@fuad24/gitbridge 0.1.0

package/dist/bin/gb.js

@@ -0,0 +1,3275 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/cli/index.ts
+var import_commander = require("commander");
+
+// src/cli/commands/status.ts
+var import_picocolors3 = __toESM(require("picocolors"));
+
+// src/core/config/config-store.ts
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path3 = __toESM(require("node:path"));
+
+// src/core/config/path-resolver.ts
+var import_node_path2 = __toESM(require("node:path"));
+
+// src/utils/platform.ts
+var import_node_os = __toESM(require("node:os"));
+var import_node_path = __toESM(require("node:path"));
+function getPlatform() {
+  const p2 = process.platform;
+  if (p2 === "linux" || p2 === "darwin" || p2 === "win32") {
+    return p2;
+  }
+  return "unknown";
+}
+function getHomeDir() {
+  return import_node_os.default.homedir();
+}
+function expandTilde(filepath) {
+  if (!filepath) return filepath;
+  if (filepath.startsWith("~/") || filepath === "~") {
+    return import_node_path.default.join(getHomeDir(), filepath.slice(1));
+  }
+  return filepath;
+}
+function collapseTilde(filepath) {
+  if (!filepath) return filepath;
+  const home = getHomeDir();
+  if (filepath === home) return "~";
+  if (filepath.startsWith(home + import_node_path.default.sep)) {
+    return `~${filepath.slice(home.length)}`;
+  }
+  return filepath;
+}
+
+// src/core/config/path-resolver.ts
+var PathResolver = class {
+  baseDir;
+  constructor(customBaseDir) {
+    if (customBaseDir) {
+      this.baseDir = expandTilde(customBaseDir);
+    } else if (process.env.GITBRIDGE_HOME) {
+      this.baseDir = expandTilde(process.env.GITBRIDGE_HOME);
+    } else if (process.env.XDG_CONFIG_HOME) {
+      this.baseDir = import_node_path2.default.join(expandTilde(process.env.XDG_CONFIG_HOME), "gitbridge");
+    } else {
+      this.baseDir = import_node_path2.default.join(getHomeDir(), ".gitbridge");
+    }
+  }
+  getBaseDir() {
+    return this.baseDir;
+  }
+  getConfigFile() {
+    return import_node_path2.default.join(this.baseDir, "config.json");
+  }
+  getIdentitiesFile() {
+    return import_node_path2.default.join(this.baseDir, "identities.json");
+  }
+  getAccountsFile() {
+    return import_node_path2.default.join(this.baseDir, "accounts.json");
+  }
+  getReposFile() {
+    return import_node_path2.default.join(this.baseDir, "repos.json");
+  }
+  getGeneratedDir() {
+    return import_node_path2.default.join(this.baseDir, "generated");
+  }
+  getMainGitConfigFile() {
+    return import_node_path2.default.join(this.getGeneratedDir(), "main.gitconfig");
+  }
+  getGeneratedSshConfigFile() {
+    return import_node_path2.default.join(this.getGeneratedDir(), "ssh_config");
+  }
+  getRulesDir() {
+    return import_node_path2.default.join(this.getGeneratedDir(), "rules");
+  }
+  getRuleGitConfigFile(ruleId) {
+    const sanitized = ruleId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    return import_node_path2.default.join(this.getRulesDir(), `${sanitized}.gitconfig`);
+  }
+  getBackupsDir() {
+    return import_node_path2.default.join(this.baseDir, "backups");
+  }
+  getEncryptedVaultFile() {
+    return import_node_path2.default.join(this.baseDir, "vault.enc");
+  }
+  getUserGitConfigFile() {
+    return import_node_path2.default.join(getHomeDir(), ".gitconfig");
+  }
+  getUserSshConfigFile() {
+    return import_node_path2.default.join(getHomeDir(), ".ssh", "config");
+  }
+  getUserSshDir() {
+    return import_node_path2.default.join(getHomeDir(), ".ssh");
+  }
+};
+var defaultPathResolver = new PathResolver();
+
+// src/core/config/schema.ts
+var import_zod = require("zod");
+var GitProviderTypeSchema = import_zod.z.enum(["github", "gitlab", "bitbucket", "gitea", "custom"]);
+var AuthTypeSchema = import_zod.z.enum(["oauth", "pat", "ssh", "password"]);
+var GitIdentitySchema = import_zod.z.object({
+  id: import_zod.z.string().min(1),
+  name: import_zod.z.string().min(1),
+  email: import_zod.z.string().email(),
+  signingKey: import_zod.z.string().nullable().optional().default(null),
+  isDefault: import_zod.z.boolean().optional().default(false),
+  createdAt: import_zod.z.string().datetime().optional().default(() => (/* @__PURE__ */ new Date()).toISOString())
+});
+var IdentitiesFileSchema = import_zod.z.object({
+  identities: import_zod.z.array(GitIdentitySchema).default([])
+});
+var ProviderAccountSchema = import_zod.z.object({
+  id: import_zod.z.string().min(1),
+  providerId: GitProviderTypeSchema,
+  host: import_zod.z.string().min(1),
+  username: import_zod.z.string().min(1),
+  displayName: import_zod.z.string().optional(),
+  authType: AuthTypeSchema,
+  sshKeyPath: import_zod.z.string().optional(),
+  createdAt: import_zod.z.string().datetime().optional().default(() => (/* @__PURE__ */ new Date()).toISOString())
+});
+var AccountsFileSchema = import_zod.z.object({
+  accounts: import_zod.z.array(ProviderAccountSchema).default([])
+});
+var DirectoryRuleSchema = import_zod.z.object({
+  id: import_zod.z.string().min(1),
+  path: import_zod.z.string().min(1),
+  identityId: import_zod.z.string().min(1),
+  defaultProvider: GitProviderTypeSchema.optional(),
+  defaultAccountId: import_zod.z.string().optional()
+});
+var GitBridgeSettingsSchema = import_zod.z.object({
+  autoSyncGitConfig: import_zod.z.boolean().default(true),
+  credentialHelperEnabled: import_zod.z.boolean().default(true),
+  sshManagementEnabled: import_zod.z.boolean().default(true),
+  commitIdentitySafety: import_zod.z.boolean().default(true),
+  fallbackEncryptedStore: import_zod.z.boolean().default(false)
+});
+var MainConfigSchema = import_zod.z.object({
+  $schema: import_zod.z.string().optional(),
+  version: import_zod.z.string().default("1.0.0"),
+  enabled: import_zod.z.boolean().default(true),
+  defaultIdentityId: import_zod.z.string().nullable().optional().default(null),
+  rules: import_zod.z.array(DirectoryRuleSchema).default([]),
+  settings: GitBridgeSettingsSchema.default({})
+});
+var RepositoryRemoteSchema = import_zod.z.object({
+  name: import_zod.z.string().min(1),
+  providerId: GitProviderTypeSchema,
+  host: import_zod.z.string().min(1),
+  accountId: import_zod.z.string().optional(),
+  url: import_zod.z.string().min(1),
+  rawUrl: import_zod.z.string().optional()
+});
+var RepositoryProfileSchema = import_zod.z.object({
+  path: import_zod.z.string().min(1),
+  identityId: import_zod.z.string().optional(),
+  remotes: import_zod.z.array(RepositoryRemoteSchema).default([]),
+  safetyHookInstalled: import_zod.z.boolean().optional().default(false),
+  updatedAt: import_zod.z.string().datetime().optional().default(() => (/* @__PURE__ */ new Date()).toISOString())
+});
+var RepositoriesFileSchema = import_zod.z.object({
+  repositories: import_zod.z.array(RepositoryProfileSchema).default([])
+});
+var CustomProviderSchema = import_zod.z.object({
+  id: import_zod.z.string().min(1),
+  name: import_zod.z.string().min(1),
+  host: import_zod.z.string().min(1),
+  type: GitProviderTypeSchema.default("custom"),
+  apiBaseUrl: import_zod.z.string().url().optional()
+});
+
+// src/utils/errors.ts
+var GitBridgeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "GitBridgeError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+  code;
+};
+var ConfigError = class extends GitBridgeError {
+  constructor(message) {
+    super(message, "CONFIG_ERROR");
+    this.name = "ConfigError";
+  }
+};
+var ProviderError = class extends GitBridgeError {
+  constructor(message, provider) {
+    super(`[${provider}] ${message}`, "PROVIDER_ERROR");
+    this.provider = provider;
+    this.name = "ProviderError";
+  }
+  provider;
+};
+var GitCliError = class extends GitBridgeError {
+  constructor(message, exitCode, stderr) {
+    super(`Git error (${exitCode}): ${message}`, "GIT_CLI_ERROR");
+    this.exitCode = exitCode;
+    this.stderr = stderr;
+    this.name = "GitCliError";
+  }
+  exitCode;
+  stderr;
+};
+var CredentialStoreError = class extends GitBridgeError {
+  constructor(message) {
+    super(message, "CREDENTIAL_STORE_ERROR");
+    this.name = "CredentialStoreError";
+  }
+};
+
+// src/core/config/config-store.ts
+var ConfigStore = class {
+  paths;
+  constructor(paths = defaultPathResolver) {
+    this.paths = paths;
+  }
+  getPathResolver() {
+    return this.paths;
+  }
+  ensureDirectories() {
+    const dirs = [
+      this.paths.getBaseDir(),
+      this.paths.getGeneratedDir(),
+      this.paths.getRulesDir(),
+      this.paths.getBackupsDir()
+    ];
+    for (const dir of dirs) {
+      if (!import_node_fs.default.existsSync(dir)) {
+        import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+      }
+    }
+  }
+  atomicWriteJson(filepath, data) {
+    this.ensureDirectories();
+    const tempFile = `${filepath}.tmp.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+    const content = JSON.stringify(data, null, 2);
+    import_node_fs.default.writeFileSync(tempFile, content, { encoding: "utf-8", mode: 384 });
+    import_node_fs.default.renameSync(tempFile, filepath);
+  }
+  // --- Main Config ---
+  loadConfig() {
+    const file = this.paths.getConfigFile();
+    if (!import_node_fs.default.existsSync(file)) {
+      return MainConfigSchema.parse({});
+    }
+    try {
+      const raw = JSON.parse(import_node_fs.default.readFileSync(file, "utf-8"));
+      return MainConfigSchema.parse(raw);
+    } catch (err) {
+      throw new ConfigError(`Failed to load config from ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  saveConfig(config) {
+    const current = this.loadConfig();
+    const merged = MainConfigSchema.parse({ ...current, ...config });
+    this.atomicWriteJson(this.paths.getConfigFile(), merged);
+    return merged;
+  }
+  updateSettings(settings) {
+    const current = this.loadConfig();
+    const updated = {
+      ...current,
+      settings: { ...current.settings, ...settings }
+    };
+    return this.saveConfig(updated);
+  }
+  setEnabled(enabled) {
+    return this.saveConfig({ enabled });
+  }
+  // --- Identities ---
+  loadIdentities() {
+    const file = this.paths.getIdentitiesFile();
+    if (!import_node_fs.default.existsSync(file)) {
+      return [];
+    }
+    try {
+      const raw = JSON.parse(import_node_fs.default.readFileSync(file, "utf-8"));
+      const parsed = IdentitiesFileSchema.parse(raw);
+      return parsed.identities;
+    } catch (err) {
+      throw new ConfigError(`Failed to load identities from ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  saveIdentities(identities) {
+    const validated = IdentitiesFileSchema.parse({ identities });
+    this.atomicWriteJson(this.paths.getIdentitiesFile(), validated);
+  }
+  getIdentity(id) {
+    const list = this.loadIdentities();
+    return list.find((i) => i.id === id);
+  }
+  addIdentity(identity) {
+    const list = this.loadIdentities();
+    if (list.some((i) => i.id === identity.id)) {
+      throw new ConfigError(`Identity with ID '${identity.id}' already exists.`);
+    }
+    const isFirst = list.length === 0;
+    const newIdentity = {
+      id: identity.id,
+      name: identity.name,
+      email: identity.email,
+      signingKey: identity.signingKey || null,
+      isDefault: identity.isDefault ?? isFirst,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (newIdentity.isDefault) {
+      list.forEach((i) => {
+        i.isDefault = false;
+      });
+      this.saveConfig({ defaultIdentityId: newIdentity.id });
+    }
+    list.push(newIdentity);
+    this.saveIdentities(list);
+    return newIdentity;
+  }
+  updateIdentity(id, updates) {
+    const list = this.loadIdentities();
+    const index = list.findIndex((i) => i.id === id);
+    if (index === -1) {
+      throw new ConfigError(`Identity with ID '${id}' not found.`);
+    }
+    if (updates.isDefault) {
+      list.forEach((i) => {
+        i.isDefault = false;
+      });
+      this.saveConfig({ defaultIdentityId: id });
+    }
+    const updated = {
+      ...list[index],
+      ...updates,
+      signingKey: updates.signingKey !== void 0 ? updates.signingKey : list[index].signingKey
+    };
+    list[index] = updated;
+    this.saveIdentities(list);
+    return updated;
+  }
+  removeIdentity(id) {
+    const list = this.loadIdentities();
+    const filtered = list.filter((i) => i.id !== id);
+    if (filtered.length === list.length) {
+      return false;
+    }
+    const config = this.loadConfig();
+    if (config.defaultIdentityId === id) {
+      const nextDefault = filtered[0]?.id ?? null;
+      if (filtered[0]) filtered[0].isDefault = true;
+      this.saveConfig({ defaultIdentityId: nextDefault });
+    }
+    this.saveIdentities(filtered);
+    return true;
+  }
+  setDefaultIdentity(id) {
+    const list = this.loadIdentities();
+    const target = list.find((i) => i.id === id);
+    if (!target) {
+      throw new ConfigError(`Identity with ID '${id}' not found.`);
+    }
+    list.forEach((i) => {
+      i.isDefault = i.id === id;
+    });
+    this.saveIdentities(list);
+    this.saveConfig({ defaultIdentityId: id });
+  }
+  // --- Accounts ---
+  loadAccounts() {
+    const file = this.paths.getAccountsFile();
+    if (!import_node_fs.default.existsSync(file)) {
+      return [];
+    }
+    try {
+      const raw = JSON.parse(import_node_fs.default.readFileSync(file, "utf-8"));
+      const parsed = AccountsFileSchema.parse(raw);
+      return parsed.accounts;
+    } catch (err) {
+      throw new ConfigError(`Failed to load accounts from ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  saveAccounts(accounts) {
+    const validated = AccountsFileSchema.parse({ accounts });
+    this.atomicWriteJson(this.paths.getAccountsFile(), validated);
+  }
+  getAccount(id) {
+    return this.loadAccounts().find((a) => a.id === id);
+  }
+  addAccount(account) {
+    const list = this.loadAccounts();
+    const existingIndex = list.findIndex((a) => a.id === account.id);
+    const newAccount = {
+      ...account,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (existingIndex >= 0) {
+      list[existingIndex] = newAccount;
+    } else {
+      list.push(newAccount);
+    }
+    this.saveAccounts(list);
+    return newAccount;
+  }
+  removeAccount(id) {
+    const list = this.loadAccounts();
+    const filtered = list.filter((a) => a.id !== id);
+    if (filtered.length === list.length) {
+      return false;
+    }
+    this.saveAccounts(filtered);
+    return true;
+  }
+  // --- Directory Rules ---
+  loadRules() {
+    return this.loadConfig().rules;
+  }
+  addRule(rule) {
+    const config = this.loadConfig();
+    const existingIndex = config.rules.findIndex((r) => r.id === rule.id || r.path === rule.path);
+    if (existingIndex >= 0) {
+      config.rules[existingIndex] = rule;
+    } else {
+      config.rules.push(rule);
+    }
+    this.saveConfig(config);
+    return rule;
+  }
+  removeRule(ruleIdOrPath) {
+    const config = this.loadConfig();
+    const initialLen = config.rules.length;
+    config.rules = config.rules.filter((r) => r.id !== ruleIdOrPath && r.path !== ruleIdOrPath);
+    if (config.rules.length === initialLen) {
+      return false;
+    }
+    this.saveConfig(config);
+    return true;
+  }
+  // --- Repository Profiles ---
+  loadRepositories() {
+    const file = this.paths.getReposFile();
+    if (!import_node_fs.default.existsSync(file)) {
+      return [];
+    }
+    try {
+      const raw = JSON.parse(import_node_fs.default.readFileSync(file, "utf-8"));
+      const parsed = RepositoriesFileSchema.parse(raw);
+      return parsed.repositories;
+    } catch (err) {
+      throw new ConfigError(`Failed to load repositories from ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  saveRepositories(repositories) {
+    const validated = RepositoriesFileSchema.parse({ repositories });
+    this.atomicWriteJson(this.paths.getReposFile(), validated);
+  }
+  getRepository(repoPath) {
+    const normalized = import_node_path3.default.resolve(repoPath);
+    return this.loadRepositories().find((r) => import_node_path3.default.resolve(r.path) === normalized);
+  }
+  saveRepositoryProfile(profile) {
+    const list = this.loadRepositories();
+    const normalized = import_node_path3.default.resolve(profile.path);
+    const existingIndex = list.findIndex((r) => import_node_path3.default.resolve(r.path) === normalized);
+    const updatedProfile = {
+      path: normalized,
+      identityId: profile.identityId,
+      remotes: profile.remotes || [],
+      safetyHookInstalled: profile.safetyHookInstalled || false,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (existingIndex >= 0) {
+      list[existingIndex] = updatedProfile;
+    } else {
+      list.push(updatedProfile);
+    }
+    this.saveRepositories(list);
+    return updatedProfile;
+  }
+  removeRepositoryProfile(repoPath) {
+    const list = this.loadRepositories();
+    const normalized = import_node_path3.default.resolve(repoPath);
+    const filtered = list.filter((r) => import_node_path3.default.resolve(r.path) !== normalized);
+    if (filtered.length === list.length) {
+      return false;
+    }
+    this.saveRepositories(filtered);
+    return true;
+  }
+};
+var defaultConfigStore = new ConfigStore();
+
+// src/core/git/gitconfig-injector.ts
+var import_node_fs3 = __toESM(require("node:fs"));
+var import_node_path4 = __toESM(require("node:path"));
+
+// src/core/git/config-generator.ts
+var import_node_fs2 = __toESM(require("node:fs"));
+var GitConfigGenerator = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  /**
+   * Generates all Git configuration files into ~/.gitbridge/generated/
+   */
+  generate() {
+    this.store.ensureDirectories();
+    const config = this.store.loadConfig();
+    const identities = this.store.loadIdentities();
+    const accounts = this.store.loadAccounts();
+    const paths = this.store.getPathResolver();
+    const defaultIdentity = identities.find((i) => i.id === config.defaultIdentityId) || identities.find((i) => i.isDefault) || identities[0];
+    const ruleFiles = [];
+    for (const rule of config.rules) {
+      const ruleIdentity = identities.find((i) => i.id === rule.identityId);
+      const ruleFile = paths.getRuleGitConfigFile(rule.id);
+      let ruleContent = `# Managed by GitBridge for rule: ${rule.id}
+`;
+      if (ruleIdentity) {
+        ruleContent += `[user]
+`;
+        ruleContent += `    name = ${ruleIdentity.name}
+`;
+        ruleContent += `    email = ${ruleIdentity.email}
+`;
+        if (ruleIdentity.signingKey) {
+          ruleContent += `    signingkey = ${ruleIdentity.signingKey}
+`;
+          ruleContent += `    # format = ssh or gpg
+`;
+        }
+      }
+      if (rule.defaultAccountId) {
+        const account = accounts.find((a) => a.id === rule.defaultAccountId);
+        if (account && account.host) {
+          const aliasHost = `${account.host}-${account.id}`;
+          ruleContent += `
+[url "git@${aliasHost}:"]
+`;
+          ruleContent += `    insteadOf = git@${account.host}:
+`;
+        }
+      }
+      import_node_fs2.default.writeFileSync(ruleFile, ruleContent, { encoding: "utf-8", mode: 420 });
+      ruleFiles.push(ruleFile);
+    }
+    let mainContent = `# Auto-generated by GitBridge. DO NOT EDIT DIRECTLY.
+`;
+    mainContent += `# Generated at: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+`;
+    if (defaultIdentity) {
+      mainContent += `# Default Identity
+`;
+      mainContent += `[user]
+`;
+      mainContent += `    name = ${defaultIdentity.name}
+`;
+      mainContent += `    email = ${defaultIdentity.email}
+`;
+      if (defaultIdentity.signingKey) {
+        mainContent += `    signingkey = ${defaultIdentity.signingKey}
+`;
+      }
+      mainContent += `
+`;
+    }
+    if (config.settings.credentialHelperEnabled) {
+      mainContent += `# Git Credential Helper Bridge
+`;
+      mainContent += `[credential]
+`;
+      mainContent += `    helper = gitbridge credential
+
+`;
+    }
+    if (config.rules.length > 0) {
+      mainContent += `# Directory-Based Conditional Includes
+`;
+      for (const rule of config.rules) {
+        const ruleFile = paths.getRuleGitConfigFile(rule.id);
+        const expandedRulePath = expandTilde(rule.path);
+        const gitDirPattern = expandedRulePath.endsWith("/") ? `${expandedRulePath}**` : `${expandedRulePath}/**`;
+        mainContent += `[includeIf "gitdir:${gitDirPattern}"]
+`;
+        mainContent += `    path = ${ruleFile}
+
+`;
+      }
+    }
+    const mainFile = paths.getMainGitConfigFile();
+    import_node_fs2.default.writeFileSync(mainFile, mainContent, { encoding: "utf-8", mode: 420 });
+    return {
+      mainConfigPath: mainFile,
+      generatedRules: ruleFiles
+    };
+  }
+};
+
+// src/core/git/gitconfig-injector.ts
+var GITCONFIG_BLOCK_START = "# --- BEGIN GITBRIDGE MANAGED BLOCK ---";
+var GITCONFIG_BLOCK_END = "# --- END GITBRIDGE MANAGED BLOCK ---";
+var GitConfigInjector = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  isInstalled(targetFile) {
+    const gitConfigFile = targetFile || this.store.getPathResolver().getUserGitConfigFile();
+    if (!import_node_fs3.default.existsSync(gitConfigFile)) return false;
+    const content = import_node_fs3.default.readFileSync(gitConfigFile, "utf-8");
+    return content.includes(GITCONFIG_BLOCK_START) && content.includes(GITCONFIG_BLOCK_END);
+  }
+  createBackup(gitConfigFile) {
+    if (!import_node_fs3.default.existsSync(gitConfigFile)) return null;
+    const backupsDir = this.store.getPathResolver().getBackupsDir();
+    if (!import_node_fs3.default.existsSync(backupsDir)) {
+      import_node_fs3.default.mkdirSync(backupsDir, { recursive: true });
+    }
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const backupFile = import_node_path4.default.join(backupsDir, `gitconfig.${timestamp}.bak`);
+    import_node_fs3.default.copyFileSync(gitConfigFile, backupFile);
+    const primaryBak = `${gitConfigFile}.gitbridge.bak`;
+    if (!import_node_fs3.default.existsSync(primaryBak)) {
+      import_node_fs3.default.copyFileSync(gitConfigFile, primaryBak);
+    }
+    return backupFile;
+  }
+  inject(targetFile) {
+    const generator = new GitConfigGenerator(this.store);
+    const { mainConfigPath } = generator.generate();
+    const gitConfigFile = targetFile || this.store.getPathResolver().getUserGitConfigFile();
+    const backupPath = this.createBackup(gitConfigFile);
+    let originalContent = "";
+    if (import_node_fs3.default.existsSync(gitConfigFile)) {
+      originalContent = import_node_fs3.default.readFileSync(gitConfigFile, "utf-8");
+    }
+    const blockContent = [
+      GITCONFIG_BLOCK_START,
+      `# Do not edit this block directly. Manage via: gitbridge / gb`,
+      `[include]`,
+      `    path = ${mainConfigPath}`,
+      GITCONFIG_BLOCK_END
+    ].join("\n");
+    let newContent;
+    if (originalContent.includes(GITCONFIG_BLOCK_START) && originalContent.includes(GITCONFIG_BLOCK_END)) {
+      const before = originalContent.substring(0, originalContent.indexOf(GITCONFIG_BLOCK_START));
+      const after = originalContent.substring(originalContent.indexOf(GITCONFIG_BLOCK_END) + GITCONFIG_BLOCK_END.length);
+      newContent = `${before.trimEnd()}
+
+${blockContent}
+
+${after.trimStart()}`.trim() + "\n";
+    } else {
+      newContent = `${originalContent.trimEnd()}
+
+${blockContent}
+`.trimStart();
+    }
+    import_node_fs3.default.writeFileSync(gitConfigFile, newContent, { encoding: "utf-8", mode: 420 });
+    return { success: true, backupPath };
+  }
+  remove(targetFile) {
+    const gitConfigFile = targetFile || this.store.getPathResolver().getUserGitConfigFile();
+    if (!import_node_fs3.default.existsSync(gitConfigFile)) return true;
+    const originalContent = import_node_fs3.default.readFileSync(gitConfigFile, "utf-8");
+    if (!originalContent.includes(GITCONFIG_BLOCK_START)) return true;
+    const before = originalContent.substring(0, originalContent.indexOf(GITCONFIG_BLOCK_START));
+    const after = originalContent.substring(originalContent.indexOf(GITCONFIG_BLOCK_END) + GITCONFIG_BLOCK_END.length);
+    const cleaned = `${before.trimEnd()}
+${after.trimStart()}`.trim();
+    if (cleaned.length === 0) {
+      import_node_fs3.default.writeFileSync(gitConfigFile, "", { encoding: "utf-8", mode: 420 });
+    } else {
+      import_node_fs3.default.writeFileSync(gitConfigFile, `${cleaned}
+`, { encoding: "utf-8", mode: 420 });
+    }
+    return true;
+  }
+};
+
+// src/core/ssh/ssh-injector.ts
+var import_node_fs5 = __toESM(require("node:fs"));
+var import_node_path5 = __toESM(require("node:path"));
+
+// src/core/ssh/ssh-config-generator.ts
+var import_node_fs4 = __toESM(require("node:fs"));
+var SshConfigGenerator = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  generate() {
+    this.store.ensureDirectories();
+    const accounts = this.store.loadAccounts();
+    const paths = this.store.getPathResolver();
+    const generatedSshFile = paths.getGeneratedSshConfigFile();
+    let content = `# Auto-generated by GitBridge. DO NOT EDIT DIRECTLY.
+`;
+    content += `# Generated at: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+`;
+    const sshAccounts = accounts.filter((a) => a.sshKeyPath);
+    if (sshAccounts.length === 0) {
+      content += `# No accounts currently configured with custom SSH keys.
+`;
+    } else {
+      for (const account of sshAccounts) {
+        const hostAlias = `${account.host}-${account.id}`;
+        const keyPath = expandTilde(account.sshKeyPath);
+        content += `# Account: ${account.displayName || account.username} (${account.providerId})
+`;
+        content += `Host ${hostAlias}
+`;
+        content += `    HostName ${account.host}
+`;
+        content += `    User git
+`;
+        content += `    IdentityFile ${keyPath}
+`;
+        content += `    IdentitiesOnly yes
+
+`;
+      }
+    }
+    import_node_fs4.default.writeFileSync(generatedSshFile, content, { encoding: "utf-8", mode: 384 });
+    return generatedSshFile;
+  }
+};
+
+// src/core/ssh/ssh-injector.ts
+var SSH_BLOCK_START = "# --- BEGIN GITBRIDGE MANAGED BLOCK ---";
+var SSH_BLOCK_END = "# --- END GITBRIDGE MANAGED BLOCK ---";
+var SshInjector = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  isInstalled(targetFile) {
+    const sshConfigFile = targetFile || this.store.getPathResolver().getUserSshConfigFile();
+    if (!import_node_fs5.default.existsSync(sshConfigFile)) return false;
+    const content = import_node_fs5.default.readFileSync(sshConfigFile, "utf-8");
+    return content.includes(SSH_BLOCK_START) && content.includes(SSH_BLOCK_END);
+  }
+  createBackup(sshConfigFile) {
+    if (!import_node_fs5.default.existsSync(sshConfigFile)) return null;
+    const backupsDir = this.store.getPathResolver().getBackupsDir();
+    if (!import_node_fs5.default.existsSync(backupsDir)) {
+      import_node_fs5.default.mkdirSync(backupsDir, { recursive: true });
+    }
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const backupFile = import_node_path5.default.join(backupsDir, `ssh_config.${timestamp}.bak`);
+    import_node_fs5.default.copyFileSync(sshConfigFile, backupFile);
+    const primaryBak = `${sshConfigFile}.gitbridge.bak`;
+    if (!import_node_fs5.default.existsSync(primaryBak)) {
+      import_node_fs5.default.copyFileSync(sshConfigFile, primaryBak);
+    }
+    return backupFile;
+  }
+  inject(targetFile) {
+    const generator = new SshConfigGenerator(this.store);
+    const generatedPath = generator.generate();
+    const sshConfigFile = targetFile || this.store.getPathResolver().getUserSshConfigFile();
+    const sshDir = import_node_path5.default.dirname(sshConfigFile);
+    if (!import_node_fs5.default.existsSync(sshDir)) {
+      import_node_fs5.default.mkdirSync(sshDir, { recursive: true, mode: 448 });
+    }
+    const backupPath = this.createBackup(sshConfigFile);
+    let originalContent = "";
+    if (import_node_fs5.default.existsSync(sshConfigFile)) {
+      originalContent = import_node_fs5.default.readFileSync(sshConfigFile, "utf-8");
+    }
+    const includePath = collapseTilde(generatedPath);
+    const blockContent = [
+      SSH_BLOCK_START,
+      `# Do not edit this block directly. Manage via: gitbridge / gb`,
+      `Include ${includePath}`,
+      SSH_BLOCK_END
+    ].join("\n");
+    let newContent;
+    if (originalContent.includes(SSH_BLOCK_START) && originalContent.includes(SSH_BLOCK_END)) {
+      const before = originalContent.substring(0, originalContent.indexOf(SSH_BLOCK_START));
+      const after = originalContent.substring(originalContent.indexOf(SSH_BLOCK_END) + SSH_BLOCK_END.length);
+      newContent = `${blockContent}
+
+${before.trim()}
+${after.trim()}`.trim() + "\n";
+    } else {
+      newContent = `${blockContent}
+
+${originalContent.trim()}`.trim() + "\n";
+    }
+    import_node_fs5.default.writeFileSync(sshConfigFile, newContent, { encoding: "utf-8", mode: 384 });
+    return { success: true, backupPath };
+  }
+  remove(targetFile) {
+    const sshConfigFile = targetFile || this.store.getPathResolver().getUserSshConfigFile();
+    if (!import_node_fs5.default.existsSync(sshConfigFile)) return true;
+    const originalContent = import_node_fs5.default.readFileSync(sshConfigFile, "utf-8");
+    if (!originalContent.includes(SSH_BLOCK_START)) return true;
+    const before = originalContent.substring(0, originalContent.indexOf(SSH_BLOCK_START));
+    const after = originalContent.substring(originalContent.indexOf(SSH_BLOCK_END) + SSH_BLOCK_END.length);
+    const cleaned = `${before.trim()}
+${after.trim()}`.trim();
+    if (cleaned.length === 0) {
+      import_node_fs5.default.writeFileSync(sshConfigFile, "", { encoding: "utf-8", mode: 384 });
+    } else {
+      import_node_fs5.default.writeFileSync(sshConfigFile, `${cleaned}
+`, { encoding: "utf-8", mode: 384 });
+    }
+    return true;
+  }
+};
+
+// src/cli/ui/banners.ts
+var import_picocolors = __toESM(require("picocolors"));
+function showBanner() {
+  console.log(
+    import_picocolors.default.cyan(`
+  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+  \u2502                   ${import_picocolors.default.bold("GitBridge")}                      \u2502
+  \u2502   Universal Git Identity & Multi-Account Layer   \u2502
+  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+    `)
+  );
+}
+function formatBadge(text2, color = "blue") {
+  switch (color) {
+    case "green":
+      return import_picocolors.default.bgGreen(import_picocolors.default.black(` ${text2} `));
+    case "blue":
+      return import_picocolors.default.bgBlue(import_picocolors.default.white(` ${text2} `));
+    case "yellow":
+      return import_picocolors.default.bgYellow(import_picocolors.default.black(` ${text2} `));
+    case "red":
+      return import_picocolors.default.bgRed(import_picocolors.default.white(` ${text2} `));
+    case "magenta":
+      return import_picocolors.default.bgMagenta(import_picocolors.default.white(` ${text2} `));
+    case "cyan":
+      return import_picocolors.default.bgCyan(import_picocolors.default.black(` ${text2} `));
+  }
+}
+
+// src/cli/ui/tables.ts
+var import_cli_table3 = __toESM(require("cli-table3"));
+var import_picocolors2 = __toESM(require("picocolors"));
+function renderIdentitiesTable(identities, defaultId) {
+  if (identities.length === 0) {
+    return import_picocolors2.default.gray("  No identities configured yet. Run 'gitbridge identity add' to create one.\n");
+  }
+  const table = new import_cli_table3.default({
+    head: [import_picocolors2.default.bold("ID"), import_picocolors2.default.bold("Name"), import_picocolors2.default.bold("Email"), import_picocolors2.default.bold("Default"), import_picocolors2.default.bold("Signing Key")],
+    style: { head: ["cyan"] }
+  });
+  for (const id of identities) {
+    const isDef = id.id === defaultId || id.isDefault;
+    table.push([
+      import_picocolors2.default.cyan(id.id),
+      id.name,
+      id.email,
+      isDef ? import_picocolors2.default.green("\u2714 yes") : import_picocolors2.default.gray("no"),
+      id.signingKey ? import_picocolors2.default.yellow(id.signingKey.slice(0, 20) + "...") : import_picocolors2.default.gray("none")
+    ]);
+  }
+  return table.toString();
+}
+function renderAccountsTable(accounts) {
+  if (accounts.length === 0) {
+    return import_picocolors2.default.gray("  No accounts logged in yet. Run 'gitbridge auth login <provider>' to add one.\n");
+  }
+  const table = new import_cli_table3.default({
+    head: [import_picocolors2.default.bold("ID"), import_picocolors2.default.bold("Provider"), import_picocolors2.default.bold("Username"), import_picocolors2.default.bold("Host"), import_picocolors2.default.bold("Auth Type"), import_picocolors2.default.bold("SSH Key")],
+    style: { head: ["cyan"] }
+  });
+  for (const acc of accounts) {
+    table.push([
+      import_picocolors2.default.cyan(acc.id),
+      import_picocolors2.default.magenta(acc.providerId.toUpperCase()),
+      acc.username,
+      acc.host,
+      acc.authType,
+      acc.sshKeyPath ? import_picocolors2.default.yellow(acc.sshKeyPath) : import_picocolors2.default.gray("none")
+    ]);
+  }
+  return table.toString();
+}
+function renderRulesTable(rules) {
+  if (rules.length === 0) {
+    return import_picocolors2.default.gray("  No directory rules configured. Run 'gitbridge rule add' to map directories.\n");
+  }
+  const table = new import_cli_table3.default({
+    head: [import_picocolors2.default.bold("Rule ID"), import_picocolors2.default.bold("Directory Path"), import_picocolors2.default.bold("Identity"), import_picocolors2.default.bold("Provider"), import_picocolors2.default.bold("Account")],
+    style: { head: ["cyan"] }
+  });
+  for (const rule of rules) {
+    table.push([
+      import_picocolors2.default.cyan(rule.id),
+      import_picocolors2.default.blue(rule.path),
+      import_picocolors2.default.green(rule.identityId),
+      rule.defaultProvider ? import_picocolors2.default.magenta(rule.defaultProvider) : import_picocolors2.default.gray("any"),
+      rule.defaultAccountId ? import_picocolors2.default.yellow(rule.defaultAccountId) : import_picocolors2.default.gray("any")
+    ]);
+  }
+  return table.toString();
+}
+function renderRemotesTable(remotes) {
+  if (remotes.length === 0) {
+    return import_picocolors2.default.gray("  No Git remotes found.\n");
+  }
+  const table = new import_cli_table3.default({
+    head: [import_picocolors2.default.bold("Remote"), import_picocolors2.default.bold("Provider"), import_picocolors2.default.bold("Host"), import_picocolors2.default.bold("Repo / Org"), import_picocolors2.default.bold("Account Alias")],
+    style: { head: ["cyan"] }
+  });
+  for (const r of remotes) {
+    const parsed = r.parsedPush || r.parsedFetch;
+    table.push([
+      import_picocolors2.default.cyan(r.name),
+      parsed ? import_picocolors2.default.magenta(parsed.providerId.toUpperCase()) : import_picocolors2.default.gray("unknown"),
+      parsed ? parsed.host : import_picocolors2.default.gray("unknown"),
+      parsed ? parsed.fullName : import_picocolors2.default.gray("unknown"),
+      parsed?.accountAlias ? import_picocolors2.default.yellow(parsed.accountAlias) : import_picocolors2.default.gray("default")
+    ]);
+  }
+  return table.toString();
+}
+
+// src/cli/commands/status.ts
+async function handleStatusCommand(store = defaultConfigStore) {
+  showBanner();
+  const config = store.loadConfig();
+  const identities = store.loadIdentities();
+  const accounts = store.loadAccounts();
+  const rules = store.loadRules();
+  const gitInjector = new GitConfigInjector(store);
+  const sshInjector = new SshInjector(store);
+  const gitInstalled = gitInjector.isInstalled();
+  const sshInstalled = sshInjector.isInstalled();
+  console.log(import_picocolors3.default.bold("  STATUS OVERVIEW"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  GitBridge Mode:         ${config.enabled ? formatBadge("ENABLED", "green") : formatBadge("DISABLED", "red")}`);
+  console.log(`  Git Extension Block:    ${gitInstalled ? import_picocolors3.default.green("\u2714 Active in ~/.gitconfig") : import_picocolors3.default.yellow("\u26A0 Not installed (run 'gitbridge enable')")}`);
+  console.log(`  SSH Extension Block:    ${sshInstalled ? import_picocolors3.default.green("\u2714 Active in ~/.ssh/config") : import_picocolors3.default.gray("\u25CB Not installed")}`);
+  console.log(`  Default Identity:       ${config.defaultIdentityId ? import_picocolors3.default.cyan(config.defaultIdentityId) : import_picocolors3.default.gray("none")}`);
+  console.log("");
+  console.log(import_picocolors3.default.bold("  IDENTITIES"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(renderIdentitiesTable(identities, config.defaultIdentityId));
+  console.log("");
+  console.log(import_picocolors3.default.bold("  AUTHENTICATED PROVIDER ACCOUNTS"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(renderAccountsTable(accounts));
+  console.log("");
+  console.log(import_picocolors3.default.bold("  DIRECTORY RULES"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(renderRulesTable(rules));
+  console.log("");
+}
+
+// src/utils/logger.ts
+var import_picocolors4 = __toESM(require("picocolors"));
+var Logger = class {
+  isDebug = process.env.DEBUG === "true" || process.env.GITBRIDGE_DEBUG === "1";
+  setDebug(val) {
+    this.isDebug = val;
+  }
+  debug(msg, ...args) {
+    if (this.isDebug) {
+      console.log(import_picocolors4.default.gray(`[DEBUG] ${msg}`), ...args);
+    }
+  }
+  info(msg) {
+    console.log(import_picocolors4.default.blue("\u2139 ") + msg);
+  }
+  success(msg) {
+    console.log(import_picocolors4.default.green("\u2714 ") + import_picocolors4.default.bold(msg));
+  }
+  warn(msg) {
+    console.log(import_picocolors4.default.yellow("\u26A0 ") + import_picocolors4.default.yellow(msg));
+  }
+  error(msg, err) {
+    console.error(import_picocolors4.default.red("\u2716 ") + import_picocolors4.default.red(msg));
+    if (err && this.isDebug) {
+      console.error(err);
+    }
+  }
+  highlight(text2) {
+    return import_picocolors4.default.cyan(text2);
+  }
+  dim(text2) {
+    return import_picocolors4.default.gray(text2);
+  }
+  bold(text2) {
+    return import_picocolors4.default.bold(text2);
+  }
+};
+var logger = new Logger();
+
+// src/cli/commands/enable.ts
+var import_picocolors5 = __toESM(require("picocolors"));
+async function handleEnableCommand(store = defaultConfigStore) {
+  store.setEnabled(true);
+  const gitInjector = new GitConfigInjector(store);
+  const sshInjector = new SshInjector(store);
+  const gitRes = gitInjector.inject();
+  const sshRes = sshInjector.inject();
+  logger.success("GitBridge enabled successfully!");
+  if (gitRes.backupPath) {
+    logger.debug(`Created backup of .gitconfig at ${gitRes.backupPath}`);
+  }
+  if (sshRes.backupPath) {
+    logger.debug(`Created backup of .ssh/config at ${sshRes.backupPath}`);
+  }
+  console.log(import_picocolors5.default.green("\n\u2714 GitBridge integration is now active."));
+  console.log(import_picocolors5.default.gray("  \u2022 Native Git commands (commit, push, pull) will now inherit GitBridge context."));
+  console.log(import_picocolors5.default.gray("  \u2022 Run 'gitbridge status' or 'gitbridge context' to inspect current setup.\n"));
+}
+async function handleDisableCommand(store = defaultConfigStore) {
+  store.setEnabled(false);
+  const gitInjector = new GitConfigInjector(store);
+  const sshInjector = new SshInjector(store);
+  gitInjector.remove();
+  sshInjector.remove();
+  logger.success("GitBridge disabled successfully!");
+  console.log(import_picocolors5.default.yellow("\n\u26A0 GitBridge integration has been safely removed."));
+  console.log(import_picocolors5.default.gray("  \u2022 ~/.gitconfig and ~/.ssh/config have been restored to native settings."));
+  console.log(import_picocolors5.default.gray("  \u2022 Run 'gitbridge enable' to reactivate whenever you want.\n"));
+}
+
+// src/cli/ui/prompts.ts
+var p = __toESM(require("@clack/prompts"));
+var import_picocolors6 = __toESM(require("picocolors"));
+function handleCancel() {
+  p.cancel(import_picocolors6.default.yellow("Operation cancelled."));
+  process.exit(0);
+}
+async function promptText(options) {
+  const res = await p.text({
+    message: options.message,
+    placeholder: options.placeholder,
+    defaultValue: options.defaultValue,
+    validate: options.validate
+  });
+  if (p.isCancel(res)) handleCancel();
+  return String(res);
+}
+async function promptSelect(options) {
+  const res = await p.select({
+    message: options.message,
+    options: options.options,
+    initialValue: options.initialValue
+  });
+  if (p.isCancel(res)) handleCancel();
+  return res;
+}
+async function promptMultiSelect(options) {
+  const res = await p.multiselect({
+    message: options.message,
+    options: options.options,
+    required: options.required
+  });
+  if (p.isCancel(res)) handleCancel();
+  return res;
+}
+async function promptConfirm(options) {
+  const res = await p.confirm({
+    message: options.message,
+    active: options.active,
+    inactive: options.inactive,
+    initialValue: options.initialValue
+  });
+  if (p.isCancel(res)) handleCancel();
+  return Boolean(res);
+}
+
+// src/cli/commands/identity.ts
+var import_picocolors7 = __toESM(require("picocolors"));
+async function handleIdentityList(store = defaultConfigStore) {
+  const identities = store.loadIdentities();
+  const config = store.loadConfig();
+  console.log(import_picocolors7.default.bold("\n  GIT IDENTITIES"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(renderIdentitiesTable(identities, config.defaultIdentityId));
+}
+async function handleIdentityAdd(options = {}, store = defaultConfigStore) {
+  const isInteractive = !options.id && !options.name && !options.email;
+  let id = options.id;
+  let name = options.name;
+  let email = options.email;
+  let signingKey = options.signingKey || null;
+  let isDefault = options.default;
+  if (!id) {
+    id = await promptText({
+      message: "Enter an identity ID (e.g. personal, work, client-acme):",
+      validate: (val) => {
+        if (!val || !val.trim()) return "Identity ID is required.";
+        if (store.getIdentity(val.trim())) return "An identity with this ID already exists.";
+        return void 0;
+      }
+    });
+  }
+  if (!name) {
+    name = await promptText({
+      message: "Enter full name for Git commits (e.g. Fuad Tesfaye):",
+      validate: (val) => !val || !val.trim() ? "Name is required." : void 0
+    });
+  }
+  if (!email) {
+    email = await promptText({
+      message: "Enter email address for Git commits:",
+      validate: (val) => !val || !val.includes("@") ? "Please enter a valid email address." : void 0
+    });
+  }
+  if (isInteractive && signingKey === null) {
+    const addKey = await promptConfirm({
+      message: "Do you want to configure an SSH or GPG commit signing key for this identity?",
+      initialValue: false
+    });
+    if (addKey) {
+      signingKey = await promptText({
+        message: "Enter signing key (SSH public key or GPG Key ID):"
+      });
+    }
+  }
+  if (isDefault === void 0) {
+    const existing = store.loadIdentities();
+    if (existing.length === 0) {
+      isDefault = true;
+    } else if (isInteractive) {
+      isDefault = await promptConfirm({
+        message: "Set this identity as your global default identity?",
+        initialValue: false
+      });
+    } else {
+      isDefault = false;
+    }
+  }
+  const created = store.addIdentity({
+    id: id.trim(),
+    name: name.trim(),
+    email: email.trim(),
+    signingKey: signingKey ? signingKey.trim() : null,
+    isDefault
+  });
+  const generator = new GitConfigGenerator(store);
+  generator.generate();
+  logger.success(`Identity '${created.id}' created successfully!`);
+  console.log(import_picocolors7.default.gray(`  Name:  ${created.name}`));
+  console.log(import_picocolors7.default.gray(`  Email: ${created.email}`));
+  if (created.isDefault) {
+    console.log(import_picocolors7.default.green("  Set as global default identity."));
+  }
+  console.log("");
+}
+async function handleIdentityUse(id, store = defaultConfigStore) {
+  const target = store.getIdentity(id);
+  if (!target) {
+    logger.error(`Identity with ID '${id}' does not exist.`);
+    return;
+  }
+  store.setDefaultIdentity(id);
+  const generator = new GitConfigGenerator(store);
+  generator.generate();
+  logger.success(`Switched global default Git identity to '${target.id}' (${target.email})`);
+}
+async function handleIdentityRemove(id, store = defaultConfigStore) {
+  const removed = store.removeIdentity(id);
+  if (!removed) {
+    logger.error(`Identity with ID '${id}' not found.`);
+    return;
+  }
+  const generator = new GitConfigGenerator(store);
+  generator.generate();
+  logger.success(`Removed identity '${id}'.`);
+}
+
+// src/core/storage/linux-keyring.ts
+var LinuxKeyringCredentialStore = class {
+  name = "Linux Secret Service (secret-tool)";
+  async isAvailable() {
+    try {
+      const proc = Bun.spawn(["which", "secret-tool"], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      const code = await proc.exited;
+      return code === 0;
+    } catch {
+      return false;
+    }
+  }
+  async set(service, account, secret) {
+    try {
+      const proc = Bun.spawn(
+        ["secret-tool", "store", "--label", `GitBridge (${service}:${account})`, "service", service, "account", account],
+        {
+          stdin: "pipe",
+          stdout: "pipe",
+          stderr: "pipe"
+        }
+      );
+      proc.stdin.write(secret);
+      proc.stdin.end();
+      const code = await proc.exited;
+      if (code !== 0) {
+        const stderr = await new Response(proc.stderr).text();
+        throw new Error(stderr.trim() || `secret-tool store exited with code ${code}`);
+      }
+    } catch (err) {
+      throw new CredentialStoreError(
+        `Failed to store credential in Linux Keyring: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  async get(service, account) {
+    try {
+      const proc = Bun.spawn(["secret-tool", "lookup", "service", service, "account", account], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      const stdout = await new Response(proc.stdout).text();
+      const code = await proc.exited;
+      if (code === 0 && stdout.trim().length > 0) {
+        return stdout.trim();
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async delete(service, account) {
+    try {
+      const proc = Bun.spawn(["secret-tool", "clear", "service", service, "account", account], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      await proc.exited;
+    } catch {
+    }
+  }
+};
+
+// src/core/storage/macos-keychain.ts
+var MacOSKeychainCredentialStore = class {
+  name = "macOS Keychain";
+  async isAvailable() {
+    if (process.platform !== "darwin") return false;
+    try {
+      const proc = Bun.spawn(["which", "security"], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      const code = await proc.exited;
+      return code === 0;
+    } catch {
+      return false;
+    }
+  }
+  async set(service, account, secret) {
+    try {
+      await this.delete(service, account);
+      const proc = Bun.spawn(
+        ["security", "add-generic-password", "-a", account, "-s", service, "-w", secret, "-U"],
+        {
+          stdout: "pipe",
+          stderr: "pipe"
+        }
+      );
+      const code = await proc.exited;
+      if (code !== 0) {
+        const stderr = await new Response(proc.stderr).text();
+        throw new Error(stderr.trim() || `security add-generic-password exited with code ${code}`);
+      }
+    } catch (err) {
+      throw new CredentialStoreError(
+        `Failed to store credential in macOS Keychain: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  async get(service, account) {
+    try {
+      const proc = Bun.spawn(["security", "find-generic-password", "-a", account, "-s", service, "-w"], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      const stdout = await new Response(proc.stdout).text();
+      const code = await proc.exited;
+      if (code === 0 && stdout.trim().length > 0) {
+        return stdout.trim();
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async delete(service, account) {
+    try {
+      const proc = Bun.spawn(["security", "delete-generic-password", "-a", account, "-s", service], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      await proc.exited;
+    } catch {
+    }
+  }
+};
+
+// src/core/storage/windows-cred.ts
+var WindowsCredentialStore = class {
+  name = "Windows Credential Manager";
+  async isAvailable() {
+    return process.platform === "win32";
+  }
+  targetName(service, account) {
+    return `gitbridge:${service}:${account}`;
+  }
+  async set(service, account, secret) {
+    const target = this.targetName(service, account);
+    try {
+      const proc = Bun.spawn(["cmdkey", `/generic:${target}`, `/user:${account}`, `/pass:${secret}`], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      const code = await proc.exited;
+      if (code !== 0) {
+        const stderr = await new Response(proc.stderr).text();
+        throw new Error(stderr.trim() || `cmdkey exited with code ${code}`);
+      }
+    } catch (err) {
+      throw new CredentialStoreError(
+        `Failed to store credential in Windows Credential Manager: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  async get(service, account) {
+    const target = this.targetName(service, account);
+    try {
+      const script = `
+        Add-Type -AssemblyName System.Security
+        $target = "${target}"
+        $cred = [System.Net.CredentialCache]::DefaultCredentials
+        # Note: full extraction on Windows uses powershell credential lookup
+      `;
+      const proc = Bun.spawn(["powershell", "-NoProfile", "-NonInteractive", "-Command", script], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      const stdout = await new Response(proc.stdout).text();
+      const code = await proc.exited;
+      if (code === 0 && stdout.trim()) {
+        return stdout.trim();
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async delete(service, account) {
+    const target = this.targetName(service, account);
+    try {
+      const proc = Bun.spawn(["cmdkey", `/delete:${target}`], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      await proc.exited;
+    } catch {
+    }
+  }
+};
+
+// src/core/storage/encrypted-vault.ts
+var import_node_crypto = __toESM(require("node:crypto"));
+var import_node_fs6 = __toESM(require("node:fs"));
+var import_node_path6 = __toESM(require("node:path"));
+var import_node_os2 = __toESM(require("node:os"));
+var EncryptedVaultCredentialStore = class {
+  name = "Encrypted Vault (AES-256-GCM)";
+  paths;
+  constructor(paths) {
+    this.paths = paths;
+  }
+  async isAvailable() {
+    return true;
+  }
+  getMachineSecret() {
+    const hostname = import_node_os2.default.hostname();
+    const user = import_node_os2.default.userInfo().username;
+    const homedir = import_node_os2.default.homedir();
+    return `gitbridge-vault-key:${hostname}:${user}:${homedir}`;
+  }
+  deriveKey(salt) {
+    const secret = this.getMachineSecret();
+    return import_node_crypto.default.pbkdf2Sync(secret, salt, 1e5, 32, "sha256");
+  }
+  readVault() {
+    const file = this.paths.getEncryptedVaultFile();
+    if (!import_node_fs6.default.existsSync(file)) {
+      return {};
+    }
+    try {
+      const buffer = import_node_fs6.default.readFileSync(file);
+      if (buffer.length < 16 + 12 + 16) {
+        return {};
+      }
+      const salt = buffer.subarray(0, 16);
+      const iv = buffer.subarray(16, 28);
+      const tag = buffer.subarray(28, 44);
+      const ciphertext = buffer.subarray(44);
+      const key = this.deriveKey(salt);
+      const decipher = import_node_crypto.default.createDecipheriv("aes-256-gcm", key, iv);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      return JSON.parse(decrypted.toString("utf-8"));
+    } catch {
+      return {};
+    }
+  }
+  writeVault(data) {
+    const file = this.paths.getEncryptedVaultFile();
+    try {
+      const dir = import_node_path6.default.dirname(file);
+      if (!import_node_fs6.default.existsSync(dir)) {
+        import_node_fs6.default.mkdirSync(dir, { recursive: true, mode: 448 });
+      }
+      const salt = import_node_crypto.default.randomBytes(16);
+      const iv = import_node_crypto.default.randomBytes(12);
+      const key = this.deriveKey(salt);
+      const cipher = import_node_crypto.default.createCipheriv("aes-256-gcm", key, iv);
+      const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
+      const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+      const tag = cipher.getAuthTag();
+      const payload = Buffer.concat([salt, iv, tag, ciphertext]);
+      const tempFile = `${file}.tmp.${Date.now()}`;
+      import_node_fs6.default.writeFileSync(tempFile, payload, { mode: 384 });
+      import_node_fs6.default.renameSync(tempFile, file);
+    } catch (err) {
+      throw new CredentialStoreError(
+        `Failed to write encrypted vault: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  makeKey(service, account) {
+    return `${service}:::${account}`;
+  }
+  async set(service, account, secret) {
+    const vault = this.readVault();
+    vault[this.makeKey(service, account)] = secret;
+    this.writeVault(vault);
+  }
+  async get(service, account) {
+    const vault = this.readVault();
+    return vault[this.makeKey(service, account)] ?? null;
+  }
+  async delete(service, account) {
+    const vault = this.readVault();
+    delete vault[this.makeKey(service, account)];
+    this.writeVault(vault);
+  }
+};
+
+// src/core/storage/store-factory.ts
+var CompositeCredentialStore = class {
+  name;
+  primary;
+  fallback;
+  constructor(primary, fallback) {
+    this.primary = primary;
+    this.fallback = fallback;
+    this.name = `${primary.name} (with Encrypted Vault fallback)`;
+  }
+  async isAvailable() {
+    return true;
+  }
+  async set(service, account, secret) {
+    try {
+      await this.primary.set(service, account, secret);
+    } catch {
+      await this.fallback.set(service, account, secret);
+    }
+  }
+  async get(service, account) {
+    try {
+      const val = await this.primary.get(service, account);
+      if (val !== null && val.length > 0) {
+        return val;
+      }
+    } catch {
+    }
+    return this.fallback.get(service, account);
+  }
+  async delete(service, account) {
+    try {
+      await this.primary.delete(service, account);
+    } catch {
+    }
+    await this.fallback.delete(service, account);
+  }
+};
+var StoreFactory = class {
+  static async getStore(paths = defaultPathResolver, forceEncrypted = false) {
+    const vault = new EncryptedVaultCredentialStore(paths);
+    if (forceEncrypted || process.env.GITBRIDGE_USE_VAULT === "1" || process.env.NODE_ENV === "test") {
+      return vault;
+    }
+    if (process.platform === "darwin") {
+      const macStore = new MacOSKeychainCredentialStore();
+      if (await macStore.isAvailable()) {
+        return new CompositeCredentialStore(macStore, vault);
+      }
+    } else if (process.platform === "win32") {
+      const winStore = new WindowsCredentialStore();
+      if (await winStore.isAvailable()) {
+        return new CompositeCredentialStore(winStore, vault);
+      }
+    } else if (process.platform === "linux") {
+      const linuxStore = new LinuxKeyringCredentialStore();
+      if (await linuxStore.isAvailable()) {
+        return new CompositeCredentialStore(linuxStore, vault);
+      }
+    }
+    return vault;
+  }
+};
+
+// src/cli/commands/account.ts
+var import_picocolors8 = __toESM(require("picocolors"));
+async function handleAccountList(store = defaultConfigStore) {
+  const accounts = store.loadAccounts();
+  console.log(import_picocolors8.default.bold("\n  AUTHENTICATED PROVIDER ACCOUNTS"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(renderAccountsTable(accounts));
+}
+async function handleAccountRemove(id, store = defaultConfigStore) {
+  const account = store.getAccount(id);
+  if (!account) {
+    logger.error(`Account with ID '${id}' not found.`);
+    return;
+  }
+  const credStore = await StoreFactory.getStore(store.getPathResolver());
+  await credStore.delete(account.host, account.id);
+  store.removeAccount(id);
+  const sshGen = new SshConfigGenerator(store);
+  sshGen.generate();
+  logger.success(`Removed account '${id}' and erased credentials.`);
+}
+
+// src/cli/commands/auth.ts
+var import_ora = __toESM(require("ora"));
+var import_picocolors9 = __toESM(require("picocolors"));
+
+// src/utils/http.ts
+async function requestJson(url, method = "GET", body, options = {}) {
+  let targetUrl = url;
+  if (options.params) {
+    const searchParams = new URLSearchParams();
+    for (const [key, value] of Object.entries(options.params)) {
+      if (value !== void 0) {
+        searchParams.append(key, String(value));
+      }
+    }
+    const queryString = searchParams.toString();
+    if (queryString) {
+      targetUrl += (url.includes("?") ? "&" : "?") + queryString;
+    }
+  }
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 15e3);
+  try {
+    const headers = {
+      "User-Agent": "GitBridge-CLI/0.1.0",
+      Accept: "application/json",
+      ...options.headers
+    };
+    let serializedBody;
+    if (body !== void 0) {
+      if (typeof body === "string") {
+        serializedBody = body;
+      } else {
+        serializedBody = JSON.stringify(body);
+        if (!headers["Content-Type"]) {
+          headers["Content-Type"] = "application/json";
+        }
+      }
+    }
+    const res = await fetch(targetUrl, {
+      method,
+      headers,
+      body: serializedBody,
+      signal: controller.signal
+    });
+    clearTimeout(timeout);
+    let responseData;
+    const contentType = res.headers.get("content-type") || "";
+    if (contentType.includes("application/json")) {
+      responseData = await res.json();
+    } else {
+      const text2 = await res.text();
+      try {
+        responseData = JSON.parse(text2);
+      } catch {
+        responseData = text2;
+      }
+    }
+    return {
+      data: responseData,
+      status: res.status,
+      headers: res.headers
+    };
+  } catch (err) {
+    clearTimeout(timeout);
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`Request to ${url} timed out after ${options.timeoutMs ?? 15e3}ms`);
+    }
+    throw err;
+  }
+}
+
+// src/core/providers/github.provider.ts
+var GITHUB_CLIENT_ID = process.env.GITBRIDGE_GITHUB_CLIENT_ID || "Iv1.b507a08c87ecfe98";
+var GitHubProvider = class {
+  id = "github";
+  name = "GitHub";
+  defaultHost = "github.com";
+  getApiUrl(host) {
+    const targetHost = host || this.defaultHost;
+    if (targetHost === "github.com") {
+      return "https://api.github.com";
+    }
+    return `https://${targetHost}/api/v3`;
+  }
+  async validateToken(token, host) {
+    try {
+      const api = this.getApiUrl(host);
+      const res = await requestJson(`${api}/user`, "GET", void 0, {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "X-GitHub-Api-Version": "2022-11-28"
+        }
+      });
+      return res.status === 200;
+    } catch {
+      return false;
+    }
+  }
+  async getUser(token, host) {
+    const api = this.getApiUrl(host);
+    const res = await requestJson(`${api}/user`, "GET", void 0, {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28"
+      }
+    });
+    if (res.status !== 200 || !res.data.login) {
+      throw new ProviderError(res.data.message || `Failed to fetch user (status: ${res.status})`, this.name);
+    }
+    return {
+      id: String(res.data.id),
+      username: res.data.login,
+      displayName: res.data.name || res.data.login,
+      email: res.data.email,
+      avatarUrl: res.data.avatar_url
+    };
+  }
+  async listRepositories(token, host) {
+    const api = this.getApiUrl(host);
+    const res = await requestJson(`${api}/user/repos?per_page=50&sort=updated`, "GET", void 0, {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28"
+      }
+    });
+    if (res.status !== 200 || !Array.isArray(res.data)) {
+      throw new ProviderError(`Failed to fetch repositories (status: ${res.status})`, this.name);
+    }
+    return res.data.map((r) => ({
+      id: String(r.id),
+      name: r.name,
+      fullName: r.full_name,
+      sshUrl: r.ssh_url,
+      httpsUrl: r.clone_url,
+      isPrivate: r.private,
+      defaultBranch: r.default_branch || "main",
+      htmlUrl: r.html_url
+    }));
+  }
+  async checkHealth(host) {
+    const api = this.getApiUrl(host);
+    const start = Date.now();
+    try {
+      const res = await requestJson(`${api}/rate_limit`, "GET", void 0, { timeoutMs: 8e3 });
+      const pingMs = Date.now() - start;
+      return {
+        apiOk: res.status === 200 || res.status === 401 || res.status === 403,
+        pingMs,
+        message: "GitHub API reachable"
+      };
+    } catch (err) {
+      return {
+        apiOk: false,
+        pingMs: Date.now() - start,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async startDeviceFlow() {
+    const res = await requestJson("https://github.com/login/device/code", "POST", {
+      client_id: GITHUB_CLIENT_ID,
+      scope: "repo,read:user,user:email"
+    });
+    if (!res.data.device_code) {
+      throw new ProviderError(res.data.error || "Failed to start GitHub device flow", this.name);
+    }
+    return {
+      deviceCode: res.data.device_code,
+      userCode: res.data.user_code,
+      verificationUri: res.data.verification_uri,
+      expiresIn: res.data.expires_in,
+      interval: res.data.interval || 5
+    };
+  }
+  async pollDeviceFlow(deviceCode, interval = 5) {
+    const pollIntervalMs = (interval + 1) * 1e3;
+    const maxAttempts = 60;
+    for (let i = 0; i < maxAttempts; i++) {
+      await new Promise((r) => setTimeout(r, pollIntervalMs));
+      const res = await requestJson("https://github.com/login/oauth/access_token", "POST", {
+        client_id: GITHUB_CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      });
+      if (res.data.access_token) {
+        return { token: res.data.access_token };
+      }
+      if (res.data.error === "authorization_pending") {
+        continue;
+      }
+      if (res.data.error === "slow_down") {
+        await new Promise((r) => setTimeout(r, 5e3));
+        continue;
+      }
+      if (res.data.error) {
+        throw new ProviderError(res.data.error_description || res.data.error, this.name);
+      }
+    }
+    throw new ProviderError("Device authorization timed out.", this.name);
+  }
+};
+
+// src/core/providers/gitlab.provider.ts
+var GitLabProvider = class {
+  id = "gitlab";
+  name = "GitLab";
+  defaultHost = "gitlab.com";
+  getApiUrl(host) {
+    const targetHost = host || this.defaultHost;
+    return `https://${targetHost}/api/v4`;
+  }
+  getAuthHeader(token) {
+    if (token.startsWith("glpat-") || token.length < 30) {
+      return { "PRIVATE-TOKEN": token };
+    }
+    return { Authorization: `Bearer ${token}` };
+  }
+  async validateToken(token, host) {
+    try {
+      const api = this.getApiUrl(host);
+      const res = await requestJson(`${api}/user`, "GET", void 0, {
+        headers: this.getAuthHeader(token)
+      });
+      return res.status === 200;
+    } catch {
+      return false;
+    }
+  }
+  async getUser(token, host) {
+    const api = this.getApiUrl(host);
+    const res = await requestJson(`${api}/user`, "GET", void 0, {
+      headers: this.getAuthHeader(token)
+    });
+    if (res.status !== 200 || !res.data.username) {
+      throw new ProviderError(res.data.message || `Failed to fetch GitLab user (status: ${res.status})`, this.name);
+    }
+    return {
+      id: String(res.data.id),
+      username: res.data.username,
+      displayName: res.data.name || res.data.username,
+      email: res.data.email,
+      avatarUrl: res.data.avatar_url
+    };
+  }
+  async listRepositories(token, host) {
+    const api = this.getApiUrl(host);
+    const res = await requestJson(`${api}/projects?membership=true&simple=true&per_page=50&order_by=updated_at`, "GET", void 0, {
+      headers: this.getAuthHeader(token)
+    });
+    if (res.status !== 200 || !Array.isArray(res.data)) {
+      throw new ProviderError(`Failed to fetch GitLab projects (status: ${res.status})`, this.name);
+    }
+    return res.data.map((r) => ({
+      id: String(r.id),
+      name: r.name,
+      fullName: r.path_with_namespace,
+      sshUrl: r.ssh_url_to_repo,
+      httpsUrl: r.http_url_to_repo,
+      isPrivate: r.visibility === "private",
+      defaultBranch: r.default_branch || "main",
+      htmlUrl: r.web_url
+    }));
+  }
+  async checkHealth(host) {
+    const api = this.getApiUrl(host);
+    const start = Date.now();
+    try {
+      const res = await requestJson(`${api}/version`, "GET", void 0, { timeoutMs: 8e3 });
+      const pingMs = Date.now() - start;
+      return {
+        apiOk: res.status === 200 || res.status === 401,
+        // 401 means API endpoint reached but unauthenticated
+        pingMs,
+        message: "GitLab API reachable"
+      };
+    } catch (err) {
+      return {
+        apiOk: false,
+        pingMs: Date.now() - start,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+};
+
+// src/core/providers/bitbucket.provider.ts
+var BitbucketProvider = class {
+  id = "bitbucket";
+  name = "Bitbucket";
+  defaultHost = "bitbucket.org";
+  getApiUrl(host) {
+    const targetHost = host || this.defaultHost;
+    if (targetHost === "bitbucket.org") {
+      return "https://api.bitbucket.org/2.0";
+    }
+    return `https://${targetHost}/rest/api/1.0`;
+  }
+  getAuthHeader(token) {
+    if (token.includes(":")) {
+      const encoded = Buffer.from(token).toString("base64");
+      return { Authorization: `Basic ${encoded}` };
+    }
+    return { Authorization: `Bearer ${token}` };
+  }
+  async validateToken(token, host) {
+    try {
+      const api = this.getApiUrl(host);
+      const res = await requestJson(`${api}/user`, "GET", void 0, {
+        headers: this.getAuthHeader(token)
+      });
+      return res.status === 200;
+    } catch {
+      return false;
+    }
+  }
+  async getUser(token, host) {
+    const api = this.getApiUrl(host);
+    const res = await requestJson(`${api}/user`, "GET", void 0, {
+      headers: this.getAuthHeader(token)
+    });
+    if (res.status !== 200 || !res.data.username && !res.data.display_name) {
+      throw new ProviderError(res.data.error?.message || `Failed to fetch Bitbucket user`, this.name);
+    }
+    const username = res.data.username || res.data.display_name?.replace(/\s+/g, "").toLowerCase() || "user";
+    return {
+      id: res.data.account_id || res.data.uuid || username,
+      username,
+      displayName: res.data.display_name || username,
+      avatarUrl: res.data.links?.avatar?.href
+    };
+  }
+  async listRepositories(token, host) {
+    const user = await this.getUser(token, host);
+    const api = this.getApiUrl(host);
+    const res = await requestJson(`${api}/repositories/${user.username}?pagelen=50&sort=-updated_on`, "GET", void 0, {
+      headers: this.getAuthHeader(token)
+    });
+    if (res.status !== 200 || !res.data.values) {
+      return [];
+    }
+    return res.data.values.map((r) => {
+      const sshClone = r.links?.clone?.find((c) => c.name === "ssh")?.href || `git@bitbucket.org:${r.full_name}.git`;
+      const httpsClone = r.links?.clone?.find((c) => c.name === "https")?.href || `https://bitbucket.org/${r.full_name}.git`;
+      return {
+        id: r.uuid,
+        name: r.name,
+        fullName: r.full_name,
+        sshUrl: sshClone,
+        httpsUrl: httpsClone,
+        isPrivate: r.is_private,
+        defaultBranch: r.mainbranch?.name || "main",
+        htmlUrl: r.links?.html?.href
+      };
+    });
+  }
+  async checkHealth(host) {
+    const api = this.getApiUrl(host);
+    const start = Date.now();
+    try {
+      const res = await requestJson(`${api}/user`, "GET", void 0, { timeoutMs: 8e3 });
+      const pingMs = Date.now() - start;
+      return {
+        apiOk: res.status === 200 || res.status === 401,
+        pingMs,
+        message: "Bitbucket API reachable"
+      };
+    } catch (err) {
+      return {
+        apiOk: false,
+        pingMs: Date.now() - start,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+};
+
+// src/core/providers/provider-registry.ts
+var ProviderRegistry = class {
+  providers = /* @__PURE__ */ new Map();
+  constructor() {
+    this.register(new GitHubProvider());
+    this.register(new GitLabProvider());
+    this.register(new BitbucketProvider());
+  }
+  register(provider) {
+    this.providers.set(provider.id, provider);
+  }
+  get(idOrType) {
+    return this.providers.get(idOrType);
+  }
+  getByHost(host) {
+    const clean = host.toLowerCase();
+    if (clean.includes("github.com") || clean.startsWith("github")) {
+      return this.providers.get("github");
+    }
+    if (clean.includes("gitlab.com") || clean.startsWith("gitlab")) {
+      return this.providers.get("gitlab");
+    }
+    if (clean.includes("bitbucket.org") || clean.startsWith("bitbucket")) {
+      return this.providers.get("bitbucket");
+    }
+    for (const provider of this.providers.values()) {
+      if (provider.defaultHost === host) {
+        return provider;
+      }
+    }
+    return void 0;
+  }
+  list() {
+    return Array.from(this.providers.values());
+  }
+};
+var defaultProviderRegistry = new ProviderRegistry();
+
+// src/core/ssh/ssh-key-detector.ts
+var import_node_fs7 = __toESM(require("node:fs"));
+var import_node_path7 = __toESM(require("node:path"));
+var SshKeyDetector = class {
+  static listAvailableKeys(sshDir) {
+    const targetDir = sshDir || import_node_path7.default.join(getHomeDir(), ".ssh");
+    if (!import_node_fs7.default.existsSync(targetDir)) {
+      return [];
+    }
+    const files = import_node_fs7.default.readdirSync(targetDir);
+    const pubFiles = files.filter((f) => f.endsWith(".pub"));
+    const keys = [];
+    for (const pub of pubFiles) {
+      const pubPath = import_node_path7.default.join(targetDir, pub);
+      const privName = pub.slice(0, -4);
+      const privPath = import_node_path7.default.join(targetDir, privName);
+      try {
+        const content = import_node_fs7.default.readFileSync(pubPath, "utf-8").trim();
+        const parts = content.split(/\s+/);
+        const type = parts[0] || "unknown";
+        const comment = parts.length > 2 ? parts.slice(2).join(" ") : void 0;
+        keys.push({
+          name: privName,
+          privateKeyPath: collapseTilde(privPath),
+          publicKeyPath: collapseTilde(pubPath),
+          type,
+          comment
+        });
+      } catch {
+      }
+    }
+    return keys;
+  }
+};
+
+// src/cli/commands/auth.ts
+async function handleAuthLogin(providerName, options = {}, store = defaultConfigStore) {
+  let targetProvider = providerName?.toLowerCase();
+  if (!targetProvider) {
+    targetProvider = await promptSelect({
+      message: "Select Git Provider to authenticate with:",
+      options: [
+        { value: "github", label: "GitHub (github.com / Enterprise)" },
+        { value: "gitlab", label: "GitLab (gitlab.com / Self-Hosted)" },
+        { value: "bitbucket", label: "Bitbucket (bitbucket.org / Server)" }
+      ]
+    });
+  }
+  const provider = defaultProviderRegistry.get(targetProvider);
+  if (!provider) {
+    logger.error(`Unknown provider: '${targetProvider}'`);
+    return;
+  }
+  const host = options.host || provider.defaultHost;
+  let token = options.token;
+  let username = "";
+  if (!token) {
+    if (targetProvider === "github" && provider.startDeviceFlow && provider.pollDeviceFlow) {
+      const method = await promptSelect({
+        message: "Choose authentication method for GitHub:",
+        options: [
+          { value: "device", label: "Web Browser (Device Code Authorization)" },
+          { value: "pat", label: "Personal Access Token (PAT)" }
+        ]
+      });
+      if (method === "device") {
+        const spinner2 = (0, import_ora.default)("Initiating GitHub Device Authorization...").start();
+        try {
+          const deviceFlow = await provider.startDeviceFlow();
+          spinner2.stop();
+          console.log("\n  " + import_picocolors9.default.bold(import_picocolors9.default.cyan("GitHub Device Authorization")));
+          console.log(`  1. Open your browser: ${import_picocolors9.default.underline(import_picocolors9.default.cyan(deviceFlow.verificationUri))}`);
+          console.log(`  2. Enter the one-time code: ${import_picocolors9.default.bold(import_picocolors9.default.green(deviceFlow.userCode))}
+`);
+          const pollSpinner = (0, import_ora.default)("Waiting for browser authorization...").start();
+          const authResult = await provider.pollDeviceFlow(deviceFlow.deviceCode, deviceFlow.interval);
+          token = authResult.token;
+          pollSpinner.succeed("Authorization granted!");
+        } catch (err) {
+          spinner2.fail("Device flow failed.");
+          logger.error(err instanceof Error ? err.message : String(err));
+          return;
+        }
+      }
+    }
+    if (!token) {
+      token = await promptText({
+        message: `Enter your Personal Access Token (PAT) for ${provider.name} (${host}):`,
+        validate: (val) => !val || !val.trim() ? "Token cannot be empty." : void 0
+      });
+    }
+  }
+  const spinner = (0, import_ora.default)(`Validating credentials with ${provider.name}...`).start();
+  try {
+    const user = await provider.getUser(token, host);
+    username = user.username;
+    spinner.succeed(`Authenticated as ${import_picocolors9.default.green(user.displayName || user.username)} (@${user.username})`);
+    let sshKeyPath = options.sshKey;
+    if (!sshKeyPath) {
+      const availableKeys = SshKeyDetector.listAvailableKeys();
+      if (availableKeys.length > 0) {
+        const linkKey = await promptConfirm({
+          message: `Do you want to link an SSH key for this ${provider.name} account?`,
+          initialValue: true
+        });
+        if (linkKey) {
+          sshKeyPath = await promptSelect({
+            message: "Select SSH key to link:",
+            options: availableKeys.map((k) => ({
+              value: k.privateKeyPath,
+              label: `${k.name} (${k.type})`,
+              hint: k.comment
+            }))
+          });
+        }
+      }
+    }
+    const accountId = `${targetProvider}_${username.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
+    store.addAccount({
+      id: accountId,
+      providerId: targetProvider,
+      host,
+      username,
+      displayName: user.displayName,
+      authType: "oauth",
+      sshKeyPath
+    });
+    const credStore = await StoreFactory.getStore(store.getPathResolver());
+    await credStore.set(host, accountId, token);
+    const sshGen = new SshConfigGenerator(store);
+    sshGen.generate();
+    logger.success(`Account '${accountId}' registered and token secured in OS Keychain/Keyring!`);
+    console.log(import_picocolors9.default.gray(`  Host:      ${host}`));
+    console.log(import_picocolors9.default.gray(`  Username:  ${username}`));
+    if (sshKeyPath) {
+      console.log(import_picocolors9.default.gray(`  SSH Alias: ${host}-${accountId}`));
+    }
+    console.log("");
+  } catch (err) {
+    spinner.fail(`Authentication failed.`);
+    logger.error(err instanceof Error ? err.message : String(err));
+  }
+}
+async function handleAuthLogout(providerName, username, store = defaultConfigStore) {
+  const accounts = store.loadAccounts().filter((a) => a.providerId === providerName);
+  if (accounts.length === 0) {
+    logger.warn(`No accounts found for provider '${providerName}'.`);
+    return;
+  }
+  let targetAccount = accounts[0];
+  if (username) {
+    const found = accounts.find((a) => a.username === username);
+    if (!found) {
+      logger.error(`Account '${username}' not found for provider '${providerName}'.`);
+      return;
+    }
+    targetAccount = found;
+  }
+  const credStore = await StoreFactory.getStore(store.getPathResolver());
+  await credStore.delete(targetAccount.host, targetAccount.id);
+  store.removeAccount(targetAccount.id);
+  const sshGen = new SshConfigGenerator(store);
+  sshGen.generate();
+  logger.success(`Logged out of ${targetAccount.providerId} (${targetAccount.username}). Credentials removed.`);
+}
+
+// src/cli/commands/provider.ts
+var import_cli_table32 = __toESM(require("cli-table3"));
+var import_picocolors10 = __toESM(require("picocolors"));
+async function handleProviderList() {
+  const providers = defaultProviderRegistry.list();
+  console.log(import_picocolors10.default.bold("\n  GIT PROVIDERS"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  const table = new import_cli_table32.default({
+    head: [import_picocolors10.default.bold("ID"), import_picocolors10.default.bold("Name"), import_picocolors10.default.bold("Default Host"), import_picocolors10.default.bold("Status")],
+    style: { head: ["cyan"] }
+  });
+  for (const p2 of providers) {
+    table.push([import_picocolors10.default.cyan(p2.id), p2.name, p2.defaultHost, import_picocolors10.default.green("\u2714 supported")]);
+  }
+  console.log(table.toString());
+  console.log("");
+}
+
+// src/cli/commands/rule.ts
+var import_node_path8 = __toESM(require("node:path"));
+var import_picocolors11 = __toESM(require("picocolors"));
+async function handleRuleList(store = defaultConfigStore) {
+  const rules = store.loadRules();
+  console.log(import_picocolors11.default.bold("\n  DIRECTORY ROUTING RULES"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(renderRulesTable(rules));
+}
+async function handleRuleAdd(dirPath, identityId, options = {}, store = defaultConfigStore) {
+  const identities = store.loadIdentities();
+  const accounts = store.loadAccounts();
+  if (identities.length === 0) {
+    logger.warn("No identities found. Please create an identity first with 'gitbridge identity add'.");
+    return;
+  }
+  let targetPath = dirPath;
+  if (!targetPath) {
+    targetPath = await promptText({
+      message: "Enter the directory path to map (e.g. ~/Projects/company or /path/to/work):",
+      validate: (val) => !val || !val.trim() ? "Directory path is required." : void 0
+    });
+  }
+  targetPath = collapseTilde(import_node_path8.default.resolve(expandTilde(targetPath.trim())));
+  let targetIdentity = identityId;
+  if (!targetIdentity) {
+    targetIdentity = await promptSelect({
+      message: `Select identity to assign to '${targetPath}':`,
+      options: identities.map((i) => ({
+        value: i.id,
+        label: `${i.id} (${i.name} <${i.email}>)`
+      }))
+    });
+  }
+  const ruleId = options.id || `rule_${import_node_path8.default.basename(targetPath).replace(/[^a-zA-Z0-9_-]/g, "_")}`;
+  let defaultProvider = options.provider;
+  let defaultAccountId = options.account;
+  if (accounts.length > 0 && !defaultAccountId) {
+    const matchingAccounts = accounts.filter((a) => a.username.includes(targetIdentity) || a.id.includes(targetIdentity));
+    if (matchingAccounts.length > 0) {
+      defaultAccountId = matchingAccounts[0].id;
+      defaultProvider = matchingAccounts[0].providerId;
+    }
+  }
+  store.addRule({
+    id: ruleId,
+    path: targetPath,
+    identityId: targetIdentity,
+    defaultProvider,
+    defaultAccountId
+  });
+  const generator = new GitConfigGenerator(store);
+  generator.generate();
+  logger.success(`Directory rule '${ruleId}' added successfully!`);
+  console.log(import_picocolors11.default.gray(`  Path:      ${targetPath}`));
+  console.log(import_picocolors11.default.gray(`  Identity:  ${targetIdentity}`));
+  if (defaultAccountId) {
+    console.log(import_picocolors11.default.gray(`  Account:   ${defaultAccountId}`));
+  }
+  console.log(import_picocolors11.default.green("  Git includeIf rules regenerated."));
+  console.log("");
+}
+async function handleRuleRemove(idOrPath, store = defaultConfigStore) {
+  const removed = store.removeRule(idOrPath);
+  if (!removed) {
+    logger.error(`Rule '${idOrPath}' not found.`);
+    return;
+  }
+  const generator = new GitConfigGenerator(store);
+  generator.generate();
+  logger.success(`Directory rule '${idOrPath}' removed.`);
+}
+
+// src/cli/commands/repo.ts
+var import_node_path11 = __toESM(require("node:path"));
+
+// src/core/git/url-parser.ts
+function detectProviderType(host) {
+  const cleanHost = host.toLowerCase();
+  if (cleanHost.includes("github.com") || cleanHost === "github") {
+    return "github";
+  }
+  if (cleanHost.includes("gitlab.com") || cleanHost === "gitlab") {
+    return "gitlab";
+  }
+  if (cleanHost.includes("bitbucket.org") || cleanHost === "bitbucket") {
+    return "bitbucket";
+  }
+  if (cleanHost.includes("gitea") || cleanHost.includes("codeberg")) {
+    return "gitea";
+  }
+  return "custom";
+}
+function extractHostAndAlias(rawHost) {
+  const knownDomains = [".com-", ".org-", ".net-", ".io-", ".dev-", ".co-"];
+  for (const kd of knownDomains) {
+    const idx = rawHost.indexOf(kd);
+    if (idx !== -1) {
+      const extLen = kd.length - 1;
+      const host = rawHost.substring(0, idx + extLen);
+      const accountAlias = rawHost.substring(idx + kd.length);
+      if (accountAlias) {
+        return { host, accountAlias };
+      }
+    }
+  }
+  const shortPrefixes = ["github-", "gitlab-", "bitbucket-"];
+  for (const sp of shortPrefixes) {
+    if (rawHost.startsWith(sp)) {
+      const provider = sp.slice(0, -1);
+      const host = provider === "bitbucket" ? "bitbucket.org" : `${provider}.com`;
+      const accountAlias = rawHost.slice(sp.length);
+      return { host, accountAlias };
+    }
+  }
+  return { host: rawHost };
+}
+function parseRemoteUrl(url) {
+  if (!url || typeof url !== "string") return null;
+  const trimmed = url.trim();
+  const scpMatch = trimmed.match(/^(?:([a-zA-Z0-9._-]+)@)?([^:]+):(.+)$/);
+  if (scpMatch && !trimmed.startsWith("http://") && !trimmed.startsWith("https://") && !trimmed.startsWith("ssh://") && !trimmed.startsWith("file://")) {
+    const [, , rawHost, pathPart] = scpMatch;
+    const { host, accountAlias } = extractHostAndAlias(rawHost);
+    const cleanPath = pathPart.replace(/^\/+/, "").replace(/\.git$/, "");
+    const pathSegments = cleanPath.split("/");
+    const repo = pathSegments.pop() || "";
+    const owner = pathSegments.join("/");
+    return {
+      rawUrl: trimmed,
+      protocol: "ssh",
+      providerId: detectProviderType(host),
+      host,
+      rawHost,
+      accountAlias,
+      owner,
+      repo,
+      fullName: owner ? `${owner}/${repo}` : repo
+    };
+  }
+  try {
+    const parsed = new URL(trimmed);
+    const rawHost = parsed.hostname;
+    const { host, accountAlias } = extractHostAndAlias(rawHost);
+    let protocol = "unknown";
+    if (parsed.protocol === "https:" || parsed.protocol === "http:") {
+      protocol = "https";
+    } else if (parsed.protocol === "ssh:" || parsed.protocol === "git+ssh:") {
+      protocol = "ssh";
+    } else if (parsed.protocol === "file:") {
+      protocol = "file";
+    }
+    const cleanPath = parsed.pathname.replace(/^\/+/, "").replace(/\.git$/, "");
+    const pathSegments = cleanPath.split("/");
+    const repo = pathSegments.pop() || "";
+    const owner = pathSegments.join("/");
+    return {
+      rawUrl: trimmed,
+      protocol,
+      providerId: detectProviderType(host),
+      host,
+      rawHost,
+      accountAlias,
+      owner,
+      repo,
+      fullName: owner ? `${owner}/${repo}` : repo
+    };
+  } catch {
+    return null;
+  }
+}
+function buildSshUrl(host, owner, repo, accountId) {
+  const targetHost = accountId ? `${host}-${accountId}` : host;
+  const cleanRepo = repo.endsWith(".git") ? repo : `${repo}.git`;
+  return `git@${targetHost}:${owner}/${cleanRepo}`;
+}
+
+// src/core/git/git-cli.ts
+var GitCli = class {
+  cwd;
+  constructor(cwd = process.cwd()) {
+    this.cwd = cwd;
+  }
+  getCwd() {
+    return this.cwd;
+  }
+  async exec(args, options = {}) {
+    const targetCwd = options.cwd ?? this.cwd;
+    try {
+      const proc = Bun.spawn(["git", ...args], {
+        cwd: targetCwd,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: { ...process.env, ...options.env }
+      });
+      const [stdout, stderr] = await Promise.all([
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text()
+      ]);
+      const exitCode = await proc.exited;
+      if (exitCode !== 0 && !options.allowFailure) {
+        throw new GitCliError(
+          stderr.trim() || stdout.trim() || `git ${args.join(" ")} failed`,
+          exitCode,
+          stderr.trim()
+        );
+      }
+      return {
+        stdout: stdout.trim(),
+        stderr: stderr.trim(),
+        exitCode
+      };
+    } catch (err) {
+      if (err instanceof GitCliError) throw err;
+      throw new GitCliError(
+        `Failed to run 'git ${args.join(" ")}': ${err instanceof Error ? err.message : String(err)}`,
+        1,
+        String(err)
+      );
+    }
+  }
+  async isGitRepo() {
+    try {
+      const res = await this.exec(["rev-parse", "--is-inside-work-tree"], { allowFailure: true });
+      return res.exitCode === 0 && res.stdout === "true";
+    } catch {
+      return false;
+    }
+  }
+  async getRepoRoot() {
+    try {
+      const res = await this.exec(["rev-parse", "--show-toplevel"], { allowFailure: true });
+      if (res.exitCode === 0 && res.stdout) {
+        return res.stdout.trim();
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async getConfig(key, scope) {
+    const args = ["config"];
+    if (scope) args.push(`--${scope}`);
+    args.push("--get", key);
+    const res = await this.exec(args, { allowFailure: true });
+    if (res.exitCode === 0 && res.stdout) {
+      return res.stdout.trim();
+    }
+    return null;
+  }
+  async setConfig(key, value, scope = "local") {
+    await this.exec(["config", `--${scope}`, key, value]);
+  }
+  async unsetConfig(key, scope = "local") {
+    await this.exec(["config", `--${scope}`, "--unset", key], { allowFailure: true });
+  }
+  async getRemotes() {
+    const res = await this.exec(["remote", "-v"], { allowFailure: true });
+    if (res.exitCode !== 0 || !res.stdout) return [];
+    const lines = res.stdout.split("\n");
+    const remoteMap = /* @__PURE__ */ new Map();
+    for (const line of lines) {
+      const match = line.match(/^(\S+)\s+(\S+)\s+\((fetch|push)\)$/);
+      if (match) {
+        const [, name, url, type] = match;
+        const current = remoteMap.get(name) || { fetchUrl: "", pushUrl: "" };
+        if (type === "fetch") current.fetchUrl = url;
+        if (type === "push") current.pushUrl = url;
+        remoteMap.set(name, current);
+      }
+    }
+    const result = [];
+    for (const [name, urls] of remoteMap.entries()) {
+      result.push({
+        name,
+        fetchUrl: urls.fetchUrl,
+        pushUrl: urls.pushUrl,
+        parsedFetch: parseRemoteUrl(urls.fetchUrl),
+        parsedPush: parseRemoteUrl(urls.pushUrl)
+      });
+    }
+    return result;
+  }
+  async setRemoteUrl(name, url) {
+    const remotes = await this.getRemotes();
+    const exists = remotes.some((r) => r.name === name);
+    if (exists) {
+      await this.exec(["remote", "set-url", name, url]);
+    } else {
+      await this.exec(["remote", "add", name, url]);
+    }
+  }
+  async getCurrentBranch() {
+    const res = await this.exec(["branch", "--show-current"], { allowFailure: true });
+    if (res.exitCode === 0 && res.stdout) {
+      return res.stdout.trim();
+    }
+    return null;
+  }
+  async getGitVersion() {
+    const res = await this.exec(["--version"], { allowFailure: true });
+    if (res.exitCode === 0 && res.stdout) {
+      const match = res.stdout.match(/git version ([\d.]+)/);
+      return match ? match[1] : res.stdout;
+    }
+    return null;
+  }
+};
+
+// src/core/safety/identity-guard.ts
+var import_node_fs8 = __toESM(require("node:fs"));
+var import_node_path10 = __toESM(require("node:path"));
+
+// src/core/identity/identity-resolver.ts
+var import_node_path9 = __toESM(require("node:path"));
+var IdentityResolver = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  async resolve(cwd = process.cwd()) {
+    const git = new GitCli(cwd);
+    const isGitRepo = await git.isGitRepo();
+    const repoRoot = isGitRepo ? await git.getRepoRoot() : null;
+    const targetPath = repoRoot || import_node_path9.default.resolve(cwd);
+    const identities = this.store.loadIdentities();
+    const accounts = this.store.loadAccounts();
+    const rules = this.store.loadRules();
+    const config = this.store.loadConfig();
+    let localGitEmail = null;
+    let localGitName = null;
+    let remotes = [];
+    if (isGitRepo) {
+      localGitEmail = await git.getConfig("user.email");
+      localGitName = await git.getConfig("user.name");
+      remotes = await git.getRemotes();
+    }
+    let resolvedIdentity = null;
+    let resolvedAccount = null;
+    let matchedRule = null;
+    let repoProfile = null;
+    let source = "unconfigured";
+    repoProfile = this.store.getRepository(targetPath) || (repoRoot ? this.store.getRepository(repoRoot) : null) || null;
+    if (repoProfile && repoProfile.identityId) {
+      const found = identities.find((i) => i.id === repoProfile.identityId);
+      if (found) {
+        resolvedIdentity = found;
+        source = "repo_profile";
+      }
+    }
+    if (!resolvedIdentity) {
+      let bestMatchLength = -1;
+      for (const rule of rules) {
+        const expandedRulePath = import_node_path9.default.resolve(expandTilde(rule.path));
+        if (targetPath === expandedRulePath || targetPath.startsWith(expandedRulePath + import_node_path9.default.sep)) {
+          if (expandedRulePath.length > bestMatchLength) {
+            bestMatchLength = expandedRulePath.length;
+            matchedRule = rule;
+          }
+        }
+      }
+      if (matchedRule) {
+        const found = identities.find((i) => i.id === matchedRule.identityId);
+        if (found) {
+          resolvedIdentity = found;
+          source = "directory_rule";
+          if (matchedRule.defaultAccountId) {
+            resolvedAccount = accounts.find((a) => a.id === matchedRule.defaultAccountId) || null;
+          }
+        }
+      }
+    }
+    if (!resolvedIdentity) {
+      const defaultId = config.defaultIdentityId || identities.find((i) => i.isDefault)?.id;
+      if (defaultId) {
+        resolvedIdentity = identities.find((i) => i.id === defaultId) || null;
+        if (resolvedIdentity) {
+          source = "global_default";
+        }
+      }
+    }
+    if (!resolvedIdentity && localGitEmail) {
+      source = "system_fallback";
+    }
+    if (!resolvedAccount && remotes.length > 0) {
+      const firstRemote = remotes[0];
+      const parsed = firstRemote.parsedPush || firstRemote.parsedFetch;
+      if (parsed) {
+        if (parsed.accountAlias) {
+          resolvedAccount = accounts.find((a) => a.id === parsed.accountAlias || a.username === parsed.accountAlias) || null;
+        }
+        if (!resolvedAccount) {
+          resolvedAccount = accounts.find((a) => a.host === parsed.host) || null;
+        }
+      }
+    }
+    let isMismatched = false;
+    if (resolvedIdentity && localGitEmail && localGitEmail !== resolvedIdentity.email) {
+      isMismatched = true;
+    }
+    return {
+      cwd,
+      isGitRepo,
+      repoRoot,
+      source,
+      identity: resolvedIdentity,
+      account: resolvedAccount,
+      matchedRule,
+      repoProfile,
+      remotes,
+      localGitEmail,
+      localGitName,
+      isMismatched
+    };
+  }
+};
+
+// src/core/safety/identity-guard.ts
+var IdentityGuard = class {
+  store;
+  resolver;
+  constructor(store) {
+    this.store = store;
+    this.resolver = new IdentityResolver(store);
+  }
+  async check(cwd = process.cwd()) {
+    const ctx = await this.resolver.resolve(cwd);
+    if (!ctx.isGitRepo) {
+      return { allowed: true, expectedEmail: null, currentEmail: null };
+    }
+    const expectedEmail = ctx.identity?.email || null;
+    const currentEmail = ctx.localGitEmail || null;
+    if (expectedEmail && currentEmail && expectedEmail !== currentEmail) {
+      return {
+        allowed: false,
+        expectedEmail,
+        currentEmail,
+        message: `Mismatched Git commit identity! Current: '${currentEmail}', Expected: '${expectedEmail}' (${ctx.identity?.name}).`
+      };
+    }
+    return {
+      allowed: true,
+      expectedEmail,
+      currentEmail
+    };
+  }
+  isInstalled(repoPath) {
+    const hookFile = import_node_path10.default.join(repoPath, ".git", "hooks", "pre-commit");
+    if (!import_node_fs8.default.existsSync(hookFile)) return false;
+    const content = import_node_fs8.default.readFileSync(hookFile, "utf-8");
+    return content.includes("gitbridge hook pre-commit") || content.includes("gb hook pre-commit");
+  }
+  async install(repoPath) {
+    return this.installPreCommitHook(repoPath);
+  }
+  async uninstall(repoPath) {
+    return this.uninstallPreCommitHook(repoPath);
+  }
+  async installPreCommitHook(repoPath) {
+    const git = new GitCli(repoPath);
+    const root = await git.getRepoRoot();
+    if (!root) return false;
+    const hooksDir = import_node_path10.default.join(root, ".git", "hooks");
+    if (!import_node_fs8.default.existsSync(hooksDir)) {
+      import_node_fs8.default.mkdirSync(hooksDir, { recursive: true });
+    }
+    const hookFile = import_node_path10.default.join(hooksDir, "pre-commit");
+    const hookScript = `#!/usr/bin/env bash
+# GitBridge Pre-Commit Identity Guard
+if command -v gitbridge >/dev/null 2>&1; then
+    gitbridge hook pre-commit
+elif command -v gb >/dev/null 2>&1; then
+    gb hook pre-commit
+fi
+`;
+    if (import_node_fs8.default.existsSync(hookFile)) {
+      const existing = import_node_fs8.default.readFileSync(hookFile, "utf-8");
+      if (!existing.includes("gitbridge hook pre-commit")) {
+        import_node_fs8.default.appendFileSync(hookFile, `
+${hookScript}
+`, { mode: 493 });
+      }
+    } else {
+      import_node_fs8.default.writeFileSync(hookFile, hookScript, { encoding: "utf-8", mode: 493 });
+    }
+    return true;
+  }
+  async uninstallPreCommitHook(repoPath) {
+    const git = new GitCli(repoPath);
+    const root = await git.getRepoRoot();
+    if (!root) return false;
+    const hookFile = import_node_path10.default.join(root, ".git", "hooks", "pre-commit");
+    if (!import_node_fs8.default.existsSync(hookFile)) return true;
+    const content = import_node_fs8.default.readFileSync(hookFile, "utf-8");
+    if (content.includes("GitBridge Pre-Commit Identity Guard") || content.includes("gitbridge hook pre-commit")) {
+      const nonCommentLines = content.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+      const isOnlyGitBridge = nonCommentLines.every(
+        (l) => l.startsWith("if ") || l.startsWith("elif ") || l === "fi" || l.includes("gitbridge") || l.includes("gb hook")
+      );
+      if (isOnlyGitBridge) {
+        import_node_fs8.default.unlinkSync(hookFile);
+      } else {
+        const filtered = content.split("\n").filter(
+          (l) => !l.includes("GitBridge") && !l.includes("gitbridge hook") && !l.includes("gb hook") && !l.includes("command -v gitbridge") && !l.includes("command -v gb")
+        ).join("\n").trim();
+        import_node_fs8.default.writeFileSync(hookFile, `${filtered}
+`, { encoding: "utf-8", mode: 493 });
+      }
+    }
+    return true;
+  }
+};
+
+// src/cli/commands/repo.ts
+var import_picocolors12 = __toESM(require("picocolors"));
+async function handleRepoInit(store = defaultConfigStore) {
+  const cwd = process.cwd();
+  const git = new GitCli(cwd);
+  let isGitRepo = await git.isGitRepo();
+  if (!isGitRepo) {
+    const initialize = await promptConfirm({
+      message: `Current directory is not a Git repository. Run 'git init'?`,
+      initialValue: true
+    });
+    if (initialize) {
+      await git.exec(["init"]);
+      isGitRepo = true;
+    } else {
+      logger.warn("Initialization aborted.");
+      return;
+    }
+  }
+  const repoRoot = await git.getRepoRoot() || cwd;
+  const repoName = import_node_path11.default.basename(repoRoot);
+  console.log(import_picocolors12.default.bold(`
+  CONFIGURING REPOSITORY: ${import_picocolors12.default.cyan(repoName)}`));
+  console.log(import_picocolors12.default.gray(`  Path: ${repoRoot}
+`));
+  const identities = store.loadIdentities();
+  const accounts = store.loadAccounts();
+  if (identities.length === 0) {
+    logger.warn("No GitBridge identities configured yet. Run 'gitbridge identity add' first.");
+    return;
+  }
+  const selectedIdentityId = await promptSelect({
+    message: "Select Git identity for this repository:",
+    options: identities.map((i) => ({
+      value: i.id,
+      label: `${i.id} (${i.name} <${i.email}>)`
+    }))
+  });
+  const identity = store.getIdentity(selectedIdentityId);
+  await git.setConfig("user.name", identity.name, "local");
+  await git.setConfig("user.email", identity.email, "local");
+  if (identity.signingKey) {
+    await git.setConfig("user.signingkey", identity.signingKey, "local");
+  }
+  const existingRemotes = await git.getRemotes();
+  const repositoryRemotes = [];
+  if (existingRemotes.length > 0) {
+    console.log(import_picocolors12.default.bold("\n  Detected Remotes:"));
+    for (const r of existingRemotes) {
+      const parsed = r.parsedPush || r.parsedFetch;
+      console.log(`    \u2022 ${import_picocolors12.default.cyan(r.name)}: ${r.fetchUrl}`);
+      if (parsed) {
+        let accountId = parsed.accountAlias;
+        if (!accountId && accounts.length > 0) {
+          const matching = accounts.find((a) => a.host === parsed.host);
+          if (matching) {
+            accountId = matching.id;
+          }
+        }
+        repositoryRemotes.push({
+          name: r.name,
+          providerId: parsed.providerId,
+          host: parsed.host,
+          accountId,
+          url: r.fetchUrl,
+          rawUrl: r.fetchUrl
+        });
+      }
+    }
+  }
+  const installHook = await promptConfirm({
+    message: "Install GitBridge pre-commit identity guard hook in this repo?",
+    initialValue: true
+  });
+  if (installHook) {
+    const guard = new IdentityGuard(store);
+    await guard.installPreCommitHook(repoRoot);
+  }
+  store.saveRepositoryProfile({
+    path: repoRoot,
+    identityId: selectedIdentityId,
+    remotes: repositoryRemotes,
+    safetyHookInstalled: installHook
+  });
+  logger.success(`Repository '${repoName}' initialized with GitBridge!`);
+  console.log(import_picocolors12.default.gray(`  Identity: ${identity.name} <${identity.email}>`));
+  console.log(import_picocolors12.default.gray(`  Pre-commit guard: ${installHook ? import_picocolors12.default.green("installed") : import_picocolors12.default.gray("skipped")}`));
+  console.log(import_picocolors12.default.green("\nYou can now make commits and push normally with native Git!\n"));
+}
+
+// src/cli/commands/context.ts
+var import_node_path12 = __toESM(require("node:path"));
+var import_picocolors13 = __toESM(require("picocolors"));
+async function handleContextCommand(store = defaultConfigStore) {
+  const resolver = new IdentityResolver(store);
+  const ctx = await resolver.resolve();
+  console.log(import_picocolors13.default.bold("\n  GITBRIDGE CONTEXT"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  if (ctx.isGitRepo) {
+    const repoName = ctx.repoRoot ? import_node_path12.default.basename(ctx.repoRoot) : "unknown";
+    console.log(`  Repository:             ${import_picocolors13.default.cyan(repoName)} (${ctx.repoRoot})`);
+  } else {
+    console.log(`  Directory:              ${import_picocolors13.default.blue(ctx.cwd)} ${import_picocolors13.default.gray("(not a git repo)")}`);
+  }
+  console.log(`  Resolution Source:      ${formatBadge(ctx.source.toUpperCase(), "cyan")}`);
+  if (ctx.identity) {
+    console.log(`  Resolved Identity:      ${import_picocolors13.default.green(ctx.identity.name)} <${import_picocolors13.default.green(ctx.identity.email)}>`);
+    if (ctx.identity.signingKey) {
+      console.log(`  Signing Key:            ${import_picocolors13.default.yellow(ctx.identity.signingKey)}`);
+    }
+  } else {
+    console.log(`  Resolved Identity:      ${import_picocolors13.default.yellow("None configured")}`);
+  }
+  if (ctx.isGitRepo) {
+    console.log(`  Local Git Email:        ${ctx.localGitEmail ? import_picocolors13.default.cyan(ctx.localGitEmail) : import_picocolors13.default.gray("not set in .git/config")}`);
+    if (ctx.isMismatched) {
+      console.log(
+        import_picocolors13.default.red(`  \u26A0 WARNING:              Local git email '${ctx.localGitEmail}' does not match resolved identity '${ctx.identity?.email}'!`)
+      );
+    }
+  }
+  if (ctx.account) {
+    console.log(`  Target Account:         ${import_picocolors13.default.magenta(ctx.account.providerId.toUpperCase())} (${ctx.account.username})`);
+    if (ctx.account.sshKeyPath) {
+      console.log(`  SSH Key:                ${import_picocolors13.default.yellow(ctx.account.sshKeyPath)}`);
+    }
+  }
+  if (ctx.matchedRule) {
+    console.log(`  Matched Rule:           ${import_picocolors13.default.blue(ctx.matchedRule.id)} (${ctx.matchedRule.path})`);
+  }
+  if (ctx.isGitRepo && ctx.remotes.length > 0) {
+    console.log("\n  " + import_picocolors13.default.bold("Configured Remotes:"));
+    console.log(renderRemotesTable(ctx.remotes));
+  } else {
+    console.log("");
+  }
+}
+
+// src/cli/commands/remote.ts
+var import_picocolors14 = __toESM(require("picocolors"));
+async function handleRemoteList() {
+  const git = new GitCli();
+  if (!await git.isGitRepo()) {
+    logger.error("Current directory is not a Git repository.");
+    return;
+  }
+  const remotes = await git.getRemotes();
+  console.log(import_picocolors14.default.bold("\n  GIT REMOTES"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(renderRemotesTable(remotes));
+}
+async function handleRemoteAdd(name, url, options = {}, store = defaultConfigStore) {
+  const git = new GitCli();
+  if (!await git.isGitRepo()) {
+    logger.error("Current directory is not a Git repository.");
+    return;
+  }
+  const parsed = parseRemoteUrl(url);
+  if (!parsed) {
+    logger.error("Invalid remote URL format.");
+    return;
+  }
+  let finalUrl = url;
+  if (options.account && parsed.protocol === "ssh") {
+    finalUrl = buildSshUrl(parsed.host, parsed.owner, parsed.repo, options.account);
+  }
+  await git.setRemoteUrl(name, finalUrl);
+  const repoRoot = await git.getRepoRoot();
+  if (repoRoot) {
+    const existing = store.getRepository(repoRoot);
+    const remotes = existing ? [...existing.remotes] : [];
+    const existingIdx = remotes.findIndex((r) => r.name === name);
+    const remoteData = {
+      name,
+      providerId: parsed.providerId,
+      host: parsed.host,
+      accountId: options.account,
+      url: finalUrl,
+      rawUrl: url
+    };
+    if (existingIdx >= 0) {
+      remotes[existingIdx] = remoteData;
+    } else {
+      remotes.push(remoteData);
+    }
+    const profile = {
+      path: repoRoot,
+      identityId: existing?.identityId,
+      remotes,
+      safetyHookInstalled: existing?.safetyHookInstalled || false,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    store.saveRepositoryProfile(profile);
+  }
+  logger.success(`Remote '${name}' added: ${finalUrl}`);
+}
+
+// src/cli/commands/push.ts
+var import_ora2 = __toESM(require("ora"));
+var import_picocolors15 = __toESM(require("picocolors"));
+async function handlePushCommand(targetRemoteOrProvider, options = {}) {
+  const git = new GitCli();
+  if (!await git.isGitRepo()) {
+    logger.error("Current directory is not a Git repository.");
+    return;
+  }
+  const currentBranch = await git.getCurrentBranch();
+  if (!currentBranch) {
+    logger.error("Unable to determine current Git branch (HEAD might be detached).");
+    return;
+  }
+  const remotes = await git.getRemotes();
+  if (remotes.length === 0) {
+    logger.error("No remotes configured for this repository.");
+    return;
+  }
+  let targets = remotes;
+  if (targetRemoteOrProvider && !options.all) {
+    targets = remotes.filter(
+      (r) => r.name === targetRemoteOrProvider || r.parsedPush?.providerId === targetRemoteOrProvider || r.parsedFetch?.providerId === targetRemoteOrProvider
+    );
+    if (targets.length === 0) {
+      logger.error(`No remote matching '${targetRemoteOrProvider}' found.`);
+      return;
+    }
+  }
+  console.log(import_picocolors15.default.bold(`
+  Pushing branch '${import_picocolors15.default.cyan(currentBranch)}' to ${targets.length} remote(s)...
+`));
+  const results = await Promise.allSettled(
+    targets.map(async (remote) => {
+      const spinner = (0, import_ora2.default)(`Pushing to ${import_picocolors15.default.cyan(remote.name)} (${remote.pushUrl})...`).start();
+      try {
+        const pushArgs = ["push", remote.name, currentBranch];
+        if (options.tags) pushArgs.push("--tags");
+        if (options.force) pushArgs.push("--force");
+        await git.exec(pushArgs);
+        spinner.succeed(`Pushed to ${import_picocolors15.default.green(remote.name)} [${remote.parsedPush?.providerId.toUpperCase() || "GIT"}]`);
+        return { remote: remote.name, success: true };
+      } catch (err) {
+        spinner.fail(`Failed push to ${import_picocolors15.default.red(remote.name)}: ${err instanceof Error ? err.message : String(err)}`);
+        return { remote: remote.name, success: false, error: String(err) };
+      }
+    })
+  );
+  const successful = results.filter((r) => r.status === "fulfilled" && r.value.success).length;
+  console.log("");
+  if (successful === targets.length) {
+    logger.success(`All ${successful} remote(s) updated successfully!`);
+  } else {
+    logger.warn(`Push finished with ${successful}/${targets.length} remotes succeeded.`);
+  }
+}
+
+// src/cli/commands/switch.ts
+var import_picocolors16 = __toESM(require("picocolors"));
+async function handleSwitchCommand(targetIdentityId, options = {}, store = defaultConfigStore) {
+  const identities = store.loadIdentities();
+  if (identities.length === 0) {
+    logger.warn("No identities configured. Create one with 'gitbridge identity add'.");
+    return;
+  }
+  let selectedId = targetIdentityId;
+  if (!selectedId) {
+    selectedId = await promptSelect({
+      message: "Switch to identity:",
+      options: identities.map((i) => ({
+        value: i.id,
+        label: `${i.id} (${i.name} <${i.email}>)`,
+        hint: i.isDefault ? "current global default" : void 0
+      }))
+    });
+  }
+  const identity = store.getIdentity(selectedId);
+  if (!identity) {
+    logger.error(`Identity '${selectedId}' not found.`);
+    return;
+  }
+  const git = new GitCli();
+  const isGitRepo = await git.isGitRepo();
+  if (isGitRepo && !options.global) {
+    await git.setConfig("user.name", identity.name, "local");
+    await git.setConfig("user.email", identity.email, "local");
+    if (identity.signingKey) {
+      await git.setConfig("user.signingkey", identity.signingKey, "local");
+    }
+    const repoRoot = await git.getRepoRoot();
+    if (repoRoot) {
+      const existing = store.getRepository(repoRoot);
+      const profile = {
+        path: repoRoot,
+        identityId: identity.id,
+        remotes: existing?.remotes || [],
+        safetyHookInstalled: existing?.safetyHookInstalled || false,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      store.saveRepositoryProfile(profile);
+    }
+    logger.success(`Switched repository identity to '${identity.id}'!`);
+    console.log(import_picocolors16.default.gray(`  Name:  ${identity.name}`));
+    console.log(import_picocolors16.default.gray(`  Email: ${identity.email}`));
+    console.log(import_picocolors16.default.gray("  Applied locally to current repository (.git/config)."));
+  } else {
+    store.setDefaultIdentity(identity.id);
+    const generator = new GitConfigGenerator(store);
+    generator.generate();
+    logger.success(`Switched global default Git identity to '${identity.id}'!`);
+    console.log(import_picocolors16.default.gray(`  Name:  ${identity.name}`));
+    console.log(import_picocolors16.default.gray(`  Email: ${identity.email}`));
+    console.log(import_picocolors16.default.green("  Applied globally across GitBridge configuration."));
+  }
+}
+
+// src/cli/commands/doctor.ts
+var import_ora3 = __toESM(require("ora"));
+var import_picocolors17 = __toESM(require("picocolors"));
+async function handleDoctorCommand(store = defaultConfigStore) {
+  console.log(import_picocolors17.default.bold("\n  GITBRIDGE DOCTOR - SYSTEM DIAGNOSTICS"));
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  const git = new GitCli();
+  const gitInjector = new GitConfigInjector(store);
+  const sshInjector = new SshInjector(store);
+  const gitVersion = await git.getGitVersion();
+  const bunVersion = typeof Bun !== "undefined" ? Bun.version : "N/A";
+  const platform = getPlatform();
+  console.log(import_picocolors17.default.bold("  1. Toolchain & Environment"));
+  if (gitVersion) {
+    console.log(`     ${import_picocolors17.default.green("\u2714")} Git CLI:            ${import_picocolors17.default.cyan(gitVersion)}`);
+  } else {
+    console.log(`     ${import_picocolors17.default.red("\u2716")} Git CLI:            ${import_picocolors17.default.red("Not found on PATH")}`);
+  }
+  console.log(`     ${import_picocolors17.default.green("\u2714")} Bun Runtime:       ${import_picocolors17.default.cyan(bunVersion)}`);
+  console.log(`     ${import_picocolors17.default.green("\u2714")} Platform:          ${import_picocolors17.default.cyan(platform)} (${process.arch})`);
+  console.log(import_picocolors17.default.bold("\n  2. Git & SSH Integrations"));
+  const gitInstalled = gitInjector.isInstalled();
+  const sshInstalled = sshInjector.isInstalled();
+  if (gitInstalled) {
+    console.log(`     ${import_picocolors17.default.green("\u2714")} ~/.gitconfig:      ${import_picocolors17.default.green("Managed block active")}`);
+  } else {
+    console.log(`     ${import_picocolors17.default.yellow("\u26A0")} ~/.gitconfig:      ${import_picocolors17.default.yellow("Not enabled (run 'gitbridge enable')")}`);
+  }
+  if (sshInstalled) {
+    console.log(`     ${import_picocolors17.default.green("\u2714")} ~/.ssh/config:      ${import_picocolors17.default.green("Include directive active")}`);
+  } else {
+    console.log(`     ${import_picocolors17.default.gray("\u25CB")} ~/.ssh/config:      ${import_picocolors17.default.gray("Not enabled")}`);
+  }
+  console.log(import_picocolors17.default.bold("\n  3. Secure Credential Storage"));
+  const credStore = await StoreFactory.getStore(store.getPathResolver());
+  const storeAvailable = await credStore.isAvailable();
+  if (storeAvailable) {
+    console.log(`     ${import_picocolors17.default.green("\u2714")} Active Backend:    ${import_picocolors17.default.cyan(credStore.name)}`);
+  } else {
+    console.log(`     ${import_picocolors17.default.red("\u2716")} Active Backend:    ${import_picocolors17.default.red("Unavailable")}`);
+  }
+  const sshKeys = SshKeyDetector.listAvailableKeys();
+  console.log(import_picocolors17.default.bold("\n  4. Discovered SSH Keys"));
+  if (sshKeys.length > 0) {
+    for (const key of sshKeys) {
+      console.log(`     ${import_picocolors17.default.green("\u2714")} ${key.name}: ${import_picocolors17.default.gray(key.publicKeyPath)} (${key.type})`);
+    }
+  } else {
+    console.log(`     ${import_picocolors17.default.gray("\u25CB")} No .pub keys found in ~/.ssh`);
+  }
+  console.log(import_picocolors17.default.bold("\n  5. Provider Connectivity"));
+  const providers = defaultProviderRegistry.list();
+  for (const provider of providers) {
+    const spinner = (0, import_ora3.default)(`     Checking ${provider.name} (${provider.defaultHost})...`).start();
+    const health = await provider.checkHealth();
+    if (health.apiOk) {
+      spinner.succeed(`    ${import_picocolors17.default.green("\u2714")} ${provider.name}: API reachable (${health.pingMs}ms)`);
+    } else {
+      spinner.warn(`    ${import_picocolors17.default.yellow("\u26A0")} ${provider.name}: ${health.error || "Unreachable"}`);
+    }
+  }
+  console.log(import_picocolors17.default.green("\n\u2714 Diagnostics complete.\n"));
+}
+
+// src/cli/commands/setup.ts
+var import_picocolors18 = __toESM(require("picocolors"));
+async function handleSetupCommand(store = defaultConfigStore) {
+  showBanner();
+  console.log(import_picocolors18.default.bold("  Welcome to GitBridge Interactive Onboarding!\n"));
+  console.log(import_picocolors18.default.gray("  Let's set up your Git identities, provider connections, and workspace rules.\n"));
+  console.log(import_picocolors18.default.cyan("\u2500\u2500 Step 1: Create your Primary Git Identity \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
+  await handleIdentityAdd({ id: "personal", default: true }, store);
+  const addWork = await promptConfirm({
+    message: "Do you also want to create a Work or secondary identity now?",
+    initialValue: true
+  });
+  if (addWork) {
+    console.log(import_picocolors18.default.cyan("\n\u2500\u2500 Step 1b: Create Work Git Identity \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
+    await handleIdentityAdd({ id: "work", default: false }, store);
+  }
+  console.log(import_picocolors18.default.cyan("\n\u2500\u2500 Step 2: Connect Git Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
+  const selectedProviders = await promptMultiSelect({
+    message: "Which Git providers do you use? (Select with spacebar):",
+    options: [
+      { value: "github", label: "GitHub" },
+      { value: "gitlab", label: "GitLab" },
+      { value: "bitbucket", label: "Bitbucket" }
+    ]
+  });
+  for (const prov of selectedProviders) {
+    const loginNow = await promptConfirm({
+      message: `Do you want to log in to ${prov.toUpperCase()} right now?`,
+      initialValue: true
+    });
+    if (loginNow) {
+      await handleAuthLogin(prov, {}, store);
+    }
+  }
+  console.log(import_picocolors18.default.cyan("\n\u2500\u2500 Step 3: Workspace Directory Routing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
+  const addDirRule = await promptConfirm({
+    message: "Do you want to map a directory (e.g. ~/Projects/work) to an identity?",
+    initialValue: true
+  });
+  if (addDirRule) {
+    await handleRuleAdd(void 0, void 0, {}, store);
+  }
+  console.log(import_picocolors18.default.cyan("\n\u2500\u2500 Step 4: Activate Git Integration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
+  await handleEnableCommand(store);
+  logger.success("GitBridge setup completed successfully!");
+  console.log(import_picocolors18.default.bold("\n  You're all set! Try running:"));
+  console.log(import_picocolors18.default.cyan("    gitbridge status") + import_picocolors18.default.gray("     # view configured status"));
+  console.log(import_picocolors18.default.cyan("    gitbridge context") + import_picocolors18.default.gray("    # inspect current directory"));
+  console.log(import_picocolors18.default.cyan("    gitbridge doctor") + import_picocolors18.default.gray("     # run system diagnostics\n"));
+}
+
+// src/cli/commands/credential.ts
+function parseGitCredentialInput(raw) {
+  const lines = raw.split("\n");
+  const payload = {};
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx !== -1) {
+      const key = trimmed.slice(0, eqIdx);
+      const val = trimmed.slice(eqIdx + 1);
+      if (key === "protocol") payload.protocol = val;
+      if (key === "host") payload.host = val;
+      if (key === "path") payload.path = val;
+      if (key === "username") payload.username = val;
+      if (key === "password") payload.password = val;
+    }
+  }
+  return payload;
+}
+var GitCredentialHelperHandler = class {
+  store;
+  resolver;
+  constructor(store = defaultConfigStore) {
+    this.store = store;
+    this.resolver = new IdentityResolver(store);
+  }
+  async handleGet(input, cwd = process.cwd()) {
+    const payload = parseGitCredentialInput(input);
+    if (!payload.host) return "";
+    const accounts = this.store.loadAccounts();
+    const config = this.store.loadConfig();
+    if (!config.enabled) return "";
+    const ctx = await this.resolver.resolve(cwd);
+    let targetAccount = ctx.account;
+    if (!targetAccount) {
+      if (payload.username) {
+        targetAccount = accounts.find((a) => a.host === payload.host && a.username === payload.username) || null;
+      }
+      if (!targetAccount) {
+        targetAccount = accounts.find((a) => a.host === payload.host) || null;
+      }
+    }
+    if (!targetAccount) return "";
+    const credStore = await StoreFactory.getStore(this.store.getPathResolver());
+    const token = await credStore.get(targetAccount.host, targetAccount.id);
+    if (!token) return "";
+    const lines = [
+      `username=${targetAccount.username}`,
+      `password=${token}`,
+      ""
+      // trailing newline required by Git protocol
+    ];
+    return lines.join("\n");
+  }
+  async handleStore(input) {
+    const payload = parseGitCredentialInput(input);
+    if (!payload.host || !payload.username || !payload.password) return;
+    const credStore = await StoreFactory.getStore(this.store.getPathResolver());
+    const accountId = `${payload.host.replace(/[^a-zA-Z0-9]/g, "_")}_${payload.username}`;
+    await credStore.set(payload.host, accountId, payload.password);
+  }
+  async handleErase(input) {
+    const payload = parseGitCredentialInput(input);
+    if (!payload.host || !payload.username) return;
+    const credStore = await StoreFactory.getStore(this.store.getPathResolver());
+    const accountId = `${payload.host.replace(/[^a-zA-Z0-9]/g, "_")}_${payload.username}`;
+    await credStore.delete(payload.host, accountId);
+  }
+};
+async function handleCredentialCommand(action, stdinData) {
+  const handler = new GitCredentialHelperHandler();
+  let input = stdinData;
+  if (input === void 0) {
+    input = await new Response(Bun.stdin.stream()).text();
+  }
+  if (action === "get") {
+    const output = await handler.handleGet(input);
+    if (output) {
+      process.stdout.write(output);
+    }
+  } else if (action === "store") {
+    await handler.handleStore(input);
+  } else if (action === "erase") {
+    await handler.handleErase(input);
+  }
+}
+
+// src/cli/commands/hook.ts
+var import_picocolors19 = __toESM(require("picocolors"));
+async function handleHookCommand(hookType) {
+  if (hookType !== "pre-commit") {
+    return;
+  }
+  const guard = new IdentityGuard(defaultConfigStore);
+  const result = await guard.check();
+  if (!result.allowed) {
+    console.error(import_picocolors19.default.red("\n\u2716 [GitBridge Identity Guard] Commit Blocked!"));
+    console.error(import_picocolors19.default.yellow(`  ${result.message}`));
+    console.error(
+      import_picocolors19.default.gray("  To fix this commit identity, run: ") + import_picocolors19.default.cyan(`git config user.email "${result.expectedEmail}"`)
+    );
+    console.error(
+      import_picocolors19.default.gray("  Or update your GitBridge profile with: ") + import_picocolors19.default.cyan("gitbridge repo init\n")
+    );
+    process.exit(1);
+  }
+}
+
+// src/cli/index.ts
+function createProgram(name = "gitbridge") {
+  const program2 = new import_commander.Command();
+  program2.name(name).description("Universal Git Identity & Multi-Account Management Layer").version("0.1.0");
+  program2.command("setup").description("Interactive onboarding wizard to configure identities, providers, and rules").action(() => handleSetupCommand());
+  program2.command("status").alias("st").description("Show overall GitBridge status, active identities, accounts, and rules").action(() => handleStatusCommand());
+  program2.command("context").alias("ctx").description("Display GitBridge and Git identity context for current directory or repo").action(() => handleContextCommand());
+  program2.command("enable").description("Enable GitBridge integration in ~/.gitconfig and ~/.ssh/config").action(() => handleEnableCommand());
+  program2.command("disable").description("Disable GitBridge integration and safely restore original Git config").action(() => handleDisableCommand());
+  program2.command("switch [identityId]").alias("sw").description("Quickly switch active Git identity (globally or for current repository)").option("-g, --global", "Switch global default identity instead of local repo").action((identityId, opts) => handleSwitchCommand(identityId, opts));
+  program2.command("init").description("Initialize GitBridge profile and identity for the current Git repository").action(() => handleRepoInit());
+  const identityCmd = program2.command("identity").alias("id").description("Manage Git commit identities (name, email, signing key)");
+  identityCmd.command("list").alias("ls").description("List all configured identities").action(() => handleIdentityList());
+  identityCmd.command("add").description("Create a new Git identity").option("--id <id>", "Identity ID (e.g. personal, work)").option("--name <name>", "Full name for Git commits").option("--email <email>", "Email address for Git commits").option("--signing-key <key>", "SSH/GPG commit signing key").option("--default", "Set as global default identity").action((opts) => handleIdentityAdd(opts));
+  identityCmd.command("use <id>").description("Set global default Git identity").action((id) => handleIdentityUse(id));
+  identityCmd.command("remove <id>").alias("rm").description("Remove an identity").action((id) => handleIdentityRemove(id));
+  const accountCmd = program2.command("account").alias("acc").description("Manage authenticated provider accounts");
+  accountCmd.command("list").alias("ls").description("List logged-in provider accounts").action(() => handleAccountList());
+  accountCmd.command("remove <id>").alias("rm").description("Remove an account and erase credentials").action((id) => handleAccountRemove(id));
+  const authCmd = program2.command("auth").description("Authenticate with Git providers");
+  authCmd.command("login [provider]").description("Log in to a Git provider (GitHub, GitLab, Bitbucket)").option("-t, --token <token>", "Personal access token").option("--host <host>", "Custom host for enterprise/self-hosted instances").option("--ssh-key <path>", "Path to SSH private key to associate").action((prov, opts) => handleAuthLogin(prov, opts));
+  authCmd.command("logout <provider> [username]").description("Log out of a provider and remove stored tokens").action((prov, user) => handleAuthLogout(prov, user));
+  const providerCmd = program2.command("provider").alias("prov").description("Inspect supported Git providers");
+  providerCmd.command("list").alias("ls").description("List supported Git providers").action(() => handleProviderList());
+  const ruleCmd = program2.command("rule").alias("rules").description("Manage directory routing rules");
+  ruleCmd.command("list").alias("ls").description("List directory routing rules").action(() => handleRuleList());
+  ruleCmd.command("add [path] [identityId]").description("Add a directory routing rule (maps a folder to an identity)").option("--id <id>", "Custom rule ID").option("--provider <provider>", "Default provider for this directory").option("--account <accountId>", "Default account for this directory").action((p2, id, opts) => handleRuleAdd(p2, id, opts));
+  ruleCmd.command("remove <idOrPath>").alias("rm").description("Remove a directory routing rule").action((target) => handleRuleRemove(target));
+  const remoteCmd = program2.command("remote").alias("rem").description("Manage repository remotes across providers");
+  remoteCmd.command("list").alias("ls").description("List remotes for current repository").action(() => handleRemoteList());
+  remoteCmd.command("add <name> <url>").description("Add a remote with optional provider account routing").option("-a, --account <accountId>", "Account ID to route SSH alias to").action((name2, url, opts) => handleRemoteAdd(name2, url, opts));
+  program2.command("push [remoteOrProvider]").description("Push current branch to configured remotes or multiple providers").option("--all", "Push to all configured remotes simultaneously").option("--tags", "Push tags as well").option("-f, --force", "Force push").action((target, opts) => handlePushCommand(target, opts));
+  program2.command("doctor").alias("doc").description("Run comprehensive health and diagnostic checks").action(() => handleDoctorCommand());
+  const credCmd = program2.command("credential").description("Git credential helper bridge (invoked by git)");
+  credCmd.command("get").description("Retrieve credentials for git").action(() => handleCredentialCommand("get"));
+  credCmd.command("store").description("Store credentials for git").action(() => handleCredentialCommand("store"));
+  credCmd.command("erase").description("Erase credentials for git").action(() => handleCredentialCommand("erase"));
+  const hookCmd = program2.command("hook").description("Internal Git hook runner");
+  hookCmd.command("pre-commit").description("Pre-commit identity validation").action(() => handleHookCommand("pre-commit"));
+  return program2;
+}
+
+// bin/gb.ts
+var program = createProgram("gb");
+program.parseAsync(process.argv).catch((err) => {
+  console.error("Error:", err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});