@ozyman42/ozy-cli 0.0.5 → 0.2.0

package/dist/index.js

@@ -2784,7 +2784,7 @@ var require_ssh_config2 = __commonJS((exports) => {
   exports.default = ssh_config_1.default;
 });
 // package.json
-var version = "0.0.5";
+var version = "0.2.0";
 
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
@@ -2815,9 +2815,13 @@ function log(...stuff) {
 // src/common/command.ts
 function makeCommand(name, description, action) {
   return new Command(name).description(description).action(async () => {
-    const result = await action();
-    if (!result.success) {
-      log(`${result.error}: ${result.reason}`);
+    try {
+      const result = await action();
+      if (!result.success) {
+        log(`\u2717 ${result.error}: ${result.reason}`);
+      }
+    } catch (err) {
+      log(`\u2717 unexpected error: ${err instanceof Error ? err.message : String(err)}`);
     }
     process.exit();
   });
@@ -8024,22 +8028,30 @@ function parseIndexGitlinks(output) {
     return { commit: match2[1], path: match2[2] };
   });
 }
-function findGitDirs(root, rel = "") {
+function scanModuleDirs(root, modulePaths, rel = "") {
+  const gitDirs = [];
+  const orphanDirs = [];
   if (!existsSync2(root))
-    return [];
-  const results = [];
+    return { gitDirs, orphanDirs };
   for (const entry of readdirSync(root)) {
     const abs = join(root, entry);
-    const relPath = rel ? `${rel}/${entry}` : entry;
     if (!statSync(abs).isDirectory())
       continue;
+    const relPath = rel ? `${rel}/${entry}` : entry;
     if (existsSync2(join(abs, "HEAD"))) {
-      results.push(relPath);
+      gitDirs.push(relPath);
     } else {
-      results.push(...findGitDirs(abs, relPath));
+      const isPrefix = [...modulePaths].some((p) => p.startsWith(relPath + "/"));
+      if (isPrefix) {
+        const sub = scanModuleDirs(abs, modulePaths, relPath);
+        gitDirs.push(...sub.gitDirs);
+        orphanDirs.push(...sub.orphanDirs);
+      } else {
+        orphanDirs.push(relPath);
+      }
     }
   }
-  return results;
+  return { gitDirs, orphanDirs };
 }
 async function readModuleDirRemoteUrl(abs) {
   const configPath = join(abs, "config");
@@ -8049,15 +8061,38 @@ async function readModuleDirRemoteUrl(abs) {
   const match2 = content.match(/\[remote "origin"\][^\[]*\n\s+url\s*=\s*(.+)/);
   return match2?.[1].trim();
 }
+async function spawnGitInDir(args, cwd) {
+  const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "pipe" });
+  const [code, out, err] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  return code === 0 ? out.trim() : { error: err.trim().split(`
+`)[0] };
+}
 async function readWorkingTreeEntry(repoRoot, subPath) {
-  const dotGit = join(repoRoot, subPath, ".git");
-  if (!existsSync2(dotGit))
-    return { path: subPath, type: "missing" };
-  if (statSync(dotGit).isDirectory())
-    return { path: subPath, type: "dir" };
-  const content = await readFile3(dotGit, "utf8");
-  const match2 = content.match(/^gitdir:\s*(.+)$/m);
-  return { path: subPath, type: "file", gitdirTarget: match2?.[1].trim() };
+  const workingTreeAbs = join(repoRoot, subPath);
+  const dotGit = join(workingTreeAbs, ".git");
+  let type;
+  let gitdirTarget;
+  if (!existsSync2(dotGit)) {
+    type = "missing";
+  } else if (statSync(dotGit).isDirectory()) {
+    type = "dir";
+  } else {
+    type = "file";
+    const content = await readFile3(dotGit, "utf8");
+    const match2 = content.match(/^gitdir:\s*(.+)$/m);
+    gitdirTarget = match2?.[1].trim();
+  }
+  if (!existsSync2(workingTreeAbs))
+    return { path: subPath, type, gitdirTarget };
+  const [remote, headCommit] = await Promise.all([
+    spawnGitInDir(["remote", "get-url", "origin"], workingTreeAbs),
+    spawnGitInDir(["rev-parse", "HEAD"], workingTreeAbs)
+  ]);
+  return { path: subPath, type, gitdirTarget, remote, headCommit };
 }
 async function readGitState(repoRoot, extraPaths = []) {
   const gitDir = resolve2(repoRoot, ".git");
@@ -8067,8 +8102,9 @@ async function readGitState(repoRoot, extraPaths = []) {
   ]);
   const config = parseGitConfig(configContent);
   const index = parseIndexGitlinks(lsOutput);
+  const modulePaths = new Set(extraPaths);
   const modulesRoot = resolve2(gitDir, "modules");
-  const moduleDirPaths = findGitDirs(modulesRoot);
+  const { gitDirs: moduleDirPaths, orphanDirs: orphanModuleDirs } = scanModuleDirs(modulesRoot, modulePaths);
   const moduleDirs = await Promise.all(moduleDirPaths.map(async (rel) => ({
     relativePath: rel,
     remoteUrl: await readModuleDirRemoteUrl(join(modulesRoot, rel))
@@ -8081,11 +8117,11 @@ async function readGitState(repoRoot, extraPaths = []) {
     ])
   ];
   const workingTree = await Promise.all(allPaths.map((p) => readWorkingTreeEntry(repoRoot, p)));
-  return { config, moduleDirs, index, workingTree };
+  return { config, moduleDirs, orphanModuleDirs, index, workingTree };
 }
 
 // src/commands/git/sync-submodules/fix.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync3, statSync as statSync2 } from "fs";
 import { readFile as readFile4, writeFile, rename, mkdir, rm } from "fs/promises";
 import { resolve as resolve3, join as join2, dirname, relative } from "path";
 function removeExtraConfigSubmodules(content, validNames) {
@@ -8114,295 +8150,359 @@ function removeExtraConfigSubmodules(content, validNames) {
   return { result: output.join(`
 `), removed };
 }
-function repoPath(url) {
-  const stripped = url.replace(/\.git$/, "");
-  if (stripped.startsWith("http")) {
-    const parts = stripped.split("/");
-    return parts.slice(-2).join("/");
-  }
-  const colonIdx = stripped.indexOf(":");
-  return colonIdx >= 0 ? stripped.slice(colonIdx + 1) : stripped;
-}
 async function spawnGit(args, cwd) {
-  const proc = Bun.spawn(["git", ...args], { cwd, stdout: "inherit", stderr: "inherit" });
+  const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "pipe" });
   const code = await proc.exited;
-  if (code !== 0)
-    throw new Error(`git ${args.join(" ")} exited with code ${code}`);
+  if (code !== 0) {
+    const err = await new Response(proc.stderr).text();
+    throw new Error(`git ${args.join(" ")} exited with code ${code}
+${err.trim()}`);
+  }
 }
-async function fixModuleDirs(repoRoot, modules, moduleDirs) {
+async function fixGitConfig(repoRoot, modules) {
+  const configPath = resolve3(repoRoot, ".git", "config");
+  const content = await readFile4(configPath, "utf8");
+  const validNames = new Set(modules.map((m) => m.name));
+  const { result: afterRemoval, removed } = removeExtraConfigSubmodules(content, validNames);
+  const existingNames = new Set([...afterRemoval.matchAll(/^\[submodule "(.+)"\]$/gm)].map((m) => m[1]));
+  const missing = modules.filter((m) => !existingNames.has(m.name));
+  let result = afterRemoval;
+  for (const m of missing) {
+    if (!result.endsWith(`
+`))
+      result += `
+`;
+    result += `[submodule "${m.name}"]
+	active = true
+	url = ${m.url}
+	path = ${m.path}
+`;
+  }
+  if (removed.length === 0 && missing.length === 0)
+    return [];
+  await writeFile(configPath, result, "utf8");
+  return [
+    ...removed.map((name) => ({ location: [".git", "config", name], action: "deleted" })),
+    ...missing.map((m) => ({ location: [".git", "config", m.name], action: "synced" }))
+  ];
+}
+async function fixModuleDirs(repoRoot, modules, moduleDirs, orphanModuleDirs) {
+  const fixes = [];
   const modulesRoot = resolve3(repoRoot, ".git", "modules");
-  const gmByRepoPath = new Map(modules.map((m) => [repoPath(m.url), m]));
+  const gmByPath = new Map(modules.map((m) => [m.path, m]));
   for (const d of moduleDirs) {
-    const prefix = `  .git/modules/${d.relativePath}`;
-    if (!d.remoteUrl) {
-      console.log(`${prefix}: no remote URL, skipping`);
-      continue;
-    }
-    const gm = gmByRepoPath.get(repoPath(d.remoteUrl));
+    const gm = gmByPath.get(d.relativePath);
     if (!gm) {
       await rm(join2(modulesRoot, d.relativePath), { recursive: true, force: true });
-      console.log(`${prefix}: deleted (orphaned, no matching submodule)`);
-      continue;
+      fixes.push({ location: [".git", "modules", ...d.relativePath.split("/")], action: "deleted" });
     }
-    if (d.relativePath === gm.path) {
-      console.log(`${prefix}: already correct`);
-      continue;
-    }
-    const targetAbs = join2(modulesRoot, gm.path);
-    if (existsSync3(targetAbs)) {
-      console.log(`${prefix}: target ${gm.path} already exists, skipping`);
-      continue;
-    }
-    await mkdir(dirname(targetAbs), { recursive: true });
-    await rename(join2(modulesRoot, d.relativePath), targetAbs);
-    console.log(`${prefix} \u2192 ${gm.path}`);
+  }
+  for (const rel of orphanModuleDirs) {
+    await rm(join2(modulesRoot, rel), { recursive: true, force: true });
+    fixes.push({ location: [".git", "modules", ...rel.split("/")], action: "deleted" });
   }
   for (const m of modules) {
     const workingTreeDir = resolve3(repoRoot, m.path);
     const moduleGitDir = join2(modulesRoot, m.path);
     const dotGit = join2(workingTreeDir, ".git");
-    if (!existsSync3(workingTreeDir) || !existsSync3(moduleGitDir) || existsSync3(dotGit))
+    if (!existsSync3(workingTreeDir))
+      continue;
+    if (existsSync3(dotGit) && statSync2(dotGit).isDirectory()) {
+      if (existsSync3(moduleGitDir))
+        continue;
+      await mkdir(dirname(moduleGitDir), { recursive: true });
+      await rename(dotGit, moduleGitDir);
+      const rel2 = relative(workingTreeDir, moduleGitDir);
+      await writeFile(dotGit, `gitdir: ${rel2}
+`, "utf8");
+      fixes.push({ location: [...m.path.split("/"), ".git"], action: "synced", detail: "migrated standalone .git" });
+      continue;
+    }
+    if (!existsSync3(moduleGitDir)) {
+      await mkdir(dirname(moduleGitDir), { recursive: true });
+      await spawnGit(["clone", "--bare", m.url, moduleGitDir], repoRoot);
+      const configFile = `.git/modules/${m.path}/config`;
+      const worktree = relative(moduleGitDir, workingTreeDir);
+      await spawnGit(["config", "-f", configFile, "core.bare", "false"], repoRoot);
+      await spawnGit(["config", "-f", configFile, "core.worktree", worktree], repoRoot);
+      fixes.push({ location: [".git", "modules", ...m.path.split("/")], action: "synced", detail: "initialized" });
+      continue;
+    }
+    if (existsSync3(dotGit))
       continue;
     const rel = relative(workingTreeDir, moduleGitDir);
     await writeFile(dotGit, `gitdir: ${rel}
 `, "utf8");
-    console.log(`  wrote ${m.path}/.git \u2192 ${rel}`);
+    fixes.push({ location: [...m.path.split("/"), ".git"], action: "synced" });
   }
-  console.log("  running: git submodule sync");
-  await spawnGit(["submodule", "sync"], repoRoot);
   for (const m of modules) {
     const moduleGitDir = join2(modulesRoot, m.path);
     if (!existsSync3(moduleGitDir))
       continue;
+    const configFile = `.git/modules/${m.path}/config`;
+    const readConfig = (key) => Bun.spawn(["git", "config", "-f", configFile, key], { cwd: repoRoot, stdout: "pipe", stderr: "pipe" });
+    const [currentUrl, currentWorktree] = await Promise.all([
+      new Response(readConfig("remote.origin.url").stdout).text().then((t) => t.trim()),
+      new Response(readConfig("core.worktree").stdout).text().then((t) => t.trim())
+    ]);
     const worktree = relative(moduleGitDir, resolve3(repoRoot, m.path));
-    await spawnGit(["config", "-f", `.git/modules/${m.path}/config`, "core.worktree", worktree], repoRoot);
-    console.log(`  set core.worktree for ${m.path}: ${worktree}`);
+    if (currentUrl !== m.url) {
+      await spawnGit(["config", "-f", configFile, "remote.origin.url", m.url], repoRoot);
+      fixes.push({ location: [".git", "modules", ...m.path.split("/"), "config"], action: "synced", detail: "remote.origin.url" });
+    }
+    if (currentWorktree !== worktree) {
+      await spawnGit(["config", "-f", configFile, "core.worktree", worktree], repoRoot);
+      fixes.push({ location: [".git", "modules", ...m.path.split("/"), "config"], action: "synced", detail: "core.worktree" });
+    }
   }
+  return fixes;
 }
-async function fixIndexGitlinks(repoRoot, modules) {
+async function fixIndexGitlinks(repoRoot, modules, currentIndex) {
+  const currentShas = new Map(currentIndex.map((e) => [e.path, e.commit]));
+  const fixes = [];
   for (const m of modules) {
     const workingTree = resolve3(repoRoot, m.path);
-    if (!existsSync3(workingTree)) {
-      console.log(`  ${m.path}: working tree missing, skipping`);
+    if (!existsSync3(workingTree))
       continue;
-    }
-    const shaProc = Bun.spawn(["git", "rev-parse", "HEAD"], { cwd: workingTree, stdout: "pipe" });
+    const shaProc = Bun.spawn(["git", "rev-parse", "HEAD"], { cwd: workingTree, stdout: "pipe", stderr: "pipe" });
     const sha = (await new Response(shaProc.stdout).text()).trim();
-    if (!/^[0-9a-f]{40}$/.test(sha)) {
-      console.log(`  ${m.path}: could not read HEAD (${sha}), skipping`);
+    if (!/^[0-9a-f]{40}$/.test(sha))
       continue;
+    const current = currentShas.get(m.path);
+    await spawnGit(["update-index", "--add", "--cacheinfo", `160000,${sha},${m.path}`], repoRoot);
+    if (current !== sha) {
+      fixes.push({ location: [".git", "index"], action: "synced", detail: `${m.path}: ${sha.slice(0, 8)}` });
     }
-    await spawnGit(["update-index", "--cacheinfo", `160000,${sha},${m.path}`], repoRoot);
-    console.log(`  ${m.path}: ${sha.slice(0, 8)}`);
-  }
-}
-async function fixGitConfig(repoRoot, modules) {
-  const configPath = resolve3(repoRoot, ".git", "config");
-  const content = await readFile4(configPath, "utf8");
-  const validNames = new Set(modules.map((m) => m.name));
-  const { result, removed } = removeExtraConfigSubmodules(content, validNames);
-  if (removed.length === 0) {
-    console.log("  .git/config: no extra submodule entries");
-    return;
-  }
-  await writeFile(configPath, result, "utf8");
-  for (const name of removed) {
-    console.log(`  .git/config: removed [submodule "${name}"]`);
   }
+  return fixes;
 }
 
 // src/commands/git/sync-submodules/printer.ts
 var RED = "\x1B[31m";
+var GREEN = "\x1B[32m";
+var CYAN = "\x1B[36m";
+var DIM = "\x1B[2m";
+var BOLD = "\x1B[1m";
 var RESET = "\x1B[0m";
-function renderField(f, indent) {
-  const text = f.key !== undefined ? `${indent}  ${f.key}=${f.value}` : `${indent}  ${f.value}`;
-  return f.error ? `${text}  ${RED}\u2190 ${f.error}${RESET}` : text;
-}
-
-class PrintableItem {
-  headerError() {
-    return;
-  }
-  print(indent = "  ") {
-    const e = this.headerError();
-    console.log(e ? `${indent}${this.header()}  ${RED}\u2190 ${e}${RESET}` : `${indent}${this.header()}`);
-    for (const f of this.fields())
-      console.log(renderField(f, indent));
-  }
-  static printGroup(header, items) {
-    console.log(`
-=== ${header} ===`);
-    for (const item of items)
-      item.print();
+var ok = `${GREEN}\u2713${RESET}`;
+var fail = (msg) => `${RED}\u2717 ${msg}${RESET}`;
+var fsName = (s) => `${CYAN}${s}${RESET}`;
+var key = (s) => `${DIM}${s}${RESET}`;
+function render(lines, prefix = "") {
+  for (let i = 0;i < lines.length; i++) {
+    const last = i === lines.length - 1;
+    const branch = last ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ";
+    const child = last ? "    " : "\u2502   ";
+    const l = lines[i];
+    const label = l.isKey ? key(l.label) : fsName(l.label);
+    let out = `${prefix}${branch}${label}`;
+    if (l.value !== undefined)
+      out += `: ${l.value}`;
+    if (l.status !== undefined)
+      out += `  ${l.status}`;
+    console.log(out);
+    if (l.children?.length)
+      render(l.children, prefix + child);
   }
 }
-
-class GhostItem extends PrintableItem {
-  label;
-  message;
-  constructor(label, message) {
-    super();
-    this.label = label;
-    this.message = message;
-  }
-  header() {
-    return this.label;
-  }
-  fields() {
-    return [];
-  }
-  print(indent = "  ") {
-    console.log(`${RED}${indent}${this.label}  \u2190 ${this.message}${RESET}`);
-  }
+function buildPathTree(parts, children) {
+  if (parts.length === 1)
+    return { label: parts[0], children };
+  return { label: parts[0], children: [buildPathTree(parts.slice(1), children)] };
 }
-
-class GitmodulesEntryItem extends PrintableItem {
-  m;
-  constructor(m) {
-    super();
-    this.m = m;
-  }
-  header() {
-    return `[${this.m.name}]`;
-  }
-  fields() {
-    return [
-      { key: "path", value: this.m.path },
-      { key: "url", value: this.m.url }
-    ];
-  }
+function resultLine(label, result) {
+  if (result === undefined)
+    return { label, isKey: true, status: fail("unknown") };
+  if (typeof result === "string")
+    return { label, isKey: true, value: result };
+  return { label, isKey: true, status: fail(result.error) };
 }
-
-class GitConfigEntryItem extends PrintableItem {
-  e;
-  gm;
-  isDuplicate;
-  constructor(e, gm, isDuplicate) {
-    super();
-    this.e = e;
-    this.gm = gm;
-    this.isDuplicate = isDuplicate;
-  }
-  header() {
-    return `[${this.e.name}]`;
-  }
-  headerError() {
-    if (this.isDuplicate)
-      return "duplicate";
-    if (!this.gm)
-      return "not in .gitmodules";
-  }
-  fields() {
-    const { e, gm } = this;
-    return [
-      { key: "path", value: e.path ?? "(none)", error: gm && e.path !== gm.path ? `expected ${gm.path}` : undefined },
-      { key: "url", value: e.url ?? "(none)", error: gm && e.url !== gm.url ? `expected ${gm.url}` : undefined },
-      { key: "active", value: String(e.active ?? "(unset)") }
-    ];
-  }
+function moduleHasIssues(m, cfg, dir, idx, headSha, wt) {
+  if (!cfg)
+    return true;
+  if (cfg.path !== m.path || cfg.url !== m.url)
+    return true;
+  if (!dir)
+    return true;
+  if (!idx)
+    return true;
+  if (headSha && idx.commit !== headSha)
+    return true;
+  if (!wt || wt.type === "missing" || wt.type === "dir")
+    return true;
+  if (typeof wt.headCommit !== "string")
+    return true;
+  if (typeof wt.remote !== "string" || wt.remote !== m.url)
+    return true;
+  return false;
 }
-
-class ModuleDirItem extends PrintableItem {
-  d;
-  gm;
-  constructor(d, gm) {
-    super();
-    this.d = d;
-    this.gm = gm;
-  }
-  header() {
-    return this.d.relativePath;
-  }
-  headerError() {
-    return !this.gm ? "not in .gitmodules" : undefined;
+function printSyncState(modules, state) {
+  const byName = new Map(state.config.map((c) => [c.name, c]));
+  const byPath = new Map(state.moduleDirs.map((d) => [d.relativePath, d]));
+  const byIndexPath = new Map(state.index.map((i) => [i.path, i]));
+  const byTreePath = new Map(state.workingTree.map((w) => [w.path, w]));
+  const modulePaths = new Set(modules.map((m) => m.path));
+  const moduleNames = new Set(modules.map((m) => m.name));
+  console.log("=== submodules ===");
+  for (const m of modules) {
+    const cfg = byName.get(m.name);
+    const dir = byPath.get(m.path);
+    const idx = byIndexPath.get(m.path);
+    const wt = byTreePath.get(m.path);
+    const headSha = typeof wt?.headCommit === "string" ? wt.headCommit : undefined;
+    console.log(`
+${BOLD}[${m.name}]${RESET}`);
+    if (!moduleHasIssues(m, cfg, dir, idx, headSha, wt)) {
+      console.log(`\u2514\u2500\u2500 ${ok}`);
+      continue;
+    }
+    const gitmodulesNode = {
+      label: ".gitmodules",
+      children: [
+        { label: "path", isKey: true, value: m.path },
+        { label: "url", isKey: true, value: m.url }
+      ]
+    };
+    let configNode;
+    if (!cfg) {
+      configNode = { label: "config", status: fail("missing") };
+    } else {
+      configNode = {
+        label: "config",
+        children: [
+          {
+            label: "path",
+            isKey: true,
+            value: cfg.path ?? "(missing)",
+            status: cfg.path === m.path ? ok : fail(`expected ${m.path}`)
+          },
+          {
+            label: "url",
+            isKey: true,
+            value: cfg.url ?? "(missing)",
+            status: cfg.url === m.url ? ok : fail(`expected ${m.url}`)
+          }
+        ]
+      };
+    }
+    const modulesNode = {
+      label: "modules",
+      children: [{ label: m.path, status: dir ? ok : fail("missing") }]
+    };
+    let indexNode;
+    if (!idx) {
+      indexNode = { label: "index", status: fail("missing") };
+    } else {
+      const idxSha8 = idx.commit.slice(0, 8);
+      const matches = headSha && idx.commit === headSha;
+      const mismatches = headSha && idx.commit !== headSha;
+      indexNode = {
+        label: "index",
+        value: idxSha8,
+        status: matches ? ok : mismatches ? fail(`head is ${headSha.slice(0, 8)}`) : undefined
+      };
+    }
+    const dotGitNode = {
+      label: ".git",
+      children: [configNode, modulesNode, indexNode]
+    };
+    const wtLeaves = [];
+    if (!wt || wt.type === "missing") {
+      wtLeaves.push({ label: ".git", status: fail("missing") });
+    } else if (wt.type === "dir") {
+      wtLeaves.push({ label: ".git", status: fail("directory (standalone clone)") });
+    } else {
+      wtLeaves.push({ label: ".git", value: `gitdir \u2192 ${wt.gitdirTarget}` });
+    }
+    if (wt) {
+      const head = headSha ?? wt.headCommit;
+      wtLeaves.push(resultLine("head", typeof head === "string" ? head.slice(0, 8) : head));
+      if (typeof wt.remote === "string") {
+        wtLeaves.push({
+          label: "remote",
+          isKey: true,
+          value: wt.remote,
+          status: wt.remote === m.url ? ok : fail(`expected ${m.url}`)
+        });
+      } else {
+        wtLeaves.push(resultLine("remote", wt.remote));
+      }
+    }
+    const workingTreeNode = buildPathTree(m.path.split("/"), wtLeaves);
+    render([gitmodulesNode, dotGitNode, workingTreeNode]);
   }
-  fields() {
-    const { d, gm } = this;
-    return [
-      { key: "remote", value: d.remoteUrl ?? "(none)", error: gm && d.remoteUrl && d.remoteUrl !== gm.url ? `expected ${gm.url}` : undefined }
-    ];
+  const staleConfig = state.config.filter((c) => !moduleNames.has(c.name));
+  const staleDirs = state.moduleDirs.filter((d) => !modulePaths.has(d.relativePath));
+  const staleIndex = state.index.filter((i) => !modulePaths.has(i.path));
+  if (staleConfig.length || staleDirs.length || state.orphanModuleDirs.length || staleIndex.length) {
+    console.log(`
+${RED}${BOLD}=== stale (not in .gitmodules) ===${RESET}`);
+    const staleNodes = [];
+    if (staleConfig.length) {
+      staleNodes.push({
+        label: ".git/config",
+        children: staleConfig.map((c) => ({ label: c.name }))
+      });
+    }
+    if (staleDirs.length || state.orphanModuleDirs.length) {
+      staleNodes.push({
+        label: ".git/modules",
+        children: [
+          ...staleDirs.map((d) => ({ label: d.relativePath })),
+          ...state.orphanModuleDirs.map((d) => ({ label: d }))
+        ]
+      });
+    }
+    if (staleIndex.length) {
+      staleNodes.push({
+        label: ".git/index",
+        children: staleIndex.map((i) => ({ label: i.path, isKey: true, value: i.commit.slice(0, 8) }))
+      });
+    }
+    render(staleNodes);
   }
 }
-
-class IndexGitlinkItem extends PrintableItem {
-  e;
-  knownPath;
-  constructor(e, knownPath) {
-    super();
-    this.e = e;
-    this.knownPath = knownPath;
-  }
-  header() {
-    return this.e.path;
-  }
-  headerError() {
-    return !this.knownPath ? "not in .gitmodules" : undefined;
-  }
-  fields() {
-    return [{ key: "commit", value: this.e.commit.slice(0, 8) }];
+function addToFixTree(tree, fix, depth = 0) {
+  const seg = fix.location[depth];
+  if (!tree.has(seg))
+    tree.set(seg, { subtree: new Map, fixes: [] });
+  const node = tree.get(seg);
+  if (depth === fix.location.length - 1) {
+    node.fixes.push(fix);
+  } else {
+    addToFixTree(node.subtree, fix, depth + 1);
   }
 }
-
-class WorkingTreeItem extends PrintableItem {
-  e;
-  constructor(e) {
-    super();
-    this.e = e;
-  }
-  header() {
-    return this.e.path;
-  }
-  headerError() {
-    if (this.e.type === "missing")
-      return "missing";
-    if (this.e.type === "dir")
-      return "expected gitdir file, got directory";
-  }
-  fields() {
-    if (this.e.type === "file")
-      return [{ value: `gitdir -> ${this.e.gitdirTarget}` }];
-    return [];
+function fixTreeToLines(tree) {
+  const lines = [];
+  for (const [label, { subtree, fixes }] of tree) {
+    const children = fixTreeToLines(subtree);
+    if (fixes.length > 0) {
+      for (const fix of fixes) {
+        const actionStr = fix.action === "deleted" ? `${RED}deleted${RESET}` : `${GREEN}synced${RESET}`;
+        const status = fix.detail ? `${actionStr}  ${fix.detail}` : actionStr;
+        lines.push({ label, status, children: children.length > 0 ? children : undefined });
+      }
+    } else {
+      lines.push({ label, children });
+    }
   }
+  return lines;
+}
+function printFixes(fixes) {
+  if (fixes.length === 0)
+    return;
+  const tree = new Map;
+  for (const fix of fixes)
+    addToFixTree(tree, fix);
+  console.log(`
+applied fixes:`);
+  render(fixTreeToLines(tree));
 }
 
 // src/commands/git/sync-submodules/index.ts
 var REPO_ROOT = process.cwd();
 var GITMODULES_PATH = resolve4(REPO_ROOT, ".gitmodules");
-function buildSections(modules, state) {
-  const byName = new Map(modules.map((m) => [m.name, m]));
-  const byPath = new Map(modules.map((m) => [m.path, m]));
-  const gitmodulesItems = modules.map((m) => new GitmodulesEntryItem(m));
-  const seenConfigNames = new Set;
-  const configItems = state.config.map((e) => {
-    const isDuplicate = seenConfigNames.has(e.name);
-    seenConfigNames.add(e.name);
-    return new GitConfigEntryItem(e, byName.get(e.name), isDuplicate);
-  });
-  for (const m of modules) {
-    if (!seenConfigNames.has(m.name))
-      configItems.push(new GhostItem(`[${m.name}]`, "missing from .git/config"));
-  }
-  const seenModulePaths = new Set;
-  const moduleDirItems = state.moduleDirs.map((d) => {
-    seenModulePaths.add(d.relativePath);
-    return new ModuleDirItem(d, byPath.get(d.relativePath));
-  });
-  for (const m of modules) {
-    if (!seenModulePaths.has(m.path))
-      moduleDirItems.push(new GhostItem(m.path, "missing from .git/modules/"));
-  }
-  const seenIndexPaths = new Set;
-  const indexItems = state.index.map((e) => {
-    seenIndexPaths.add(e.path);
-    return new IndexGitlinkItem(e, byPath.has(e.path));
-  });
-  for (const m of modules) {
-    if (!seenIndexPaths.has(m.path))
-      indexItems.push(new GhostItem(m.path, "missing from index"));
-  }
-  const workingTreeItems = state.workingTree.map((e) => new WorkingTreeItem(e));
-  return { gitmodulesItems, configItems, moduleDirItems, indexItems, workingTreeItems };
-}
 async function main() {
   const content = await readFile5(GITMODULES_PATH, "utf8");
   const modules = parse(content);
@@ -8414,20 +8514,14 @@ async function main() {
     process.exit(1);
   }
   const submodulePaths = modules.map((m) => m.path);
-  console.log("=== fixing ===");
-  await fixGitConfig(REPO_ROOT, modules);
-  const preFixState = await readGitState(REPO_ROOT, submodulePaths);
-  await fixModuleDirs(REPO_ROOT, modules, preFixState.moduleDirs);
-  await fixIndexGitlinks(REPO_ROOT, modules);
   const state = await readGitState(REPO_ROOT, submodulePaths);
-  const { gitmodulesItems, configItems, moduleDirItems, indexItems, workingTreeItems } = buildSections(modules, state);
-  console.log("=== .gitmodules ===");
-  for (const item of gitmodulesItems)
-    item.print();
-  PrintableItem.printGroup(".git/config submodule entries", configItems);
-  PrintableItem.printGroup(".git/modules/ git dirs", moduleDirItems);
-  PrintableItem.printGroup("index gitlinks", indexItems);
-  PrintableItem.printGroup("working tree .git entries", workingTreeItems);
+  printSyncState(modules, state);
+  const appliedFixes = [
+    ...await fixGitConfig(REPO_ROOT, modules),
+    ...await fixModuleDirs(REPO_ROOT, modules, state.moduleDirs, state.orphanModuleDirs),
+    ...await fixIndexGitlinks(REPO_ROOT, modules, state.index)
+  ];
+  printFixes(appliedFixes);
   const result = serialize(sorted(modules));
   if (result !== content) {
     await writeFile2(GITMODULES_PATH, result, "utf8");
@@ -8446,10 +8540,425 @@ var git = new Command("git").summary("setup git in repo for verified commits");
   git.addCommand(cmd);
 });
 
-// src/commands/npm/setup.ts
+// src/commands/npm/setup/index.ts
+var {$: $6 } = globalThis.Bun;
+import { existsSync as existsSync4 } from "fs";
+
+// src/commands/npm/setup/npm-auth.ts
+var {$: $3 } = globalThis.Bun;
+import { readFileSync, writeFileSync, unlinkSync } from "fs";
+import { homedir } from "os";
+var npmrcPath = `${homedir()}/.npmrc`;
+var TOKEN_RE = /^\/\/registry\.npmjs\.org\/:_authToken=(\S+)$/m;
+function readNpmrc() {
+  try {
+    return readFileSync(npmrcPath, "utf8");
+  } catch {
+    return "";
+  }
+}
+function stripTokenFromDisk() {
+  const content = readNpmrc();
+  const stripped = content.replace(TOKEN_RE, "").replace(/\n{3,}/g, `
+
+`).trim();
+  if (!stripped) {
+    try {
+      unlinkSync(npmrcPath);
+    } catch {}
+  } else {
+    writeFileSync(npmrcPath, stripped + `
+`);
+  }
+}
+async function whoamiWithToken(token) {
+  const result = await $3`npm whoami`.env({ ...process.env, NODE_AUTH_TOKEN: token }).quiet().nothrow();
+  if (result.exitCode !== 0)
+    return null;
+  return result.stdout.toString().trim();
+}
+async function acquireToken() {
+  const existing = readNpmrc().match(TOKEN_RE)?.[1];
+  if (existing) {
+    const user2 = await whoamiWithToken(existing);
+    if (user2) {
+      stripTokenFromDisk();
+      return { token: existing, user: user2 };
+    }
+  }
+  log("  not logged in \u2014 opening npm login...");
+  await $3`npm login`.nothrow();
+  const token = readNpmrc().match(TOKEN_RE)?.[1];
+  if (!token)
+    throw new Error('npm login did not produce a token \u2014 try running "npm login" manually');
+  const user = await whoamiWithToken(token);
+  if (!user)
+    throw new Error("npm login succeeded but token verification failed");
+  stripTokenFromDisk();
+  return { token, user };
+}
+
+// src/commands/npm/setup/package-registry.ts
+async function fetchPackageInfo(name) {
+  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`);
+  if (res.status === 404)
+    return null;
+  if (!res.ok)
+    throw new Error(`registry error ${res.status} for ${name}`);
+  const data = await res.json();
+  return {
+    name: data.name,
+    latestVersion: data["dist-tags"]?.latest,
+    distTags: data["dist-tags"] ?? {}
+  };
+}
+
+// src/commands/npm/setup/trusted-publishing.ts
+var {$: $4 } = globalThis.Bun;
+import { createInterface } from "readline";
+function encodePackageName(name) {
+  if (!name.startsWith("@"))
+    return encodeURIComponent(name);
+  const slash = name.indexOf("/");
+  return `@${name.slice(1, slash)}%2F${name.slice(slash + 1)}`;
+}
+function promptPasscode() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve5) => {
+    rl.question("  enter the passcode from the browser: ", (answer) => {
+      rl.close();
+      resolve5(answer.trim());
+    });
+  });
+}
+async function registryPost(url, body, authToken, { existingOtp, alreadyExistsStatus } = {}) {
+  const headers = {
+    Authorization: `Bearer ${authToken}`,
+    "Content-Type": "application/json"
+  };
+  const post = (otp) => fetch(url, {
+    method: "POST",
+    headers: otp ? { ...headers, "npm-otp": otp } : headers,
+    body
+  });
+  const check = (res2) => {
+    if (res2.ok)
+      return true;
+    if (alreadyExistsStatus && res2.status === alreadyExistsStatus)
+      return true;
+    return false;
+  };
+  if (existingOtp) {
+    const res2 = await post(existingOtp);
+    if (check(res2))
+      return { otp: existingOtp, alreadyExists: !res2.ok };
+  }
+  let res = await post();
+  if (check(res))
+    return { otp: undefined, alreadyExists: !res.ok };
+  if (res.status === 401) {
+    const notice = res.headers.get("npm-notice") ?? "";
+    const loginUrl = notice.match(/https:\/\/www\.npmjs\.com\/login\/[a-f0-9-]+/)?.[0];
+    if (!loginUrl)
+      throw new Error("2FA required but could not parse login URL");
+    await $4`open ${loginUrl}`.quiet().nothrow();
+    const otp = await promptPasscode();
+    res = await post(otp);
+    if (check(res))
+      return { otp, alreadyExists: !res.ok };
+  }
+  throw new Error(`${res.status} ${await res.text()}`);
+}
+async function addTrustedPublisher(name, ownerRepo, token, environment = "prod") {
+  const encoded = encodePackageName(name);
+  log("  setting up (may require 2FA)...");
+  const body = JSON.stringify([{
+    type: "github",
+    claims: { repository: ownerRepo, workflow_ref: { file: "publish.yml" }, environment },
+    permissions: ["createPackage"]
+  }]);
+  try {
+    const { otp, alreadyExists } = await registryPost(`https://registry.npmjs.org/-/package/${encoded}/trust`, body, token, { alreadyExistsStatus: 409 });
+    return { alreadyConfigured: alreadyExists, otp };
+  } catch (e) {
+    throw new Error(`trust setup failed: ${e.message}`);
+  }
+}
+async function setPackageAccessPolicy(name, token, existingOtp) {
+  const encoded = encodePackageName(name);
+  const body = JSON.stringify({ publish_requires_tfa: true, automation_token_overrides_tfa: false });
+  try {
+    await registryPost(`https://registry.npmjs.org/-/package/${encoded}/access`, body, token, { existingOtp });
+  } catch (e) {
+    throw new Error(`access policy setup failed: ${e.message}`);
+  }
+}
+
+// src/commands/npm/setup/git-remote.ts
+var {$: $5 } = globalThis.Bun;
+function parseGithubOwnerRepo(url) {
+  const https = url.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (https)
+    return { owner: https[1], repo: https[2] };
+  const alias = url.match(/^[^:]+:([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (alias)
+    return { owner: alias[1], repo: alias[2] };
+  return null;
+}
+async function checkGitHubAccess(remoteUrl) {
+  const parsed = parseGithubOwnerRepo(remoteUrl);
+  if (!parsed)
+    return null;
+  const result = await $5`gh api repos/${parsed.owner}/${parsed.repo}`.quiet().nothrow();
+  if (result.exitCode !== 0)
+    return null;
+  let data;
+  try {
+    data = JSON.parse(result.stdout.toString());
+  } catch {
+    return null;
+  }
+  return { ...parsed, canPush: data?.permissions?.push === true };
+}
+
+// src/commands/npm/setup/workflow.ts
+import * as fs3 from "fs/promises";
+import * as path from "path";
+
+// src/commands/npm/setup/publish-workflow.yml
+var publish_workflow_default = `name: Publish to npm
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: prod
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build
+        run: bun run build
+
+      - name: Publish
+        run: npm publish dist/ --access public
+`;
+
+// src/commands/npm/setup/workflow.ts
+var WORKFLOW_PATH = ".github/workflows/publish.yml";
+async function workflowExists(repoRoot) {
+  try {
+    await fs3.access(path.join(repoRoot, WORKFLOW_PATH));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function createWorkflow(repoRoot) {
+  const fullPath = path.join(repoRoot, WORKFLOW_PATH);
+  await fs3.mkdir(path.dirname(fullPath), { recursive: true });
+  await fs3.writeFile(fullPath, publish_workflow_default, "utf8");
+}
+
+// src/commands/npm/setup/package-json-validate.ts
+var GITHUB_URL_RE = /^git\+https:\/\/github\.com\/[^/]+\/[^/]+\.git$/;
+function isValidGitHubUrl(url) {
+  return GITHUB_URL_RE.test(url);
+}
+function validatePackageJson(pkg) {
+  const issues = [];
+  const repoUrl = typeof pkg.repository === "object" ? pkg.repository?.url : pkg.repository;
+  if (!repoUrl) {
+    issues.push({ field: "repository", issue: "missing \u2014 required for provenance" });
+  } else if (!isValidGitHubUrl(repoUrl)) {
+    issues.push({ field: "repository.url", issue: `not a valid GitHub URL (got "${repoUrl}")` });
+  }
+  if (pkg.publishConfig?.access !== "public") {
+    issues.push({ field: "publishConfig.access", issue: 'should be "public"' });
+  }
+  if (pkg.publishConfig?.provenance !== true) {
+    issues.push({ field: "publishConfig.provenance", issue: "should be true" });
+  }
+  if (!pkg.version) {
+    issues.push({ field: "version", issue: 'missing \u2014 add a "version" field (e.g. "0.0.1")', fatal: true });
+  }
+  if (!pkg.scripts?.build) {
+    issues.push({ field: "scripts.build", issue: 'missing \u2014 add a "build" script before running setup', fatal: true });
+  }
+  if (!pkg.files?.includes("dist")) {
+    issues.push({ field: "files", issue: `"dist" not included \u2014 built output won't be published` });
+  }
+  return issues;
+}
+
+// src/commands/npm/setup/index.ts
 var setup2 = makeCommand("setup", "configure a new npm package for publishing", async () => {
+  const cwd = process.cwd();
+  log("checking npm...");
+  const npmCheck = await $6`which npm`.quiet().nothrow();
+  if (npmCheck.exitCode !== 0) {
+    return Err("NpmNotFound" /* NpmNotFound */, '"npm" not found in PATH \u2014 install Node.js from nodejs.org');
+  }
+  const npmVersion = (await $6`npm --version`.quiet().nothrow()).stdout.toString().trim();
+  const [major, minor] = npmVersion.split(".").map(Number);
+  if (major < 11 || major === 11 && minor < 10) {
+    return Err("NpmNotFound" /* NpmNotFound */, `npm ${npmVersion} is too old \u2014 "npm trust" requires 11.10.0+ (run "npm install -g npm")`);
+  }
+  let npmToken, npmUser;
+  try {
+    ({ token: npmToken, user: npmUser } = await acquireToken());
+  } catch (e) {
+    return Err("NotLoggedIn" /* NotLoggedIn */, `npm authentication failed: ${e.message}`);
+  }
+  log(`  \u2713 logged in as ${npmUser}`);
+  log("checking GitHub...");
+  const ghCheck = await $6`which gh`.quiet().nothrow();
+  if (ghCheck.exitCode !== 0) {
+    return Err("GhNotFound" /* GhNotFound */, '"gh" not found in PATH \u2014 install GitHub CLI from cli.github.com');
+  }
+  let ghUser = await $6`gh api user --jq .login`.quiet().nothrow();
+  if (ghUser.exitCode !== 0) {
+    log("  not logged in \u2014 opening gh auth login...");
+    await $6`gh auth login`.nothrow();
+    ghUser = await $6`gh api user --jq .login`.quiet().nothrow();
+  }
+  if (ghUser.exitCode !== 0) {
+    return Err("NotLoggedIn" /* NotLoggedIn */, 'not logged into GitHub \u2014 run "gh auth login"');
+  }
+  log(`  \u2713 logged in as ${ghUser.stdout.toString().trim()}`);
+  log("checking git repo...");
+  if (!existsSync4(`${cwd}/.git`)) {
+    return Err("NoGitRepo" /* NoGitRepo */, 'current directory is not a git repository \u2014 run "git init" first');
+  }
+  log("  \u2713 git repo");
+  log("checking package.json...");
+  const pkgFile = Bun.file(`${cwd}/package.json`);
+  if (!await pkgFile.exists()) {
+    return Err("NoPackageJson" /* NoPackageJson */, "no package.json found \u2014 run this command from a package directory");
+  }
+  let pkg;
+  try {
+    pkg = await pkgFile.json();
+  } catch {
+    return Err("InvalidPackageJson" /* InvalidPackageJson */, "package.json contains invalid JSON \u2014 fix it and retry");
+  }
+  const { name } = pkg;
+  if (!name) {
+    return Err("InvalidPackageJson" /* InvalidPackageJson */, 'package.json is missing a "name" field');
+  }
+  log(`  name: ${name}`);
+  const fatal = validatePackageJson(pkg).find((i) => i.fatal);
+  if (fatal) {
+    return Err("InvalidPackageJson" /* InvalidPackageJson */, `${fatal.field}: ${fatal.issue}`);
+  }
+  log("checking git remote...");
+  const remote = await getRemoteUrl(cwd);
+  if (!remote) {
+    return Err("NoGitRemote" /* NoGitRemote */, 'no git remote configured \u2014 run "git remote add origin <url>" first');
+  }
+  log(`  remote: ${remote}`);
+  const access2 = await checkGitHubAccess(remote);
+  if (!access2) {
+    return Err("RepoNotFound" /* RepoNotFound */, `could not reach GitHub repo at ${remote} \u2014 check "gh auth status"`);
+  }
+  if (!access2.canPush) {
+    return Err("NoWriteAccess" /* NoWriteAccess */, `no push access to ${access2.owner}/${access2.repo} \u2014 you need write permissions`);
+  }
+  const repoHttpsUrl = `https://github.com/${access2.owner}/${access2.repo}`;
+  log(`  \u2713 ${access2.owner}/${access2.repo} (write access confirmed)`);
+  const expectedRepoUrl = `git+${repoHttpsUrl}.git`;
+  const currentRepoUrl = typeof pkg.repository === "object" ? pkg.repository?.url : pkg.repository;
+  if (currentRepoUrl !== expectedRepoUrl) {
+    log("syncing package.json repository URL...");
+    log(`  was: ${currentRepoUrl ?? "(missing)"}`);
+    pkg = { ...pkg, repository: { type: "git", url: expectedRepoUrl } };
+    await Bun.write(`${cwd}/package.json`, JSON.stringify(pkg, null, 2) + `
+`);
+    log(`  \u2713 set to ${expectedRepoUrl}`);
+  }
+  const nonFatal = validatePackageJson(pkg).filter((i) => !i.fatal);
+  if (nonFatal.length > 0) {
+    log("package.json issues (fix manually):");
+    for (const { field, issue } of nonFatal)
+      log(`  ${field}: ${issue}`);
+  }
+  log("checking publish workflow...");
+  if (!await workflowExists(cwd)) {
+    await createWorkflow(cwd);
+    log("  \u2713 created .github/workflows/publish.yml");
+  } else {
+    log("  \u2713 already exists");
+  }
+  log("checking npm registry...");
+  const info = await fetchPackageInfo(name).catch((err) => {
+    throw new Error(`npm registry lookup failed: ${err.message}`);
+  });
+  if (!info) {
+    log("  package not yet published \u2014 building and creating initial release...");
+    const buildResult = await $6`bun run build`.nothrow();
+    if (buildResult.exitCode !== 0) {
+      throw new Error(`build failed: ${buildResult.stderr.toString().trim()}`);
+    }
+    const distPkgFile = Bun.file(`${cwd}/dist/package.json`);
+    if (!await distPkgFile.exists()) {
+      throw new Error("build succeeded but dist/package.json is missing \u2014 build script must produce it");
+    }
+    try {
+      await distPkgFile.json();
+    } catch {
+      throw new Error("dist/package.json exists but contains invalid JSON \u2014 check your build script");
+    }
+    await npmPublish(npmToken);
+    log(`  \u2713 published ${name}`);
+  } else {
+    const version2 = info.latestVersion ?? "(unknown)";
+    log(`  \u2713 exists (latest v${version2})`);
+  }
+  log("checking trusted publishing...");
+  const ownerRepo = `${access2.owner}/${access2.repo}`;
+  const trust = await addTrustedPublisher(name, ownerRepo, npmToken);
+  log(trust.alreadyConfigured ? "  \u2713 already configured" : "  \u2713 configured");
+  log("setting package access policy...");
+  await setPackageAccessPolicy(name, npmToken, trust.otp);
+  log("  \u2713 configured");
   return Ok(true);
 });
+async function getRemoteUrl(cwd) {
+  const result = await $6`git -C ${cwd} remote get-url origin`.quiet().nothrow();
+  if (result.exitCode !== 0)
+    return;
+  return result.stdout.toString().trim();
+}
+async function npmPublish(token) {
+  const proc = Bun.spawn(["npm", "publish", "dist/", "--access", "public", "--no-provenance"], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: { ...process.env, NODE_AUTH_TOKEN: token }
+  });
+  const exitCode = await proc.exited;
+  if (exitCode !== 0)
+    throw new Error("npm publish failed \u2014 see output above");
+}
 
 // src/commands/npm/index.ts
 var npm = new Command("npm").summary("npm package management utilities");
@@ -8457,9 +8966,89 @@ var npm = new Command("npm").summary("npm package management utilities");
   npm.addCommand(cmd);
 });
 
+// src/commands/upgrade.ts
+import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+function findLockFile(dir) {
+  let current = dir;
+  while (true) {
+    if (existsSync5(join4(current, "bun.lock")) || existsSync5(join4(current, "bun.lockb")))
+      return "bun";
+    if (existsSync5(join4(current, "pnpm-lock.yaml")))
+      return "pnpm";
+    if (existsSync5(join4(current, "package-lock.json")))
+      return "npm";
+    const parent = dirname3(current);
+    if (parent === current)
+      return;
+    current = parent;
+  }
+}
+function detectInstall(binaryPath) {
+  if (binaryPath.includes("/.bun/bin/")) {
+    return { pm: "bun", scope: "global" };
+  }
+  if (binaryPath.includes("/pnpm/")) {
+    return { pm: "pnpm", scope: "global" };
+  }
+  const localMatch = binaryPath.match(/^(.+\/node_modules)\/.bin\//);
+  if (localMatch) {
+    const projectRoot = dirname3(localMatch[1]);
+    const pm = findLockFile(projectRoot) ?? "npm";
+    return { pm, scope: "local", cwd: projectRoot };
+  }
+  return;
+}
+function buildUpgradeCommand(info) {
+  const pkg = "@ozyman42/ozy-cli@latest";
+  if (info.scope === "global") {
+    if (info.pm === "bun")
+      return ["bun", "add", "-g", pkg];
+    if (info.pm === "pnpm")
+      return ["pnpm", "add", "-g", pkg];
+    return ["npm", "install", "-g", pkg];
+  }
+  if (info.pm === "bun")
+    return ["bun", "add", pkg];
+  if (info.pm === "pnpm")
+    return ["pnpm", "add", pkg];
+  return ["npm", "install", pkg];
+}
+async function whichOzy() {
+  const proc = Bun.spawn(["which", "ozy"], { stdout: "pipe", stderr: "pipe" });
+  const code = await proc.exited;
+  if (code !== 0)
+    return;
+  return (await new Response(proc.stdout).text()).trim();
+}
+var upgrade = makeCommand("upgrade", "upgrade ozy-cli to the latest version", async () => {
+  const binaryPath = await whichOzy();
+  if (!binaryPath) {
+    return Err("not-installed", "ozy binary not found \u2014 install with: bun add -g @ozyman42/ozy-cli");
+  }
+  const info = detectInstall(binaryPath);
+  if (!info) {
+    return Err("unknown-install", `could not detect package manager from binary path: ${binaryPath}
+Upgrade manually with your package manager.`);
+  }
+  const cmd = buildUpgradeCommand(info);
+  console.log(`Detected: ${info.pm} (${info.scope})`);
+  console.log(`Running: ${cmd.join(" ")}`);
+  const proc = Bun.spawn(cmd, {
+    cwd: info.cwd ?? process.cwd(),
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  const code = await proc.exited;
+  if (code !== 0) {
+    return Err("install-failed", `${cmd[0]} exited with code ${code}`);
+  }
+  return Ok(true);
+});
+
 // src/commands/index.ts
 program.name("ozy").version(version);
-[git, npm].forEach((cmd) => {
+[git, npm, upgrade].forEach((cmd) => {
   program.addCommand(cmd);
 });
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ozyman42/ozy-cli",
-  "version": "0.0.5",
+  "version": "0.2.0",
   "description": "Ozymandias' personal tools",
   "type": "module",
   "bin": {