? path;
     const group = groups.get(entry) ?? { entry, paths: [] };
     group.paths.push(path);
     groups.set(entry, group);
@@ -1615,56 +1405,39 @@ function groupProtectedUpstreamChanges(paths, config) {
   for (const group of groups.values()) group.paths.sort();
   return [...groups.values()];
 }
-function isPinnedForSync(filePath, config, unpinned) {
-  if (isManagedFile(filePath)) return true;
-  if (unpinned) return false;
-  return isPinned(filePath, config);
-}
-function hasGlobChars(entry) {
-  return entry.includes("*") || entry.includes("?");
-}
 async function validateOverrides(config, forkPath, upstreamRef) {
   const warnings = [];
-  const pinned = config.overrides?.pinned || [];
-  for (const entry of pinned) {
-    if (hasGlobChars(entry)) {
-      warnings.push({
-        type: "pinned-glob",
-        pattern: entry,
-        message: `pin uses glob (not supported, use a path or folder): ${entry}`
-      });
-    } else if (!existsSync5(join7(forkPath, entry))) {
-      warnings.push({
-        type: "pinned-not-found",
-        pattern: entry,
-        message: `pin not found: ${entry}`
-      });
-    }
-  }
-  const ignored = config.overrides?.ignored || [];
-  for (const entry of ignored) {
-    if (hasGlobChars(entry)) {
-      warnings.push({
-        type: "ignored-not-found",
-        pattern: entry,
-        message: `ignored entry uses glob (not supported, use a path or folder): ${entry}`
-      });
-    } else if (!existsSync5(join7(forkPath, entry.replace(/\/+$/, "")))) {
-      if (upstreamRef && await fileExistsAtRef(forkPath, upstreamRef, entry.replace(/\/+$/, ""))) continue;
-      warnings.push({
-        type: "ignored-not-found",
-        pattern: entry,
-        message: `ignored entry not found: ${entry}`
-      });
+  const ignored = config.overrides?.ignored ?? [];
+  const upstream = upstreamRef && await revParse(forkPath, upstreamRef) ? upstreamRef : void 0;
+  const pinsUpstreamHas = [];
+  for (const entry of config.overrides?.pinned ?? []) {
+    const path = normalizeEntry(entry);
+    const ignoredEntry = ignored.find((folder) => isUnderAnyFolder(path, [folder]));
+    if (/[*?]/.test(entry)) warnings.push(`pin uses glob (not supported, use a path or folder): ${entry}`);
+    else if (!existsSync5(join6(forkPath, path))) warnings.push(`pin not found: ${entry}`);
+    else if (ignoredEntry) warnings.push(`pin does nothing, '${normalizeEntry(ignoredEntry)}' is ignored: ${entry}`);
+    else if (!upstream) continue;
+    else if (await fileExistsAtRef(forkPath, upstream, path)) pinsUpstreamHas.push(entry);
+    else warnings.push(`pin does nothing, upstream no longer has it: ${entry}`);
+  }
+  if (upstream && pinsUpstreamHas.length > 0) {
+    const differs = await listChangedSinceRef(forkPath, upstream, pinsUpstreamHas.map(normalizeEntry));
+    for (const entry of pinsUpstreamHas) {
+      if (differs.some((changed) => isUnderAnyFolder(changed, [entry]))) continue;
+      warnings.push(`pin is identical to upstream, it only drops upstream's next change: ${entry}`);
+    }
+  }
+  for (const entry of config.overrides?.ignored ?? []) {
+    const path = normalizeEntry(entry);
+    if (/[*?]/.test(entry)) {
+      warnings.push(`ignored entry uses glob (not supported, use a path or folder): ${entry}`);
+    } else if (!existsSync5(join6(forkPath, path))) {
+      if (upstreamRef && await fileExistsAtRef(forkPath, upstreamRef, path)) continue;
+      warnings.push(`ignored entry not found: ${entry}`);
     }
   }
   return warnings;
 }
-function printWarnings(warnings) {
-  for (const warning of warnings) {
-    console.info(`${warningMark} ${warning.message}`);
-  }
-}
 
 // src/cli.ts
 var str = (value) => typeof value === "string" ? value : void 0;
@@ -1680,74 +1453,44 @@ function readOptions(opts, operands = []) {
     throw new Error(`unexpected argument '${operands[0]}'. arguments after the options only go with --run <id>`);
   }
   return {
-    logFile: flag(opts.log),
     verbose: flag(opts.verbose),
     list: flag(opts.list),
     json: flag(opts.json),
-    diff: str(opts.diff),
-    openDiff: str(opts.openDiff),
     scope: normalizedScope,
     fork: str(opts.fork),
-    hard: flag(opts.hard),
-    unpinned: flag(opts.unpinned),
     track: opts.track === "release" || opts.track === "branch" ? opts.track : void 0,
     ref: str(opts.ref) || void 0,
     keepConfig: flag(opts.keepConfig),
-    force: flag(opts.force),
-    checkOverrides: flag(opts.checkOverrides),
-    coverage: flag(opts.coverage),
+    unpinned: flag(opts.unpinned),
     since: str(opts.since) || void 0,
     md: flag(opts.md),
     all: flag(opts.all),
     show: str(opts.show),
     extract: str(opts.extract),
     run,
-    script: str(opts.script),
     runArgs: run ? operands : void 0,
     mark: Array.isArray(opts.mark) ? opts.mark.filter((id) => typeof id === "string") : void 0
   };
 }
-var logOption = {
-  flags: "--log",
-  description: "write complete file list to cella-sync.log"
-};
-var jsonOption = {
-  flags: "--json",
-  description: "machine-readable output for tooling/agents"
-};
-var trackOption = {
-  flags: "--track <mode>",
-  description: "override upstream tracking for this run: release|branch"
-};
-var refOption = {
-  flags: "--ref <ref>",
-  description: "pin the upstream commit for this run: sha, release tag or branch"
-};
-var hardOption = {
-  flags: "--hard",
-  description: "overwrite drifted files with upstream version (aggressive realignment)"
-};
-var verboseOption = {
-  flags: "-V, --verbose",
-  description: "show detailed output during operations"
-};
-var forkOption = {
-  flags: "--fork <name>",
-  description: "pre-select a fork by name (skips the fork selection prompt)"
-};
+var jsonOption = ["--json", "machine-readable output for tooling/agents"];
+var trackOption = ["--track <mode>", "override upstream tracking for this run: release|branch"];
+var refOption = ["--ref <ref>", "pin the upstream commit for this run: sha, release tag or branch"];
+var unpinnedOption = [
+  "--unpinned",
+  "lift every pinned entry for this run (managed files stay pinned) and merge from the full upstream history"
+];
+var forkOption = ["--fork <name>", "pre-select a fork by name (skips the fork selection prompt)"];
 var serviceDefinitions = [
   {
     name: "analyze",
     description: "dry run to see what would change on sync",
     options: [
-      logOption,
-      { flags: "--list", description: "non-interactive output for tooling (one file per line)" },
+      ["--list", "non-interactive output for tooling (one file per line)"],
       jsonOption,
-      { flags: "--scope <scope>", description: "analyze scope for --list/--json: all|risk|protected" },
+      ["--scope <scope>", "analyze scope for --list/--json: all|risk|protected"],
       trackOption,
       refOption,
-      { flags: "--diff <path>", description: "print the unified diff for one file, then exit" },
-      { flags: "--open-diff <path>", description: "open a browser diff for one file, then exit" }
+      unpinnedOption
     ],
     includeInMenu: (context) => !context.isUpstreamRepo
   },
@@ -1755,12 +1498,10 @@ var serviceDefinitions = [
     name: "sync",
     description: "merge upstream changes onto a fresh branch, sync package.json and open a squash-merge PR",
     options: [
-      logOption,
-      hardOption,
-      { flags: "--unpinned", description: "ignore pinned files (except package.json) to resurface upstream changes" },
       trackOption,
       refOption,
-      { flags: "--keep-config", description: "merge with your sync config as it stands when upstream changed its own" }
+      ["--keep-config", "merge with your sync config as it stands when upstream changed its own"],
+      unpinnedOption
     ],
     includeInMenu: (context) => !context.isUpstreamRepo
   },
@@ -1768,66 +1509,46 @@ var serviceDefinitions = [
     name: "migrate",
     description: "list the upstream migration notes this app has not handled yet",
     options: [
-      { flags: "--all", description: "list every upstream note, handled or not" },
+      ["--all", "list every upstream note, handled or not"],
       jsonOption,
-      { flags: "--show <id>", description: "print one note's README" },
-      { flags: "--extract <id>", description: "write one note's folder under node_modules/.cache to run its codemod" },
-      { flags: "--run <id>", description: "run one note's codemod; files identical to upstream stay as they are" },
-      { flags: "--script <file>", description: "with --run: the script to run when the note folder holds several" },
-      { flags: "--mark <ids...>", description: "record notes as handled" }
+      ["--show <id>", "print one note's README"],
+      ["--extract <id>", "write one note's folder under node_modules/.cache to run its codemod"],
+      ["--run <id>", "run one note's codemod; files identical to upstream stay as they are"],
+      ["--mark <ids...>", "record notes as handled"]
+    ],
+    operands: [
+      "[codemodArgs...]",
+      "with --run, after `--`: arguments for the codemod (default: inventory and the note's roots)"
     ],
-    operands: {
-      flags: "[codemodArgs...]",
-      description: "with --run, after `--`: arguments for the codemod (default: inventory and the note's roots)"
-    },
     includeInMenu: (context) => !context.isUpstreamRepo
   },
   {
     name: "audit",
-    description: "check for outdated packages and vulnerabilities",
-    options: [
-      { flags: "--list", description: "skip interactive update prompts after printing audit results" },
-      { flags: "--force", description: "bypass pnpm metadata cache for fresh registry data" },
-      { flags: "--check-overrides", description: "check which pnpm.overrides are still needed" }
-    ]
+    description: "update outdated packages, then rebuild the security overrides from a fresh audit",
+    options: [["--list", "report only: no prompts, and nothing is written"]]
   },
   {
     name: "forks",
     description: "run normal sync inside local fork repositories",
     options: [
       forkOption,
-      { flags: "--log", description: "write complete file list to cella-sync.log for each synced fork" },
-      verboseOption,
-      hardOption,
-      {
-        flags: "--keep-config",
-        description: "merge with the fork's sync config as it stands when upstream changed its own"
-      }
+      ["--keep-config", "merge with the fork's sync config as it stands when upstream changed its own"]
     ],
     includeInMenu: (context) => context.hasForks
   },
   {
     name: "contributions",
     description: "pull and adopt changes from local forks",
-    options: [
-      forkOption,
-      { flags: "--list", description: "non-interactive output for tooling (tab-separated rows)" },
-      jsonOption,
-      { flags: "--diff <path>", description: "print the unified diff for one contributed file, then exit" }
-    ],
+    options: [forkOption, jsonOption],
     includeInMenu: (context) => context.hasForks
   },
   {
     name: "stats",
     description: "count files by category and workspace package",
     options: [
-      verboseOption,
-      { flags: "--coverage", description: "regenerate test coverage before showing the stats summary" },
-      {
-        flags: "--since <ref>",
-        description: "count what the current branch changed since it left <ref>, by kind of file"
-      },
-      { flags: "--md", description: "with --since: print the table as markdown for a pull request description" }
+      ["-V, --verbose", "show detailed output during operations"],
+      ["--since <ref>", "count what the current branch changed since it left <ref>, by kind of file"],
+      ["--md", "with --since: print the table as markdown for a pull request description"]
     ]
   }
 ];
@@ -1851,10 +1572,8 @@ function buildServiceChoices(context) {
 }
 function addServiceCommand(program, definition, setSelection) {
   const command = program.command(definition.name).description(definition.description);
-  for (const option of definition.options ?? []) {
-    command.option(option.flags, option.description);
-  }
-  if (definition.operands) command.argument(definition.operands.flags, definition.operands.description);
+  for (const option of definition.options ?? []) command.option(...option);
+  if (definition.operands) command.argument(...definition.operands);
   command.action((...args) => {
     const operands = definition.operands ? args[0] : [];
     const opts = definition.operands ? args[1] : args[0];
@@ -1865,21 +1584,18 @@ function addServiceCommand(program, definition, setSelection) {
   });
 }
 function buildProgram(setSelection) {
-  const program = new Command(NAME).name("cella").version(VERSION, "-v, --version", "output the current version").usage("[service] [options]").helpOption("-h, --help", "display help for a command").showHelpAfterError().addHelpText(
+  const program = new Command("cella").version(VERSION, "-v, --version", "output the current version").usage("[service] [options]").helpOption("-h, --help", "display help for a command").showHelpAfterError().addHelpText(
     "after",
     [
       "",
       "Examples:",
       "  $ cella analyze",
       "  $ cella analyze --json --scope risk",
-      "  $ cella analyze --open-diff frontend/src/routes/index.tsx",
-      "  $ cella sync --hard",
-      "  $ cella sync --unpinned",
       "  $ cella sync --track branch",
       "  $ cella sync --ref 4f7d87c",
       "  $ cella migrate --run 20261001T2116-tailwind-class-conventions -- rewrite frontend/src",
       "  $ cella migrate --mark 20261002T0614-config-switch",
-      "  $ cella audit --check-overrides",
+      "  $ cella audit --list",
       "  $ cella stats --since origin/main --md",
       "  $ cella contributions --fork raak --json"
     ].join("\n")
@@ -1914,274 +1630,110 @@ async function promptForService(userConfig, forkPath) {
   console.info();
   return selected;
 }
-function buildRuntimeConfig(userConfig, forkPath, selection) {
-  const { branchRef } = resolveUpstream(userConfig.settings);
-  return {
-    ...userConfig,
-    forkPath,
-    upstreamRef: branchRef,
-    service: selection.service ?? "analyze",
-    ...selection.options
-  };
+function buildRuntimeConfig(userConfig, forkPath, selection, upstreamRef) {
+  return { ...userConfig, forkPath, upstreamRef, service: selection.service ?? "analyze", ...selection.options };
 }
 async function parseCli(userConfig, forkPath) {
   const selection = parseCommandLine(process5.argv);
   const machineList = selection.options.list && selection.service !== "audit";
-  if (selection.options.json || selection.options.diff || selection.options.md || machineList) setJsonMode(true);
+  if (selection.options.json || selection.options.md || machineList) setJsonMode(true);
   printHeader();
-  const warnings = await validateOverrides(userConfig, forkPath, resolveUpstream(userConfig.settings).branchRef);
-  if (warnings.length > 0) {
-    printWarnings(warnings);
-    console.info();
-  }
+  const { branchRef } = resolveUpstream(userConfig.settings);
+  const warnings = await validateOverrides(userConfig, forkPath, branchRef);
+  for (const warning of warnings) console.info(`${warningMark} ${warning}`);
+  if (warnings.length > 0) console.info();
   if (!selection.service) {
     selection.service = await promptForService(userConfig, forkPath);
   }
-  return buildRuntimeConfig(userConfig, forkPath, selection);
+  return buildRuntimeConfig(userConfig, forkPath, selection, branchRef);
 }
 
-// src/services/analyze.ts
-import { basename as basename4 } from "path";
+// src/services/merge-engine.ts
+import { existsSync as existsSync6 } from "fs";
+import { rm as rm2 } from "fs/promises";
+import { join as join7 } from "path";
 
-// src/utils/diff.ts
-import { execFileSync } from "child_process";
-import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir } from "os";
-import { basename as basename2, join as join8 } from "path";
-import process6 from "process";
-function gitDiffFile(cwd, range, filePath, options = {}) {
-  const args = ["diff", "--no-color"];
-  if (options.dstPrefix) args.push("--src-prefix=cella/", `--dst-prefix=${options.dstPrefix}/`);
-  args.push(range, "--", filePath);
-  try {
-    return execFileSync("git", args, { cwd, maxBuffer: MAX_BUFFER });
-  } catch (error) {
-    const stderr = error.stderr?.toString().trim();
-    throw new Error(stderr || `failed to diff ${filePath}`);
-  }
+// src/utils/versions.ts
+function parseComparableVersion(version) {
+  const trimmed = version.trim();
+  const match = trimmed.match(
+    /^(?:\^|~|>=|<=|>|<|=)?\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
+  );
+  if (!match) return null;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2] ?? 0),
+    patch: Number(match[3] ?? 0)
+  };
 }
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function compareVersions(left, right) {
+  if (left.major !== right.major) return left.major - right.major;
+  if (left.minor !== right.minor) return left.minor - right.minor;
+  return left.patch - right.patch;
 }
-async function renderDiffPage(patch, meta) {
-  const { preloadPatchDiff } = await import("@pierre/diffs/ssr");
-  const { prerenderedHTML } = await preloadPatchDiff({
-    patch,
-    options: {
-      diffStyle: "split",
-      themeType: "system",
-      lineDiffType: "word-alt",
-      hunkSeparators: "line-info",
-      overflow: "wrap",
-      disableFileHeader: true
-    }
+function isPrerelease(version) {
+  return /^v?\d+(?:\.\d+){0,2}-/.test(version.trim());
+}
+function compareVersionStrings(left, right) {
+  const a = parseComparableVersion(left);
+  const b = parseComparableVersion(right);
+  if (!a || !b) return Number(!!a) - Number(!!b);
+  return compareVersions(a, b) || Number(isPrerelease(right)) - Number(isPrerelease(left));
+}
+function satisfiesComparators(version, range) {
+  return range.split("||").some((alternative) => {
+    const comparators = [...alternative.matchAll(/(>=|<=|>|<|=)?\s*v?(\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?)/g)];
+    if (comparators.length === 0) return false;
+    return comparators.every(([, operator = "=", bound]) => {
+      const order = compareVersionStrings(version, bound);
+      if (operator === ">=") return order >= 0;
+      if (operator === "<=") return order <= 0;
+      if (operator === ">") return order > 0;
+      if (operator === "<") return order < 0;
+      return order === 0;
+    });
   });
-  const title = `${escapeHtml(meta.filePath)} \xB7 ${escapeHtml(meta.srcLabel)} vs ${escapeHtml(meta.dstLabel)}`;
-  const note = meta.note ? `<span class="note">\xB7 ${escapeHtml(meta.note)}</span>` : "";
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
-<style>
-  :root { color-scheme: light dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
-    background: light-dark(#fafafa, #111);
-    color: light-dark(#111, #eee);
+}
+function isBreakingJump(from, to) {
+  const a = parseComparableVersion(from);
+  const b = parseComparableVersion(to);
+  if (!a || !b) return true;
+  if (a.major !== b.major) return true;
+  if (a.major > 0) return false;
+  if (a.minor !== b.minor) return true;
+  return a.minor === 0 && a.patch !== b.patch;
+}
+
+// src/utils/cli-version.ts
+var CLI_PACKAGE = "@cellajs/cli";
+async function readUpstreamCliRange(repoPath, ref) {
+  const source = await git(["show", `${ref}:package.json`], repoPath, { ignoreErrors: true });
+  if (!source) return null;
+  try {
+    const pkg = JSON.parse(source);
+    return pkg.devDependencies?.[CLI_PACKAGE] ?? pkg.dependencies?.[CLI_PACKAGE] ?? null;
+  } catch {
+    return null;
   }
-  header {
-    display: flex; align-items: baseline; gap: 0.75rem; flex-wrap: wrap;
-    padding: 0.9rem 1.25rem;
-    border-bottom: 1px solid light-dark(#e2e2e2, #2a2a2a);
-    position: sticky; top: 0;
-    background: inherit;
-  }
-  header .brand { font-weight: 600; color: light-dark(#0891b2, #22d3ee); }
-  header code { font-family: ui-monospace, monospace; font-size: 0.9rem; }
-  header .sides { margin-left: auto; font-size: 0.8rem; opacity: 0.7; }
-  main { max-width: 1400px; margin: 1rem auto; padding: 0 1rem 2rem; }
-  .diff-shell {
-    border: 1px solid light-dark(#e2e2e2, #2a2a2a);
-    border-radius: 8px; overflow: hidden;
-    background: light-dark(#fff, #161616);
-  }
-</style>
-</head>
-<body>
-<header>
-  <span class="brand">\u29C8 cella diff</span>
-  <code>${escapeHtml(meta.filePath)}</code>
-  <span class="sides">${escapeHtml(meta.srcLabel)} \u2190 \u2192 ${escapeHtml(meta.dstLabel)} ${note}</span>
-</header>
-<main>
-  <!-- Declarative shadow DOM: the library's CSS targets :host, which only
-       matches inside a shadow root (its browser component renders into one). -->
-  <div class="diff-shell">
-    <template shadowrootmode="open">
-${prerenderedHTML}
-    </template>
-  </div>
-</main>
-</body>
-</html>`;
-}
-function openWithDefaultApp(target) {
-  try {
-    if (process6.platform === "win32") {
-      execFileSync("rundll32", ["url.dll,FileProtocolHandler", target], { stdio: "ignore" });
-    } else {
-      execFileSync(process6.platform === "darwin" ? "open" : "xdg-open", [target], { stdio: "ignore" });
-    }
-  } catch {
-  }
-}
-async function openDiffInBrowser(patch, meta, repoPath) {
-  const html = await renderDiffPage(patch, meta);
-  const dir = join8(tmpdir(), `cella-diff-${basename2(repoPath)}`);
-  mkdirSync(dir, { recursive: true });
-  const outPath = join8(dir, `${meta.filePath.replace(/[^\w.-]+/g, "-")}.html`);
-  writeFileSync2(outPath, html);
-  openWithDefaultApp(outPath);
-  return outPath;
-}
-
-// src/services/merge-engine.ts
-import { existsSync as existsSync7 } from "fs";
-import { rm as rm2 } from "fs/promises";
-import { join as join10 } from "path";
-
-// src/utils/cleanup.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync6, rmSync } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, join as join9, resolve as resolve4 } from "path";
-import process7 from "process";
-var WORKTREE_PREFIXES = {
-  sync: "cella-sync-",
-  view: "cella-view-"
-};
-function buildWorktreePath(kind, repoPath) {
-  const key = createHash("sha256").update(resolve4(repoPath)).digest("hex").slice(0, 8);
-  return join9(tmpdir2(), `${WORKTREE_PREFIXES[kind]}${basename3(repoPath)}-${key}`);
-}
-function legacyWorktreePath(kind, repoPath) {
-  return join9(tmpdir2(), `${WORKTREE_PREFIXES[kind]}${basename3(repoPath)}`);
-}
-function getWorktreePath(repoPath) {
-  return buildWorktreePath("sync", repoPath);
-}
-var cleanupRegistered = false;
-var currentWorktreePath = null;
-var currentRepoPath = null;
-function registerWorktree(repoPath, worktreePath) {
-  currentRepoPath = repoPath;
-  currentWorktreePath = worktreePath;
-}
-function unregisterWorktree() {
-  currentRepoPath = null;
-  currentWorktreePath = null;
-}
-async function cleanupWorktree(repoPath, worktreePath) {
-  await removeWorktree(repoPath, worktreePath);
-  if (existsSync6(worktreePath)) {
-    rmSync(worktreePath, { recursive: true, force: true });
-  }
-  unregisterWorktree();
-}
-async function cleanupLeftoverWorktrees(repoPath) {
-  for (const kind of Object.keys(WORKTREE_PREFIXES)) {
-    for (const worktreePath of [buildWorktreePath(kind, repoPath), legacyWorktreePath(kind, repoPath)]) {
-      if (existsSync6(worktreePath)) await cleanupWorktree(repoPath, worktreePath);
-    }
-  }
-  const prefixes = Object.values(WORKTREE_PREFIXES);
-  const worktrees = await listWorktrees(repoPath);
-  for (const wt of worktrees) {
-    if (prefixes.some((prefix) => wt.includes(prefix)) && !existsSync6(wt)) {
-      await removeWorktree(repoPath, wt);
-    }
-  }
-}
-async function handleAbort(signal) {
-  console.info();
-  console.info(`${warningMark} interrupted (${signal}): cleaning up...`);
-  if (currentRepoPath && currentWorktreePath) {
-    try {
-      await mergeAbort(currentWorktreePath);
-    } catch {
-    }
-    try {
-      await cleanupWorktree(currentRepoPath, currentWorktreePath);
-      console.info(`${checkMark} no changes were made to your repository.`);
-    } catch (error) {
-      console.error(`${colors_default.red("\u2717")} failed to clean up worktree: ${errorMessage(error)}`);
-    }
-  }
-  process7.exit(1);
-}
-function registerSignalHandlers() {
-  if (cleanupRegistered) return;
-  process7.on("SIGINT", () => handleAbort("SIGINT"));
-  process7.on("SIGTERM", () => handleAbort("SIGTERM"));
-  cleanupRegistered = true;
-}
-
-// src/utils/versions.ts
-function parseComparableVersion(version) {
-  const trimmed = version.trim();
-  if (trimmed === "" || trimmed === "*" || trimmed.includes("workspace:") || trimmed.includes("catalog:") || trimmed.includes("file:") || trimmed.includes("link:") || trimmed.includes("git+") || trimmed.includes("github:") || trimmed.includes("http://") || trimmed.includes("https://") || trimmed.includes("||")) {
-    return null;
-  }
-  const match = trimmed.match(
-    /^(?:\^|~|>=|<=|>|<|=)?\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
-  );
-  if (!match) return null;
-  return {
-    major: Number(match[1]),
-    minor: Number(match[2] ?? 0),
-    patch: Number(match[3] ?? 0)
-  };
-}
-function compareVersions(left, right) {
-  if (left.major !== right.major) return left.major - right.major;
-  if (left.minor !== right.minor) return left.minor - right.minor;
-  return left.patch - right.patch;
-}
-
-// src/utils/cli-version.ts
-var CLI_PACKAGE = "@cellajs/cli";
-async function readUpstreamCliRange(repoPath, ref) {
-  const source = await git(["show", `${ref}:package.json`], repoPath, { ignoreErrors: true });
-  if (!source) return null;
-  try {
-    const pkg = JSON.parse(source);
-    return pkg.devDependencies?.[CLI_PACKAGE] ?? pkg.dependencies?.[CLI_PACKAGE] ?? null;
-  } catch {
-    return null;
-  }
-}
-function cliVersionMismatch(running, range) {
-  if (/^\s*(<|>(?!=))/.test(range)) return null;
-  const required = parseComparableVersion(range);
-  const current = parseComparableVersion(running);
-  if (!required || !current || compareVersions(current, required) >= 0) return null;
-  return [
-    `upstream needs ${CLI_PACKAGE} ${range}, this is ${running}: an older CLI misses fixes to the sync itself.`,
-    `  update it, commit, then rerun: pnpm add -D -w '${CLI_PACKAGE}@${range}'`
-  ].join("\n");
-}
-
-// src/utils/upstream-overrides.ts
-import { Node, Project as Project2, SyntaxKind as SyntaxKind2 } from "ts-morph";
-var LIST_KEYS = ["pinned", "ignored"];
-function resolveExpression(node, sourceFile, depth = 0) {
-  if (!node || depth > 8) return node;
-  if (Node.isParenthesizedExpression(node) || Node.isAsExpression(node) || Node.isSatisfiesExpression(node)) {
-    return resolveExpression(node.getExpression(), sourceFile, depth + 1);
+}
+function cliVersionMismatch(running, range) {
+  if (/^\s*(<|>(?!=))/.test(range)) return null;
+  const required = parseComparableVersion(range);
+  const current = parseComparableVersion(running);
+  if (!required || !current || compareVersions(current, required) >= 0) return null;
+  return [
+    `upstream needs ${CLI_PACKAGE} ${range}, this is ${running}: an older CLI misses fixes to the sync itself.`,
+    `  update it, commit, then rerun: pnpm add -D -w '${CLI_PACKAGE}@${range}'`
+  ].join("\n");
+}
+
+// src/utils/upstream-overrides.ts
+import { Node, Project as Project2, SyntaxKind as SyntaxKind2 } from "ts-morph";
+var LIST_KEYS = ["pinned", "ignored"];
+function resolveExpression(node, sourceFile, depth = 0) {
+  if (!node || depth > 8) return node;
+  if (Node.isParenthesizedExpression(node) || Node.isAsExpression(node) || Node.isSatisfiesExpression(node)) {
+    return resolveExpression(node.getExpression(), sourceFile, depth + 1);
   }
   if (Node.isIdentifier(node)) {
     return resolveExpression(
@@ -2258,9 +1810,6 @@ function parseOverrideLists(source) {
     return null;
   }
 }
-function normalizeEntry(entry) {
-  return entry.trim().replace(/^\.\//, "").replace(/\/+$/, "");
-}
 function diffOverrideLists(base, incoming, fork) {
   const diff = (key) => {
     const baseSet = new Set(base[key].map(normalizeEntry).filter(Boolean));
@@ -2281,22 +1830,14 @@ function diffOverrideLists(base, incoming, fork) {
   };
   return { pinned: diff("pinned"), ignored: diff("ignored"), packageJsonSync: diffKeys() };
 }
-async function readConfigSourceAtRef(repoPath, ref) {
-  for (const path of CONFIG_FILE_PATHS) {
-    const source = await git(["show", `${ref}:${path}`], repoPath, { ignoreErrors: true });
-    if (source) return source;
-  }
-  return null;
-}
 async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, forkConfig) {
-  const [baseSource, incomingSource] = await Promise.all([
-    readConfigSourceAtRef(repoPath, mergeBaseRef),
-    readConfigSourceAtRef(repoPath, incomingRef)
-  ]);
+  const [baseSource, incomingSource] = await Promise.all(
+    [mergeBaseRef, incomingRef].map((ref) => git(["show", `${ref}:${CONFIG_FILE}`], repoPath, { ignoreErrors: true }))
+  );
   if (baseSource === incomingSource) return void 0;
-  const base = baseSource === null ? null : parseOverrideLists(baseSource);
+  const base = baseSource ? parseOverrideLists(baseSource) : null;
   if (!base) return { kind: "unreadable", side: "base" };
-  const incoming = incomingSource === null ? null : parseOverrideLists(incomingSource);
+  const incoming = incomingSource ? parseOverrideLists(incomingSource) : null;
   if (!incoming) return { kind: "unreadable", side: "incoming" };
   const fork = {
     pinned: forkConfig.overrides?.pinned ?? [],
@@ -2304,8 +1845,8 @@ async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, for
     packageJsonSync: forkConfig.settings.packageJsonSync ?? DEFAULT_PACKAGE_JSON_SYNC
   };
   const changes = diffOverrideLists(base, incoming, fork);
-  const count = Object.values(changes).reduce((n, list) => n + list.added.length + list.removed.length, 0);
-  return count > 0 ? { kind: "changes", ...changes } : void 0;
+  const count2 = Object.values(changes).reduce((n, list) => n + list.added.length + list.removed.length, 0);
+  return count2 > 0 ? { kind: "changes", ...changes } : void 0;
 }
 
 // src/services/analyze-core.ts
@@ -2346,15 +1887,17 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
     const upstreamChange = upstreamChanges.get(filePath);
     const isUpstreamRename = upstreamChange?.status === "R" && upstreamChange.oldPath;
     const renamedToPath = upstreamRenames.get(filePath);
+    const push = (status2, extra = {}) => analyzedFiles.push({
+      path: filePath,
+      status: status2,
+      isIgnored: fileIsIgnored,
+      isPinned: fileIsPinned,
+      existsInFork: inFork,
+      existsInUpstream: inUpstream,
+      ...extra
+    });
     if (!changedFiles.has(filePath) && inFork && inUpstream) {
-      analyzedFiles.push({
-        path: filePath,
-        status: "identical",
-        isIgnored: fileIsIgnored,
-        isPinned: fileIsPinned,
-        existsInFork: true,
-        existsInUpstream: true
-      });
+      push("identical");
       continue;
     }
     processed++;
@@ -2391,17 +1934,7 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
         renamedFrom = oldPath;
       }
       const upstreamOnly2 = fileIsIgnored && !forkModifiedOld && isReportableIgnored(filePath);
-      analyzedFiles.push({
-        path: filePath,
-        status,
-        isIgnored: fileIsIgnored,
-        isPinned: fileIsPinned,
-        existsInFork: inFork,
-        existsInUpstream: true,
-        renamedFrom,
-        upstreamChanged: upstreamChanged2,
-        upstreamOnly: upstreamOnly2 || void 0
-      });
+      push(status, { existsInUpstream: true, renamedFrom, upstreamChanged: upstreamChanged2, upstreamOnly: upstreamOnly2 || void 0 });
       continue;
     }
     if (renamedToPath) {
@@ -2427,23 +1960,14 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       if (forkChanged && upstreamChanged2) {
         status = fileIsPinned ? "pinned" : "diverged";
       } else if (forkChanged && !upstreamChanged2) {
-        status = fileIsPinned ? "ahead" : predicates.hard ? "behind" : "drifted";
+        status = fileIsPinned ? "ahead" : "drifted";
       } else {
         status = "behind";
       }
     }
     const upstreamChanged = (fileIsPinned || fileIsIgnored) && inUpstream && upstreamHash !== baseHash && forkHash !== baseHash;
     const upstreamOnly = fileIsIgnored && isReportableIgnored(filePath) && upstreamHash !== baseHash && forkHash === baseHash;
-    analyzedFiles.push({
-      path: filePath,
-      status,
-      isIgnored: fileIsIgnored,
-      isPinned: fileIsPinned,
-      existsInFork: inFork,
-      existsInUpstream: inUpstream,
-      upstreamChanged: upstreamChanged || void 0,
-      upstreamOnly: upstreamOnly || void 0
-    });
+    push(status, { upstreamChanged: upstreamChanged || void 0, upstreamOnly: upstreamOnly || void 0 });
   }
   const flagged = analyzedFiles.filter((file) => file.upstreamChanged && !renamedProtected.has(file.path));
   if (flagged.length > 0) {
@@ -2480,34 +2004,25 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
 async function enrichChangeInfo(repoPath, files, mergeBaseRef, localRef, incomingRef) {
   const forkInfo = await getFileChangeInfo(repoPath, mergeBaseRef, localRef);
   const upstreamInfo = await getFileChangeInfo(repoPath, mergeBaseRef, incomingRef);
+  const setChanged = (file, info) => {
+    if (!info) return;
+    file.changedAt = info.date;
+    file.changedTs = info.timestamp;
+    file.changedCommit = info.hash;
+  };
   for (const file of files) {
     if (file.status === "identical") continue;
     if (file.status === "ahead" || file.status === "drifted") {
-      const info = forkInfo.get(file.path);
-      if (info) {
-        file.changedAt = info.date;
-        file.changedTs = info.timestamp;
-        file.changedCommit = info.hash;
-      }
+      setChanged(file, forkInfo.get(file.path));
     } else if (file.status === "behind") {
+      setChanged(file, upstreamInfo.get(file.path));
+    } else if (file.status === "diverged" || file.status === "pinned" || file.upstreamChanged) {
+      setChanged(file, forkInfo.get(file.path));
       const info = upstreamInfo.get(file.path);
       if (info) {
-        file.changedAt = info.date;
-        file.changedTs = info.timestamp;
-        file.changedCommit = info.hash;
-      }
-    } else if (file.status === "diverged" || file.status === "pinned" || file.upstreamChanged) {
-      const forkFileInfo = forkInfo.get(file.path);
-      const upstreamFileInfo = upstreamInfo.get(file.path);
-      if (forkFileInfo) {
-        file.changedAt = forkFileInfo.date;
-        file.changedTs = forkFileInfo.timestamp;
-        file.changedCommit = forkFileInfo.hash;
-      }
-      if (upstreamFileInfo) {
-        file.upstreamChangedAt = upstreamFileInfo.date;
-        file.upstreamChangedTs = upstreamFileInfo.timestamp;
-        file.upstreamCommit = upstreamFileInfo.hash;
+        file.upstreamChangedAt = info.date;
+        file.upstreamChangedTs = info.timestamp;
+        file.upstreamCommit = info.hash;
       }
     }
   }
@@ -2530,15 +2045,8 @@ var UpstreamConfigChangedError = class extends Error {
   }
 };
 function getGitHubBaseUrl(remoteUrl) {
-  const sshMatch = remoteUrl.match(/git@github\.com:([^/]+)\/([^.]+)(?:\.git)?$/);
-  if (sshMatch) {
-    return `https://github.com/${sshMatch[1]}/${sshMatch[2]}`;
-  }
-  const httpsMatch = remoteUrl.match(/https:\/\/github\.com\/([^/]+)\/([^/.]+)(?:\.git)?$/);
-  if (httpsMatch) {
-    return `https://github.com/${httpsMatch[1]}/${httpsMatch[2]}`;
-  }
-  return null;
+  const match = remoteUrl.match(/github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/);
+  return match ? `https://github.com/${match[1]}/${match[2]}` : null;
 }
 function isProtectedFile(file) {
   return file.isIgnored || file.isPinned;
@@ -2546,8 +2054,7 @@ function isProtectedFile(file) {
 function syncPredicates(config) {
   return {
     isIgnored: (path) => isIgnored(path, config),
-    isPinned: (path) => isPinnedForSync(path, config, config.unpinned),
-    hard: config.hard
+    isPinned: (path) => config.unpinned ? isManagedFile(path) : isPinned(path, config)
   };
 }
 async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onProgress) {
@@ -2563,38 +2070,27 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
   const batchRestorePaths = [];
   const batchRemovePaths = [];
   for (const file of analyzedFiles) {
-    const { path: filePath, status, isPinned: pinned, isIgnored: ignored, existsInFork } = file;
-    if (status === "identical" || status === "ahead") continue;
-    if (!isProtectedFile(file)) continue;
-    if (ignored && existsInFork) {
-      batchRestorePaths.push(filePath);
-    } else if (ignored && !existsInFork) {
-      batchRemovePaths.push(filePath);
-    } else if (pinned && !file.renamedFrom && existsInFork) {
-      batchRestorePaths.push(filePath);
-    } else if (pinned && !file.renamedFrom && !existsInFork) {
-      batchRemovePaths.push(filePath);
+    if (file.status === "identical" || file.status === "ahead") continue;
+    if (file.isIgnored || file.isPinned && !file.renamedFrom) {
+      (file.existsInFork ? batchRestorePaths : batchRemovePaths).push(file.path);
     }
   }
   onProgress?.("starting merge in fork...");
   await withTemporarySyncBaseGraft(forkPath, "HEAD", mergeBaseRef, () => merge(forkPath, upstreamRef));
   if (batchRestorePaths.length > 0) {
     onProgress?.(`batch restoring ${batchRestorePaths.length} pinned/ignored files...`);
-    await batchRestoreToHead(forkPath, batchRestorePaths);
+    await checkoutFromRef(forkPath, "HEAD", batchRestorePaths);
   }
   if (batchRemovePaths.length > 0) {
     onProgress?.(`batch removing ${batchRemovePaths.length} ignored files...`);
-    await batchGitRm(forkPath, batchRemovePaths);
+    await gitRm(forkPath, batchRemovePaths);
     for (const filePath of batchRemovePaths) {
       await removeFileFromWorktree(forkPath, filePath);
     }
   }
   for (const file of analyzedFiles) {
     const { path: filePath, status, existsInFork } = file;
-    if (status === "identical" || status === "ahead") {
-      continue;
-    }
-    if (isProtectedFile(file)) continue;
+    if (status === "identical" || status === "ahead" || isProtectedFile(file)) continue;
     if (status === "diverged") {
       onProgress?.(`\u2192 ${filePath}: using git merge result (diverged)`);
       continue;
@@ -2602,13 +2098,13 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
     if (status === "behind") {
       if (!existsInFork) {
         onProgress?.(`\u2192 ${filePath}: adding from upstream (new file)`);
-        await checkoutFromRef(forkPath, upstreamRef, filePath);
+        await checkoutFromRef(forkPath, upstreamRef, [filePath]);
       } else if (!file.existsInUpstream) {
         onProgress?.(`\u2192 ${filePath}: removing (deleted in upstream)`);
         await removeFileFully(forkPath, filePath);
       } else {
         onProgress?.(`\u2192 ${filePath}: accepting upstream (behind)`);
-        await checkoutFromRef(forkPath, upstreamRef, filePath);
+        await checkoutFromRef(forkPath, upstreamRef, [filePath]);
       }
       continue;
     }
@@ -2626,31 +2122,25 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
           await gitMv(forkPath, oldPath, filePath);
         } catch {
           await removeFileFully(forkPath, oldPath);
-          await checkoutFromRef(forkPath, upstreamRef, filePath);
+          await checkoutFromRef(forkPath, upstreamRef, [filePath]);
         }
       } else if (oldPathExists && newPathExists) {
         onProgress?.(`\u2192 ${oldPath} \u2192 ${filePath}: completing rename (removing old)`);
         await removeFileFully(forkPath, oldPath);
-        await checkoutFromRef(forkPath, upstreamRef, filePath);
+        await checkoutFromRef(forkPath, upstreamRef, [filePath]);
       } else {
         onProgress?.(`\u2192 ${filePath}: updating from upstream (renamed)`);
-        await checkoutFromRef(forkPath, upstreamRef, filePath);
+        await checkoutFromRef(forkPath, upstreamRef, [filePath]);
       }
     }
   }
-  const protectedConflicts = analyzedFiles.filter((file) => file.upstreamChanged).map((file) => file.path);
-  const protectedConflictSet = new Set(protectedConflicts);
-  const gitConflicts = await getConflictedFiles(forkPath);
-  for (const filePath of gitConflicts) {
-    const isProtected = isIgnored(filePath, config) || isPinnedForSync(filePath, config, config.unpinned);
-    if (!isProtected) continue;
+  const protectedConflicts = new Set(analyzedFiles.filter((file) => file.upstreamChanged).map((file) => file.path));
+  for (const filePath of await getConflictedFiles(forkPath)) {
+    if (!isIgnored(filePath, config) && !syncPredicates(config).isPinned(filePath)) continue;
     if (await fileExistsAtRef(forkPath, "HEAD", filePath)) {
       onProgress?.(`\u2192 ${filePath}: keeping fork (protected conflict)`);
-      await restoreToHead(forkPath, filePath);
-      if (!protectedConflictSet.has(filePath)) {
-        protectedConflictSet.add(filePath);
-        protectedConflicts.push(filePath);
-      }
+      await checkoutFromRef(forkPath, "HEAD", [filePath]);
+      protectedConflicts.add(filePath);
     } else {
       onProgress?.(`\u2192 ${filePath}: removing (protected conflict, not in fork)`);
       await removeFileFully(forkPath, filePath);
@@ -2663,12 +2153,12 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
   const staleIgnoredFiles = stagedNewFiles.filter((f) => isIgnored(f, config));
   if (staleIgnoredFiles.length > 0) {
     onProgress?.(`cleaning up ${staleIgnoredFiles.length} ignored files still in index...`);
-    await batchUnstageFiles(forkPath, staleIgnoredFiles);
+    await gitRm(forkPath, staleIgnoredFiles, { cached: true });
     for (const filePath of staleIgnoredFiles) {
       await removeFileFromWorktree(forkPath, filePath);
     }
   }
-  return { remainingConflicts, analyzedFiles, autoMergedFiles, protectedConflicts };
+  return { remainingConflicts, analyzedFiles, autoMergedFiles, protectedConflicts: [...protectedConflicts] };
 }
 function calculateSummary(files) {
   const summary = {
@@ -2756,14 +2246,13 @@ async function prepareUpstream(config, onProgress, onStep) {
   onProgress?.("checking sync base...");
   await ensureSyncBase(forkPath, "HEAD", upstreamRef);
   const upstreamGitHubUrl = getGitHubBaseUrl(config.settings.upstreamUrl) ?? void 0;
-  const aggressive = config.hard === true || config.unpinned === true;
-  const syncPoint = (await getEffectiveMergeBase(forkPath, "HEAD", upstreamRef)).base;
-  const mergeBase = aggressive ? await getMergeBase(forkPath, "HEAD", upstreamRef) : syncPoint;
+  const mergeBase = (await getEffectiveMergeBase(forkPath, "HEAD", upstreamRef)).base;
+  const mergeRef = config.unpinned ? await getMergeBase(forkPath, "HEAD", upstreamRef) : mergeBase;
   const upstreamCommit = await getCommitInfo(forkPath, upstreamRef);
-  if (upstreamCommit.hash !== syncPoint && await isAncestor(forkPath, upstreamCommit.hash, syncPoint)) {
+  if (upstreamCommit.hash !== mergeBase && await isAncestor(forkPath, upstreamCommit.hash, mergeBase)) {
     const [upstreamShort, syncShort] = await Promise.all([
       getShortSha(forkPath, upstreamCommit.hash),
-      getShortSha(forkPath, syncPoint)
+      getShortSha(forkPath, mergeBase)
     ]);
     const hint = config.ref ? "Pick a newer --ref." : releaseTag ? `Nothing to sync until a release past ${syncShort}; to follow the tip instead, run with --track branch.` : `Nothing to sync until '${branchRef}' moves past ${syncShort}.`;
     throw new BehindSyncPointError(
@@ -2772,14 +2261,13 @@ ${hint}`
     );
   }
   const commitCount = await countCommitsBetween(forkPath, mergeBase, upstreamRef);
-  const commitSkip = commitCount > COMMIT_LIST_MAX ? commitCount - COMMIT_LIST_MAX : 0;
-  const upstreamCommits = commitCount > 0 ? await listCommitsBetween(forkPath, mergeBase, upstreamRef, { skip: commitSkip, limit: COMMIT_LIST_MAX }) : [];
+  const upstreamCommits = commitCount > 0 ? await listCommitsBetween(forkPath, mergeBase, upstreamRef, COMMIT_LIST_MAX) : [];
   onStep?.("fetched upstream", formatFetchedUpstreamDetail(commitCount, upstreamCommits, upstreamGitHubUrl));
-  return { upstreamRef, releaseTag, mergeBase, syncPoint, upstreamGitHubUrl, upstreamCommit, upstreamCommits };
+  return { upstreamRef, releaseTag, mergeBase, mergeRef, upstreamGitHubUrl, upstreamCommit };
 }
 async function assertSyncConfigFollowed(config, ctx) {
   if (config.keepConfig) return;
-  const report = await compareUpstreamOverrides(config.forkPath, ctx.syncPoint, ctx.upstreamRef, config).catch(
+  const report = await compareUpstreamOverrides(config.forkPath, ctx.mergeBase, ctx.upstreamRef, config).catch(
     () => void 0
   );
   if (report?.kind === "changes") throw new UpstreamConfigChangedError(report);
@@ -2790,8 +2278,7 @@ function resultMeta(config, ctx) {
     upstreamRef: ctx.upstreamRef,
     upstreamTag: ctx.releaseTag,
     upstreamGitHubUrl: ctx.upstreamGitHubUrl,
-    upstreamCommit: ctx.upstreamCommit,
-    upstreamCommits: ctx.upstreamCommits
+    upstreamCommit: ctx.upstreamCommit
   };
 }
 async function upstreamOnlyReports(config, ctx, files, protectedConflicts) {
@@ -2818,8 +2305,8 @@ async function readNotesInRange(config, ctx) {
   try {
     const [total, arrived, pending] = await Promise.all([
       listNoteIds(forkPath, ctx.upstreamRef),
-      arrivedNoteIds(forkPath, ctx.syncPoint, ctx.upstreamRef),
-      readPending(forkPath, ctx.syncPoint)
+      arrivedNoteIds(forkPath, ctx.mergeBase, ctx.upstreamRef),
+      readPending(forkPath)
     ]);
     return { total: total.length, arrived, pending: [.../* @__PURE__ */ new Set([...pending, ...arrived])] };
   } catch {
@@ -2830,20 +2317,20 @@ function notesResult(notes) {
   return notes ? { migrationNotes: { total: notes.total, arrived: notes.arrived, open: notes.pending.length } } : {};
 }
 async function removeUpstreamOnlyCopy(forkPath, onStep) {
-  if (!existsSync7(join10(forkPath, NOTES_DIR))) return;
+  if (!existsSync6(join7(forkPath, NOTES_DIR))) return;
   await git(["rm", "-r", "-q", "--ignore-unmatch", "--", NOTES_DIR], forkPath);
-  await rm2(join10(forkPath, NOTES_DIR), { recursive: true, force: true });
+  await rm2(join7(forkPath, NOTES_DIR), { recursive: true, force: true });
   onStep?.("migration notes", `removed ${NOTES_DIR}/: notes stay upstream, list them with pnpm cella migrate`);
 }
 async function runSyncMerge(config, ctx, onProgress, onStep) {
   const { forkPath } = config;
-  const { upstreamRef, releaseTag, mergeBase, upstreamGitHubUrl, upstreamCommit } = ctx;
+  const { upstreamRef, releaseTag, mergeRef, upstreamGitHubUrl, upstreamCommit } = ctx;
   await assertSyncConfigFollowed(config, ctx);
   const notes = await readNotesInRange(config, ctx);
   const { remainingConflicts, analyzedFiles, autoMergedFiles, protectedConflicts } = await applyDirectMerge(
     forkPath,
     upstreamRef,
-    mergeBase,
+    mergeRef,
     config,
     onProgress
   );
@@ -2898,20 +2385,13 @@ async function runSyncMerge(config, ctx, onProgress, onStep) {
 }
 async function runAnalyzePreview(config, ctx, onProgress, onStep) {
   const { forkPath } = config;
-  const worktreePath = getWorktreePath(forkPath);
   const notes = await readNotesInRange(config, ctx);
-  onProgress?.("creating worktree in temp directory...");
-  await createWorktree(forkPath, worktreePath, "HEAD");
-  onStep?.("worktree created", worktreePath);
-  onProgress?.("performing merge in worktree...");
-  await withTemporarySyncBaseGraft(worktreePath, "HEAD", ctx.mergeBase, () => merge(worktreePath, ctx.upstreamRef));
-  onStep?.("merge complete", "upstream merged into worktree");
   onProgress?.("analyzing files...");
   const analyzedFiles = await analyzeRefs(
     forkPath,
     "HEAD",
     ctx.upstreamRef,
-    ctx.mergeBase,
+    ctx.mergeRef,
     syncPredicates(config),
     onProgress
   );
@@ -2919,8 +2399,6 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
   const protectedConflicts = analyzedFiles.filter((f) => f.upstreamChanged).map((f) => f.path);
   const reports = await upstreamOnlyReports(config, ctx, analyzedFiles, protectedConflicts);
   onStep?.("analysis complete", `${analyzedFiles.length} files analyzed, dry run, no changes applied`);
-  onProgress?.("cleaning up worktree...");
-  await cleanupWorktree(forkPath, worktreePath);
   return {
     success: true,
     files: analyzedFiles,
@@ -2933,42 +2411,25 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
     ...notesResult(notes)
   };
 }
-async function runMergeEngine(config, options) {
-  const { forkPath } = config;
-  const worktreePath = getWorktreePath(forkPath);
-  const { apply, onProgress, onStep } = options;
-  await cleanupLeftoverWorktrees(forkPath);
-  registerWorktree(forkPath, worktreePath);
-  try {
-    const ctx = await prepareUpstream(config, onProgress, onStep);
-    return apply ? await runSyncMerge(config, ctx, onProgress, onStep) : await runAnalyzePreview(config, ctx, onProgress, onStep);
-  } catch (error) {
-    await cleanupWorktree(forkPath, worktreePath);
-    throw error;
-  }
-}
 async function runEngineWithSpinner(config, apply) {
-  return runMergeEngine(config, {
-    apply,
-    onProgress: (message) => {
-      spinnerText(message);
-    },
-    onStep: (label, detail) => {
-      spinnerSuccess(label, detail);
-      createSpinner("...");
-    }
-  });
+  const onProgress = (message) => spinnerText(message);
+  const onStep = (label, detail) => {
+    spinnerSuccess(label, detail);
+    createSpinner("...");
+  };
+  const ctx = await prepareUpstream(config, onProgress, onStep);
+  return apply ? runSyncMerge(config, ctx, onProgress, onStep) : runAnalyzePreview(config, ctx, onProgress, onStep);
 }
 
 // src/services/migrate.ts
-import { execFileSync as execFileSync2, spawnSync } from "child_process";
+import { execFileSync, spawnSync } from "child_process";
 import { mkdir as mkdir4, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname4, join as join8 } from "path";
 var EXTRACT_DIR = "node_modules/.cache/cella/migrations";
 var RESTORED_LIST_MAX = 20;
 async function ensureUpstreamCommit(config, sha) {
   const { forkPath } = config;
-  const present = async () => !!await git(["rev-parse", "--verify", "--quiet", `${sha}^{commit}`], forkPath, { ignoreErrors: true });
+  const present = async () => !!await revParse(forkPath, `${sha}^{commit}`);
   if (await present()) return;
   await ensureRemote(forkPath, DEFAULT_UPSTREAM_REMOTE, config.settings.upstreamUrl);
   await fetchRemote(forkPath, DEFAULT_UPSTREAM_REMOTE);
@@ -2986,7 +2447,7 @@ async function readNotesStatus(config) {
   try {
     const ref = await resolveNotesRef(config);
     if (!ref) return null;
-    const [ids, pending] = await Promise.all([listNoteIds(config.forkPath, ref), readPending(config.forkPath, ref)]);
+    const [ids, pending] = await Promise.all([listNoteIds(config.forkPath, ref), readPending(config.forkPath)]);
     return ids.length > 0 || pending.length > 0 ? { total: ids.length, open: pending.length } : null;
   } catch {
     return null;
@@ -3007,9 +2468,6 @@ async function printMigrationNotesLine(config, result) {
   console.info();
   console.info(colors_default.dim(formatNotesLine(status.total, status.open)));
 }
-function toJson(note, url, open) {
-  return { ...note, kind: note.codemod ? "codemod" : "manual", open, url: url ?? null };
-}
 function printNote(index, note, url) {
   const tags = [
     note.codemod ? "codemod" : "manual",
@@ -3029,13 +2487,13 @@ async function writeNoteFolder(config, ref, id) {
   const note = await readNote(forkPath, ref, id);
   if (!note) throw new Error(`no migration note '${id}' at upstream ${ref.slice(0, 7)}`);
   const files = (await git(["ls-tree", "-r", "--name-only", `${ref}:${NOTES_DIR}/${id}`], forkPath)).split("\n").filter(Boolean);
-  const target = join11(EXTRACT_DIR, id);
+  const target = join8(EXTRACT_DIR, id);
   for (const file of files) {
-    const content = execFileSync2("git", ["show", `${ref}:${NOTES_DIR}/${id}/${file}`], {
+    const content = execFileSync("git", ["show", `${ref}:${NOTES_DIR}/${id}/${file}`], {
       cwd: forkPath,
       maxBuffer: MAX_BUFFER
     });
-    const path = join11(forkPath, target, file);
+    const path = join8(forkPath, target, file);
     await mkdir4(dirname4(path), { recursive: true });
     await writeFile3(path, content);
   }
@@ -3050,31 +2508,15 @@ async function extractNote(config, ref, id) {
     console.info(colors_default.dim(`  or, keeping files identical to upstream as they are: pnpm cella migrate --run ${id}`));
   }
 }
-function resolveCodemod(id, files, script) {
-  if (script) {
-    const name = script.replace(/^\.\//, "");
-    if (!files.includes(name)) {
-      throw new Error(`migration note '${id}' has no file '${script}'. its files: ${files.join(", ")}`);
-    }
-    return name;
-  }
-  const scripts = files.filter((file) => !file.includes("/") && isCodemodFile(file));
-  if (scripts.length === 0) {
+async function runNote(config, ref, id) {
+  const { forkPath } = config;
+  const { note, target } = await writeNoteFolder(config, ref, id);
+  if (!note.codemod) {
     throw new Error(
       `migration note '${id}' ships no codemod script: its steps are manual, read them with \`pnpm cella migrate --show ${id}\`.`
     );
   }
-  if (scripts.length > 1) {
-    throw new Error(
-      `migration note '${id}' ships ${scripts.length} scripts (${scripts.join(", ")}): name the one to run with --script <file>.`
-    );
-  }
-  return scripts[0];
-}
-async function runNote(config, ref, id) {
-  const { forkPath } = config;
-  const { note, target, files } = await writeNoteFolder(config, ref, id);
-  const script = join11(target, resolveCodemod(id, files, config.script));
+  const script = join8(target, note.codemod);
   const args = config.runArgs?.length ? config.runArgs : ["inventory", ...note.roots];
   const upstreamCommit = await readManifestBase(forkPath) ?? ref;
   await ensureUpstreamCommit(config, upstreamCommit);
@@ -3121,7 +2563,7 @@ async function runMigrate(config) {
     console.info(colors_default.dim("no sync point recorded yet: migration notes start with the first `pnpm cella sync`."));
     return;
   }
-  const pending = await readPending(forkPath, ref);
+  const pending = await readPending(forkPath);
   const githubUrl = getGitHubBaseUrl(config.settings.upstreamUrl) ?? void 0;
   const urlOf = (id) => noteUrl(githubUrl, ref, id);
   if (config.mark?.length) return markNotes(config, ref, pending, config.mark);
@@ -3156,7 +2598,12 @@ async function runMigrate(config) {
       upstreamCommit: ref,
       total,
       open: pending.length,
-      notes: notes.map((note) => toJson(note, urlOf(note.id), open.has(note.id)))
+      notes: notes.map((note) => ({
+        ...note,
+        kind: note.codemod ? "codemod" : "manual",
+        open: open.has(note.id),
+        url: urlOf(note.id) ?? null
+      }))
     };
     writeStdout(JSON.stringify(out, null, 2));
     return;
@@ -3185,29 +2632,11 @@ function filterByScope(result, scope) {
     (f) => statuses.has(f.status) || f.upstreamChanged === true || f.upstreamOnly === true || overridesChanged && f.path === CONFIG_FILE
   );
 }
-function findTargetFile(files, targetPath) {
-  const exact = files.find((f) => f.path === targetPath);
-  if (exact) return exact;
-  const normalized = targetPath.replace(/^\.\//, "");
-  return files.find((f) => f.path === normalized);
-}
-function printUnifiedDiff(config, filePath) {
-  const diff = gitDiffFile(config.forkPath, `${config.upstreamRef}..HEAD`, filePath, {
-    dstPrefix: basename4(config.forkPath)
-  });
-  writeStdout(diff.toString());
-}
 async function runAnalyze(config) {
   createSpinner("starting analysis...");
   const result = await runEngineWithSpinner(config, false);
   spinnerSuccess();
   const scopedFiles = filterByScope(result, config.scope ?? "all");
-  if (config.diff) {
-    const file = findTargetFile(scopedFiles, config.diff) ?? findTargetFile(result.files, config.diff);
-    if (!file) throw new Error(`file not found in analysis results: ${config.diff}`);
-    printUnifiedDiff(config, file.path);
-    return result;
-  }
   if (config.json) {
     const overrides = result.upstreamOverrides?.kind === "changes" ? result.upstreamOverrides : void 0;
     const out = scopedFiles.map((f) => ({
@@ -3233,28 +2662,6 @@ async function runAnalyze(config) {
     }
     return result;
   }
-  if (config.openDiff) {
-    const file = findTargetFile(scopedFiles, config.openDiff) ?? findTargetFile(result.files, config.openDiff);
-    if (!file) throw new Error(`file not found in analysis results: ${config.openDiff}`);
-    const patch = gitDiffFile(config.forkPath, config.upstreamRef, file.path);
-    if (patch.length === 0) {
-      console.info(`${checkMark} ${file.path} is identical to upstream`);
-      return result;
-    }
-    const pagePath = await openDiffInBrowser(
-      patch.toString(),
-      {
-        filePath: file.path,
-        srcLabel: "cella",
-        dstLabel: basename4(config.forkPath),
-        note: "local working tree"
-      },
-      config.forkPath
-    );
-    console.info(`${checkMark} opened browser diff for ${file.path}`);
-    console.info(colors_default.dim(`  ${pagePath}`));
-    return result;
-  }
   const linkOptions = {
     upstreamGitHubUrl: result.upstreamGitHubUrl,
     upstreamBranch: result.upstreamBranch,
@@ -3264,67 +2671,23 @@ async function runAnalyze(config) {
   printAnalysisFileGroups(result.files, linkOptions, result);
   printEngineReports(result, "analysis summary");
   await printMigrationNotesLine(config, result);
-  printLogFileReport(config, result.files);
   console.info();
   return result;
 }
 
 // src/services/audit.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { readFileSync as readFileSync3 } from "fs";
-import { basename as basename5, join as join13, relative as relative2 } from "path";
-import { checkbox, confirm, Separator } from "@inquirer/prompts";
+import { basename as basename2, join as join10, relative as relative3 } from "path";
+import { checkbox, confirm as confirm2, Separator } from "@inquirer/prompts";
 
 // src/utils/audit-utils.ts
 import { execFile as execFile2 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
-import { join as join12 } from "path";
 import { promisify as promisify2 } from "util";
 var execFileAsync2 = promisify2(execFile2);
-var CACHE_FILE = join12(import.meta.dirname, "..", "..", ".audit.cache.json");
-var CACHE_TTL = 7 * 24 * 60 * 60 * 1e3;
-var CHANGELOG_PATHS = ["CHANGELOG.md", "CHANGELOG", "changelog.md", "HISTORY.md", "CHANGES.md", "NEWS.md"];
-var DEFAULT_BRANCHES = ["main", "master"];
-function loadCache() {
-  try {
-    if (existsSync8(CACHE_FILE)) {
-      return JSON.parse(readFileSync2(CACHE_FILE, "utf8"));
-    }
-  } catch {
-  }
-  return {};
-}
-function saveCache(cache) {
-  try {
-    writeFileSync3(CACHE_FILE, `${JSON.stringify(cache, null, 2)}
-`);
-  } catch {
-  }
-}
-function clearCache() {
-  try {
-    if (existsSync8(CACHE_FILE)) {
-      unlinkSync(CACHE_FILE);
-      console.info(colors_default.green("\u2713 cache cleared successfully"));
-    } else {
-      console.info(colors_default.yellow("no cache file found"));
-    }
-  } catch (err) {
-    console.error(colors_default.red("failed to clear cache:"), err);
-  }
-}
-async function fetchNpmMetadata(packageName) {
-  try {
-    const response = await fetch(`https://registry.npmjs.org/${packageName}`);
-    if (!response.ok) return null;
-    return await response.json();
-  } catch {
-    return null;
-  }
-}
-function getRepoUrl(data) {
-  if (!data?.repository?.url) return null;
-  let url = data.repository.url;
+function getRepoUrl(repositoryUrl) {
+  if (!repositoryUrl) return null;
+  let url = repositoryUrl;
   if (url.startsWith("git+")) {
     url = url.slice(4);
   }
@@ -3345,110 +2708,43 @@ function isGitHubRepoUrl(repoUrl) {
     return false;
   }
 }
-async function findGitHubFile(repoUrl, filePath) {
-  if (!isGitHubRepoUrl(repoUrl)) return null;
-  for (const branch of DEFAULT_BRANCHES) {
-    const rawUrl = repoUrl.replace("github.com", "raw.githubusercontent.com").concat(`/${branch}/${filePath}`);
-    try {
-      const response = await fetch(rawUrl, { method: "HEAD" });
-      if (response.ok) return branch;
-    } catch {
-    }
-  }
-  return null;
-}
-async function findChangelogUrl(repoUrl, packageName, cache) {
-  if (!isGitHubRepoUrl(repoUrl)) return null;
-  const cached = cache[packageName];
-  if (cached && Date.now() - cached.fetchedAt < CACHE_TTL) {
-    return cached.changelogUrl;
-  }
-  for (const changelogPath of CHANGELOG_PATHS) {
-    const branch = await findGitHubFile(repoUrl, changelogPath);
-    if (branch) {
-      const blobUrl = `${repoUrl}/blob/${branch}/${changelogPath}`;
-      cache[packageName] = {
-        repoUrl,
-        changelogUrl: blobUrl,
-        fetchedAt: Date.now()
-      };
-      return blobUrl;
-    }
-  }
-  cache[packageName] = {
-    repoUrl,
-    changelogUrl: null,
-    fetchedAt: Date.now()
-  };
-  return null;
-}
 function getReleasesUrl(repoUrl) {
   if (!isGitHubRepoUrl(repoUrl)) return null;
   return `${repoUrl}/releases`;
 }
 function isMajorVersionChange(current, latest) {
-  const currentMajor = current.split(".")[0]?.replace(/^\D+/, "");
-  const latestMajor = latest.split(".")[0]?.replace(/^\D+/, "");
-  if (!currentMajor || !latestMajor) return false;
-  return Number.parseInt(latestMajor, 10) > Number.parseInt(currentMajor, 10);
+  const from = parseComparableVersion(current);
+  const to = parseComparableVersion(latest);
+  return !!from && !!to && to.major > from.major;
 }
-async function runPnpmJson(args, cwd) {
-  const parse = (stdout) => {
-    if (!stdout || stdout.trim() === "") return null;
-    try {
-      return JSON.parse(stdout);
-    } catch {
-      return null;
-    }
-  };
+async function runPnpm(args, cwd) {
   try {
-    const { stdout } = await execFileAsync2("pnpm", args, {
+    const { stdout, stderr } = await execFileAsync2("pnpm", args, {
       encoding: "utf8",
       maxBuffer: 10 * 1024 * 1024,
-      // 10MB buffer for large outputs
       cwd
     });
-    return parse(stdout);
+    return { ok: true, stdout, stderr };
   } catch (error) {
-    return parse(error instanceof Error && "stdout" in error ? error.stdout : void 0);
+    const { stdout = "", stderr = "" } = error;
+    return { ok: false, stdout, stderr: stdout || stderr ? stderr : String(error) };
   }
 }
-async function getOutdatedPackages(cwd) {
-  return await runPnpmJson(["-r", "outdated", "--json"], cwd) ?? {};
+async function runPnpmJson(args, cwd) {
+  try {
+    return JSON.parse((await runPnpm([...args, "--loglevel=error"], cwd)).stdout);
+  } catch {
+    return null;
+  }
 }
 async function runPnpmAudit(cwd) {
-  return await runPnpmJson(["audit", "--json"], cwd);
+  const result = await runPnpmJson(["audit", "--json"], cwd);
+  if (!result || typeof result.advisories !== "object" || result.advisories === null) return null;
+  return result;
 }
-function parseDependencyPath(paths) {
-  for (const pathStr of paths) {
-    const parts = pathStr.split(">");
-    if (parts.length >= 2) {
-      return {
-        workspace: parts[0],
-        directDependency: parts.length > 2 ? parts[1] : null
-      };
-    }
-  }
-  return { workspace: null, directDependency: null };
-}
-function buildVulnerabilityMap(auditResult) {
-  const map = /* @__PURE__ */ new Map();
-  if (!auditResult?.advisories) return map;
-  for (const advisory of Object.values(auditResult.advisories)) {
-    const allPaths = advisory.findings?.flatMap((f) => f.paths) || [];
-    const { workspace, directDependency } = parseDependencyPath(allPaths);
-    const existing = map.get(advisory.module_name) || [];
-    existing.push({
-      title: advisory.title,
-      severity: advisory.severity,
-      vulnerableVersions: advisory.vulnerable_versions,
-      cves: advisory.cves || [],
-      workspace,
-      directDependency
-    });
-    map.set(advisory.module_name, existing);
-  }
-  return map;
+async function fetchPublishTimes(name, cwd) {
+  const times = await runPnpmJson(["view", name, "time", "--json"], cwd);
+  return times && typeof times === "object" ? times : null;
 }
 var vulnIcons = {
   critical: colors_default.red("\u25CF"),
@@ -3460,14 +2756,6 @@ var vulnIcons = {
 function getVulnIcon(severity) {
   return vulnIcons[severity] ?? colors_default.gray("\u25CF");
 }
-function getHighestSeverity(vulns) {
-  if (vulns.length === 0) return null;
-  const order = ["critical", "high", "moderate", "low", "info"];
-  for (const severity of order) {
-    if (vulns.some((v) => v.severity === severity)) return severity;
-  }
-  return null;
-}
 function middleTruncate(str2, maxLen) {
   if (str2.length <= maxLen) return str2;
   const ellipsis = "\u2026";
@@ -3482,51 +2770,503 @@ function formatDependents(dependents) {
   return `${dependents[0]} +${dependents.length - 1}`;
 }
 
-// src/utils/yaml.ts
-function yamlBlockLines(content, key) {
-  const lines = [];
-  let inBlock = false;
-  for (const line of content.split("\n")) {
-    if (new RegExp(`^${key}:\\s*$`).test(line)) {
-      inBlock = true;
-      continue;
+// src/utils/security-plan.ts
+var SEVERITIES = ["critical", "high", "moderate", "low", "info"];
+function isAuditOverride(key) {
+  if (/[^ |@]>/.test(key)) return false;
+  return key.indexOf("@", 1) > 0;
+}
+function overrideModule(key) {
+  const child = key.split(/(?<=[^ |@])>/).at(-1) ?? key;
+  const at = child.indexOf("@", 1);
+  return at > 0 ? child.slice(0, at) : child;
+}
+function parseVersionedExclude(entry) {
+  const at = entry.lastIndexOf("@");
+  if (at <= 0) return null;
+  const version = entry.slice(at + 1);
+  return /^\d+\.\d+\.\d+[0-9A-Za-z.+-]*$/.test(version) ? { name: entry.slice(0, at), version } : null;
+}
+function advisoriesFromAudit(audit) {
+  return Object.values(audit.advisories).map((advisory) => {
+    const paths = (advisory.findings ?? []).flatMap((finding) => finding.paths ?? []).map((path) => path.split(">"));
+    return {
+      ghsa: advisory.github_advisory_id ?? advisory.url ?? String(advisory.id),
+      module: advisory.module_name,
+      severity: advisory.severity,
+      range: advisory.vulnerable_versions,
+      installed: [...new Set((advisory.findings ?? []).map((finding) => finding.version))],
+      via: [...new Set(paths.map((parts) => parts[parts.length > 2 ? 1 : 0]))],
+      direct: paths.some((parts) => parts.length === 2)
+    };
+  });
+}
+var publishedAgo = (name, version, input) => input.now - Date.parse(input.published[name]?.[version] ?? "");
+function isInstallable(name, version, input) {
+  const excludes = input.previous.releaseAgeExcludes;
+  if (excludes.includes(name) || excludes.includes(`${name}@${version}`)) return true;
+  const age = publishedAgo(name, version, input);
+  return Number.isNaN(age) || age >= input.releaseAgeMinutes * 6e4;
+}
+function admits(target, version) {
+  const base = target.replace(/^[\^~>=<\s]+/, "");
+  if (compareVersionStrings(base, version) > 0) return false;
+  return target.trim().startsWith(">") || !isBreakingJump(base, version);
+}
+var previousOverrides = (module, previous) => Object.entries(previous.overrides).filter(([key]) => isAuditOverride(key) && overrideModule(key) === module);
+function standingOverrides(module, input) {
+  const versions = Object.keys(input.published[module] ?? {});
+  return Object.fromEntries(
+    previousOverrides(module, input.previous).filter(([, target]) => versions.some((v) => admits(target, v)))
+  );
+}
+function planSecurity(input) {
+  const ignored = new Set(input.previous.ignoredGhsas);
+  const byModule = Map.groupBy(input.advisories, (advisory) => advisory.module);
+  const items = [];
+  for (const [module, advisories] of byModule) {
+    const versions = Object.keys(input.published[module] ?? {}).filter((v) => /^\d/.test(v));
+    const stable = versions.filter((v) => !isPrerelease(v)).sort(compareVersionStrings);
+    const escapesAll = (v) => !advisories.some((advisory) => satisfiesComparators(v, advisory.range));
+    const fixOf = (advisory) => {
+      const highest = [...advisory.installed].sort(compareVersionStrings).at(-1) ?? "0.0.0";
+      const candidates = stable.filter(
+        (v) => compareVersionStrings(v, highest) > 0 && !satisfiesComparators(v, advisory.range)
+      );
+      const installable = candidates.filter((v) => isInstallable(module, v, input));
+      const pick = (among) => among.find(escapesAll) ?? among[0];
+      return pick(installable) ?? pick(candidates);
+    };
+    for (const [fix, group] of Map.groupBy(advisories, fixOf)) {
+      const installed = [...new Set(group.flatMap((advisory) => advisory.installed))].sort(compareVersionStrings);
+      const ghsas = group.map((advisory) => advisory.ghsa);
+      const allIgnored = ghsas.every((ghsa) => ignored.has(ghsa));
+      const breaking = !!fix && installed.some((v) => isBreakingJump(v, fix));
+      let remedy = { kind: "none" };
+      let standing = allIgnored ? "ignored" : "new";
+      let overrides = {};
+      if (fix) {
+        const hoursOld = Math.max(0, Math.floor(publishedAgo(module, fix, input) / 36e5));
+        remedy = isInstallable(module, fix, input) ? { kind: "override", target: fix, breaking } : { kind: "fresh", target: fix, breaking, hoursOld };
+        overrides = Object.fromEntries(
+          [...new Set(group.map((advisory) => advisory.range))].map((range) => {
+            const key = `${module}@${range}`;
+            const kept = input.previous.overrides[key];
+            return [key, kept && admits(kept, fix) ? kept : `^${fix}`];
+          })
+        );
+        if (remedy.kind === "override") {
+          if (previousOverrides(module, input.previous).some(([, target]) => admits(target, fix))) standing = "carried";
+          else if (allIgnored && !breaking) standing = "new";
+        }
+      }
+      items.push({
+        module,
+        severity: SEVERITIES.find((severity) => group.some((advisory) => advisory.severity === severity)) ?? "info",
+        ghsas,
+        installed: installed[0] ?? "",
+        via: [...new Set(group.flatMap((advisory) => advisory.via))],
+        direct: group.some((advisory) => advisory.direct),
+        remedy,
+        standing,
+        overrides
+      });
     }
-    if (!inBlock) continue;
-    const trimmed = line.trim();
-    if (trimmed.startsWith("#")) continue;
-    if (trimmed !== "" && !line.startsWith(" ") && !line.startsWith("	")) break;
-    lines.push(line);
-  }
-  return lines;
-}
-function parseYamlBlockMap(content, key) {
-  const result = {};
-  for (const line of yamlBlockLines(content, key)) {
-    const match = line.match(/^\s+(.+?):\s+['"]?([^'"]+)['"]?\s*$/);
-    if (match) {
-      result[match[1].replace(/^['"]|['"]$/g, "")] = match[2];
+  }
+  return items.sort(
+    (a, b) => SEVERITIES.indexOf(a.severity) - SEVERITIES.indexOf(b.severity) || a.module.localeCompare(b.module)
+  );
+}
+function liveExcludes(input) {
+  return input.previous.releaseAgeExcludes.filter((entry) => {
+    const versioned = parseVersionedExclude(entry);
+    if (!versioned || !input.published[versioned.name]) return true;
+    return publishedAgo(versioned.name, versioned.version, input) < input.releaseAgeMinutes * 6e4;
+  });
+}
+
+// src/utils/workspace-yaml.ts
+import { isMap, isScalar, isSeq, parseDocument } from "yaml";
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var stringRecord = (value) => Object.fromEntries(Object.entries(record(value)).map(([key, entry]) => [key, String(entry)]));
+var stringList = (value) => Array.isArray(value) ? value.map(String) : [];
+function readAuditSettings(content) {
+  const doc = parseDocument(content);
+  if (doc.errors.length > 0) throw new Error(doc.errors[0].message);
+  const settings = record(doc.toJS());
+  return {
+    overrides: stringRecord(settings.overrides),
+    releaseAgeExcludes: stringList(settings.minimumReleaseAgeExclude),
+    ignoredGhsas: stringList(record(settings.auditConfig).ignoreGhsas)
+  };
+}
+function readTopLevel(content, key) {
+  return record(parseDocument(content).toJS())[key];
+}
+function readPatchFiles(content) {
+  return Object.values(stringRecord(record(parseDocument(content).toJS()).patchedDependencies));
+}
+var keyOf = (pair) => String(isScalar(pair.key) ? pair.key.value : pair.key);
+var itemText = (item) => String(isScalar(item) ? item.value : item);
+function keepingOrder(map, change) {
+  const keys = map.items.map(keyOf);
+  const wasSorted = keys.every((key, i) => i === 0 || keys[i - 1].localeCompare(key) <= 0);
+  change();
+  if (wasSorted) map.items.sort((a, b) => keyOf(a).localeCompare(keyOf(b)));
+}
+function mapAt(doc, path) {
+  if (path.length === 0) {
+    if (!isMap(doc.contents)) doc.contents = doc.createNode({});
+    return doc.contents;
+  }
+  const parent = mapAt(doc, path.slice(0, -1));
+  const key = path[path.length - 1];
+  const existing = parent.get(key, true);
+  if (isMap(existing)) {
+    if (existing.items.length === 0) existing.flow = false;
+    return existing;
+  }
+  const created = doc.createNode({});
+  keepingOrder(parent, () => parent.set(key, created));
+  return created;
+}
+function syncMap(doc, path, entries) {
+  if (!isMap(doc.getIn(path)) && Object.keys(entries).length === 0) return;
+  const map = mapAt(doc, path);
+  keepingOrder(map, () => {
+    for (const key of map.items.map(keyOf)) if (!(key in entries)) map.delete(key);
+    for (const [key, value] of Object.entries(entries)) map.set(key, value);
+  });
+  if (map.items.length === 0) doc.deleteIn(path);
+}
+function syncList(doc, path, entries) {
+  const current = doc.getIn(path);
+  if (!isSeq(current)) {
+    if (entries.length === 0) return;
+    const parent = mapAt(doc, path.slice(0, -1));
+    keepingOrder(parent, () => parent.set(path[path.length - 1], doc.createNode(entries)));
+    return;
+  }
+  current.items = current.items.filter((item) => entries.includes(itemText(item)));
+  const present = new Set(current.items.map(itemText));
+  for (const entry of entries) if (!present.has(entry)) current.add(doc.createNode(entry));
+  if (current.items.length === 0) doc.deleteIn(path);
+  else current.flow = false;
+}
+function writeAuditSettings(content, next) {
+  const doc = parseDocument(content);
+  syncMap(doc, ["overrides"], next.overrides);
+  syncList(doc, ["minimumReleaseAgeExclude"], next.releaseAgeExcludes);
+  syncList(doc, ["auditConfig", "ignoreGhsas"], next.ignoredGhsas);
+  const auditConfig = doc.getIn(["auditConfig"]);
+  if (isMap(auditConfig) && auditConfig.items.length === 0) doc.deleteIn(["auditConfig"]);
+  return doc.toString({ lineWidth: 0, singleQuote: true });
+}
+
+// src/services/audit-security.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { cpSync, existsSync as existsSync7, mkdirSync, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname5, join as join9, relative as relative2 } from "path";
+import { confirm, select as select2 } from "@inquirer/prompts";
+var WORKSPACE_FILE = "pnpm-workspace.yaml";
+var LOCK_FILE = "pnpm-lock.yaml";
+var RESOLUTION_FILES = ["package.json", LOCK_FILE, ".npmrc", ".pnpmfile.cjs"];
+var readOr = (path, fallback = "") => existsSync7(path) ? readFileSync2(path, "utf8") : fallback;
+var count = (n, noun, plural2 = `${noun}s`) => `${n} ${n === 1 ? noun : plural2}`;
+var isBreaking = (item) => item.remedy.kind !== "none" && item.remedy.breaking;
+var needsDecision = (item) => item.standing === "new" && (item.remedy.kind !== "override" || item.remedy.breaking || item.direct);
+var sameEntries = (a, b) => Object.keys(a).length === Object.keys(b).length && Object.entries(a).every(([key, value]) => b[key] === value);
+async function createStaging(forkPath, workspaceYaml) {
+  const staging = mkdtempSync(join9(tmpdir(), "cella-audit-"));
+  const projects = await runPnpmJson(["ls", "-r", "--depth", "-1", "--json"], forkPath) ?? [];
+  const files = [
+    ...RESOLUTION_FILES,
+    ...readPatchFiles(workspaceYaml),
+    ...projects.map((project) => join9(relative2(forkPath, project.path), "package.json"))
+  ];
+  for (const file of new Set(files)) {
+    if (file.startsWith("..") || !existsSync7(join9(forkPath, file))) continue;
+    mkdirSync(dirname5(join9(staging, file)), { recursive: true });
+    cpSync(join9(forkPath, file), join9(staging, file));
+  }
+  return staging;
+}
+async function resolveStaging(staging, workspaceYaml, settings) {
+  writeFileSync(join9(staging, WORKSPACE_FILE), writeAuditSettings(workspaceYaml, settings));
+  const result = await runPnpm(["install", "--lockfile-only", "--no-frozen-lockfile", "--ignore-scripts"], staging);
+  return result.ok ? { lock: readOr(join9(staging, LOCK_FILE)) } : { error: `${result.stdout}${result.stderr}`.trim() };
+}
+function lockedVersions(lock, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+  const versions = [...lock.matchAll(new RegExp(`^ {2}'?${escaped}@(\\d[^:'()\\s]*)`, "gm"))].map((match) => match[1]);
+  return [...new Set(versions)];
+}
+function versionsText(item) {
+  if (item.remedy.kind === "none") return item.installed;
+  return `${item.installed} \u2192 ${item.remedy.target}${isBreaking(item) ? " \u26A0" : ""}`;
+}
+function noteText(item, releaseAgeHours) {
+  if (item.remedy.kind === "none") return "no fix published";
+  if (item.remedy.kind === "fresh")
+    return `fix published ${item.remedy.hoursOld}h ago, inside the ${releaseAgeHours}h release age`;
+  if (item.standing === "ignored") return "the fix is a breaking jump";
+  return "";
+}
+function printGroup(title, items, releaseAgeHours) {
+  if (items.length === 0) return;
+  const nameWidth = Math.min(30, Math.max(...items.map((item) => item.module.length)));
+  const versionWidth = Math.max(...items.map((item) => versionsText(item).length));
+  console.info(colors_default.bold(`${title} (${items.length})`));
+  for (const item of items) {
+    const name = colors_default.white(middleTruncate(item.module, nameWidth).padEnd(nameWidth));
+    const source = `${formatDependents(item.via)}${item.direct ? " (direct)" : ""}`;
+    const tail = [source, noteText(item, releaseAgeHours)].filter(Boolean).join(" \xB7 ");
+    console.info(
+      `${getVulnIcon(item.severity)} ${name}  ${item.severity.padEnd(8)}  ${versionsText(item).padEnd(versionWidth)}  ${colors_default.dim(tail)}`
+    );
+  }
+  console.info();
+}
+function printDropped(title, rows) {
+  if (rows.length === 0) return;
+  const nameWidth = Math.min(40, Math.max(...rows.map(([name]) => name.length)));
+  console.info(colors_default.bold(`${title} (${rows.length})`));
+  for (const [name, reason] of rows) {
+    console.info(`${colors_default.green("\u25CB")} ${colors_default.white(middleTruncate(name, nameWidth).padEnd(nameWidth))}  ${colors_default.dim(reason)}`);
+  }
+  console.info();
+}
+function droppedReason(key, items, bareLock) {
+  const module = overrideModule(key);
+  const item = items.find((candidate) => candidate.module === module);
+  if (item) return item.remedy.kind === "none" ? "no published version fixes it" : "replaced by another range";
+  const versions = lockedVersions(bareLock, module);
+  return versions.length > 0 ? `resolves to ${versions.join(", ")} on its own` : "no longer installed";
+}
+async function decide(items, releaseAgeHours) {
+  const decisions = [];
+  for (const item of items) {
+    const { remedy } = item;
+    const jump = remedy.kind === "none" ? "" : `${item.installed} \u2192 ${remedy.target}`;
+    if (!needsDecision(item)) {
+      decisions.push({ item, action: item.standing === "ignored" ? "ignore" : "override" });
+    } else if (remedy.kind === "none") {
+      const ignore = await confirm({
+        message: `${item.module}: no fix is published. ignore ${item.ghsas.join(", ")} until one is?`,
+        default: true
+      });
+      decisions.push({ item, action: ignore ? "ignore" : "open" });
+    } else if (remedy.kind === "fresh") {
+      const action = await select2({
+        message: `${item.module}: fix ${remedy.target} was published ${remedy.hoursOld}h ago, inside the ${releaseAgeHours}h release age`,
+        choices: [
+          { name: "wait and re-run later", value: "open" },
+          { name: "install now, with an exclude that a later audit removes", value: "override" }
+        ]
+      });
+      decisions.push({ item, action, exclude: action === "override" ? `${item.module}@${remedy.target}` : void 0 });
+    } else {
+      const message = item.direct ? `the fix is ${jump}, and ${item.via[0]} depends on it directly` : `the fix jumps ${jump}, past what ${formatDependents(item.via)} asks for`;
+      const action = await select2({
+        message: `${item.module}: ${message}`,
+        choices: [
+          { name: item.direct ? "leave open, update it in package.json" : "leave open", value: "open" },
+          { name: "apply the override", value: "override" },
+          { name: "ignore the advisory", value: "ignore" }
+        ]
+      });
+      decisions.push({ item, action });
     }
   }
-  return result;
+  return decisions;
 }
-function parseYamlBlockList(content, key) {
-  const items = [];
-  for (const line of yamlBlockLines(content, key)) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith("- ")) items.push(trimmed.slice(2).trim());
+function settingsFor(decisions, kept, excludes) {
+  const overriding = decisions.filter((decision) => decision.action === "override");
+  return {
+    overrides: { ...kept, ...Object.assign({}, ...overriding.map((decision) => decision.item.overrides)) },
+    releaseAgeExcludes: [.../* @__PURE__ */ new Set([...excludes, ...overriding.flatMap((decision) => decision.exclude ?? [])])],
+    ignoredGhsas: decisions.filter((decision) => decision.action === "ignore").flatMap((decision) => decision.item.ghsas)
+  };
+}
+function changeLine(label, before, after) {
+  const dropped = before.filter((entry) => !after.includes(entry)).length;
+  const added = after.filter((entry) => !before.includes(entry)).length;
+  const moved = [dropped ? `${dropped} dropped` : "", added ? `${added} added` : ""].filter(Boolean).join(", ");
+  const counts = moved ? `${before.length} \u2192 ${after.length}` : String(after.length);
+  return `  ${label.padEnd(9)}  ${counts.padEnd(7)}  ${colors_default.dim(moved || "unchanged")}`;
+}
+async function runSecurityPass(forkPath, options) {
+  const workspaceYaml = readOr(join9(forkPath, WORKSPACE_FILE));
+  const workspaceLock = readOr(join9(forkPath, LOCK_FILE));
+  let previous;
+  try {
+    previous = readAuditSettings(workspaceYaml);
+  } catch (error) {
+    console.error(
+      `${colors_default.red("\u2717")} ${WORKSPACE_FILE} could not be read: ${error instanceof Error ? error.message : error}`
+    );
+    return;
+  }
+  const auditKeys = Object.keys(previous.overrides).filter(isAuditOverride);
+  const lasting = Object.fromEntries(Object.entries(previous.overrides).filter(([key]) => !isAuditOverride(key)));
+  const spinner = createSpinner(
+    auditKeys.length > 0 ? `resolving without the ${count(auditKeys.length, "audit override")}...` : "resolving the workspace..."
+  );
+  const fail = (message, detail = "") => {
+    spinner.stop();
+    console.error(`${colors_default.red("\u2717")} ${message}`);
+    if (detail) console.error(colors_default.dim(detail.split("\n").slice(-12).join("\n")));
+    console.info(colors_default.dim("  the workspace is unchanged"));
+    console.info();
+  };
+  const staging = await createStaging(forkPath, workspaceYaml);
+  try {
+    const bare = await resolveStaging(staging, workspaceYaml, { ...previous, overrides: lasting, ignoredGhsas: [] });
+    if ("error" in bare) return fail("could not resolve the workspace without its audit overrides", bare.error);
+    spinnerText("checking for vulnerabilities...");
+    const audit = await runPnpmAudit(staging);
+    if (!audit) return fail("pnpm audit gave no answer, so nothing can be decided");
+    const advisories = advisoriesFromAudit(audit);
+    spinnerText(`checking ${count(advisories.length, "advisory", "advisories")} against the registry...`);
+    const versionedExcludes = previous.releaseAgeExcludes.flatMap((entry) => parseVersionedExclude(entry)?.name ?? []);
+    const names = [.../* @__PURE__ */ new Set([...advisories.map((advisory) => advisory.module), ...versionedExcludes])];
+    const times = await Promise.all(names.map((name) => fetchPublishTimes(name, forkPath)));
+    const published = Object.fromEntries(
+      names.map((name, i) => [name, times[i]]).filter(([, answer]) => answer)
+    );
+    const unanswered = advisories.map((advisory) => advisory.module).filter((name) => !published[name]);
+    if (unanswered.length > 0) return fail(`the registry did not answer for ${[...new Set(unanswered)].join(", ")}`);
+    const releaseAge = Number.parseInt((await runPnpm(["config", "get", "minimumReleaseAge"], forkPath)).stdout, 10);
+    const releaseAgeMinutes = Number.isNaN(releaseAge) ? 0 : releaseAge;
+    const releaseAgeHours = Math.round(releaseAgeMinutes / 60);
+    const planInput = { advisories, published, previous, releaseAgeMinutes, now: Date.now() };
+    const items = planSecurity(planInput);
+    const excludes = liveExcludes(planInput);
+    spinner.stop();
+    const changes = printPlan({
+      items,
+      previous,
+      auditKeys,
+      lasting,
+      advisories,
+      bareLock: bare.lock,
+      releaseAgeHours
+    });
+    if (!options.apply) {
+      if (changes) console.info(colors_default.dim("run without --list to apply"));
+      console.info();
+      return;
+    }
+    let decisions;
+    try {
+      decisions = await decide(items, releaseAgeHours);
+    } catch {
+      console.info(colors_default.dim("  cancelled, the workspace is unchanged"));
+      return;
+    }
+    const open = decisions.filter((decision) => decision.action === "open").map((decision) => decision.item.module);
+    const kept = Object.assign({}, lasting, ...open.map((module) => standingOverrides(module, planInput)));
+    const next = settingsFor(decisions, kept, excludes);
+    const nextYaml = writeAuditSettings(workspaceYaml, next);
+    if (nextYaml === workspaceYaml) {
+      const state = `${count(auditKeys.length, "override")} \xB7 ${next.ignoredGhsas.length} ignored`;
+      console.info(`${checkMark} security settings are current ${colors_default.dim(`\xB7 ${state}`)}`);
+      printOpen(open);
+      return;
+    }
+    const summarize = () => {
+      console.info(colors_default.bold(WORKSPACE_FILE));
+      console.info(changeLine("overrides", auditKeys, Object.keys(next.overrides).filter(isAuditOverride)));
+      console.info(changeLine("excludes", previous.releaseAgeExcludes, next.releaseAgeExcludes));
+      console.info(changeLine("ignored", previous.ignoredGhsas, next.ignoredGhsas));
+      console.info();
+    };
+    if (sameEntries(next.overrides, previous.overrides)) {
+      writeFileSync(join9(forkPath, WORKSPACE_FILE), nextYaml);
+      console.info(`${checkMark} ${WORKSPACE_FILE} updated ${colors_default.dim("\xB7 nothing to install")}`);
+      printOpen(open);
+      summarize();
+      return;
+    }
+    const stagingSpinner = createSpinner("resolving with the new settings...");
+    const staged = await resolveStaging(staging, workspaceYaml, next);
+    stagingSpinner.stop();
+    if ("error" in staged) return fail("could not resolve the workspace with the new settings", staged.error);
+    writeFileSync(join9(forkPath, WORKSPACE_FILE), nextYaml);
+    writeFileSync(join9(forkPath, LOCK_FILE), staged.lock);
+    const install = spawnSync2("pnpm", ["install"], { cwd: forkPath, stdio: "inherit" });
+    console.info();
+    if (install.status !== 0) {
+      writeFileSync(join9(forkPath, WORKSPACE_FILE), workspaceYaml);
+      writeFileSync(join9(forkPath, LOCK_FILE), workspaceLock);
+      console.error(`${colors_default.red("\u2717")} pnpm install failed (exit code ${install.status})`);
+      console.info(colors_default.dim(`  ${WORKSPACE_FILE} and ${LOCK_FILE} are back as they were; run pnpm install to match`));
+      console.info();
+      return;
+    }
+    const verified = await runPnpmAudit(forkPath);
+    const reported = verified ? [...new Set(advisoriesFromAudit(verified).map((advisory) => advisory.module))] : open;
+    console.info(`${checkMark} installed${reported.length === 0 ? ` ${colors_default.dim("\xB7")} audit clean` : ""}`);
+    printOpen(reported);
+    summarize();
+  } finally {
+    spinner.stop();
+    rmSync(staging, { recursive: true, force: true });
   }
-  return items;
+}
+function printOpen(modules) {
+  if (modules.length > 0) {
+    console.info(`${warningMark} ${count(modules.length, "package")} still reported: ${modules.join(", ")}`);
+  }
+  console.info();
+}
+function printPlan(plan) {
+  const { items, previous, releaseAgeHours } = plan;
+  const kept = items.filter((item) => item.standing === "carried");
+  const undecided = items.filter(needsDecision);
+  const added = items.filter((item) => item.standing === "new" && !needsDecision(item));
+  const ignored = items.filter((item) => item.standing === "ignored");
+  const plannedKeys = new Set(
+    items.flatMap((item) => item.standing === "ignored" ? [] : Object.keys(item.overrides))
+  );
+  const pending = new Set(undecided.map((item) => item.module));
+  const droppedOverrides = plan.auditKeys.filter((key) => !plannedKeys.has(key) && !pending.has(overrideModule(key))).map((key) => [key, droppedReason(key, items, plan.bareLock)]);
+  const reportedGhsas = new Set(plan.advisories.map((advisory) => advisory.ghsa));
+  const fixedGhsas = new Set([...kept, ...added].flatMap((item) => item.ghsas));
+  const droppedIgnores = previous.ignoredGhsas.filter((ghsa) => !reportedGhsas.has(ghsa) || fixedGhsas.has(ghsa)).map((ghsa) => [ghsa, fixedGhsas.has(ghsa) ? "a fix is published" : "no longer applies"]);
+  console.info(colors_default.bold("security"));
+  console.info(DIVIDER);
+  if (items.length === 0 && droppedOverrides.length === 0 && droppedIgnores.length === 0) {
+    console.info(`${checkMark} no vulnerabilities found`);
+    console.info();
+    return false;
+  }
+  printGroup("override kept", kept, releaseAgeHours);
+  printGroup("fix available", added, releaseAgeHours);
+  printGroup("needs a decision", undecided, releaseAgeHours);
+  printGroup("ignored", ignored, releaseAgeHours);
+  printDropped("override dropped", droppedOverrides);
+  printDropped("ignore dropped", droppedIgnores);
+  const lastingCount = Object.keys(plan.lasting).length;
+  if (lastingCount > 0) {
+    console.info(colors_default.dim(`${count(lastingCount, "override")} without a version selector left as written`));
+  }
+  if (items.some(isBreaking)) {
+    console.info(colors_default.dim("\u26A0 a breaking jump: another major, or another minor below 1.0"));
+  }
+  console.info();
+  return added.length + undecided.length + droppedOverrides.length + droppedIgnores.length > 0;
 }
 
 // src/services/audit.ts
-var AUDIT_FIX_VALUE = "__audit_fix__";
 function createDependentPkgReader() {
   const cache = /* @__PURE__ */ new Map();
   return (location) => {
     let cached = cache.get(location);
     if (cached === void 0) {
       try {
-        cached = JSON.parse(readFileSync3(join13(location, "package.json"), "utf8"));
+        cached = JSON.parse(readFileSync3(join10(location, "package.json"), "utf8"));
       } catch {
         cached = null;
       }
@@ -3535,106 +3275,74 @@ function createDependentPkgReader() {
     return cached ?? null;
   };
 }
-function formatSeverityCounts(counts, suffix = "") {
-  const parts = [];
-  if (counts.critical) parts.push(colors_default.red(`${counts.critical} critical${suffix}`));
-  if (counts.high) parts.push(colors_default.red(`${counts.high} high${suffix}`));
-  if (counts.moderate) parts.push(colors_default.yellow(`${counts.moderate} moderate${suffix}`));
-  if (counts.low) parts.push(colors_default.blue(`${counts.low} low`));
-  return parts;
-}
 async function runAudit(config) {
   const { forkPath } = config;
-  if (config.checkOverrides) {
-    await checkOverrides(forkPath);
-    return;
-  }
-  const spinner = createSpinner("checking for outdated packages & vulnerabilities...");
+  const spinner = createSpinner("checking for outdated packages...");
   try {
-    if (config.force) {
-      spinnerText("clearing pnpm metadata cache...");
-      clearCache();
-      spawnSync2("pnpm", ["cache", "delete", "*"], {
-        cwd: forkPath,
-        stdio: "ignore"
-      });
-      spinnerText("checking for outdated packages & vulnerabilities...");
+    const [outdated, auditResult] = await Promise.all([
+      runPnpmJson(["-r", "outdated", "--json", "--long"], forkPath),
+      runPnpmAudit(forkPath)
+    ]);
+    if (!outdated) {
+      spinnerFail("pnpm outdated gave no answer: run pnpm -r outdated to see why");
+      console.info(`${warningMark} security pass skipped: it runs after the update check`);
+      return;
     }
-    const [outdatedPackages, auditResult] = await Promise.all([getOutdatedPackages(forkPath), runPnpmAudit(forkPath)]);
+    const outdatedPackages = outdated;
     const packageNames = Object.keys(outdatedPackages);
-    const vulnMap = buildVulnerabilityMap(auditResult);
-    if (packageNames.length === 0 && vulnMap.size === 0) {
-      spinnerSuccess("all packages are up to date and secure");
+    if (packageNames.length === 0) {
+      spinnerSuccess("all packages are up to date");
+      console.info();
+      await runSecurityPass(forkPath, { apply: !config.list });
       return;
     }
-    const cache = loadCache();
-    spinnerText(`found ${packageNames.length} outdated package(s), fetching metadata...`);
+    const advisories = auditResult ? advisoriesFromAudit(auditResult) : [];
+    const severityOf = (name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
     const readDependentPkg = createDependentPkgReader();
-    const dependentNameCache = /* @__PURE__ */ new Map();
-    for (const name of packageNames) {
-      for (const dep of outdatedPackages[name].dependentPackages) {
-        if (!dependentNameCache.has(dep.location)) {
-          dependentNameCache.set(dep.location, readDependentPkg(dep.location)?.name || basename5(dep.location));
+    const enhancedPackages = packageNames.map((name) => {
+      const pkg = outdatedPackages[name];
+      const repoUrl = getRepoUrl(pkg.latestManifest?.repository?.url);
+      const pinnedIn = [];
+      for (const d of pkg.dependentPackages) {
+        const spec = readDependentPkg(d.location)?.[pkg.dependencyType]?.[name] || "";
+        if (spec && !spec.startsWith("^") && !spec.startsWith("~") && !spec.startsWith(">")) {
+          pinnedIn.push(d.name);
         }
       }
-    }
-    const enhancedPackages = [];
-    const batchSize = 10;
-    for (let i = 0; i < packageNames.length; i += batchSize) {
-      const batch = packageNames.slice(i, i + batchSize);
-      const results = await Promise.all(
-        batch.map(async (name) => {
-          const pkg = outdatedPackages[name];
-          const metadata = await fetchNpmMetadata(name);
-          const repoUrl = getRepoUrl(metadata);
-          const changelogUrl = await findChangelogUrl(repoUrl, name, cache);
-          const pinnedIn = [];
-          for (const d of pkg.dependentPackages) {
-            const spec = readDependentPkg(d.location)?.[pkg.dependencyType]?.[name] || "";
-            if (spec && !spec.startsWith("^") && !spec.startsWith("~") && !spec.startsWith(">")) {
-              pinnedIn.push(d.name);
-            }
-          }
-          return {
-            name,
-            current: pkg.current,
-            latest: pkg.latest,
-            dependents: pkg.dependentPackages.map((d) => d.name),
-            dependentLocations: pkg.dependentPackages.map((d) => d.location),
-            isDev: pkg.dependencyType === "devDependencies",
-            isMajorUpdate: isMajorVersionChange(pkg.current, pkg.latest),
-            pinnedIn,
-            repoUrl,
-            changelogUrl,
-            releasesUrl: getReleasesUrl(repoUrl),
-            vulnerabilities: vulnMap.get(name) || []
-          };
-        })
-      );
-      enhancedPackages.push(...results);
-    }
-    saveCache(cache);
+      return {
+        name,
+        current: pkg.current,
+        latest: pkg.latest,
+        dependentPackages: pkg.dependentPackages,
+        isDev: pkg.dependencyType === "devDependencies",
+        isMajorUpdate: isMajorVersionChange(pkg.current, pkg.latest),
+        pinnedIn,
+        repoUrl,
+        releasesUrl: getReleasesUrl(repoUrl),
+        severity: severityOf(name)
+      };
+    });
     enhancedPackages.sort((a, b) => {
-      const depA = formatDependents(a.dependents);
-      const depB = formatDependents(b.dependents);
-      const depCompare = depA.localeCompare(depB);
+      const depCompare = dependentsText(a).localeCompare(dependentsText(b));
       if (depCompare !== 0) return depCompare;
       return a.name.localeCompare(b.name);
     });
     spinner.stop();
-    if (enhancedPackages.length > 0) {
-      printOutdatedResults(enhancedPackages, dependentNameCache, forkPath);
-    }
-    printVulnerabilityResults(auditResult, vulnMap);
-    const hasVulns = vulnMap.size > 0;
-    if ((enhancedPackages.length > 0 || hasVulns) && !config.list) {
-      await promptForUpdates(enhancedPackages, forkPath, auditResult);
+    printOutdatedResults(enhancedPackages, forkPath);
+    console.info();
+    const outcome = config.list ? "skipped" : await promptForUpdates(enhancedPackages, forkPath);
+    if (outcome === "cancelled") return;
+    if (outcome === "failed") {
+      console.info(`${warningMark} security pass skipped: it needs a workspace that installs`);
+      return;
     }
+    await runSecurityPass(forkPath, { apply: !config.list });
   } finally {
     spinner.stop();
   }
 }
-function printOutdatedResults(enhancedPackages, dependentNameCache, forkPath) {
+var dependentsText = (pkg) => formatDependents(pkg.dependentPackages.map((d) => d.name));
+function printOutdatedResults(enhancedPackages, forkPath) {
   const DEV_TAG = " (dev)";
   const MAX_NAME_LEN = 35;
   const MAX_DEPENDENTS_LEN = 15;
@@ -3646,7 +3354,7 @@ function printOutdatedResults(enhancedPackages, dependentNameCache, forkPath) {
   const maxLatestLen = Math.max(6, ...enhancedPackages.map((p) => p.latest.length));
   const maxDependentsLen = Math.min(
     MAX_DEPENDENTS_LEN,
-    Math.max(10, ...enhancedPackages.map((p) => formatDependents(p.dependents).length))
+    Math.max(10, ...enhancedPackages.map((p) => dependentsText(p).length))
   );
   const header = [
     " ",
@@ -3658,20 +3366,15 @@ function printOutdatedResults(enhancedPackages, dependentNameCache, forkPath) {
   ].join(" ");
   console.info(header);
   for (const pkg of enhancedPackages) {
-    const highestSeverity = getHighestSeverity(pkg.vulnerabilities);
-    const vulnIndicator = highestSeverity ? getVulnIcon(highestSeverity) : " ";
+    const vulnIndicator = pkg.severity ? getVulnIcon(pkg.severity) : " ";
     const fullName = pkg.isDev ? `${pkg.name}${DEV_TAG}` : pkg.name;
     const displayName = middleTruncate(fullName, maxNameLen);
     const name = colors_default.white(displayName.padEnd(maxNameLen));
     const current = colors_default.red(pkg.current.padEnd(maxCurrentLen));
     const latestText = pkg.latest.padEnd(maxLatestLen);
     const latest = pkg.isMajorUpdate ? colors_default.bold(colors_default.green(latestText)) : colors_default.green(latestText);
-    const dependentsText = formatDependents(pkg.dependents);
-    const dependents = colors_default.dim(middleTruncate(dependentsText, maxDependentsLen).padEnd(maxDependentsLen));
+    const dependents = colors_default.dim(middleTruncate(dependentsText(pkg), maxDependentsLen).padEnd(maxDependentsLen));
     const links = [];
-    if (pkg.changelogUrl) {
-      links.push(hyperlink(colors_default.magenta("log"), pkg.changelogUrl));
-    }
     if (pkg.releasesUrl) {
       links.push(hyperlink(colors_default.blue("rel"), pkg.releasesUrl));
     }
@@ -3684,28 +3387,28 @@ function printOutdatedResults(enhancedPackages, dependentNameCache, forkPath) {
   console.info();
   const dependentMap = /* @__PURE__ */ new Map();
   for (const pkg of enhancedPackages) {
-    for (const loc of pkg.dependentLocations) {
-      const dependentName = dependentNameCache.get(loc) || basename5(loc);
+    for (const { name, location } of pkg.dependentPackages) {
+      const dependentName = name || basename2(location);
       const existing = dependentMap.get(dependentName);
       if (existing) {
         existing.count++;
       } else {
-        dependentMap.set(dependentName, { location: loc, count: 1 });
+        dependentMap.set(dependentName, { location, count: 1 });
       }
     }
   }
   const sortedDependents = [...dependentMap.entries()].sort((a, b) => a[0].localeCompare(b[0]));
   const maxDependentNameLen = Math.max(0, ...sortedDependents.map(([name]) => name.length));
-  for (const [dependentName, { location, count }] of sortedDependents) {
-    const packageJsonPath2 = join13(location, "package.json");
-    const relativePath = relative2(forkPath, packageJsonPath2);
+  for (const [dependentName, { location, count: count2 }] of sortedDependents) {
+    const packageJsonPath2 = join10(location, "package.json");
+    const relativePath = relative3(forkPath, packageJsonPath2);
     const paddedName = dependentName.padEnd(maxDependentNameLen);
     console.info(
-      `  ${colors_default.dim("\u2022")} ${paddedName}  ${hyperlink(relativePath, `file://${packageJsonPath2}`)} ${colors_default.dim(`${count}`)}`
+      `  ${colors_default.dim("\u2022")} ${paddedName}  ${hyperlink(relativePath, `file://${packageJsonPath2}`)} ${colors_default.dim(`${count2}`)}`
     );
   }
 }
-function buildUpdateChoices(packages, auditResult, hasVulnerabilities) {
+function buildUpdateChoices(packages) {
   const makeChoice = (pkg) => {
     const devTag = pkg.isDev ? colors_default.dim(" (dev)") : "";
     const version = `${colors_default.red(pkg.current)} \u2192 ${colors_default.green(pkg.latest)}`;
@@ -3719,49 +3422,26 @@ function buildUpdateChoices(packages, auditResult, hasVulnerabilities) {
   const pinned = packages.filter((p) => p.pinnedIn.length > 0);
   const regular = packages.filter((p) => p.pinnedIn.length === 0);
   const choices = [];
-  if (hasVulnerabilities) {
-    const parts = formatSeverityCounts(auditResult?.metadata?.vulnerabilities || {});
-    const vulnSummary = parts.length > 0 ? ` ${colors_default.dim("\xB7")} ${parts.join(" ")}` : "";
-    choices.push(new Separator(colors_default.red(`\u2500\u2500 vulnerabilities${vulnSummary} \u2500\u2500`)));
-    choices.push({
-      name: `${colors_default.cyan("pnpm audit --fix override")}  ${colors_default.dim("add overrides for non-vulnerable versions")}`,
-      value: AUDIT_FIX_VALUE,
-      checked: false
-    });
-  }
   if (pinned.length > 0) {
     choices.push(new Separator(colors_default.yellow(`\u2500\u2500 pinned (${pinned.length}) \u2500\u2500`)));
     choices.push(...pinned.map(makeChoice));
   }
   if (regular.length > 0) {
-    if (pinned.length > 0 || hasVulnerabilities) {
-      choices.push(new Separator(colors_default.dim(`\u2500\u2500 packages (${regular.length}) \u2500\u2500`)));
-    }
+    if (pinned.length > 0) choices.push(new Separator(colors_default.dim(`\u2500\u2500 packages (${regular.length}) \u2500\u2500`)));
     choices.push(...regular.map(makeChoice));
   }
   return choices;
 }
-async function promptForUpdates(packages, forkPath, auditResult) {
-  const hasVulnerabilities = auditResult !== null && Object.values(auditResult.metadata?.vulnerabilities || {}).some((c) => c > 0);
-  const hasPackages = packages.length > 0;
-  let confirmMessage = "update packages?";
-  if (hasVulnerabilities && hasPackages) {
-    confirmMessage = "update packages and fix vulnerabilities?";
-  } else if (hasVulnerabilities) {
-    confirmMessage = "fix vulnerabilities?";
-  }
+async function promptForUpdates(packages, forkPath) {
   let wantsUpdate;
   try {
-    wantsUpdate = await confirm({
-      message: confirmMessage,
-      default: true
-    });
+    wantsUpdate = await confirm2({ message: "update packages?", default: true });
   } catch {
-    return;
+    return "cancelled";
   }
-  if (!wantsUpdate) return;
   console.info();
-  const choices = buildUpdateChoices(packages, auditResult, hasVulnerabilities);
+  if (!wantsUpdate) return "skipped";
+  const choices = buildUpdateChoices(packages);
   let selected;
   try {
     selected = await checkbox({
@@ -3785,37 +3465,29 @@ async function promptForUpdates(packages, forkPath, auditResult) {
       }
     });
   } catch {
-    return;
+    return "cancelled";
   }
-  const runAuditFix = selected.includes(AUDIT_FIX_VALUE);
-  const selectedPackages = selected.filter((s) => s !== AUDIT_FIX_VALUE);
-  await executeUpdates(packages, forkPath, selectedPackages, runAuditFix);
+  return executeUpdates(packages, forkPath, selected);
 }
-async function executeUpdates(packages, forkPath, selectedPackages, runAuditFix) {
-  const summaryParts = [];
-  if (selectedPackages.length > 0) {
-    summaryParts.push(`updating ${selectedPackages.length} package${selectedPackages.length !== 1 ? "s" : ""}`);
-  }
-  if (runAuditFix) {
-    summaryParts.push("then updating dependencies");
-  }
+async function executeUpdates(packages, forkPath, selectedPackages) {
   console.info();
-  console.info(colors_default.green(`\u2713 ${summaryParts.join(" ")}`));
+  console.info(colors_default.green(`\u2713 updating ${selectedPackages.length} package${selectedPackages.length !== 1 ? "s" : ""}`));
   console.info();
   const selectedMajor = packages.filter((p) => selectedPackages.includes(p.name) && p.isMajorUpdate);
   if (selectedMajor.length > 0) {
     const majorNames = selectedMajor.map((p) => colors_default.bold(p.name)).join(", ");
     try {
-      const proceed = await confirm({
+      const proceed = await confirm2({
         message: `${selectedMajor.length} major update${selectedMajor.length > 1 ? "s" : ""} selected (${majorNames}). proceed?`,
         default: true
       });
       if (!proceed) {
         console.info(colors_default.dim("  update cancelled"));
-        return;
+        console.info();
+        return "skipped";
       }
     } catch {
-      return;
+      return "cancelled";
     }
   }
   const catalogPackages = readCatalogPackageNames(forkPath);
@@ -3823,194 +3495,49 @@ async function executeUpdates(packages, forkPath, selectedPackages, runAuditFix)
   for (const pkgName of selectedPackages) {
     const pkg = packages.find((p) => p.name === pkgName);
     if (!pkg) continue;
-    for (const dependent of pkg.dependents) {
+    for (const { name: dependent } of pkg.dependentPackages) {
       const group = workspacePackages.get(dependent);
       if (group) group.push(pkgName);
       else workspacePackages.set(dependent, [pkgName]);
     }
   }
-  if (runAuditFix) {
-    console.info(colors_default.dim("running pnpm audit --fix override..."));
-    const auditFixResult = spawnSync2("pnpm", ["audit", "--fix", "override"], {
-      cwd: forkPath,
-      stdio: "inherit"
-    });
-    console.info();
-    if (auditFixResult.status === 0) {
-      console.info(colors_default.green("\u2713 pnpm audit --fix override completed"));
-    } else {
-      console.error(colors_default.red(`\u2717 pnpm audit --fix override failed (exit code ${auditFixResult.status})`));
-    }
-  }
   for (const [workspace, pkgs] of workspacePackages) {
     const pkgList = pkgs.join(", ");
     console.info(`${colors_default.cyan("\u2191")} ${colors_default.bold(workspace)}: ${colors_default.dim(pkgList)}`);
   }
-  if (selectedPackages.length > 0) {
-    console.info();
-    const selectedCatalogPackages = selectedPackages.filter((pkgName) => catalogPackages.has(pkgName));
-    if (selectedCatalogPackages.length > 0) {
-      console.info(colors_default.dim(`normalizing catalog consumers: ${selectedCatalogPackages.join(", ")}`));
-      const normalizeResult = spawnSync2("pnpm", ["-r", "up", ...selectedCatalogPackages], {
-        cwd: forkPath,
-        stdio: "inherit"
-      });
-      console.info();
-      if (normalizeResult.status !== 0) {
-        console.error(colors_default.red(`\u2717 catalog normalization failed (exit code ${normalizeResult.status})`));
-        return;
-      }
-    }
-    const result = spawnSync2("pnpm", ["-r", "up", "--latest", ...selectedPackages], {
+  console.info();
+  const selectedCatalogPackages = selectedPackages.filter((pkgName) => catalogPackages.has(pkgName));
+  if (selectedCatalogPackages.length > 0) {
+    console.info(colors_default.dim(`normalizing catalog consumers: ${selectedCatalogPackages.join(", ")}`));
+    const normalizeResult = spawnSync3("pnpm", ["-r", "up", ...selectedCatalogPackages], {
       cwd: forkPath,
       stdio: "inherit"
     });
     console.info();
-    if (result.status === 0) {
-      console.info(colors_default.green(`\u2713 ${selectedPackages.length} package${selectedPackages.length > 1 ? "s" : ""} updated`));
-    } else {
-      console.error(colors_default.red(`\u2717 update failed (exit code ${result.status})`));
+    if (normalizeResult.status !== 0) {
+      console.error(colors_default.red(`\u2717 catalog normalization failed (exit code ${normalizeResult.status})`));
+      return "failed";
     }
   }
-}
-function printVulnerabilityResults(auditResult, vulnMap) {
-  if (auditResult && vulnMap.size > 0) {
-    const vulnMeta = auditResult.metadata?.vulnerabilities || {};
-    console.info();
-    console.info(
-      `${colors_default.red("\u26A0")} ${colors_default.bold("vulnerabilities")} ${colors_default.dim("\xB7")} ${formatSeverityCounts(vulnMeta, " ").join("")}`
-    );
-    console.info(DIVIDER);
-    for (const [pkgName, vulns] of vulnMap.entries()) {
-      for (const vuln of vulns) {
-        const severityIcon = getVulnIcon(vuln.severity);
-        const cveStr = vuln.cves.length > 0 ? colors_default.dim(` ${vuln.cves[0]}`) : "";
-        let sourceStr = "";
-        if (vuln.workspace) {
-          sourceStr = colors_default.dim(` in ${vuln.workspace}`);
-          if (vuln.directDependency) {
-            sourceStr += colors_default.dim(` via ${vuln.directDependency}`);
-          }
-        }
-        const title = middleTruncate(vuln.title, 60);
-        console.info(
-          `${severityIcon} ${colors_default.white(pkgName)} ${colors_default.dim(vuln.vulnerableVersions)}${sourceStr} ${colors_default.dim("\xB7")} ${title}${cveStr}`
-        );
-      }
-    }
-  } else {
-    console.info();
-    console.info(`${checkMark} no vulnerabilities found`);
+  const result = spawnSync3("pnpm", ["-r", "up", "--latest", ...selectedPackages], { cwd: forkPath, stdio: "inherit" });
+  console.info();
+  if (result.status !== 0) {
+    console.error(colors_default.red(`\u2717 update failed (exit code ${result.status})`));
+    return "failed";
   }
+  console.info(colors_default.green(`\u2713 ${selectedPackages.length} package${selectedPackages.length > 1 ? "s" : ""} updated`));
   console.info();
+  return "updated";
 }
 function readCatalogPackageNames(forkPath) {
-  const workspacePath = join13(forkPath, "pnpm-workspace.yaml");
+  const workspacePath = join10(forkPath, "pnpm-workspace.yaml");
   try {
     const content = readFileSync3(workspacePath, "utf8");
-    return new Set(Object.keys(parseYamlBlockMap(content, "catalog")));
+    return new Set(Object.keys(readTopLevel(content, "catalog") ?? {}));
   } catch {
     return /* @__PURE__ */ new Set();
   }
 }
-function readOverrides(forkPath) {
-  const overrides = /* @__PURE__ */ new Map();
-  const pkgJsonPath = join13(forkPath, "package.json");
-  try {
-    const pkgJson = JSON.parse(readFileSync3(pkgJsonPath, "utf8"));
-    const pnpmOverrides = pkgJson.pnpm?.overrides || {};
-    for (const [key, value] of Object.entries(pnpmOverrides)) {
-      overrides.set(key, { target: value, source: "package.json" });
-    }
-  } catch {
-  }
-  const workspacePath = join13(forkPath, "pnpm-workspace.yaml");
-  try {
-    const content = readFileSync3(workspacePath, "utf8");
-    const wsOverrides = parseYamlBlockMap(content, "overrides");
-    for (const [key, value] of Object.entries(wsOverrides)) {
-      overrides.set(key, { target: value, source: "pnpm-workspace.yaml" });
-    }
-  } catch {
-  }
-  return overrides;
-}
-async function checkOverrides(forkPath) {
-  const spinner = createSpinner("checking overrides against current audit...");
-  const overrides = readOverrides(forkPath);
-  if (overrides.size === 0) {
-    spinnerSuccess("no pnpm.overrides found");
-    return;
-  }
-  const auditResult = await runPnpmAudit(forkPath);
-  const activeAdvisoryPackages = /* @__PURE__ */ new Set();
-  if (auditResult?.advisories) {
-    for (const advisory of Object.values(auditResult.advisories)) {
-      activeAdvisoryPackages.add(advisory.module_name);
-    }
-  }
-  spinner.stop();
-  const securityOverrides = [];
-  const pinOverrides = [];
-  for (const [key, { target, source }] of overrides) {
-    const atIndex = key.indexOf("@", key.startsWith("@") ? 1 : 0);
-    if (atIndex > 0) {
-      const pkg = key.slice(0, atIndex);
-      const hasActiveAdvisory = activeAdvisoryPackages.has(pkg);
-      const status = hasActiveAdvisory ? "active" : "likely stale";
-      securityOverrides.push({ key, pkg, target, source, status });
-    } else {
-      pinOverrides.push({ key, target, source });
-    }
-  }
-  const allKeys = Array.from(overrides.keys());
-  const allValues = Array.from(overrides.values());
-  const maxKeyLen = Math.max(8, ...allKeys.map((k) => k.length));
-  const maxTargetLen = Math.max(6, ...allValues.map((v) => v.target.length));
-  if (securityOverrides.length > 0) {
-    console.info(colors_default.bold(`security overrides (${securityOverrides.length})`));
-    console.info(DIVIDER);
-    for (const o of securityOverrides) {
-      const icon = o.status === "active" ? colors_default.red("\u25CF") : colors_default.green("\u25CB");
-      const statusText = o.status === "active" ? colors_default.red("active") : colors_default.green("likely stale");
-      const keyText = colors_default.white(o.key.padEnd(maxKeyLen));
-      const targetText = colors_default.dim(o.target.padEnd(maxTargetLen));
-      const sourceText = colors_default.dim(o.source);
-      console.info(`  ${icon} ${keyText} \u2192 ${targetText} ${statusText}  ${sourceText}`);
-    }
-    console.info();
-  }
-  if (pinOverrides.length > 0) {
-    console.info(colors_default.bold(`version pins (${pinOverrides.length})`));
-    console.info(DIVIDER);
-    for (const o of pinOverrides) {
-      const keyText = colors_default.white(o.key.padEnd(maxKeyLen));
-      const targetText = colors_default.dim(o.target.padEnd(maxTargetLen));
-      const sourceText = colors_default.dim(o.source);
-      console.info(`  ${colors_default.blue("\u25C6")} ${keyText} \u2192 ${targetText}  ${sourceText}`);
-    }
-    console.info();
-  }
-  const staleCount = securityOverrides.filter((o) => o.status === "likely stale").length;
-  const activeCount = securityOverrides.filter((o) => o.status === "active").length;
-  if (staleCount > 0) {
-    console.info(
-      `${colors_default.green("\u25CB")} ${staleCount} override${staleCount !== 1 ? "s" : ""} likely stale: no matching advisory found in current audit`
-    );
-    console.info(colors_default.dim("  overrides mask vulnerabilities: verify by temporarily removing and running pnpm audit"));
-  }
-  if (activeCount > 0) {
-    console.info(
-      `${colors_default.red("\u25CF")} ${activeCount} override${activeCount !== 1 ? "s" : ""} still active: advisory present without override`
-    );
-  }
-  if (pinOverrides.length > 0) {
-    console.info(
-      `${colors_default.blue("\u25C6")} ${pinOverrides.length} version pin${pinOverrides.length !== 1 ? "s" : ""}: not security-related, review manually`
-    );
-  }
-  console.info();
-}
 
 // src/services/contributions.ts
 import {
@@ -4023,10 +3550,113 @@ import {
   usePagination,
   useState
 } from "@inquirer/core";
-import { select as select2 } from "@inquirer/prompts";
+import { select as select3 } from "@inquirer/prompts";
+
+// src/utils/diff.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename3, join as join11 } from "path";
+import process6 from "process";
+function gitDiffFile(cwd, range, filePath, options = {}) {
+  const args = ["diff", "--no-color"];
+  if (options.dstPrefix) args.push("--src-prefix=cella/", `--dst-prefix=${options.dstPrefix}/`);
+  args.push(range, "--", filePath);
+  try {
+    return execFileSync2("git", args, { cwd, maxBuffer: MAX_BUFFER });
+  } catch (error) {
+    const stderr = error.stderr?.toString().trim();
+    throw new Error(stderr || `failed to diff ${filePath}`);
+  }
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+async function renderDiffPage(patch, meta) {
+  const { preloadPatchDiff } = await import("@pierre/diffs/ssr");
+  const { prerenderedHTML } = await preloadPatchDiff({
+    patch,
+    options: {
+      diffStyle: "split",
+      themeType: "system",
+      lineDiffType: "word-alt",
+      hunkSeparators: "line-info",
+      overflow: "wrap",
+      disableFileHeader: true
+    }
+  });
+  const title = `${escapeHtml(meta.filePath)} \xB7 ${escapeHtml(meta.srcLabel)} vs ${escapeHtml(meta.dstLabel)}`;
+  const note = meta.note ? `<span class="note">\xB7 ${escapeHtml(meta.note)}</span>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
+    background: light-dark(#fafafa, #111);
+    color: light-dark(#111, #eee);
+  }
+  header {
+    display: flex; align-items: baseline; gap: 0.75rem; flex-wrap: wrap;
+    padding: 0.9rem 1.25rem;
+    border-bottom: 1px solid light-dark(#e2e2e2, #2a2a2a);
+    position: sticky; top: 0;
+    background: inherit;
+  }
+  header .brand { font-weight: 600; color: light-dark(#0891b2, #22d3ee); }
+  header code { font-family: ui-monospace, monospace; font-size: 0.9rem; }
+  header .sides { margin-left: auto; font-size: 0.8rem; opacity: 0.7; }
+  main { max-width: 1400px; margin: 1rem auto; padding: 0 1rem 2rem; }
+  .diff-shell {
+    border: 1px solid light-dark(#e2e2e2, #2a2a2a);
+    border-radius: 8px; overflow: hidden;
+    background: light-dark(#fff, #161616);
+  }
+</style>
+</head>
+<body>
+<header>
+  <span class="brand">\u29C8 cella diff</span>
+  <code>${escapeHtml(meta.filePath)}</code>
+  <span class="sides">${escapeHtml(meta.srcLabel)} \u2190 \u2192 ${escapeHtml(meta.dstLabel)} ${note}</span>
+</header>
+<main>
+  <!-- Declarative shadow DOM: the library's CSS targets :host, which only
+       matches inside a shadow root (its browser component renders into one). -->
+  <div class="diff-shell">
+    <template shadowrootmode="open">
+${prerenderedHTML}
+    </template>
+  </div>
+</main>
+</body>
+</html>`;
+}
+function openWithDefaultApp(target) {
+  try {
+    execFileSync2(process6.platform === "darwin" ? "open" : "xdg-open", [target], { stdio: "ignore" });
+  } catch {
+  }
+}
+async function openDiffInBrowser(patch, meta, repoPath) {
+  const html = await renderDiffPage(patch, meta);
+  const dir = join11(tmpdir2(), `cella-diff-${basename3(repoPath)}`);
+  mkdirSync2(dir, { recursive: true });
+  const outPath = join11(dir, `${meta.filePath.replace(/[^\w.-]+/g, "-")}.html`);
+  writeFileSync2(outPath, html);
+  openWithDefaultApp(outPath);
+  return outPath;
+}
 
 // src/services/contrib-core.ts
-import { dirname as dirname5, join as join14, resolve as resolve5 } from "path";
+import { rmSync as rmSync2 } from "fs";
+import { dirname as dirname6, join as join12, resolve as resolve4 } from "path";
 async function listFilesAtRef(repoPath, ref) {
   const raw = await git(["ls-tree", "-r", "--name-only", ref], repoPath);
   return new Set(raw.split("\n").filter(Boolean));
@@ -4042,10 +3672,10 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
   const baseFiles = await listFilesAtRef(repoPath, baseRef);
   const baseDirs = /* @__PURE__ */ new Set(["."]);
   for (const f of baseFiles) {
-    let dir = dirname5(f);
+    let dir = dirname6(f);
     while (dir !== ".") {
       baseDirs.add(dir);
-      dir = dirname5(dir);
+      dir = dirname6(dir);
     }
   }
   const files = [];
@@ -4058,7 +3688,7 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
     if (inCella && !inFork) {
       kind = "deleted";
     } else if (!inCella && inFork) {
-      if (!baseDirs.has(dirname5(file.path))) continue;
+      if (!baseDirs.has(dirname6(file.path))) continue;
       kind = "created";
     } else {
       kind = "modified";
@@ -4067,15 +3697,7 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
     const changedTs = file.status === "diverged" ? file.upstreamChangedTs : file.changedTs;
     files.push({ path: file.path, kind, status: file.status, changedAt, changedTs });
   }
-  return {
-    modified: files.filter((f) => f.kind === "modified").map((f) => f.path),
-    created: files.filter((f) => f.kind === "created").map((f) => f.path),
-    deleted: files.filter((f) => f.kind === "deleted").map((f) => f.path),
-    files
-  };
-}
-function countDetection(detection) {
-  return detection.modified.length + detection.created.length + detection.deleted.length;
+  return files;
 }
 async function readBlobInfo(repoPath, ref, filePath) {
   const line = await git(["ls-tree", ref, "--", filePath], repoPath, { ignoreErrors: true });
@@ -4087,29 +3709,25 @@ async function readBlobInfo(repoPath, ref, filePath) {
   if (mode !== "100644" && mode !== "100755") return null;
   return { mode, hash };
 }
-async function buildContribBranch(repoPath, baseRef, forkRef, detection, forkName) {
+async function buildContribBranch(repoPath, baseRef, forkRef, files, forkName) {
   const branch = `contrib/${forkName}`;
-  const gitDir = resolve5(repoPath, await git(["rev-parse", "--git-dir"], repoPath));
-  const tmpIndex = join14(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
+  const gitDir = resolve4(repoPath, await git(["rev-parse", "--git-dir"], repoPath));
+  const tmpIndex = join12(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
   const indexEnv = { GIT_INDEX_FILE: tmpIndex };
   try {
     await git(["read-tree", baseRef], repoPath, { env: indexEnv });
     const appliedFiles = [];
-    for (const filePath of [...detection.modified, ...detection.created]) {
-      const blob = await readBlobInfo(repoPath, forkRef, filePath);
+    for (const { path, kind } of files) {
+      if (kind === "deleted") {
+        await git(["update-index", "--remove", path], repoPath, { env: indexEnv, ignoreErrors: true });
+        appliedFiles.push(`(deleted) ${path}`);
+        continue;
+      }
+      const blob = await readBlobInfo(repoPath, forkRef, path);
       if (!blob) continue;
-      await git(
-        ["update-index", "--add", "--replace", "--cacheinfo", `${blob.mode},${blob.hash},${filePath}`],
-        repoPath,
-        {
-          env: indexEnv
-        }
-      );
-      appliedFiles.push(filePath);
-    }
-    for (const filePath of detection.deleted) {
-      await git(["update-index", "--remove", filePath], repoPath, { env: indexEnv, ignoreErrors: true });
-      appliedFiles.push(`(deleted) ${filePath}`);
+      const cacheinfo = `${blob.mode},${blob.hash},${path}`;
+      await git(["update-index", "--add", "--replace", "--cacheinfo", cacheinfo], repoPath, { env: indexEnv });
+      appliedFiles.push(path);
     }
     if (appliedFiles.length === 0) {
       return { branch, appliedFiles };
@@ -4124,29 +3742,25 @@ ${commitBody}`;
     await git(["update-ref", `refs/heads/${branch}`, commitHash], repoPath);
     return { branch, appliedFiles };
   } finally {
-    try {
-      const { unlinkSync: unlinkSync2 } = await import("fs");
-      unlinkSync2(tmpIndex);
-    } catch {
-    }
+    rmSync2(tmpIndex, { force: true });
   }
 }
 
 // src/services/fork-utils.ts
-import { existsSync as existsSync9 } from "fs";
-import { dirname as dirname6, resolve as resolve6 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { dirname as dirname7, resolve as resolve5 } from "path";
 async function resolveForkBasePath(repoPath) {
   const commonDir = await git(["rev-parse", "--git-common-dir"], repoPath, { ignoreErrors: true });
-  return commonDir ? dirname6(resolve6(repoPath, commonDir)) : repoPath;
+  return commonDir ? dirname7(resolve5(repoPath, commonDir)) : repoPath;
 }
 function validateForkPath(fork, basePath, requireConfig = false) {
-  const resolvedPath = resolve6(basePath, fork.localPath);
-  if (!resolvedPath.startsWith(resolve6(basePath, ".."))) {
+  const resolvedPath = resolve5(basePath, fork.localPath);
+  if (!resolvedPath.startsWith(resolve5(basePath, ".."))) {
     return { fork, resolvedPath, valid: false, error: "path resolves outside parent directory" };
   }
-  if (!existsSync9(resolvedPath)) return { fork, resolvedPath, valid: false, error: "path does not exist" };
-  if (!existsSync9(`${resolvedPath}/.git`)) return { fork, resolvedPath, valid: false, error: "not a git repository" };
-  if (requireConfig && !existsSync9(`${resolvedPath}/${CONFIG_FILE}`)) {
+  if (!existsSync8(resolvedPath)) return { fork, resolvedPath, valid: false, error: "path does not exist" };
+  if (!existsSync8(`${resolvedPath}/.git`)) return { fork, resolvedPath, valid: false, error: "not a git repository" };
+  if (requireConfig && !existsSync8(`${resolvedPath}/${CONFIG_FILE}`)) {
     return { fork, resolvedPath, valid: false, error: `missing ${CONFIG_FILE}` };
   }
   return { fork, resolvedPath, valid: true };
@@ -4158,13 +3772,8 @@ function printNoForksHint(action) {
 }
 
 // src/services/contributions.ts
-async function showContribDiff(item, baseRef, cwd, forkName) {
-  const patch = gitDiffFile(cwd, `${baseRef}..${item.ref}`, item.path);
-  if (patch.length === 0) return null;
-  return openDiffInBrowser(patch.toString(), { filePath: item.path, srcLabel: "cella", dstLabel: forkName }, cwd);
-}
 var contribPrompt = createPrompt((config, done) => {
-  const { pageSize = 20, baseRef, cwd, forkName } = config;
+  const { pageSize = 20, baseRef, branch, cwd, forkName } = config;
   const [items, setItems] = useState(config.items);
   const [active, setActive] = useState(0);
   const [statusMsg, setStatusMsg] = useState("");
@@ -4218,9 +3827,12 @@ var contribPrompt = createPrompt((config, done) => {
       return;
     }
     if (key.name === "d") {
+      const { path } = items[active];
       try {
-        const pagePath = await showContribDiff(items[active], baseRef, cwd, forkName);
-        setStatusMsg(pagePath ? `opened ${items[active].path} in browser` : `no changes for ${items[active].path}`);
+        const patch = gitDiffFile(cwd, `${baseRef}..${branch}`, path);
+        if (patch.length === 0) return setStatusMsg(`no changes for ${path}`);
+        await openDiffInBrowser(patch.toString(), { filePath: path, srcLabel: "cella", dstLabel: forkName }, cwd);
+        setStatusMsg(`opened ${path} in browser`);
       } catch (error) {
         setStatusMsg(`diff failed: ${errorMessage(error)}`);
       }
@@ -4250,8 +3862,8 @@ var contribPrompt = createPrompt((config, done) => {
     renderItem({ item, isActive }) {
       const checkbox2 = item.checked ? colors_default.green("\u25CF") : colors_default.dim("\u25CB");
       const cursor = isActive ? colors_default.cyan("\u276F") : " ";
-      const newLabel = item.created ? colors_default.yellow(" \xB7 not in cella") : "";
-      const delLabel = item.deleted ? colors_default.yellow(" [del]") : "";
+      const newLabel = item.kind === "created" ? colors_default.yellow(" \xB7 not in cella") : "";
+      const delLabel = item.kind === "deleted" ? colors_default.yellow(" [del]") : "";
       const statusTag = item.status === "diverged" ? colors_default.yellow(" \u26A0 diverged") : "";
       const dateLabel = item.changedAt ? colors_default.dim(` \xB7 ${item.changedAt}`) : "";
       const line = `${cursor} ${checkbox2} ${item.path}${delLabel}${statusTag}${newLabel}${dateLabel}`;
@@ -4283,14 +3895,10 @@ async function selectFork(config, validated) {
     }
     return match;
   }
-  const validForks = validated.filter((v) => v.valid);
-  if (config.list || config.json || config.diff) {
-    if (validForks.length === 0) {
-      throw new Error("no valid forks configured");
-    }
-    if (validForks.length > 1) {
-      throw new Error("multiple forks configured; pass --fork <name> to choose one");
-    }
+  if (config.json) {
+    const validForks = validated.filter((v) => v.valid);
+    if (validForks.length === 0) throw new Error("no valid forks configured");
+    if (validForks.length > 1) throw new Error("multiple forks configured; pass --fork <name> to choose one");
     return validForks[0];
   }
   const choices = validated.map((v) => ({
@@ -4298,7 +3906,7 @@ async function selectFork(config, validated) {
     name: v.valid ? `${v.fork.name}  ${colors_default.dim(`[${v.fork.pullBranch}] ${v.fork.localPath}`)}` : `${v.fork.name}  ${colors_default.dim(v.fork.localPath)}`,
     disabled: v.valid ? false : v.error ?? "invalid"
   }));
-  const picked = await select2({
+  const picked = await select3({
     message: "select fork to pull contributions from:",
     choices,
     loop: false
@@ -4307,10 +3915,6 @@ async function selectFork(config, validated) {
   if (!selected) console.info(colors_default.dim("no fork selected."));
   return selected;
 }
-async function fetchForkBranch(cellaPath, fetchSource, pullBranch) {
-  await git(["fetch", fetchSource, pullBranch], cellaPath);
-  return git(["rev-parse", "FETCH_HEAD"], cellaPath);
-}
 async function forkRefMeta(cellaPath, forkRef) {
   const out = await git(["log", "-1", "--format=%h%x09%cr", forkRef], cellaPath, { ignoreErrors: true });
   const [sha = forkRef.slice(0, 7), date = "unknown"] = out.split("	");
@@ -4341,9 +3945,10 @@ async function runContributions(config) {
   createSpinner("pulling fork contributions...");
   const allItems = [];
   let forkBanner = null;
+  let branch = "";
   try {
-    const fetchSource = fork.remoteUrl ?? resolvedPath;
-    const forkRef = await fetchForkBranch(config.forkPath, fetchSource, fork.pullBranch);
+    await git(["fetch", fork.remoteUrl ?? resolvedPath, fork.pullBranch], config.forkPath);
+    const forkRef = await git(["rev-parse", "FETCH_HEAD"], config.forkPath);
     const meta = await forkRefMeta(config.forkPath, forkRef);
     forkBanner = { pullBranch: fork.pullBranch, sha: meta.sha, date: meta.date };
     let forkTerritory = [];
@@ -4352,29 +3957,16 @@ async function runContributions(config) {
       forkTerritory = forkConfig.overrides?.ignored ?? [];
     } catch {
     }
-    const detection = await detectContributableFiles(config.forkPath, baseRef, forkRef, config, forkTerritory);
-    if (countDetection(detection) > 0) {
-      const { branch, appliedFiles } = await buildContribBranch(config.forkPath, baseRef, forkRef, detection, forkName);
-      if (appliedFiles.length > 0) {
+    const files = await detectContributableFiles(config.forkPath, baseRef, forkRef, config, forkTerritory);
+    if (files.length > 0) {
+      const built = await buildContribBranch(config.forkPath, baseRef, forkRef, files, forkName);
+      if (built.appliedFiles.length > 0) {
+        branch = built.branch;
         const stat = await getDiffStat(config.forkPath, baseRef, branch);
-        const metaByPath = new Map(detection.files.map((f) => [f.path, f]));
-        const toItem = (path, deleted) => {
-          const fileMeta = metaByPath.get(path);
-          return {
-            path,
-            ref: branch,
-            deleted,
-            ...deleted ? {} : { created: fileMeta?.kind === "created" },
-            status: fileMeta?.status,
-            changedAt: fileMeta?.changedAt,
-            changedTs: fileMeta?.changedTs,
-            additions: stat.get(path)?.additions ?? null,
-            deletions: stat.get(path)?.deletions ?? null,
-            checked: false
-          };
-        };
-        for (const path of [...detection.modified, ...detection.created]) allItems.push(toItem(path, false));
-        for (const path of detection.deleted) allItems.push(toItem(path, true));
+        for (const file of files) {
+          const { additions = null, deletions = null } = stat.get(file.path) ?? {};
+          allItems.push({ ...file, additions, deletions, checked: false });
+        }
       }
     }
   } catch (error) {
@@ -4388,45 +3980,25 @@ async function runContributions(config) {
   }
   allItems.sort((a, b) => (b.changedTs ?? 0) - (a.changedTs ?? 0) || a.path.localeCompare(b.path));
   spinnerSuccess(`${allItems.length} files from ${forkName}`);
-  if (!config.list && !config.diff && forkBanner) {
+  if (forkBanner) {
     console.info(
       `  ${colors_default.dim(`${forkName}: comparing committed '${forkBanner.pullBranch}' @ ${forkBanner.sha} (${forkBanner.date}); uncommitted fork changes are not included`)}`
     );
   }
-  if (config.diff) {
-    const matches = allItems.filter((i) => i.path === config.diff);
-    if (matches.length === 0) {
-      throw new Error(`no contribution found for path: ${config.diff}`);
-    }
-    for (const item of matches) {
-      const diff = gitDiffFile(config.forkPath, `${baseRef}..${item.ref}`, item.path, { dstPrefix: forkName });
-      writeStdout(diff.toString());
-    }
-    return;
-  }
   if (config.json) {
     const out = allItems.map((item) => ({
       fork: forkName,
       path: item.path,
-      status: item.status ?? null,
-      kind: item.deleted ? "deleted" : "modified",
+      status: item.status,
+      kind: item.kind === "deleted" ? "deleted" : "modified",
       changedAt: item.changedAt ?? null,
       changedTs: item.changedTs ?? null,
-      additions: item.additions ?? null,
-      deletions: item.deletions ?? null
+      additions: item.additions,
+      deletions: item.deletions
     }));
     writeStdout(JSON.stringify(out, null, 2));
     return;
   }
-  if (config.list) {
-    for (const item of allItems) {
-      const status = item.status ?? "behind";
-      const kind = item.deleted ? "deleted" : "modified";
-      const changedAt = item.changedAt ?? "-";
-      writeStdout(`${forkName}	${status}	${kind}	${changedAt}	${item.path}`);
-    }
-    return;
-  }
   console.info();
   console.info(DIVIDER);
   const selected = await contribPrompt({
@@ -4434,6 +4006,7 @@ async function runContributions(config) {
     items: allItems,
     forkName,
     baseRef,
+    branch,
     cwd: config.forkPath,
     pageSize: 20
   });
@@ -4451,17 +4024,17 @@ async function runContributions(config) {
         errors.push(`${item.path}: rejected (path traversal)`);
         continue;
       }
-      if (item.deleted) {
+      if (item.kind === "deleted") {
         if (applyUnstaged) {
           await removeFileFromWorktree(config.forkPath, item.path);
         } else {
-          await git(["rm", "-f", "--", item.path], config.forkPath, { ignoreErrors: true });
+          await gitRm(config.forkPath, [item.path]);
         }
       } else {
         if (applyUnstaged) {
-          await restoreWorktreeFromRef(config.forkPath, item.ref, item.path);
+          await restoreWorktreeFromRef(config.forkPath, branch, item.path);
         } else {
-          await git(["checkout", item.ref, "--", item.path], config.forkPath);
+          await checkoutFromRef(config.forkPath, branch, [item.path]);
         }
       }
       applied++;
@@ -4487,27 +4060,24 @@ async function runContributions(config) {
 }
 
 // src/services/forks.ts
-import { resolve as resolve7 } from "path";
-import process8 from "process";
-import { Separator as Separator2, select as select4 } from "@inquirer/prompts";
+import { resolve as resolve6 } from "path";
+import process7 from "process";
+import { Separator as Separator2, select as select5 } from "@inquirer/prompts";
 
 // src/services/sync.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { select as select3 } from "@inquirer/prompts";
+import { spawnSync as spawnSync5 } from "child_process";
+import { select as select4 } from "@inquirer/prompts";
 
 // src/utils/gh.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 function ghAvailable() {
-  return spawnSync3("gh", ["--version"], { stdio: "ignore" }).status === 0;
+  return spawnSync4("gh", ["--version"], { stdio: "ignore" }).status === 0;
 }
 function runGh(cwd, args) {
-  const result = spawnSync3("gh", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const result = spawnSync4("gh", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
   return { ok: result.status === 0, output };
 }
-function filterSyncPrs(prs, prefix) {
-  return prs.filter((pr) => pr.headRefName.startsWith(`${prefix}/`));
-}
 function listOpenSyncPrs(cwd, prefix) {
   const { ok, output } = runGh(cwd, [
     "pr",
@@ -4526,27 +4096,22 @@ function listOpenSyncPrs(cwd, prefix) {
   } catch {
     return [];
   }
-  return filterSyncPrs(parsed, prefix).sort((a, b) => b.number - a.number);
-}
-function buildMergeArgs(ref, options = {}) {
-  const args = ["pr", "merge", ref, "--squash"];
-  if (options.deleteBranch) args.push("--delete-branch");
-  return args;
+  return parsed.filter((pr) => pr.headRefName.startsWith(`${prefix}/`)).sort((a, b) => b.number - a.number);
 }
 function mergePrSquash(cwd, ref, options = {}) {
-  return runGh(cwd, buildMergeArgs(String(ref), options));
+  return runGh(cwd, ["pr", "merge", String(ref), "--squash", ...options.deleteBranch ? ["--delete-branch"] : []]);
 }
 function closePr(cwd, ref) {
   return runGh(cwd, ["pr", "close", String(ref)]);
 }
 
 // src/services/packages.ts
-import { existsSync as existsSync11, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join14 } from "path";
 
 // src/services/package-usage.ts
-import { existsSync as existsSync10, readFileSync as readFileSync4, statSync } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync4, statSync } from "fs";
+import { join as join13 } from "path";
 var MAX_FILE_BYTES = 1024 * 1024;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4562,7 +4127,7 @@ function readSearchable(filePath) {
 }
 function fileSource(forkPath, path) {
   let text;
-  return { path, label: path, text: () => text ??= readSearchable(join15(forkPath, path)) };
+  return { path, label: path, text: () => text ??= readSearchable(join13(forkPath, path)) };
 }
 async function readScriptsAtRef(forkPath, ref, path) {
   try {
@@ -4574,7 +4139,7 @@ async function readScriptsAtRef(forkPath, ref, path) {
 async function scriptSources(forkPath, upstreamRef, baseRef, path) {
   let forkScripts;
   try {
-    forkScripts = JSON.parse(readFileSync4(join15(forkPath, path), "utf8")).scripts ?? {};
+    forkScripts = JSON.parse(readFileSync4(join13(forkPath, path), "utf8")).scripts ?? {};
   } catch {
     return [];
   }
@@ -4584,9 +4149,9 @@ async function scriptSources(forkPath, upstreamRef, baseRef, path) {
 }
 function binNames(forkPath, location, name) {
   const bareName = name.split("/").pop();
-  for (const dir of [join15(forkPath, location), forkPath]) {
-    const manifest = join15(dir, "node_modules", name, "package.json");
-    if (!existsSync10(manifest)) continue;
+  for (const dir of [join13(forkPath, location), forkPath]) {
+    const manifest = join13(dir, "node_modules", name, "package.json");
+    if (!existsSync9(manifest)) continue;
     try {
       const { bin } = JSON.parse(readFileSync4(manifest, "utf8"));
       if (typeof bin === "string") return [bareName];
@@ -4641,7 +4206,7 @@ var DEPENDENCY_KEYS = [
   "peerDependencies",
   "optionalDependencies"
 ];
-function mergeRecord(forkRecord, upstreamRecord, baseRecord, { bumpHigher = true, findUse } = {}) {
+function mergeRecord(forkRecord, upstreamRecord, baseRecord, { bumpHigher = true, findUse, upstreamOrder = false } = {}) {
   if (!upstreamRecord) return void 0;
   const merged = { ...forkRecord || {} };
   const base = baseRecord || {};
@@ -4675,9 +4240,26 @@ function mergeRecord(forkRecord, upstreamRecord, baseRecord, { bumpHigher = true
     delete merged[name];
     removed.push(name);
   }
-  const sorted = Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+  const keys = upstreamOrder ? orderLikeUpstream(Object.keys(merged), Object.keys(upstreamRecord)) : Object.keys(merged).sort((a, b) => a.localeCompare(b));
+  const ordered = Object.fromEntries(keys.map((name) => [name, merged[name]]));
   const changed = added.length + updated.length + removed.length > 0;
-  return { merged: sorted, changed, added, updated, removed, kept };
+  return { merged: ordered, changed, added, updated, removed, kept };
+}
+function orderLikeUpstream(forkKeys, upstreamKeys) {
+  const upstream = new Set(upstreamKeys);
+  const forkOnlyAfter = /* @__PURE__ */ new Map();
+  let anchor;
+  for (const key of forkKeys) {
+    if (upstream.has(key)) anchor = key;
+    else forkOnlyAfter.set(anchor, [...forkOnlyAfter.get(anchor) ?? [], key]);
+  }
+  const present = new Set(forkKeys);
+  const ordered = [...forkOnlyAfter.get(void 0) ?? []];
+  for (const key of upstreamKeys) {
+    if (present.has(key)) ordered.push(key);
+    ordered.push(...forkOnlyAfter.get(key) ?? []);
+  }
+  return ordered;
 }
 function isSubpathMap(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -4695,26 +4277,10 @@ function safeMergePnpm(forkPnpm, upstreamPnpm, basePnpm) {
   if (!upstreamPnpm) return void 0;
   const merged = { ...forkPnpm || {} };
   let changed = false;
-  if (upstreamPnpm.overrides) {
-    const result = mergeRecord(
-      merged.overrides,
-      upstreamPnpm.overrides,
-      basePnpm?.overrides
-    );
-    if (result?.changed) {
-      merged.overrides = result.merged;
-      changed = true;
-    }
-  }
-  if (upstreamPnpm.patchedDependencies) {
-    const result = mergeRecord(
-      merged.patchedDependencies,
-      upstreamPnpm.patchedDependencies,
-      basePnpm?.patchedDependencies,
-      { bumpHigher: false }
-    );
+  for (const sub of ["overrides", "patchedDependencies"]) {
+    const result = mergeRecord(merged[sub], upstreamPnpm[sub], basePnpm?.[sub], { bumpHigher: sub === "overrides" });
     if (result?.changed) {
-      merged.patchedDependencies = result.merged;
+      merged[sub] = result.merged;
       changed = true;
     }
   }
@@ -4766,17 +4332,13 @@ function setTopLevelKey(pkg, key, value) {
   Object.assign(pkg, Object.fromEntries(entries));
 }
 function readPackageJson(filePath) {
-  if (!existsSync11(filePath)) return null;
+  if (!existsSync10(filePath)) return null;
   try {
     return JSON.parse(readFileSync5(filePath, "utf8"));
-  } catch {
-    return null;
+  } catch (error) {
+    throw new Error(`cannot parse ${filePath}: ${errorMessage(error)}`);
   }
 }
-function writePackageJson(filePath, data) {
-  writeFileSync4(filePath, `${JSON.stringify(data, null, 2)}
-`, "utf8");
-}
 function packageJsonPath(relativePath) {
   return relativePath ? `${relativePath}/package.json` : "package.json";
 }
@@ -4804,15 +4366,15 @@ async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync)
   const changes = [];
   const kept = [];
   const pkgRelPath = packageJsonPath(relativePath);
-  const pkgPath = join16(forkPath, pkgRelPath);
+  const pkgPath = join14(forkPath, pkgRelPath);
   const forkPkg = readPackageJson(pkgPath);
   const upstream = await readPackageJsonAtRef(forkPath, upstreamRef, relativePath);
   const basePkg = baseRef ? (await readPackageJsonAtRef(forkPath, baseRef, relativePath))?.data : void 0;
   if (!upstream) return { updated: false, changes, kept };
   if (!forkPkg) {
-    const workspaceArrived = relativePath !== "" && existsSync11(join16(forkPath, relativePath));
+    const workspaceArrived = relativePath !== "" && existsSync10(join14(forkPath, relativePath));
     if (basePkg || !workspaceArrived || isIgnored(pkgRelPath, config)) return { updated: false, changes, kept };
-    writeFileSync4(pkgPath, upstream.raw.endsWith("\n") ? upstream.raw : `${upstream.raw}
+    writeFileSync3(pkgPath, upstream.raw.endsWith("\n") ? upstream.raw : `${upstream.raw}
 `, "utf8");
     return { updated: true, changes: ["copied from upstream (new workspace)"], kept };
   }
@@ -4836,18 +4398,12 @@ async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync)
       continue;
     }
     if (key === "packageManager") {
-      const upstreamValue2 = upstreamPkg[key];
-      const forkValue2 = forkPkg[key];
-      const baseValue2 = basePkg?.[key];
-      if (upstreamValue2 && !forkValue2) {
-        if (baseValue2) continue;
-        forkPkg[key] = upstreamValue2;
-        updated = true;
-        changes.push(`${key}: added`);
-      } else if (upstreamValue2 && forkValue2 && upstreamValue2 !== forkValue2 && (forkValue2 === baseValue2 || isHigherVersion(upstreamValue2, forkValue2))) {
-        forkPkg[key] = upstreamValue2;
+      const asRecord = (pkg) => pkg?.[key] ? { [key]: String(pkg[key]) } : void 0;
+      const result2 = mergeRecord(asRecord(forkPkg), asRecord(upstreamPkg), asRecord(basePkg));
+      if (result2?.changed) {
+        forkPkg[key] = result2.merged[key];
         updated = true;
-        changes.push(`${key}: updated`);
+        changes.push(`${key}: ${result2.added.length > 0 ? "added" : "updated"}`);
       }
       continue;
     }
@@ -4866,7 +4422,12 @@ async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync)
     let findUse;
     if (usage && key === "scripts") findUse = (name) => usage.findScript(name);
     else if (usage && DEPENDENCY_KEYS.includes(key)) findUse = (name) => usage.findPackage(relativePath, name);
-    const result = mergeRecord(forkValue, upstreamValue, baseValue, { bumpHigher: key !== "scripts", findUse });
+    const isScripts = key === "scripts";
+    const result = mergeRecord(forkValue, upstreamValue, baseValue, {
+      bumpHigher: !isScripts,
+      findUse,
+      upstreamOrder: isScripts
+    });
     kept.push(...(result?.kept ?? []).map(({ name, usedAt }) => `${key}.${name}: used in ${usedAt}`));
     if (result?.changed) {
       forkPkg[key] = result.merged;
@@ -4878,9 +4439,8 @@ async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync)
       );
     }
   }
-  if (updated) {
-    writePackageJson(pkgPath, forkPkg);
-  }
+  if (updated) writeFileSync3(pkgPath, `${JSON.stringify(forkPkg, null, 2)}
+`, "utf8");
   return { updated, changes, kept };
 }
 async function runPackages(config, options = {}) {
@@ -4903,32 +4463,25 @@ async function runPackages(config, options = {}) {
     if (updated || kept2.length > 0) reports.push({ path: pkgRelPath, changes, kept: kept2 });
   }
   const changedCount = reports.filter(({ changes }) => changes.length > 0).length;
-  spinnerSuccess(
-    "package sync complete",
-    `${changedCount} package.json${changedCount === 1 ? " was" : "s were"} changed`
-  );
+  spinnerSuccess("package sync complete", `${plural(changedCount, "package.json was", "package.jsons were")} changed`);
   for (const { path, changes } of reports) {
     if (changes.length === 0) continue;
     console.info(`  ${path}`);
     for (const change of changes) console.info(`    ${colors_default.dim(change)}`);
   }
   const kept = reports.flatMap(({ path, kept: kept2 }) => kept2.map((entry) => `${path} ${entry}`));
-  if (kept.length > 0) {
-    console.info();
-    console.info(
-      `${warningMark} ${colors_default.yellow(`kept ${kept.length} ${kept.length === 1 ? "entry" : "entries"} upstream dropped, the fork still uses ${kept.length === 1 ? "it" : "them"}:`)}`
-    );
-    for (const entry of kept) console.info(`    ${colors_default.dim("\u2192")} ${entry}`);
-  }
-  if (skipped.length > 0) {
-    console.info();
-    console.info(
-      `${warningMark} ${colors_default.yellow(`skipped ${skipped.length} conflicted package.json file(s): resolve the conflicts, commit the merge, then rerun \`pnpm cella sync\`:`)}`
-    );
-    for (const path of skipped) {
-      console.info(`    ${colors_default.dim("\u2192")} ${path}`);
-    }
-  }
+  const them = kept.length === 1 ? "it" : "them";
+  printWarnList(`kept ${plural(kept.length, "entry", "entries")} upstream dropped, the fork still uses ${them}:`, kept);
+  printWarnList(
+    `skipped ${skipped.length} conflicted package.json file(s): resolve the conflicts, commit the merge, then rerun \`pnpm cella sync\`:`,
+    skipped
+  );
+}
+function printWarnList(header, entries) {
+  if (entries.length === 0) return;
+  console.info();
+  console.info(`${warningMark} ${colors_default.yellow(header)}`);
+  for (const entry of entries) console.info(`    ${colors_default.dim("\u2192")} ${entry}`);
 }
 
 // src/services/sync.ts
@@ -5018,10 +4571,13 @@ async function runSync(config, options) {
     spinnerFail("sync completed with conflicts");
   }
   printEngineReports(result, "merge summary");
-  printLogFileReport(config, result.files);
-  const stagedBranch = options?.stagedBranch && result.conflicts.length === 0 && hasStagedSyncChanges(result) ? options.stagedBranch : void 0;
+  if (config.unpinned) {
+    console.info(colors_default.yellow("\u26A0 --unpinned: every pinned entry was merged from upstream; keep only what you want."));
+    console.info();
+  }
+  const staged = result.files.some((file) => SYNC_APPLIED_STATUSES.includes(file.status));
+  const stagedBranch = options?.stagedBranch && result.conflicts.length === 0 && staged ? options.stagedBranch : void 0;
   printSyncComplete(result, { stagedBranch });
-  printFlagWarnings({ hard: config.hard, unpinned: config.unpinned });
   await printMigrationNotesLine(config, result);
   return result;
 }
@@ -5076,16 +4632,13 @@ async function buildSyncPrBodyForBranch(forkPath, base) {
   const fromSha = await readManifestBaseAtRef(forkPath, base) ?? await getMergeBase(forkPath, base, toSha).catch(() => null);
   const version = manifest.upstream.release ?? await readPackageVersionAtRef(forkPath, toSha).catch(() => null);
   const totalCount = fromSha ? await countCommitsBetween(forkPath, fromSha, toSha).catch(() => 0) : 0;
-  const commits = fromSha && totalCount > 0 ? await listCommitsBetween(forkPath, fromSha, toSha, {
-    skip: totalCount > COMMIT_LIST_MAX ? totalCount - COMMIT_LIST_MAX : 0,
-    limit: COMMIT_LIST_MAX
-  }) : [];
+  const commits = fromSha && totalCount > 0 ? await listCommitsBetween(forkPath, fromSha, toSha, COMMIT_LIST_MAX) : [];
   const notes = await readPrBodyNotes(forkPath, toSha, manifest.upstream.repo).catch(() => void 0);
   return buildSyncPrBody({ repoSlug: manifest.upstream.repo, version, fromSha, toSha, commits, totalCount, notes });
 }
 async function readPrBodyNotes(forkPath, toSha, repoSlug) {
   const githubUrl = repoSlug ? `https://github.com/${repoSlug}` : void 0;
-  const [ids, pending] = await Promise.all([listNoteIds(forkPath, toSha), readPending(forkPath, toSha)]);
+  const [ids, pending] = await Promise.all([listNoteIds(forkPath, toSha), readPending(forkPath)]);
   const open = await Promise.all(
     pending.map(async (id) => ({
       id,
@@ -5098,16 +4651,6 @@ async function readPrBodyNotes(forkPath, toSha, repoSlug) {
 function printPrCreateStep(branch, base, title = SYNC_PR_TITLE) {
   console.info(colors_default.dim(`  gh pr create --base ${base} --head ${branch} --title "${title}" --fill`));
 }
-function printShipSteps(temporaryBranch, base, title) {
-  console.info(colors_default.dim(`  git push -u origin ${temporaryBranch}`));
-  printPrCreateStep(temporaryBranch, base, title);
-}
-function hasStagedSyncChanges(result) {
-  return result.files.some((file) => SYNC_APPLIED_STATUSES.includes(file.status));
-}
-function extractFirstUrl(output) {
-  return output.match(/https?:\/\/\S+/)?.[0];
-}
 async function flattenSyncBranch(forkPath, branch, base) {
   const mergeCommits = await listBranchMergeCommits(forkPath, base);
   if (mergeCommits.length === 0) return false;
@@ -5121,9 +4664,6 @@ async function flattenSyncBranch(forkPath, branch, base) {
   await flattenBranch(forkPath, base, message);
   return true;
 }
-function indentLines(text) {
-  return text.split("\n").map((line) => `  ${line}`).join("\n");
-}
 async function shipSyncBranch(config, branch) {
   const { forkPath, settings } = config;
   const base = resolveReleaseBase(settings);
@@ -5131,27 +4671,28 @@ async function shipSyncBranch(config, branch) {
   const flattened = await flattenSyncBranch(forkPath, branch, cutBase);
   let prUrl;
   let prOpened = false;
-  const headSubject = (await getCommitInfo(forkPath, "HEAD").catch(() => null))?.message;
-  const prTitle = headSubject?.startsWith(SYNC_PR_TITLE) ? headSubject : SYNC_PR_TITLE;
+  const upstreamCommit = (await readSyncManifest(forkPath))?.upstream.commit;
+  const prTitle = upstreamCommit ? await buildSyncCommitMessage(forkPath, upstreamCommit) : SYNC_PR_TITLE;
   console.info(colors_default.dim(`pushing '${branch}' to origin...`));
   try {
     await pushBranch(forkPath, "origin", branch, { forceWithLease: flattened });
   } catch (error) {
     console.info(colors_default.yellow(`push failed (${errorMessage(error).split("\n")[0]}). finish manually:`));
-    printShipSteps(branch, base, prTitle);
+    console.info(colors_default.dim(`  git push -u origin ${branch}`));
+    printPrCreateStep(branch, base, prTitle);
     return;
   }
   if (ghAvailable()) {
     console.info(colors_default.dim("opening a pull request..."));
     const prBody = await buildSyncPrBodyForBranch(forkPath, cutBase);
     const bodyArgs = prBody ? ["--body", prBody] : ["--fill"];
-    const pr = spawnSync4("gh", ["pr", "create", "--base", base, "--head", branch, "--title", prTitle, ...bodyArgs], {
+    const pr = spawnSync5("gh", ["pr", "create", "--base", base, "--head", branch, "--title", prTitle, ...bodyArgs], {
       cwd: forkPath,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
-    prUrl = extractFirstUrl(`${pr.stdout ?? ""}
-${pr.stderr ?? ""}`);
+    prUrl = `${pr.stdout ?? ""}
+${pr.stderr ?? ""}`.match(/https?:\/\/\S+/)?.[0];
     prOpened = pr.status === 0;
     if (!prOpened) {
       console.info(colors_default.yellow("could not open the PR automatically (it may already exist). open it with:"));
@@ -5176,7 +4717,7 @@ ${pr.stderr ?? ""}`);
 function finalizeWorkspace(forkPath) {
   for (const args of [["install"], ["check"]]) {
     console.info(colors_default.dim(`running pnpm ${args.join(" ")}...`));
-    const result = spawnSync4("pnpm", args, { cwd: forkPath, stdio: "inherit" });
+    const result = spawnSync5("pnpm", args, { cwd: forkPath, stdio: "inherit" });
     if (result.status !== 0) return false;
   }
   return true;
@@ -5240,13 +4781,10 @@ async function commitSyncMerge(config, branch) {
   await commitSquash(forkPath, message);
   console.info();
   console.info(colors_default.green(`committed the sync on '${branch}' as '${message}'.`));
-  printTriageSteps(branch);
-  await printMigrationNotesLine(config);
-}
-function printTriageSteps(branch) {
   console.info(colors_default.dim(`staying on '${branch}' without pushing.`));
   console.info(colors_default.dim("  run drift triage (`pnpm cella analyze`), commit any follow-ups, then:"));
   console.info(colors_default.dim("  pnpm cella sync   (pushes the branch and opens the PR)"));
+  await printMigrationNotesLine(config);
 }
 async function mergeOpenSyncPrs(config, open) {
   const { forkPath, settings } = config;
@@ -5258,7 +4796,7 @@ async function mergeOpenSyncPrs(config, open) {
   if (!merged.ok) {
     console.info();
     console.info(colors_default.yellow(`could not merge #${newest.number}: resolve it first, then re-run \`pnpm cella sync\`:`));
-    if (merged.output) console.info(colors_default.dim(indentLines(merged.output)));
+    if (merged.output) console.info(colors_default.dim(merged.output.replace(/^/gm, "  ")));
     console.info(colors_default.dim(`  ${newest.url}`));
     return "cancel";
   }
@@ -5287,7 +4825,7 @@ async function guardAgainstOpenSyncPr(config) {
   }
   console.info(colors_default.dim(`  starting a new sync now produces a PR that re-includes ${many ? "these" : "those"} changes.`));
   console.info();
-  const choice = await select3({
+  const choice = await select4({
     message: "how do you want to proceed?",
     choices: [
       {
@@ -5325,7 +4863,9 @@ commit them first (\`git commit --amend --no-edit\` or a new commit).`
     await shipSyncBranch(config, currentBranch);
     return;
   }
-  await assertClean(forkPath);
+  if (!await isClean(forkPath)) {
+    throw new Error("working directory has uncommitted changes. please commit or stash before syncing.");
+  }
   if (await guardAgainstOpenSyncPr(config) === "cancel") return;
   const outcome = await runSyncCycle(config);
   console.info();
@@ -5407,21 +4947,16 @@ async function syncFork(config, fork, forkPath) {
   console.info(colors_default.dim(`path: ${forkPath}`));
   console.info();
   const forkConfig = await loadConfig(forkPath);
-  const { branchRef } = resolveUpstream(forkConfig.settings);
-  const upstreamRef = branchRef;
-  const forkRuntimeConfig = {
+  await runSyncCommand({
     ...forkConfig,
     forkPath,
-    upstreamRef,
+    upstreamRef: resolveUpstream(forkConfig.settings).branchRef,
     service: "sync",
-    logFile: config.logFile,
     list: false,
     json: false,
-    verbose: config.verbose,
-    hard: config.hard,
+    verbose: false,
     keepConfig: config.keepConfig
-  };
-  await runSyncCommand(forkRuntimeConfig);
+  });
 }
 async function runForks(config) {
   const forks = config.forks ?? [];
@@ -5434,7 +4969,7 @@ async function runForks(config) {
     if (!match) {
       throw new Error(`fork '${config.fork}' not found in config`);
     }
-    const resolvedPath = resolve7(await resolveForkBasePath(config.forkPath), match.localPath);
+    const resolvedPath = resolve6(await resolveForkBasePath(config.forkPath), match.localPath);
     await syncFork(config, match, resolvedPath);
     return;
   }
@@ -5442,15 +4977,15 @@ async function runForks(config) {
   while (true) {
     const choices = await buildForkChoices(forks, forkBasePath);
     const forkChoices = [...choices, new Separator2(MENU_DIVIDER), { value: "_exit", name: colors_default.dim("exit") }];
-    const selectedPath = await select4({
+    const selectedPath = await select5({
       message: "select fork to sync:",
       choices: forkChoices,
       loop: false
     });
     if (selectedPath === "_exit") {
-      process8.exit(0);
+      process7.exit(0);
     }
-    const resolvedForkPath = resolve7(forkBasePath, selectedPath);
+    const resolvedForkPath = resolve6(forkBasePath, selectedPath);
     const selectedFork = forks.find((f) => f.localPath === selectedPath);
     if (!selectedFork) {
       console.error(colors_default.red(`fork '${selectedPath}' not found in config`));
@@ -5463,16 +4998,12 @@ async function runForks(config) {
 
 // src/services/stats.ts
 import { readFile as readFile3 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join16 } from "path";
 
 // src/utils/coverage-utils.ts
-import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { join as join17, relative as relative3, sep as sep2 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { join as join15, relative as relative4, sep as sep2 } from "path";
 var STALE_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1e3;
-function summaryPath(forkPath) {
-  return join17(forkPath, ".coverage", "coverage-summary.json");
-}
 function colorPct(pct) {
   if (typeof pct !== "number" || !Number.isFinite(pct)) return colors_default.dim("n/a");
   const label = `${pct.toFixed(2)}%`;
@@ -5488,34 +5019,22 @@ function formatAge(ms) {
   const mins = Math.floor(ms / (60 * 1e3));
   return `${mins} minute${mins === 1 ? "" : "s"} ago`;
 }
-function refreshCoverage(forkPath) {
-  console.info(colors_default.dim("running `pnpm test` (this spins up Docker and runs the full suite)..."));
-  const result = spawnSync5("pnpm", ["test"], { cwd: forkPath, stdio: "inherit" });
-  return result.status === 0;
-}
-function printCoverageSummary(forkPath, options = {}) {
-  const file = summaryPath(forkPath);
-  if (options.refresh) {
-    const ok = refreshCoverage(forkPath);
-    if (!ok) {
-      console.info(colors_default.red("coverage run failed: showing last cached results (if any)"));
+function printCoverageSummary(forkPath) {
+  const file = join15(forkPath, ".coverage", "coverage-summary.json");
+  let summary;
+  let mtimeMs = 0;
+  let problem = "no coverage data found";
+  if (existsSync11(file)) {
+    try {
+      mtimeMs = statSync2(file).mtimeMs;
+      summary = JSON.parse(readFileSync6(file, "utf8"));
+    } catch {
+      problem = "could not read coverage-summary.json";
     }
-    console.info();
-  }
-  if (!existsSync12(file)) {
-    console.info(colors_default.bold("coverage"));
-    console.info(colors_default.yellow("  no coverage data found: run `pnpm test` to generate it"));
-    console.info();
-    return;
   }
-  let summary;
-  let mtimeMs;
-  try {
-    summary = JSON.parse(readFileSync6(file, "utf8"));
-    mtimeMs = statSync2(file).mtimeMs;
-  } catch {
+  if (!summary || !Object.keys(summary).some((key) => key !== "total")) {
     console.info(colors_default.bold("coverage"));
-    console.info(colors_default.yellow("  could not read coverage-summary.json: run `pnpm test` to regenerate"));
+    console.info(colors_default.yellow(`  ${problem}: run \`pnpm test\` to generate it`));
     console.info();
     return;
   }
@@ -5524,7 +5043,7 @@ function printCoverageSummary(forkPath, options = {}) {
   const perPackage = /* @__PURE__ */ new Map();
   for (const [key, entry] of Object.entries(summary)) {
     if (key === "total") continue;
-    const rel = relative3(forkPath, key);
+    const rel = relative4(forkPath, key);
     if (rel.startsWith("..")) continue;
     const pkg = rel.split(sep2)[0];
     const acc = perPackage.get(pkg) ?? { covered: 0, total: 0 };
@@ -5537,11 +5056,6 @@ function printCoverageSummary(forkPath, options = {}) {
   if (stale) {
     console.info(colors_default.yellow("  \u26A0 data is older than 7 days: run `pnpm test` to refresh"));
   }
-  if (!Object.keys(summary).some((key) => key !== "total")) {
-    console.info(colors_default.yellow("  no coverage data found: run `pnpm test` to regenerate"));
-    console.info();
-    return;
-  }
   const total = summary.total;
   console.info(
     `  ${colors_default.bold("overall")}  lines ${colorPct(total.lines.pct)} ${colors_default.dim(`(${total.lines.covered}/${total.lines.total})`)}  funcs ${colorPct(total.functions.pct)}  branches ${colorPct(total.branches.pct)}`
@@ -5557,8 +5071,9 @@ function printCoverageSummary(forkPath, options = {}) {
 // src/services/stats.ts
 var sourceExtensions = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "json", "jsonc", "css", "html"]);
 async function getWorkspacePackages(forkPath) {
-  const content = await readFile3(join18(forkPath, "pnpm-workspace.yaml"), "utf8");
-  return parseYamlBlockList(content, "packages").map((pattern) => {
+  const content = await readFile3(join16(forkPath, "pnpm-workspace.yaml"), "utf8");
+  const patterns = readTopLevel(content, "packages");
+  return (Array.isArray(patterns) ? patterns.map(String) : []).map((pattern) => {
     if (pattern.endsWith("/*")) {
       const base = pattern.slice(0, -2);
       return { name: `${base}/*`, prefix: `${base}/` };
@@ -5600,8 +5115,6 @@ function matchPackage(filePath, packages) {
 var sourcePathspecs = [...sourceExtensions].map((ext) => `*.${ext}`);
 async function collectStats(forkPath) {
   const output = await git(["grep", "-c", "", "--", ...sourcePathspecs], forkPath, { ignoreErrors: true });
-  const allFilesOutput = await git(["ls-files", "--cached"], forkPath);
-  const allFilesCount = allFilesOutput.split("\n").filter(Boolean).length;
   const packages = await getWorkspacePackages(forkPath);
   const entries = [];
   for (const line of output.split("\n")) {
@@ -5610,7 +5123,6 @@ async function collectStats(forkPath) {
     if (sep3 === -1) continue;
     entries.push({ path: line.slice(0, sep3), loc: Number.parseInt(line.slice(sep3 + 1), 10) });
   }
-  const skipped = allFilesCount - entries.length;
   const emptyCat = () => ({
     test: { files: 0, loc: 0 },
     stories: { files: 0, loc: 0 },
@@ -5640,7 +5152,7 @@ async function collectStats(forkPath) {
   const sortedPackages = Object.fromEntries(
     [...pkgStats.entries()].sort((a, b) => b[1].categories.other.loc - a[1].categories.other.loc)
   );
-  return { total: entries.length, totalLoc, skipped, categories, packages: sortedPackages };
+  return { total: entries.length, totalLoc, categories, packages: sortedPackages };
 }
 function pad(n, width = 6) {
   return String(n).padStart(width);
@@ -5649,9 +5161,6 @@ function formatLoc(n) {
   if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
   return String(n);
 }
-function formatLocColumn(n, width = 8) {
-  return formatLoc(n).padStart(width);
-}
 function fmtPct(value, total) {
   const pct = (value / total * 100).toFixed(1);
   return `${pct.padStart(5)}%`;
@@ -5672,34 +5181,20 @@ function printStats(stats, verbose) {
   ];
   for (const [label, data] of catEntries) {
     console.info(
-      `  ${pad(data.files)} ${colors_default.dim(fmtPct(data.files, stats.total))}  ${label.padEnd(18)} ${colors_default.cyan(formatLocColumn(data.loc))}  ${colors_default.dim(fmtPct(data.loc, stats.totalLoc))}`
+      `  ${pad(data.files)} ${colors_default.dim(fmtPct(data.files, stats.total))}  ${label.padEnd(18)} ${colors_default.cyan(formatLoc(data.loc).padStart(8))}  ${colors_default.dim(fmtPct(data.loc, stats.totalLoc))}`
     );
   }
   console.info();
   console.info(DIVIDER);
   console.info();
-  if (verbose) {
-    const header = `  ${"".padEnd(6)}  ${"package".padEnd(18)} ${"loc".padStart(8)} ${"test".padStart(6)} ${"story".padStart(6)} ${"gen".padStart(6)} ${"json".padStart(6)} ${"src".padStart(6)}`;
-    console.info(colors_default.dim(header));
-    for (const [name, data] of Object.entries(stats.packages)) {
-      const c = data.categories;
-      const srcFiles = c.other.files;
-      const srcLoc = c.other.loc;
-      if (srcFiles === 0) continue;
-      console.info(
-        `  ${colors_default.dim(pad(srcFiles))}  ${name.padEnd(18)} ${colors_default.cyan(formatLocColumn(srcLoc))} ${colors_default.dim(pad(c.test.files))} ${colors_default.dim(pad(c.stories.files))} ${colors_default.dim(pad(c.generated.files))} ${colors_default.dim(pad(c.json.files))} ${colors_default.dim(pad(srcFiles))}`
-      );
-    }
-  } else {
-    console.info(colors_default.dim("  source & config by package"));
-    for (const [name, data] of Object.entries(stats.packages)) {
-      const srcFiles = data.categories.other.files;
-      const srcLoc = data.categories.other.loc;
-      if (srcFiles === 0) continue;
-      console.info(
-        `  ${pad(srcFiles)} ${colors_default.dim(fmtPct(srcFiles, stats.categories.other.files))}  ${name.padEnd(18)} ${colors_default.cyan(formatLocColumn(srcLoc))}  ${colors_default.dim(fmtPct(srcLoc, stats.categories.other.loc))}`
-      );
-    }
+  const header = verbose ? `  ${"".padEnd(6)}  ${"package".padEnd(18)} ${"loc".padStart(8)} ${"test".padStart(6)} ${"story".padStart(6)} ${"gen".padStart(6)} ${"json".padStart(6)} ${"src".padStart(6)}` : "  source & config by package";
+  console.info(colors_default.dim(header));
+  const { other } = stats.categories;
+  for (const [name, { categories: c }] of Object.entries(stats.packages)) {
+    if (c.other.files === 0) continue;
+    const head = verbose ? colors_default.dim(pad(c.other.files)) : `${pad(c.other.files)} ${colors_default.dim(fmtPct(c.other.files, other.files))}`;
+    const tail = verbose ? ` ${[c.test, c.stories, c.generated, c.json, c.other].map((cat) => colors_default.dim(pad(cat.files))).join(" ")}` : `  ${colors_default.dim(fmtPct(c.other.loc, other.loc))}`;
+    console.info(`  ${head}  ${name.padEnd(18)} ${colors_default.cyan(formatLoc(c.other.loc).padStart(8))}${tail}`);
   }
   console.info();
 }
@@ -5710,19 +5205,11 @@ async function runStats(config) {
   spinnerSuccess("counted raw lines of code");
   printStats(stats, config.verbose);
   console.info();
-  printCoverageSummary(forkPath, { refresh: config.coverage });
+  printCoverageSummary(forkPath);
 }
 
 // src/services/stats-since.ts
-var kindLabels = {
-  source: "source",
-  test: "tests",
-  stories: "stories",
-  generated: "generated",
-  json: "json",
-  docs: "docs",
-  other: "other"
-};
+var kindLabel = (kind) => kind === "test" ? "tests" : kind;
 var docExtensions = /* @__PURE__ */ new Set(["md", "mdx"]);
 var lockFiles = /* @__PURE__ */ new Set(["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lock", "bun.lockb"]);
 var codeExtensions = [...sourceExtensions].filter((ext) => !ext.startsWith("json"));
@@ -5745,9 +5232,9 @@ function classifyLine(text) {
 }
 function parseNumstat(output) {
   const files = [];
-  for (const record of output.split("\0")) {
-    if (!record) continue;
-    const [added, removed, ...rest] = record.split("	");
+  for (const record2 of output.split("\0")) {
+    if (!record2) continue;
+    const [added, removed, ...rest] = record2.split("	");
     const path = rest.join("	");
     if (!path) continue;
     files.push({
@@ -5790,9 +5277,7 @@ function countLineContent(patch, isCounted) {
   return content;
 }
 async function collectBranchStats(forkPath, since) {
-  const sinceSha = await git(["rev-parse", "--verify", "--quiet", `${since}^{commit}`], forkPath, {
-    ignoreErrors: true
-  });
+  const sinceSha = await revParse(forkPath, `${since}^{commit}`);
   if (!sinceSha) throw new Error(`unknown ref '${since}'. pass a branch, tag or commit, such as origin/main`);
   const mergeBase = await git(["merge-base", sinceSha, "HEAD"], forkPath, { ignoreErrors: true });
   if (!mergeBase) throw new Error(`the current branch shares no history with '${since}'`);
@@ -5867,9 +5352,7 @@ function formatMarkdown(stats) {
   const lines = [
     "| Kind | Files | Added | Removed | Net |",
     "| --- | ---: | ---: | ---: | ---: |",
-    ...changedKinds(stats).map(
-      ([kind, change]) => row(kind === "json" ? "JSON" : capitalize(kindLabels[kind]), change)
-    ),
+    ...changedKinds(stats).map(([kind, change]) => row(kind === "json" ? "JSON" : capitalize(kindLabel(kind)), change)),
     `| **Total** | **${stats.total.files}** | **${signed(stats.total.added)}** | **${signed(-stats.total.removed)}** | **${signed(net(stats.total))}** |`
   ];
   const notes = [];
@@ -5886,7 +5369,7 @@ function printBranchStats(stats, verbose) {
   console.info();
   console.info(colors_default.dim(`  ${"files".padStart(5)} ${"added".padStart(8)} ${"removed".padStart(8)} ${"net".padStart(8)}`));
   for (const [kind, change] of changedKinds(stats)) {
-    console.info(columns(String(change.files), change, kindLabels[kind]));
+    console.info(columns(String(change.files), change, kindLabel(kind)));
   }
   console.info(columns(String(stats.total.files), stats.total, colors_default.bold("total")));
   if (stats.sourceContent && stats.kinds.source.files > 0) {
@@ -5909,7 +5392,7 @@ function printBranchStats(stats, verbose) {
     console.info(DIVIDER);
     console.info();
     for (const file of stats.files) {
-      console.info(columns("", file, `${file.path}  ${colors_default.dim(kindLabels[file.kind])}`));
+      console.info(columns("", file, `${file.path}  ${colors_default.dim(kindLabel(file.kind))}`));
     }
   }
   if (stats.uncommitted > 0) {
@@ -5920,48 +5403,60 @@ function printBranchStats(stats, verbose) {
   }
   console.info();
 }
-async function runBranchStats(forkPath, options) {
+async function runBranchStats(config, since) {
   createSpinner("counting changed lines...");
-  const stats = await collectBranchStats(forkPath, options.since);
+  const stats = await collectBranchStats(config.forkPath, since);
   spinnerSuccess(`Counted what ${stats.head} changed since ${stats.since} (${stats.mergeBase})`);
   if (stats.total.files === 0) {
     console.info(colors_default.dim(`  nothing committed since ${stats.since}`));
     return;
   }
-  if (options.markdown) {
+  if (config.md) {
     writeStdout(formatMarkdown(stats));
     if (stats.uncommitted > 0) console.info(colors_default.dim(`${stats.uncommitted} uncommitted file(s) are not counted`));
     return;
   }
-  printBranchStats(stats, options.verbose ?? false);
+  printBranchStats(stats, config.verbose);
 }
 
 // src/cella-cli.ts
 function getForkPath() {
   const envPath = getEnv("CELLA_FORK_PATH");
   if (envPath) {
-    const resolved = resolve8(envPath);
-    if (!existsSync13(resolved) || !statSync3(resolved).isDirectory()) {
+    const resolved = resolve7(envPath);
+    if (!existsSync12(resolved) || !statSync3(resolved).isDirectory()) {
       throw new Error(`CELLA_FORK_PATH is not a valid directory: ${resolved}`);
     }
     return resolved;
   }
-  let cwd = process9.cwd();
+  let cwd = process8.cwd();
   if (cwd.endsWith("/cli/cella") || cwd.endsWith("\\cli\\cella")) {
-    cwd = resolve8(cwd, "../..");
+    cwd = resolve7(cwd, "../..");
   }
   return cwd;
 }
 function preflight(forkPath) {
-  if (!existsSync13(join19(forkPath, ".git"))) {
+  if (!existsSync12(join17(forkPath, ".git"))) {
     throw new Error(`not a git repository: ${forkPath}`);
   }
 }
+var services = {
+  analyze: runAnalyze,
+  sync: runSyncCommand,
+  migrate: runMigrate,
+  audit: runAudit,
+  forks: runForks,
+  contributions: runContributions,
+  stats: async (config) => {
+    if (config.md && !config.since) throw new Error("--md goes with --since <ref>");
+    if (!config.since) return runStats(config);
+    return runBranchStats(config, config.since);
+  }
+};
 function isHelpOrVersionRequest() {
-  return process9.argv.slice(2).some((arg) => arg === "--help" || arg === "-h" || arg === "--version" || arg === "-v") || process9.argv[2] === "help";
+  return process8.argv.slice(2).some((arg) => arg === "--help" || arg === "-h" || arg === "--version" || arg === "-v") || process8.argv[2] === "help";
 }
 async function main() {
-  registerSignalHandlers();
   try {
     const forkPath = getForkPath();
     if (isHelpOrVersionRequest()) {
@@ -5973,46 +5468,12 @@ async function main() {
     if (!["audit", "forks", "contributions", "stats"].includes(config.service)) {
       preflight(forkPath);
     }
-    switch (config.service) {
-      case "analyze": {
-        await runAnalyze(config);
-        break;
-      }
-      case "sync": {
-        await runSyncCommand(config);
-        break;
-      }
-      case "migrate": {
-        await runMigrate(config);
-        break;
-      }
-      case "audit": {
-        await runAudit(config);
-        break;
-      }
-      case "forks": {
-        await runForks(config);
-        break;
-      }
-      case "contributions": {
-        await runContributions(config);
-        break;
-      }
-      case "stats": {
-        if (config.md && !config.since) throw new Error("--md goes with --since <ref>");
-        if (config.since) {
-          await runBranchStats(config.forkPath, { since: config.since, markdown: config.md, verbose: config.verbose });
-        } else {
-          await runStats(config);
-        }
-        break;
-      }
-    }
+    await services[config.service](config);
     console.info();
   } catch (error) {
     console.error();
     console.error(`${colors_default.red("\u2717")} ${errorMessage(error)}`);
-    process9.exit(1);
+    process8.exit(1);
   }
 }
 main();