@prnv/tuck 1.5.2 → 1.7.0

package/dist/index.js

@@ -555,7 +555,7 @@ import { join, dirname } from "path";
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import figures4 from "figures";
-var __dirname, packageJsonPath, VERSION_VALUE, VERSION, DESCRIPTION, HOME_DIR, DEFAULT_TUCK_DIR, MANIFEST_FILE, CONFIG_FILE, BACKUP_DIR, FILES_DIR, CATEGORIES;
+var __dirname, packageJsonPath, VERSION_VALUE, VERSION, DESCRIPTION, APP_NAME, HOME_DIR, DEFAULT_TUCK_DIR, MANIFEST_FILE, CONFIG_FILE, BACKUP_DIR, FILES_DIR, CATEGORIES;
 var init_constants = __esm({
   "src/constants.ts"() {
     "use strict";
@@ -563,12 +563,13 @@ var init_constants = __esm({
     packageJsonPath = join(__dirname, "..", "package.json");
     VERSION_VALUE = "1.0.0";
     try {
-      const pkg = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
-      VERSION_VALUE = pkg.version;
+      const pkg2 = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+      VERSION_VALUE = pkg2.version;
     } catch {
     }
     VERSION = VERSION_VALUE;
     DESCRIPTION = "Modern dotfiles manager with a beautiful CLI";
+    APP_NAME = "tuck";
     HOME_DIR = homedir();
     DEFAULT_TUCK_DIR = join(HOME_DIR, ".tuck");
     MANIFEST_FILE = ".tuckmanifest.json";
@@ -851,12 +852,25 @@ var init_secrets_schema = __esm({
 
 // src/schemas/config.schema.ts
 import { z as z2 } from "zod";
-var fileStrategySchema, categoryConfigSchema, tuckConfigSchema, defaultConfig;
+var fileStrategySchema, providerModeSchema, remoteConfigSchema, categoryConfigSchema, tuckConfigSchema, defaultConfig;
 var init_config_schema = __esm({
   "src/schemas/config.schema.ts"() {
     "use strict";
     init_secrets_schema();
     fileStrategySchema = z2.enum(["copy", "symlink"]);
+    providerModeSchema = z2.enum(["github", "gitlab", "local", "custom"]);
+    remoteConfigSchema = z2.object({
+      /** Provider mode (github, gitlab, local, custom) */
+      mode: providerModeSchema.default("local"),
+      /** Custom remote URL (for custom mode or manual override) */
+      url: z2.string().optional(),
+      /** Provider instance URL (for self-hosted GitLab, etc.) */
+      providerUrl: z2.string().optional(),
+      /** Cached username from provider */
+      username: z2.string().optional(),
+      /** Repository name (without owner) */
+      repoName: z2.string().optional()
+    }).default({ mode: "local" });
     categoryConfigSchema = z2.object({
       patterns: z2.array(z2.string()),
       icon: z2.string().optional()
@@ -895,7 +909,9 @@ var init_config_schema = __esm({
         emoji: z2.boolean().default(true),
         verbose: z2.boolean().default(false)
       }).partial().default({}),
-      security: securityConfigSchema
+      security: securityConfigSchema,
+      /** Remote/provider configuration */
+      remote: remoteConfigSchema
     });
     defaultConfig = {
       repository: {
@@ -932,6 +948,9 @@ var init_config_schema = __esm({
         excludePatterns: [],
         excludeFiles: [],
         maxFileSize: 10 * 1024 * 1024
+      },
+      remote: {
+        mode: "local"
       }
     };
   }
@@ -1476,13 +1495,13 @@ var init_git = __esm({
     };
     ensureGitCredentials = async () => {
       try {
-        const { execFile: execFile3 } = await import("child_process");
-        const { promisify: promisify4 } = await import("util");
-        const execFileAsync3 = promisify4(execFile3);
-        const { stdout, stderr } = await execFileAsync3("gh", ["auth", "status"]);
+        const { execFile: execFile6 } = await import("child_process");
+        const { promisify: promisify7 } = await import("util");
+        const execFileAsync6 = promisify7(execFile6);
+        const { stdout, stderr } = await execFileAsync6("gh", ["auth", "status"]);
         const output = (stderr || stdout || "").trim();
         if (output.includes("Logged in")) {
-          await execFileAsync3("gh", ["auth", "setup-git"]);
+          await execFileAsync6("gh", ["auth", "setup-git"]);
         }
       } catch {
       }
@@ -1618,6 +1637,591 @@ var init_git = __esm({
   }
 });
 
+// src/lib/providers/types.ts
+var ProviderError, ProviderNotConfiguredError, LocalModeError;
+var init_types = __esm({
+  "src/lib/providers/types.ts"() {
+    "use strict";
+    ProviderError = class extends Error {
+      constructor(message, provider, suggestions = []) {
+        super(message);
+        this.provider = provider;
+        this.suggestions = suggestions;
+        this.name = "ProviderError";
+      }
+    };
+    ProviderNotConfiguredError = class extends ProviderError {
+      constructor(provider) {
+        super(`Provider "${provider}" is not configured`, provider, [
+          "Run `tuck init` to set up your git provider",
+          "Or use `tuck config remote` to change providers"
+        ]);
+        this.name = "ProviderNotConfiguredError";
+      }
+    };
+    LocalModeError = class extends ProviderError {
+      constructor(operation) {
+        super(`Cannot ${operation} in local-only mode`, "local", [
+          "Your tuck is configured for local-only storage (no remote sync)",
+          "To enable remote sync, run: tuck config remote",
+          "Or re-run: tuck init"
+        ]);
+        this.name = "LocalModeError";
+      }
+    };
+  }
+});
+
+// src/lib/validation.ts
+function validateRepoName(repoName, provider) {
+  if (/[\x00-\x1F\x7F]/.test(repoName)) {
+    throw new Error("Repository name contains invalid control characters");
+  }
+  if (repoName.includes("://")) {
+    validateHttpUrl(repoName, provider);
+    return;
+  }
+  if (repoName.startsWith("git@")) {
+    validateSshUrl(repoName, provider);
+    return;
+  }
+  const validPattern = /^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(?:\/[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)*$/;
+  if (!validPattern.test(repoName)) {
+    throw new Error(
+      'Repository names must start and end with alphanumeric characters and can only contain alphanumeric characters, hyphens, underscores, and dots. Format: "owner/repo" or "repo"'
+    );
+  }
+}
+function validateHttpUrl(url, provider) {
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    throw new Error(`Invalid repository URL: ${url}`);
+  }
+  const allowedProtocols = /* @__PURE__ */ new Set(["http:", "https:", "ssh:", "git+ssh:"]);
+  if (!allowedProtocols.has(parsedUrl.protocol)) {
+    throw new Error(`Invalid protocol in URL. Allowed: ${Array.from(allowedProtocols).join(", ")}`);
+  }
+  if (!/^[a-zA-Z0-9.-]+$/.test(parsedUrl.hostname)) {
+    throw new Error("Invalid characters in hostname");
+  }
+  if (/[;&|`$(){}[\]<>!#*?'"\\]/.test(url)) {
+    throw new Error("URL contains invalid characters");
+  }
+  if (provider === "github" && parsedUrl.hostname === "github.com") {
+    const pathPattern = /^\/[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+(?:\.git)?$/;
+    if (!pathPattern.test(parsedUrl.pathname)) {
+      throw new Error("Invalid GitHub repository URL format. Expected: /owner/repo or /owner/repo.git");
+    }
+  }
+}
+function validateSshUrl(url, _provider) {
+  if (/[;&|`$(){}[\]<>!#*?'"\\]/.test(url)) {
+    throw new Error("URL contains invalid characters");
+  }
+  const sshPattern = /^git@([a-zA-Z0-9.-]+):([a-zA-Z0-9._/-]+)(?:\.git)?$/;
+  if (!sshPattern.test(url)) {
+    throw new Error("Invalid SSH URL format. Expected: git@host:path or git@host:path.git");
+  }
+  const match = url.match(sshPattern);
+  if (match) {
+    const [, host, path] = match;
+    if (!/^[a-zA-Z0-9.-]+$/.test(host)) {
+      throw new Error("Invalid hostname in SSH URL");
+    }
+    if (path.includes("..")) {
+      throw new Error("Path traversal not allowed in repository URL");
+    }
+  }
+}
+function validateDescription(description, maxLength = 350) {
+  if (description.length > maxLength) {
+    throw new Error(`Description too long (max ${maxLength} characters)`);
+  }
+  if (/[;&|`$(){}[\]<>!#*?'"\\n\r\t\x00-\x1F\x7F]/.test(description)) {
+    throw new Error(
+      "Description contains invalid characters. Cannot contain: ; & | ` $ ( ) { } [ ] < > ! # * ? ' \" \\ newlines or control characters"
+    );
+  }
+  const normalized = description.normalize("NFKC");
+  if (normalized !== description) {
+    throw new Error("Description contains unusual Unicode characters");
+  }
+}
+function validateHostname(hostname) {
+  if (!hostname) {
+    throw new Error("Hostname is required");
+  }
+  if (hostname.length > 253) {
+    throw new Error("Hostname too long (max 253 characters)");
+  }
+  const hostnamePattern = /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
+  if (!hostnamePattern.test(hostname)) {
+    throw new Error(
+      "Invalid hostname format. Must be a fully qualified domain name (e.g., gitlab.example.com)"
+    );
+  }
+  for (const pattern of PRIVATE_IP_PATTERNS) {
+    if (pattern.test(hostname)) {
+      throw new Error("Private IP addresses and localhost are not allowed for security reasons");
+    }
+  }
+  const labels = hostname.split(".");
+  if (labels.length < 2) {
+    throw new Error("Hostname must have at least two labels (subdomain.domain.tld)");
+  }
+}
+function validateGitUrl(url) {
+  if (/[\x00-\x1F\x7F]/.test(url)) {
+    return false;
+  }
+  const sshPattern = /^git@[a-zA-Z0-9.-]+:[a-zA-Z0-9._/-]+(?:\.git)?$/;
+  const sshUrlPattern = /^ssh:\/\/git@[a-zA-Z0-9.-]+\/[a-zA-Z0-9._/-]+(?:\.git)?$/;
+  const httpsPattern = /^https?:\/\/[a-zA-Z0-9.-]+\/[a-zA-Z0-9._/-]+(?:\.git)?$/;
+  const gitPattern = /^git:\/\/[a-zA-Z0-9.-]+\/[a-zA-Z0-9._/-]+(?:\.git)?$/;
+  if (url.startsWith("file://") || url.startsWith("/")) {
+    return validateFileUrl(url);
+  }
+  if (sshPattern.test(url) || sshUrlPattern.test(url) || httpsPattern.test(url) || gitPattern.test(url)) {
+    if (/[;&|`$(){}[\]<>!#*?]/.test(url.replace(/[/:@.]/g, ""))) {
+      return false;
+    }
+    return true;
+  }
+  return false;
+}
+function validateFileUrl(url) {
+  const path = url.replace(/^file:\/\//, "");
+  for (const blockedPath of BLOCKED_SYSTEM_PATHS) {
+    if (path.startsWith(blockedPath)) {
+      return false;
+    }
+  }
+  if (path.includes("../") || path.includes("/..")) {
+    return false;
+  }
+  if (!path.startsWith("/")) {
+    return false;
+  }
+  const filePattern = /^\/[a-zA-Z0-9._/-]+$/;
+  return filePattern.test(path);
+}
+function sanitizeErrorMessage(error, genericMessage) {
+  if (error instanceof Error) {
+    const message = error.message.toLowerCase();
+    if (message.includes("enotfound") || message.includes("network")) {
+      return "Network error. Please check your internet connection.";
+    }
+    if (message.includes("permission") || message.includes("eacces")) {
+      return "Permission denied. Please check your access rights.";
+    }
+    if (message.includes("timeout") || message.includes("etimedout")) {
+      return "Operation timed out. Please try again.";
+    }
+    if (message.includes("authentication") || message.includes("auth")) {
+      return "Authentication failed. Please check your credentials.";
+    }
+    return genericMessage;
+  }
+  return genericMessage;
+}
+var GIT_OPERATION_TIMEOUTS, BLOCKED_SYSTEM_PATHS, PRIVATE_IP_PATTERNS;
+var init_validation = __esm({
+  "src/lib/validation.ts"() {
+    "use strict";
+    GIT_OPERATION_TIMEOUTS = {
+      LS_REMOTE: 3e4,
+      // 30 seconds (increased from 10s)
+      CLONE: 3e5,
+      // 5 minutes
+      FETCH: 6e4,
+      // 1 minute
+      PUSH: 6e4
+      // 1 minute
+    };
+    BLOCKED_SYSTEM_PATHS = [
+      "/etc/",
+      "/proc/",
+      "/sys/",
+      "/dev/",
+      "/boot/",
+      "/root/",
+      "/var/run/",
+      "/var/log/"
+    ];
+    PRIVATE_IP_PATTERNS = [
+      /^localhost$/i,
+      /^127\.\d+\.\d+\.\d+$/,
+      /^::1$/,
+      /^0\.0\.0\.0$/,
+      /^10\./,
+      /^172\.(1[6-9]|2\d|3[01])\./,
+      /^192\.168\./,
+      /^169\.254\./,
+      // Link-local
+      /^fe80:/i
+      // IPv6 link-local
+    ];
+  }
+});
+
+// src/lib/providers/gitlab.ts
+var gitlab_exports = {};
+__export(gitlab_exports, {
+  GitLabProvider: () => GitLabProvider,
+  gitlabProvider: () => gitlabProvider
+});
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync, COMMON_DOTFILE_REPO_NAMES, DEFAULT_GITLAB_HOST, GitLabProvider, gitlabProvider;
+var init_gitlab = __esm({
+  "src/lib/providers/gitlab.ts"() {
+    "use strict";
+    init_types();
+    init_validation();
+    execFileAsync = promisify(execFile);
+    COMMON_DOTFILE_REPO_NAMES = ["dotfiles", "tuck", ".dotfiles", "dot-files", "dots"];
+    DEFAULT_GITLAB_HOST = "gitlab.com";
+    GitLabProvider = class _GitLabProvider {
+      mode = "gitlab";
+      displayName = "GitLab";
+      cliName = "glab";
+      requiresRemote = true;
+      /** The GitLab host (gitlab.com or self-hosted URL) */
+      host;
+      constructor(host = DEFAULT_GITLAB_HOST) {
+        this.host = host.replace(/^https?:\/\//, "").replace(/\/$/, "");
+      }
+      /** Create a provider for a specific host */
+      static forHost(host) {
+        return new _GitLabProvider(host);
+      }
+      // -------------------------------------------------------------------------
+      // Detection & Authentication
+      // -------------------------------------------------------------------------
+      async isCliInstalled() {
+        try {
+          await execFileAsync("glab", ["--version"]);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      async isAuthenticated() {
+        try {
+          const { stdout, stderr } = await execFileAsync("glab", ["auth", "status", "-h", this.host]);
+          const output = (stderr || stdout || "").trim();
+          return output.includes("Logged in");
+        } catch (error) {
+          if (error instanceof Error && "stderr" in error) {
+            const stderr = error.stderr;
+            return stderr.includes("Logged in");
+          }
+          return false;
+        }
+      }
+      async getUser() {
+        if (!await this.isCliInstalled() || !await this.isAuthenticated()) {
+          return null;
+        }
+        try {
+          const { stdout } = await execFileAsync("glab", ["api", "user", "-h", this.host]);
+          const data = JSON.parse(stdout);
+          return {
+            login: data.username || "",
+            name: data.name || null,
+            email: data.email || null
+          };
+        } catch (error) {
+          try {
+            const { stdout, stderr } = await execFileAsync("glab", ["auth", "status", "-h", this.host]);
+            const output = stderr || stdout || "";
+            const match = output.match(/Logged in to .+ as (\S+)/);
+            if (match) {
+              return {
+                login: match[1],
+                name: null,
+                email: null
+              };
+            }
+          } catch (fallbackError) {
+          }
+          return null;
+        }
+      }
+      async detect() {
+        const cliInstalled = await this.isCliInstalled();
+        if (!cliInstalled) {
+          return {
+            mode: this.mode,
+            displayName: this.getDisplayNameWithHost(),
+            available: false,
+            authStatus: {
+              cliInstalled: false,
+              authenticated: false,
+              instanceUrl: this.getInstanceUrl()
+            },
+            unavailableReason: "GitLab CLI (glab) is not installed"
+          };
+        }
+        const authenticated = await this.isAuthenticated();
+        const user = authenticated ? await this.getUser() : void 0;
+        return {
+          mode: this.mode,
+          displayName: this.getDisplayNameWithHost(),
+          available: authenticated,
+          authStatus: {
+            cliInstalled: true,
+            authenticated,
+            user: user || void 0,
+            instanceUrl: this.getInstanceUrl()
+          },
+          unavailableReason: !authenticated ? `Not logged in to GitLab (${this.host})` : void 0
+        };
+      }
+      // -------------------------------------------------------------------------
+      // Repository Operations
+      // -------------------------------------------------------------------------
+      async repoExists(repoName) {
+        this.validateRepoName(repoName);
+        try {
+          await execFileAsync("glab", ["repo", "view", repoName, "-h", this.host]);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      async createRepo(options) {
+        if (!await this.isCliInstalled()) {
+          throw new ProviderError("GitLab CLI is not installed", "gitlab", [
+            "Install with: brew install glab (macOS)",
+            "Or see: https://gitlab.com/gitlab-org/cli"
+          ]);
+        }
+        if (!await this.isAuthenticated()) {
+          throw new ProviderError(`Not authenticated with GitLab (${this.host})`, "gitlab", [
+            `Run: glab auth login -h ${this.host}`
+          ]);
+        }
+        const user = await this.getUser();
+        if (!user) {
+          throw new ProviderError("Could not get GitLab user information", "gitlab");
+        }
+        this.validateRepoName(options.name);
+        if (options.description) {
+          try {
+            validateDescription(options.description, 2e3);
+          } catch (error) {
+            throw new ProviderError(
+              error instanceof Error ? error.message : "Invalid description",
+              "gitlab"
+            );
+          }
+        }
+        const fullName = `${user.login}/${options.name}`;
+        if (await this.repoExists(fullName)) {
+          throw new ProviderError(`Repository "${fullName}" already exists`, "gitlab", [
+            `Use a different name or import the existing repo`
+          ]);
+        }
+        const args = ["repo", "create", options.name, "-h", this.host];
+        if (options.isPrivate !== false) {
+          args.push("--private");
+        } else {
+          args.push("--public");
+        }
+        if (options.description) {
+          args.push("--description", options.description);
+        }
+        args.push("-y");
+        try {
+          const { stdout } = await execFileAsync("glab", args);
+          const urlMatch = stdout.match(/https?:\/\/[^\s]+/);
+          const repoUrl = urlMatch ? urlMatch[0] : `https://${this.host}/${fullName}`;
+          return {
+            name: options.name,
+            fullName,
+            url: repoUrl,
+            sshUrl: `git@${this.host}:${fullName}.git`,
+            httpsUrl: `https://${this.host}/${fullName}.git`,
+            isPrivate: options.isPrivate !== false
+          };
+        } catch (error) {
+          const sanitizedMessage = sanitizeErrorMessage(error, "Failed to create repository");
+          throw new ProviderError(sanitizedMessage, "gitlab", [
+            `Try creating the repository manually at https://${this.host}/projects/new`
+          ]);
+        }
+      }
+      async getRepoInfo(repoName) {
+        this.validateRepoName(repoName);
+        try {
+          const { stdout } = await execFileAsync("glab", [
+            "repo",
+            "view",
+            repoName,
+            "-h",
+            this.host,
+            "-o",
+            "json"
+          ]);
+          const result = JSON.parse(stdout);
+          const pathWithNamespace = result.path_with_namespace || repoName;
+          return {
+            name: result.name || repoName.split("/").pop() || repoName,
+            fullName: pathWithNamespace,
+            url: result.web_url || `https://${this.host}/${pathWithNamespace}`,
+            sshUrl: result.ssh_url_to_repo || `git@${this.host}:${pathWithNamespace}.git`,
+            httpsUrl: result.http_url_to_repo || `https://${this.host}/${pathWithNamespace}.git`,
+            isPrivate: result.visibility === "private"
+          };
+        } catch {
+          return null;
+        }
+      }
+      async cloneRepo(repoName, targetDir) {
+        if (!await this.isCliInstalled()) {
+          throw new ProviderError("GitLab CLI is not installed", "gitlab");
+        }
+        this.validateRepoName(repoName);
+        try {
+          await execFileAsync("glab", ["repo", "clone", repoName, targetDir, "-h", this.host]);
+        } catch (error) {
+          throw new ProviderError(`Failed to clone repository "${repoName}"`, "gitlab", [
+            String(error),
+            "Check that the repository exists and you have access"
+          ]);
+        }
+      }
+      async findDotfilesRepo(username) {
+        const user = username || (await this.getUser())?.login;
+        if (!user) return null;
+        for (const name of COMMON_DOTFILE_REPO_NAMES) {
+          const repoName = `${user}/${name}`;
+          if (await this.repoExists(repoName)) {
+            return repoName;
+          }
+        }
+        return null;
+      }
+      // -------------------------------------------------------------------------
+      // URL Utilities
+      // -------------------------------------------------------------------------
+      async getPreferredRepoUrl(repo) {
+        const protocol = await this.getPreferredProtocol();
+        return protocol === "ssh" ? repo.sshUrl : repo.httpsUrl;
+      }
+      validateUrl(url) {
+        const host = this.host.replace(/\./g, "\\.");
+        const httpsPattern = new RegExp(`^https://${host}/`);
+        const sshPattern = new RegExp(`^git@${host}:`);
+        const sshUrlPattern = new RegExp(`^ssh://git@${host}/`);
+        return httpsPattern.test(url) || sshPattern.test(url) || sshUrlPattern.test(url);
+      }
+      buildRepoUrl(username, repoName, protocol) {
+        if (protocol === "ssh") {
+          return `git@${this.host}:${username}/${repoName}.git`;
+        }
+        return `https://${this.host}/${username}/${repoName}.git`;
+      }
+      // -------------------------------------------------------------------------
+      // Instructions
+      // -------------------------------------------------------------------------
+      getSetupInstructions() {
+        const { platform: platform2 } = process;
+        let installCmd = "";
+        if (platform2 === "darwin") {
+          installCmd = "brew install glab";
+        } else if (platform2 === "linux") {
+          installCmd = `# Debian/Ubuntu:
+# Download from https://gitlab.com/gitlab-org/cli/-/releases
+
+# Or using brew:
+brew install glab`;
+        } else if (platform2 === "win32") {
+          installCmd = `# Using winget:
+winget install GitLab.glab
+
+# Using scoop:
+scoop install glab`;
+        }
+        const hostInstructions = this.host !== DEFAULT_GITLAB_HOST ? `
+For self-hosted GitLab (${this.host}):
+glab auth login -h ${this.host}` : "";
+        return `GitLab CLI (glab) - Official GitLab command line tool
+
+Installation:
+${installCmd}
+
+After installing, authenticate:
+glab auth login
+${hostInstructions}
+
+Benefits:
+- Automatic repository creation
+- No manual token management
+- Works with self-hosted GitLab
+
+Learn more: https://gitlab.com/gitlab-org/cli`;
+      }
+      getAltAuthInstructions() {
+        return `Alternative authentication methods for GitLab:
+
+1. SSH Keys (recommended if glab CLI unavailable)
+   - Generate: ssh-keygen -t ed25519
+   - Add to GitLab: https://${this.host}/-/user_settings/ssh_keys
+   - Test: ssh -T git@${this.host}
+
+2. Personal Access Token
+   - Create at: https://${this.host}/-/user_settings/personal_access_tokens
+   - Required scopes: "api", "read_repository", "write_repository"
+   - Use as password when pushing
+
+For detailed instructions, see:
+https://docs.gitlab.com/ee/user/ssh.html`;
+      }
+      // -------------------------------------------------------------------------
+      // Private Helpers
+      // -------------------------------------------------------------------------
+      validateRepoName(repoName) {
+        try {
+          validateRepoName(repoName, "gitlab");
+        } catch (error) {
+          throw new ProviderError(
+            error instanceof Error ? error.message : "Invalid repository name",
+            "gitlab"
+          );
+        }
+      }
+      async getPreferredProtocol() {
+        try {
+          const { stdout } = await execFileAsync("glab", [
+            "config",
+            "get",
+            "git_protocol",
+            "-h",
+            this.host
+          ]);
+          return stdout.trim().toLowerCase() === "ssh" ? "ssh" : "https";
+        } catch {
+          return "https";
+        }
+      }
+      getDisplayNameWithHost() {
+        if (this.host === DEFAULT_GITLAB_HOST) {
+          return "GitLab";
+        }
+        return `GitLab (${this.host})`;
+      }
+      getInstanceUrl() {
+        return `https://${this.host}`;
+      }
+    };
+    gitlabProvider = new GitLabProvider();
+  }
+});
+
 // src/lib/github.ts
 var github_exports = {};
 __export(github_exports, {
@@ -1649,14 +2253,14 @@ __export(github_exports, {
   testStoredCredentials: () => testStoredCredentials,
   updateStoredCredentials: () => updateStoredCredentials
 });
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync, API_REQUEST_TIMEOUT_MS, GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS, TOKEN_EXPIRATION_WARNING_DAYS, MIN_GITHUB_TOKEN_LENGTH, GITHUB_TOKEN_PREFIXES, validateRepoName, isGhInstalled, isGhAuthenticated, getAuthenticatedUser, repoExists, diagnoseRepoCreationFailure, createRepo, getPreferredRemoteProtocol, getRepoInfo, ghCloneRepo, findDotfilesRepo, getPreferredRepoUrl, checkSSHKeys, getStrictHostKeyCheckingOption, testSSHConnection, getSSHKeyInstructions, getFineGrainedTokenInstructions, getClassicTokenInstructions, getGitHubCLIInstallInstructions, getAuthMethods, configureGitCredentialHelper, getCredentialsPath, storeGitHubCredentials, getStoredCredentialMetadata, removeStoredCredentials, testStoredCredentials, diagnoseAuthIssue, updateStoredCredentials, detectTokenType;
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+var execFileAsync4, API_REQUEST_TIMEOUT_MS, GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS, TOKEN_EXPIRATION_WARNING_DAYS, MIN_GITHUB_TOKEN_LENGTH, GITHUB_TOKEN_PREFIXES, validateRepoName2, isGhInstalled, isGhAuthenticated, getAuthenticatedUser, repoExists, diagnoseRepoCreationFailure, createRepo, getPreferredRemoteProtocol, getRepoInfo, ghCloneRepo, findDotfilesRepo, getPreferredRepoUrl, checkSSHKeys, getStrictHostKeyCheckingOption, testSSHConnection, getSSHKeyInstructions, getFineGrainedTokenInstructions, getClassicTokenInstructions, getGitHubCLIInstallInstructions, getAuthMethods, configureGitCredentialHelper, getCredentialsPath, storeGitHubCredentials, getStoredCredentialMetadata, removeStoredCredentials, testStoredCredentials, diagnoseAuthIssue, updateStoredCredentials, detectTokenType;
 var init_github = __esm({
   "src/lib/github.ts"() {
     "use strict";
     init_errors();
-    execFileAsync = promisify(execFile);
+    execFileAsync4 = promisify4(execFile4);
     API_REQUEST_TIMEOUT_MS = 1e4;
     GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS = 86400;
     TOKEN_EXPIRATION_WARNING_DAYS = 85;
@@ -1675,7 +2279,7 @@ var init_github = __esm({
       "ghr_"
       // Refresh token
     ];
-    validateRepoName = (repoName) => {
+    validateRepoName2 = (repoName) => {
       if (repoName.includes("://") || repoName.startsWith("git@")) {
         if (/[;&|`$(){}[\]<>!#*?]/.test(repoName.replace(/[/:@.]/g, ""))) {
           throw new GitHubCliError(`Invalid repository URL: ${repoName}`);
@@ -1692,7 +2296,7 @@ var init_github = __esm({
     };
     isGhInstalled = async () => {
       try {
-        await execFileAsync("gh", ["--version"]);
+        await execFileAsync4("gh", ["--version"]);
         return true;
       } catch {
         return false;
@@ -1700,7 +2304,7 @@ var init_github = __esm({
     };
     isGhAuthenticated = async () => {
       try {
-        const { stdout, stderr } = await execFileAsync("gh", ["auth", "status"]);
+        const { stdout, stderr } = await execFileAsync4("gh", ["auth", "status"]);
         const output = (stderr || stdout || "").trim();
         return output.includes("Logged in");
       } catch (error) {
@@ -1721,7 +2325,7 @@ var init_github = __esm({
         ]);
       }
       try {
-        const { stdout } = await execFileAsync("gh", ["api", "user", "--jq", ".login, .name, .email"]);
+        const { stdout } = await execFileAsync4("gh", ["api", "user", "--jq", ".login, .name, .email"]);
         const lines = stdout.trim().split("\n");
         return {
           login: lines[0] || "",
@@ -1737,8 +2341,8 @@ var init_github = __esm({
     };
     repoExists = async (repoName) => {
       try {
-        validateRepoName(repoName);
-        await execFileAsync("gh", ["repo", "view", repoName, "--json", "name"]);
+        validateRepoName2(repoName);
+        await execFileAsync4("gh", ["repo", "view", repoName, "--json", "name"]);
         return true;
       } catch {
         return false;
@@ -1838,7 +2442,7 @@ var init_github = __esm({
           `Use a different name or run \`tuck init --remote ${fullName}\``
         ]);
       }
-      validateRepoName(options.name);
+      validateRepoName2(options.name);
       if (options.description && /[;&|`$(){}[\]<>!#*?]/.test(options.description)) {
         throw new GitHubCliError("Invalid description: contains unsafe characters");
       }
@@ -1859,7 +2463,7 @@ var init_github = __esm({
           args.push("--homepage", options.homepage);
         }
         args.push("--confirm", "--json", "name,url,sshUrl");
-        const { stdout } = await execFileAsync("gh", args);
+        const { stdout } = await execFileAsync4("gh", args);
         const result = JSON.parse(stdout);
         return {
           name: result.name,
@@ -1877,7 +2481,7 @@ var init_github = __esm({
     };
     getPreferredRemoteProtocol = async () => {
       try {
-        const { stdout } = await execFileAsync("gh", ["config", "get", "git_protocol"]);
+        const { stdout } = await execFileAsync4("gh", ["config", "get", "git_protocol"]);
         const protocol = stdout.trim().toLowerCase();
         return protocol === "ssh" ? "ssh" : "https";
       } catch {
@@ -1886,8 +2490,8 @@ var init_github = __esm({
     };
     getRepoInfo = async (repoName) => {
       try {
-        validateRepoName(repoName);
-        const { stdout } = await execFileAsync("gh", [
+        validateRepoName2(repoName);
+        const { stdout } = await execFileAsync4("gh", [
           "repo",
           "view",
           repoName,
@@ -1911,9 +2515,9 @@ var init_github = __esm({
       if (!await isGhInstalled()) {
         throw new GitHubCliError("GitHub CLI is not installed");
       }
-      validateRepoName(repoName);
+      validateRepoName2(repoName);
       try {
-        await execFileAsync("gh", ["repo", "clone", repoName, targetDir]);
+        await execFileAsync4("gh", ["repo", "clone", repoName, targetDir]);
       } catch (error) {
         throw new GitHubCliError(`Failed to clone repository "${repoName}"`, [
           String(error),
@@ -1995,7 +2599,7 @@ var init_github = __esm({
     testSSHConnection = async () => {
       try {
         const strictHostKeyChecking = await getStrictHostKeyCheckingOption();
-        const { stderr } = await execFileAsync("ssh", ["-T", "-o", `StrictHostKeyChecking=${strictHostKeyChecking}`, "git@github.com"]);
+        const { stderr } = await execFileAsync4("ssh", ["-T", "-o", `StrictHostKeyChecking=${strictHostKeyChecking}`, "git@github.com"]);
         const match = stderr.match(/Hi ([^!]+)!/);
         if (match) {
           return { success: true, username: match[1] };
@@ -2213,7 +2817,7 @@ Learn more: https://cli.github.com/
     configureGitCredentialHelper = async () => {
       const { platform: platform2 } = process;
       try {
-        const { stdout } = await execFileAsync("git", ["config", "--global", "credential.helper"]);
+        const { stdout } = await execFileAsync4("git", ["config", "--global", "credential.helper"]);
         if (stdout.trim()) {
           return;
         }
@@ -2221,21 +2825,21 @@ Learn more: https://cli.github.com/
       }
       try {
         if (platform2 === "darwin") {
-          await execFileAsync("git", ["config", "--global", "credential.helper", "osxkeychain"]);
+          await execFileAsync4("git", ["config", "--global", "credential.helper", "osxkeychain"]);
         } else if (platform2 === "linux") {
           try {
-            await execFileAsync("git", ["config", "--global", "credential.helper", "libsecret"]);
+            await execFileAsync4("git", ["config", "--global", "credential.helper", "libsecret"]);
           } catch (error) {
             console.info(
               `git-credential-libsecret is not available; falling back to git credential cache helper with timeout of ${GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS} seconds.`
             );
-            await execFileAsync("git", ["config", "--global", "credential.helper", `cache --timeout=${GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS}`]);
+            await execFileAsync4("git", ["config", "--global", "credential.helper", `cache --timeout=${GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS}`]);
           }
         } else if (platform2 === "win32") {
-          await execFileAsync("git", ["config", "--global", "credential.helper", "manager"]);
+          await execFileAsync4("git", ["config", "--global", "credential.helper", "manager"]);
         }
       } catch {
-        await execFileAsync("git", ["config", "--global", "credential.helper", "store"]);
+        await execFileAsync4("git", ["config", "--global", "credential.helper", "store"]);
       }
     };
     getCredentialsPath = async () => {
@@ -3551,7 +4155,7 @@ var init_backup = __esm({
 
 // src/lib/hooks.ts
 import { exec } from "child_process";
-import { promisify as promisify2 } from "util";
+import { promisify as promisify5 } from "util";
 import chalk4 from "chalk";
 var execAsync, runHook, runPreSyncHook, runPostSyncHook, runPreRestoreHook, runPostRestoreHook;
 var init_hooks = __esm({
@@ -3560,7 +4164,7 @@ var init_hooks = __esm({
     init_config();
     init_logger();
     init_prompts();
-    execAsync = promisify2(exec);
+    execAsync = promisify5(exec);
     runHook = async (hookType, tuckDir, options) => {
       if (options?.skipHooks) {
         return { success: true, skipped: true };
@@ -5194,16 +5798,16 @@ var init_redactor = __esm({
 });
 
 // src/lib/secrets/external.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify3 } from "util";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify6 } from "util";
 import { z as z4 } from "zod";
-var execFileAsync2, gitleaksResultSchema, gitleaksOutputSchema, isGitleaksInstalled, isTrufflehogInstalled, mapGitleaksSeverity, generatePlaceholderFromRule, scanWithGitleaks, scanWithScanner;
+var execFileAsync5, gitleaksResultSchema, gitleaksOutputSchema, isGitleaksInstalled, isTrufflehogInstalled, mapGitleaksSeverity, generatePlaceholderFromRule, scanWithGitleaks, scanWithScanner;
 var init_external = __esm({
   "src/lib/secrets/external.ts"() {
     "use strict";
     init_scanner();
     init_paths();
-    execFileAsync2 = promisify3(execFile2);
+    execFileAsync5 = promisify6(execFile5);
     gitleaksResultSchema = z4.object({
       Description: z4.string(),
       StartLine: z4.number(),
@@ -5227,7 +5831,7 @@ var init_external = __esm({
     gitleaksOutputSchema = z4.array(gitleaksResultSchema);
     isGitleaksInstalled = async () => {
       try {
-        await execFileAsync2("gitleaks", ["version"]);
+        await execFileAsync5("gitleaks", ["version"]);
         return true;
       } catch {
         return false;
@@ -5235,7 +5839,7 @@ var init_external = __esm({
     };
     isTrufflehogInstalled = async () => {
       try {
-        await execFileAsync2("trufflehog", ["--version"]);
+        await execFileAsync5("trufflehog", ["--version"]);
         return true;
       } catch {
         return false;
@@ -5285,7 +5889,7 @@ var init_external = __esm({
         const batchResults = await Promise.all(
           batch.map(async (filepath) => {
             try {
-              const { stdout, stderr } = await execFileAsync2("gitleaks", [
+              const { stdout, stderr } = await execFileAsync5("gitleaks", [
                 "detect",
                 "--source",
                 filepath,
@@ -6322,7 +6926,7 @@ var init_sync = __esm({
 
 // src/index.ts
 import { Command as Command16 } from "commander";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 
 // src/commands/init.ts
 init_ui();
@@ -6330,55 +6934,1077 @@ init_paths();
 init_config();
 init_manifest();
 init_git();
-init_github();
-init_detect();
-init_errors();
-init_constants();
-init_config_schema();
-init_fileTracking();
 import { Command as Command2 } from "commander";
 import { join as join8 } from "path";
 import { writeFile as writeFile3 } from "fs/promises";
 import { ensureDir as ensureDir4 } from "fs-extra";
-import { copy as copy3 } from "fs-extra";
-import { tmpdir } from "os";
-import { readFile as readFile4, rm as rm2 } from "fs/promises";
-var GITIGNORE_TEMPLATE = `# OS generated files
-.DS_Store
-.DS_Store?
-._*
-.Spotlight-V100
-.Trashes
-ehthumbs.db
-Thumbs.db
-
-# Backup files
-*.bak
-*.backup
-*~
-
-# Secret files (add patterns for files you want to exclude)
-# *.secret
-# .env.local
-`;
-var trackFilesWithProgressInit = async (selectedPaths, tuckDir) => {
-  const filesToTrack = selectedPaths.map((path) => ({
-    path
-  }));
-  const result = await trackFilesWithProgress(filesToTrack, tuckDir, {
-    showCategory: true,
-    actionVerb: "Tracking"
-  });
-  return result.succeeded;
-};
-var README_TEMPLATE = (machine) => `# Dotfiles
 
-Managed with [tuck](https://github.com/Pranav-Karra-3301/tuck) - Modern Dotfiles Manager
+// src/lib/providerSetup.ts
+init_ui();
 
-${machine ? `## Machine: ${machine}
-` : ""}
+// src/lib/providers/index.ts
+init_types();
+init_gitlab();
 
-## Quick Start
+// src/lib/providers/github.ts
+init_types();
+init_validation();
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+var COMMON_DOTFILE_REPO_NAMES2 = ["dotfiles", "tuck", ".dotfiles", "dot-files", "dots"];
+var GitHubProvider = class {
+  mode = "github";
+  displayName = "GitHub";
+  cliName = "gh";
+  requiresRemote = true;
+  // -------------------------------------------------------------------------
+  // Detection & Authentication
+  // -------------------------------------------------------------------------
+  async isCliInstalled() {
+    try {
+      await execFileAsync2("gh", ["--version"]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async isAuthenticated() {
+    try {
+      const { stdout, stderr } = await execFileAsync2("gh", ["auth", "status"]);
+      const output = (stderr || stdout || "").trim();
+      return output.includes("Logged in");
+    } catch (error) {
+      if (error instanceof Error && "stderr" in error) {
+        const stderr = error.stderr;
+        return stderr.includes("Logged in");
+      }
+      return false;
+    }
+  }
+  async getUser() {
+    if (!await this.isCliInstalled() || !await this.isAuthenticated()) {
+      return null;
+    }
+    try {
+      const { stdout } = await execFileAsync2("gh", [
+        "api",
+        "user",
+        "--jq",
+        ".login, .name, .email"
+      ]);
+      const lines = stdout.trim().split("\n");
+      return {
+        login: lines[0] || "",
+        name: lines[1] !== "null" ? lines[1] : null,
+        email: lines[2] !== "null" ? lines[2] : null
+      };
+    } catch {
+      return null;
+    }
+  }
+  async detect() {
+    const cliInstalled = await this.isCliInstalled();
+    if (!cliInstalled) {
+      return {
+        mode: this.mode,
+        displayName: this.displayName,
+        available: false,
+        authStatus: {
+          cliInstalled: false,
+          authenticated: false
+        },
+        unavailableReason: "GitHub CLI (gh) is not installed"
+      };
+    }
+    const authenticated = await this.isAuthenticated();
+    const user = authenticated ? await this.getUser() : void 0;
+    return {
+      mode: this.mode,
+      displayName: this.displayName,
+      available: authenticated,
+      authStatus: {
+        cliInstalled: true,
+        authenticated,
+        user: user || void 0
+      },
+      unavailableReason: !authenticated ? "Not logged in to GitHub CLI" : void 0
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Repository Operations
+  // -------------------------------------------------------------------------
+  async repoExists(repoName) {
+    this.validateRepoName(repoName);
+    try {
+      await execFileAsync2("gh", ["repo", "view", repoName, "--json", "name"]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async createRepo(options) {
+    if (!await this.isCliInstalled()) {
+      throw new ProviderError("GitHub CLI is not installed", "github", [
+        "Install with: brew install gh (macOS) or see https://cli.github.com/"
+      ]);
+    }
+    if (!await this.isAuthenticated()) {
+      throw new ProviderError("Not authenticated with GitHub CLI", "github", [
+        "Run: gh auth login"
+      ]);
+    }
+    const user = await this.getUser();
+    if (!user) {
+      throw new ProviderError("Could not get GitHub user information", "github");
+    }
+    this.validateRepoName(options.name);
+    if (options.description) {
+      try {
+        validateDescription(options.description, 350);
+      } catch (error) {
+        throw new ProviderError(
+          error instanceof Error ? error.message : "Invalid description",
+          "github"
+        );
+      }
+    }
+    const fullName = `${user.login}/${options.name}`;
+    if (await this.repoExists(fullName)) {
+      throw new ProviderError(`Repository "${fullName}" already exists`, "github", [
+        `Use a different name or import the existing repo`
+      ]);
+    }
+    const args = ["repo", "create", options.name];
+    if (options.isPrivate !== false) {
+      args.push("--private");
+    } else {
+      args.push("--public");
+    }
+    if (options.description) {
+      args.push("--description", options.description);
+    }
+    args.push("--confirm", "--json", "name,url,sshUrl");
+    try {
+      const { stdout } = await execFileAsync2("gh", args);
+      const result = JSON.parse(stdout);
+      return {
+        name: result.name,
+        fullName: `${user.login}/${result.name}`,
+        url: result.url,
+        sshUrl: result.sshUrl,
+        httpsUrl: result.url,
+        isPrivate: options.isPrivate !== false
+      };
+    } catch (error) {
+      const sanitizedMessage = sanitizeErrorMessage(error, "Failed to create repository");
+      throw new ProviderError(sanitizedMessage, "github", [
+        "Try creating the repository manually at github.com/new"
+      ]);
+    }
+  }
+  async getRepoInfo(repoName) {
+    this.validateRepoName(repoName);
+    try {
+      const { stdout } = await execFileAsync2("gh", [
+        "repo",
+        "view",
+        repoName,
+        "--json",
+        "name,url,sshUrl,isPrivate,owner"
+      ]);
+      const result = JSON.parse(stdout);
+      return {
+        name: result.name,
+        fullName: `${result.owner.login}/${result.name}`,
+        url: result.url,
+        sshUrl: result.sshUrl,
+        httpsUrl: result.url,
+        isPrivate: result.isPrivate
+      };
+    } catch {
+      return null;
+    }
+  }
+  async cloneRepo(repoName, targetDir) {
+    if (!await this.isCliInstalled()) {
+      throw new ProviderError("GitHub CLI is not installed", "github");
+    }
+    this.validateRepoName(repoName);
+    try {
+      await execFileAsync2("gh", ["repo", "clone", repoName, targetDir]);
+    } catch (error) {
+      throw new ProviderError(`Failed to clone repository "${repoName}"`, "github", [
+        String(error),
+        "Check that the repository exists and you have access"
+      ]);
+    }
+  }
+  async findDotfilesRepo(username) {
+    const user = username || (await this.getUser())?.login;
+    if (!user) return null;
+    for (const name of COMMON_DOTFILE_REPO_NAMES2) {
+      const repoName = `${user}/${name}`;
+      if (await this.repoExists(repoName)) {
+        return repoName;
+      }
+    }
+    return null;
+  }
+  // -------------------------------------------------------------------------
+  // URL Utilities
+  // -------------------------------------------------------------------------
+  async getPreferredRepoUrl(repo) {
+    const protocol = await this.getPreferredProtocol();
+    return protocol === "ssh" ? repo.sshUrl : repo.httpsUrl;
+  }
+  validateUrl(url) {
+    return url.startsWith("https://github.com/") || url.startsWith("git@github.com:") || url.startsWith("ssh://git@github.com/");
+  }
+  buildRepoUrl(username, repoName, protocol) {
+    if (protocol === "ssh") {
+      return `git@github.com:${username}/${repoName}.git`;
+    }
+    return `https://github.com/${username}/${repoName}.git`;
+  }
+  // -------------------------------------------------------------------------
+  // Instructions
+  // -------------------------------------------------------------------------
+  getSetupInstructions() {
+    const { platform: platform2 } = process;
+    let installCmd = "";
+    if (platform2 === "darwin") {
+      installCmd = "brew install gh";
+    } else if (platform2 === "linux") {
+      installCmd = `# Debian/Ubuntu:
+sudo apt install gh
+
+# Fedora:
+sudo dnf install gh
+
+# Arch Linux:
+sudo pacman -S github-cli`;
+    } else if (platform2 === "win32") {
+      installCmd = `# Using winget:
+winget install GitHub.cli
+
+# Using scoop:
+scoop install gh`;
+    }
+    return `GitHub CLI (gh) - Recommended for the best experience
+
+Installation:
+${installCmd}
+
+After installing, authenticate:
+gh auth login
+
+Benefits:
+- Automatic repository creation
+- No manual token management
+- Easy authentication refresh
+
+Learn more: https://cli.github.com/`;
+  }
+  getAltAuthInstructions() {
+    return `Alternative authentication methods for GitHub:
+
+1. SSH Keys (recommended if gh CLI unavailable)
+   - Generate: ssh-keygen -t ed25519
+   - Add to GitHub: https://github.com/settings/ssh/new
+   - Test: ssh -T git@github.com
+
+2. Personal Access Token
+   - Create at: https://github.com/settings/tokens
+   - Required scope: "repo" for private repositories
+   - Use as password when pushing
+
+For detailed instructions, see:
+https://docs.github.com/en/authentication`;
+  }
+  // -------------------------------------------------------------------------
+  // Private Helpers
+  // -------------------------------------------------------------------------
+  validateRepoName(repoName) {
+    try {
+      validateRepoName(repoName, "github");
+    } catch (error) {
+      throw new ProviderError(
+        error instanceof Error ? error.message : "Invalid repository name",
+        "github"
+      );
+    }
+  }
+  async getPreferredProtocol() {
+    try {
+      const { stdout } = await execFileAsync2("gh", ["config", "get", "git_protocol"]);
+      return stdout.trim().toLowerCase() === "ssh" ? "ssh" : "https";
+    } catch {
+      return "https";
+    }
+  }
+};
+var githubProvider = new GitHubProvider();
+
+// src/lib/providers/local.ts
+init_types();
+var LocalProvider = class {
+  mode = "local";
+  displayName = "Local Only";
+  cliName = null;
+  requiresRemote = false;
+  // -------------------------------------------------------------------------
+  // Detection & Authentication
+  // -------------------------------------------------------------------------
+  async isCliInstalled() {
+    return true;
+  }
+  async isAuthenticated() {
+    return true;
+  }
+  async getUser() {
+    return null;
+  }
+  async detect() {
+    return {
+      mode: this.mode,
+      displayName: this.displayName,
+      available: true,
+      authStatus: {
+        cliInstalled: true,
+        authenticated: true
+      }
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Repository Operations
+  // -------------------------------------------------------------------------
+  async repoExists(_repoName) {
+    throw new LocalModeError("check if remote repository exists");
+  }
+  async createRepo(_options) {
+    throw new LocalModeError("create remote repository");
+  }
+  async getRepoInfo(_repoName) {
+    throw new LocalModeError("get remote repository info");
+  }
+  async cloneRepo(_repoName, _targetDir) {
+    throw new LocalModeError("clone remote repository");
+  }
+  async findDotfilesRepo(_username) {
+    return null;
+  }
+  // -------------------------------------------------------------------------
+  // URL Utilities
+  // -------------------------------------------------------------------------
+  async getPreferredRepoUrl(_repo) {
+    throw new LocalModeError("get remote repository URL");
+  }
+  validateUrl(_url) {
+    return false;
+  }
+  buildRepoUrl(_username, _repoName, _protocol) {
+    throw new LocalModeError("build remote repository URL");
+  }
+  // -------------------------------------------------------------------------
+  // Instructions
+  // -------------------------------------------------------------------------
+  getSetupInstructions() {
+    return `Local Only Mode
+
+Your dotfiles are stored in a local git repository without remote sync.
+This is useful for:
+- Testing tuck before setting up a remote
+- Machines that don't need cloud backup
+- Air-gapped or offline environments
+
+Your dotfiles are still version controlled with git, so you can:
+- Track changes over time
+- Restore previous versions
+- Manually push to a remote later
+
+To enable remote sync later, run:
+  tuck config remote
+
+This will guide you through setting up GitHub, GitLab, or another provider.`;
+  }
+  getAltAuthInstructions() {
+    return `To sync your dotfiles to a remote, you'll need to configure a provider.
+
+Run: tuck config remote
+
+Available options:
+- GitHub (recommended) - via gh CLI
+- GitLab - via glab CLI  
+- Custom - any git remote URL`;
+  }
+};
+var localProvider = new LocalProvider();
+
+// src/lib/providers/custom.ts
+init_types();
+init_validation();
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+var execFileAsync3 = promisify3(execFile3);
+var CustomProvider = class _CustomProvider {
+  mode = "custom";
+  displayName = "Custom Git Remote";
+  cliName = null;
+  requiresRemote = true;
+  /** The custom remote URL */
+  remoteUrl;
+  constructor(remoteUrl) {
+    this.remoteUrl = remoteUrl;
+  }
+  /** Create a provider with a specific URL */
+  static withUrl(url) {
+    const provider = new _CustomProvider(url);
+    return provider;
+  }
+  /** Set the remote URL */
+  setRemoteUrl(url) {
+    this.remoteUrl = url;
+  }
+  /** Get the configured remote URL */
+  getRemoteUrl() {
+    return this.remoteUrl;
+  }
+  // -------------------------------------------------------------------------
+  // Detection & Authentication
+  // -------------------------------------------------------------------------
+  async isCliInstalled() {
+    try {
+      await execFileAsync3("git", ["--version"]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async isAuthenticated() {
+    return true;
+  }
+  async getUser() {
+    try {
+      const { stdout: name } = await execFileAsync3("git", ["config", "--global", "user.name"]);
+      const { stdout: email } = await execFileAsync3("git", ["config", "--global", "user.email"]);
+      const userName = name.trim();
+      const userEmail = email.trim();
+      if (userName || userEmail) {
+        return {
+          login: userName || userEmail.split("@")[0] || "user",
+          name: userName || null,
+          email: userEmail || null
+        };
+      }
+    } catch {
+    }
+    return null;
+  }
+  async detect() {
+    const gitInstalled = await this.isCliInstalled();
+    return {
+      mode: this.mode,
+      displayName: this.displayName,
+      available: gitInstalled,
+      authStatus: {
+        cliInstalled: gitInstalled,
+        authenticated: true
+        // Assume authenticated for custom
+      },
+      unavailableReason: !gitInstalled ? "Git is not installed" : void 0
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Repository Operations
+  // -------------------------------------------------------------------------
+  async repoExists(repoUrl) {
+    try {
+      await execFileAsync3("git", ["ls-remote", repoUrl], {
+        timeout: GIT_OPERATION_TIMEOUTS.LS_REMOTE
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async createRepo(_options) {
+    throw new ProviderError("Cannot create repositories with custom provider", "custom", [
+      "Create your repository manually on your git hosting service",
+      "Then use: tuck init --remote <your-repo-url>"
+    ]);
+  }
+  async getRepoInfo(repoUrl) {
+    const name = this.extractRepoName(repoUrl);
+    const exists = await this.repoExists(repoUrl);
+    if (!exists) {
+      return null;
+    }
+    return {
+      name,
+      fullName: name,
+      url: repoUrl,
+      sshUrl: repoUrl.startsWith("git@") ? repoUrl : "",
+      httpsUrl: repoUrl.startsWith("http") ? repoUrl : "",
+      isPrivate: true
+      // Assume private, we can't know
+    };
+  }
+  async cloneRepo(repoUrl, targetDir) {
+    try {
+      await execFileAsync3("git", ["clone", repoUrl, targetDir], {
+        timeout: GIT_OPERATION_TIMEOUTS.CLONE,
+        maxBuffer: 10 * 1024 * 1024
+        // 10MB output limit
+      });
+    } catch (error) {
+      if (error && typeof error === "object" && "killed" in error && error.killed) {
+        throw new ProviderError("Clone operation timed out", "custom", [
+          "The repository may be too large or the connection is too slow",
+          "Try using git clone directly for large repositories"
+        ]);
+      }
+      const sanitizedMessage = sanitizeErrorMessage(error, "Failed to clone repository");
+      throw new ProviderError(sanitizedMessage, "custom", [
+        "Check that the URL is correct and you have access",
+        "You may need to set up SSH keys or credentials"
+      ]);
+    }
+  }
+  async findDotfilesRepo(_username) {
+    return null;
+  }
+  // -------------------------------------------------------------------------
+  // URL Utilities
+  // -------------------------------------------------------------------------
+  async getPreferredRepoUrl(repo) {
+    return repo.sshUrl || repo.httpsUrl || repo.url;
+  }
+  validateUrl(url) {
+    return validateGitUrl(url);
+  }
+  buildRepoUrl(_username, _repoName, _protocol) {
+    throw new ProviderError("Cannot build repository URLs for custom provider", "custom", [
+      "Please provide the full repository URL"
+    ]);
+  }
+  // -------------------------------------------------------------------------
+  // Instructions
+  // -------------------------------------------------------------------------
+  getSetupInstructions() {
+    return `Custom Git Remote
+
+Use any git hosting service by providing the repository URL directly.
+
+Supported URL formats:
+- HTTPS: https://git.example.com/user/repo.git
+- SSH: git@git.example.com:user/repo.git
+
+Steps:
+1. Create a repository on your git hosting service
+2. Copy the clone URL (SSH or HTTPS)
+3. Run: tuck init --remote <your-repo-url>
+
+Note: You'll need to handle authentication separately:
+- For SSH: Set up SSH keys with your hosting service
+- For HTTPS: Configure git credentials or use a credential helper`;
+  }
+  getAltAuthInstructions() {
+    return `Authentication for Custom Git Remotes
+
+For SSH URLs (git@...):
+1. Generate an SSH key: ssh-keygen -t ed25519
+2. Add the public key to your git hosting service
+3. Test: ssh -T git@your-host.com
+
+For HTTPS URLs:
+1. Create a personal access token on your hosting service
+2. Configure git credential helper:
+   git config --global credential.helper store
+3. On first push, enter your token as password
+
+Or use git credential manager for more secure storage.`;
+  }
+  // -------------------------------------------------------------------------
+  // Private Helpers
+  // -------------------------------------------------------------------------
+  extractRepoName(url) {
+    let name = url.replace(/\.git$/, "");
+    if (name.includes(":") && !name.includes("://")) {
+      name = name.split(":").pop() || name;
+    }
+    if (name.includes("://")) {
+      const urlParts = name.split("/");
+      name = urlParts.slice(3).join("/");
+    }
+    const parts = name.split("/");
+    return parts[parts.length - 1] || "repository";
+  }
+};
+var customProvider = new CustomProvider();
+
+// src/lib/providers/index.ts
+init_types();
+init_gitlab();
+function getProvider(mode, config) {
+  switch (mode) {
+    case "github":
+      return githubProvider;
+    case "gitlab":
+      if (config?.providerUrl) {
+        const host = config.providerUrl.replace(/^https?:\/\//, "").replace(/\/$/, "");
+        return GitLabProvider.forHost(host);
+      }
+      return gitlabProvider;
+    case "local":
+      return localProvider;
+    case "custom":
+      if (config?.url) {
+        return CustomProvider.withUrl(config.url);
+      }
+      return customProvider;
+    default:
+      throw new ProviderNotConfiguredError(mode);
+  }
+}
+async function detectProviders() {
+  const detections = await Promise.all([
+    githubProvider.detect(),
+    gitlabProvider.detect(),
+    localProvider.detect(),
+    customProvider.detect()
+  ]);
+  return detections;
+}
+async function getProviderOptions() {
+  const detections = await detectProviders();
+  const detectionMap = /* @__PURE__ */ new Map();
+  for (const detection of detections) {
+    detectionMap.set(detection.mode, detection);
+  }
+  const github = detectionMap.get("github");
+  const gitlab = detectionMap.get("gitlab");
+  const custom = detectionMap.get("custom");
+  const options = [
+    {
+      mode: "github",
+      displayName: "GitHub",
+      description: "Store dotfiles on GitHub (recommended)",
+      available: github?.available ?? false,
+      authStatus: {
+        authenticated: github?.authStatus.authenticated ?? false,
+        username: github?.authStatus.user?.login
+      },
+      unavailableReason: github?.unavailableReason
+    },
+    {
+      mode: "gitlab",
+      displayName: "GitLab",
+      description: "Store dotfiles on GitLab (supports self-hosted)",
+      available: gitlab?.available ?? false,
+      authStatus: {
+        authenticated: gitlab?.authStatus.authenticated ?? false,
+        username: gitlab?.authStatus.user?.login
+      },
+      unavailableReason: gitlab?.unavailableReason
+    },
+    {
+      mode: "local",
+      displayName: "Local Only",
+      description: "Track dotfiles locally without remote sync",
+      available: true
+    },
+    {
+      mode: "custom",
+      displayName: "Custom Remote",
+      description: "Use any git remote URL (Bitbucket, Gitea, etc.)",
+      available: custom?.available ?? true
+    }
+  ];
+  return options.sort((a, b) => {
+    if (a.authStatus?.authenticated && !b.authStatus?.authenticated) return -1;
+    if (!a.authStatus?.authenticated && b.authStatus?.authenticated) return 1;
+    if (a.available && !b.available) return -1;
+    if (!a.available && b.available) return 1;
+    return 0;
+  });
+}
+function describeProviderConfig(config) {
+  switch (config.mode) {
+    case "github":
+      return config.username ? `GitHub (@${config.username})` : "GitHub";
+    case "gitlab":
+      if (config.providerUrl) {
+        const host = config.providerUrl.replace(/^https?:\/\//, "");
+        return config.username ? `GitLab ${host} (@${config.username})` : `GitLab (${host})`;
+      }
+      return config.username ? `GitLab (@${config.username})` : "GitLab";
+    case "local":
+      return "Local only (no remote sync)";
+    case "custom":
+      return config.url ? `Custom: ${config.url}` : "Custom remote";
+    default:
+      return "Unknown provider";
+  }
+}
+function buildRemoteConfig(mode, options) {
+  return {
+    mode,
+    url: options?.url,
+    providerUrl: options?.providerUrl,
+    username: options?.username,
+    repoName: options?.repoName
+  };
+}
+
+// src/lib/providerSetup.ts
+init_validation();
+function displayProviderStatus(options) {
+  console.log();
+  console.log(colors.brand("  Available Git Providers:"));
+  console.log();
+  for (const opt of options) {
+    const status = getProviderStatusIcon(opt);
+    const authInfo = opt.authStatus?.username ? colors.muted(` (@${opt.authStatus.username})`) : "";
+    console.log(`  ${status} ${opt.displayName}${authInfo}`);
+    if (opt.unavailableReason) {
+      console.log(colors.muted(`      ${opt.unavailableReason}`));
+    }
+  }
+  console.log();
+}
+function getProviderStatusIcon(opt) {
+  if (opt.authStatus?.authenticated) {
+    return colors.success("\u2713");
+  }
+  if (opt.available) {
+    return colors.warning("\u25CB");
+  }
+  return colors.muted("\u2717");
+}
+async function selectProvider() {
+  const spinner4 = prompts.spinner();
+  spinner4.start("Detecting available git providers...");
+  const options = await getProviderOptions();
+  spinner4.stop("Provider detection complete");
+  displayProviderStatus(options);
+  const selectOptions = options.map(
+    (opt) => {
+      let hint = opt.description;
+      if (opt.authStatus?.authenticated && opt.authStatus.username) {
+        hint = `Logged in as @${opt.authStatus.username}`;
+      } else if (opt.unavailableReason) {
+        hint = opt.unavailableReason;
+      }
+      return {
+        value: opt.mode,
+        label: opt.displayName,
+        hint
+      };
+    }
+  );
+  selectOptions.push({
+    value: "skip",
+    label: "Skip for now",
+    hint: "Set up remote later with tuck config remote"
+  });
+  const selected = await prompts.select(
+    "Where would you like to store your dotfiles?",
+    selectOptions
+  );
+  if (selected === "skip") {
+    return null;
+  }
+  return selected;
+}
+async function setupProvider(initialMode) {
+  const mode = initialMode ?? await selectProvider();
+  if (!mode) {
+    return {
+      success: true,
+      mode: "local",
+      config: buildRemoteConfig("local"),
+      provider: getProvider("local")
+    };
+  }
+  const provider = getProvider(mode);
+  switch (mode) {
+    case "local":
+      return await setupLocalProvider();
+    case "github":
+      return await setupGitHubProvider(provider);
+    case "gitlab":
+      return await setupGitLabProvider(provider);
+    case "custom":
+      return await setupCustomProvider(provider);
+    default:
+      prompts.log.error(`Unknown provider: ${mode}`);
+      return null;
+  }
+}
+async function setupLocalProvider() {
+  prompts.log.info("Your dotfiles will be tracked locally without remote sync.");
+  prompts.log.info("You can set up a remote later with 'tuck config remote'.");
+  return {
+    success: true,
+    mode: "local",
+    config: buildRemoteConfig("local"),
+    provider: getProvider("local")
+  };
+}
+async function setupGitHubProvider(provider) {
+  const detection = await provider.detect();
+  if (!detection.authStatus.cliInstalled) {
+    prompts.log.warning("GitHub CLI (gh) is not installed.");
+    console.log();
+    prompts.note(provider.getSetupInstructions(), "Installation Instructions");
+    console.log();
+    const altChoice = await prompts.select("How would you like to proceed?", [
+      { value: "install", label: "I will install gh CLI", hint: "Run tuck init again after" },
+      { value: "custom", label: "Use custom URL instead", hint: "Manual repository setup" },
+      { value: "local", label: "Stay local for now", hint: "No remote sync" }
+    ]);
+    if (altChoice === "local") {
+      return setupLocalProvider();
+    }
+    if (altChoice === "custom") {
+      return setupCustomProvider(getProvider("custom"));
+    }
+    prompts.log.info("After installing, run 'tuck init' again.");
+    return null;
+  }
+  if (!detection.authStatus.authenticated) {
+    prompts.log.warning("GitHub CLI is installed but not authenticated.");
+    const authChoice = await prompts.select("Would you like to authenticate now?", [
+      { value: "auth", label: "Run gh auth login", hint: "Authenticate via browser" },
+      { value: "custom", label: "Use custom URL instead", hint: "Manual repository setup" },
+      { value: "local", label: "Stay local for now", hint: "No remote sync" }
+    ]);
+    if (authChoice === "local") {
+      return setupLocalProvider();
+    }
+    if (authChoice === "custom") {
+      return setupCustomProvider(getProvider("custom"));
+    }
+    prompts.log.info("Opening browser for GitHub authentication...");
+    try {
+      const { execFile: execFile6 } = await import("child_process");
+      const { promisify: promisify7 } = await import("util");
+      const execFileAsync6 = promisify7(execFile6);
+      await execFileAsync6("gh", ["auth", "login", "--web"]);
+      const recheck = await provider.detect();
+      if (!recheck.authStatus.authenticated) {
+        prompts.log.warning("Authentication may have failed. Please try again.");
+        return null;
+      }
+      prompts.log.success(`Authenticated as @${recheck.authStatus.user?.login}`);
+    } catch (error) {
+      prompts.log.error("Authentication failed. Please try again or run `gh auth login` manually.");
+      return null;
+    }
+  }
+  const user = await provider.getUser();
+  if (!user) {
+    prompts.log.error("Could not get GitHub user information.");
+    return null;
+  }
+  const confirmAccount = await prompts.confirm(`Use GitHub account @${user.login}?`, true);
+  if (!confirmAccount) {
+    prompts.log.info("Run 'gh auth logout' then 'gh auth login' to switch accounts.");
+    return null;
+  }
+  return {
+    success: true,
+    mode: "github",
+    config: buildRemoteConfig("github", { username: user.login }),
+    provider
+  };
+}
+async function setupGitLabProvider(provider) {
+  const hostType = await prompts.select("Which GitLab instance?", [
+    { value: "cloud", label: "gitlab.com", hint: "GitLab cloud service" },
+    { value: "self-hosted", label: "Self-hosted", hint: "Custom GitLab server" }
+  ]);
+  let providerUrl;
+  if (hostType === "self-hosted") {
+    const host = await prompts.text("Enter your GitLab host:", {
+      placeholder: "gitlab.example.com",
+      validate: (value) => {
+        try {
+          validateHostname(value);
+          return void 0;
+        } catch (error) {
+          return error instanceof Error ? error.message : "Invalid hostname";
+        }
+      }
+    });
+    providerUrl = `https://${host}`;
+    prompts.log.info(
+      "For self-hosted instances with self-signed certificates, you may need to configure git to skip SSL verification"
+    );
+    const { GitLabProvider: GitLabProvider2 } = await Promise.resolve().then(() => (init_gitlab(), gitlab_exports));
+    provider = GitLabProvider2.forHost(host);
+  }
+  const detection = await provider.detect();
+  if (!detection.authStatus.cliInstalled) {
+    prompts.log.warning("GitLab CLI (glab) is not installed.");
+    console.log();
+    prompts.note(provider.getSetupInstructions(), "Installation Instructions");
+    console.log();
+    const altChoice = await prompts.select("How would you like to proceed?", [
+      { value: "install", label: "I will install glab CLI", hint: "Run tuck init again after" },
+      { value: "custom", label: "Use custom URL instead", hint: "Manual repository setup" },
+      { value: "local", label: "Stay local for now", hint: "No remote sync" }
+    ]);
+    if (altChoice === "local") {
+      return setupLocalProvider();
+    }
+    if (altChoice === "custom") {
+      return setupCustomProvider(getProvider("custom"));
+    }
+    prompts.log.info("After installing, run 'tuck init' again.");
+    return null;
+  }
+  if (!detection.authStatus.authenticated) {
+    prompts.log.warning(
+      `GitLab CLI is installed but not authenticated${providerUrl ? ` for ${providerUrl}` : ""}.`
+    );
+    const authChoice = await prompts.select("Would you like to authenticate now?", [
+      { value: "auth", label: "Run glab auth login", hint: "Authenticate via browser" },
+      { value: "custom", label: "Use custom URL instead", hint: "Manual repository setup" },
+      { value: "local", label: "Stay local for now", hint: "No remote sync" }
+    ]);
+    if (authChoice === "local") {
+      return setupLocalProvider();
+    }
+    if (authChoice === "custom") {
+      return setupCustomProvider(getProvider("custom"));
+    }
+    prompts.log.info("Opening browser for GitLab authentication...");
+    try {
+      const { execFile: execFile6 } = await import("child_process");
+      const { promisify: promisify7 } = await import("util");
+      const execFileAsync6 = promisify7(execFile6);
+      const args = ["auth", "login", "--web"];
+      if (providerUrl) {
+        args.push("-h", providerUrl.replace(/^https?:\/\//, ""));
+      }
+      await execFileAsync6("glab", args);
+      const recheck = await provider.detect();
+      if (!recheck.authStatus.authenticated) {
+        prompts.log.warning("Authentication may have failed. Please try again.");
+        return null;
+      }
+      prompts.log.success(`Authenticated as @${recheck.authStatus.user?.login}`);
+    } catch (error) {
+      prompts.log.error("Authentication failed. Please try again or run `glab auth login` manually.");
+      return null;
+    }
+  }
+  const user = await provider.getUser();
+  if (!user) {
+    prompts.log.error("Could not get GitLab user information.");
+    return null;
+  }
+  const confirmAccount = await prompts.confirm(
+    `Use GitLab account @${user.login}${providerUrl ? ` on ${providerUrl}` : ""}?`,
+    true
+  );
+  if (!confirmAccount) {
+    prompts.log.info("Run 'glab auth logout' then 'glab auth login' to switch accounts.");
+    return null;
+  }
+  return {
+    success: true,
+    mode: "gitlab",
+    config: buildRemoteConfig("gitlab", { username: user.login, providerUrl }),
+    provider
+  };
+}
+async function setupCustomProvider(provider) {
+  prompts.log.info("You can use any git remote URL.");
+  console.log();
+  prompts.note(provider.getSetupInstructions(), "Custom Remote Setup");
+  console.log();
+  const hasRepo = await prompts.confirm("Do you have a repository URL ready?");
+  if (!hasRepo) {
+    prompts.log.info("Create a repository first, then run 'tuck config remote' to add it.");
+    return setupLocalProvider();
+  }
+  const url = await prompts.text("Enter the repository URL:", {
+    placeholder: "https://git.example.com/user/dotfiles.git",
+    validate: (value) => {
+      if (!value) return "URL is required";
+      if (!provider.validateUrl(value)) {
+        return "Invalid git URL format";
+      }
+      return void 0;
+    }
+  });
+  return {
+    success: true,
+    mode: "custom",
+    config: buildRemoteConfig("custom", { url }),
+    provider,
+    remoteUrl: url
+  };
+}
+function detectProviderFromUrl(url) {
+  if (url.includes("github.com")) {
+    return "github";
+  }
+  if (url.includes("gitlab.com") || url.includes("gitlab")) {
+    return "gitlab";
+  }
+  return "custom";
+}
+
+// src/commands/init.ts
+init_github();
+init_detect();
+init_errors();
+init_constants();
+init_config_schema();
+init_fileTracking();
+import { copy as copy3 } from "fs-extra";
+import { tmpdir } from "os";
+import { readFile as readFile4, rm as rm2 } from "fs/promises";
+var GITIGNORE_TEMPLATE = `# OS generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Backup files
+*.bak
+*.backup
+*~
+
+# Secret files (add patterns for files you want to exclude)
+# *.secret
+# .env.local
+`;
+var trackFilesWithProgressInit = async (selectedPaths, tuckDir) => {
+  const filesToTrack = selectedPaths.map((path) => ({
+    path
+  }));
+  const result = await trackFilesWithProgress(filesToTrack, tuckDir, {
+    showCategory: true,
+    actionVerb: "Tracking"
+  });
+  return result.succeeded;
+};
+var README_TEMPLATE = (machine) => `# Dotfiles
+
+Managed with [tuck](https://github.com/Pranav-Karra-3301/tuck) - Modern Dotfiles Manager
+
+${machine ? `## Machine: ${machine}
+` : ""}
+
+## Quick Start
 
 \`\`\`bash
 # Restore dotfiles to a new machine
@@ -6435,7 +8061,7 @@ var validateGitHubUrl = (value) => {
   }
   return void 0;
 };
-var validateGitUrl = (value) => {
+var validateGitUrl2 = (value) => {
   if (!value) return "Repository URL is required";
   const trimmed = value.trim();
   const isHttps = /^https?:\/\/.+\/.+/.test(trimmed);
@@ -6482,7 +8108,8 @@ var initFromScratch = async (tuckDir, options) => {
     await saveConfig(
       {
         ...defaultConfig,
-        repository: { ...defaultConfig.repository, path: tuckDir }
+        repository: { ...defaultConfig.repository, path: tuckDir },
+        remote: options.remoteConfig || defaultConfig.remote
       },
       tuckDir
     );
@@ -6765,10 +8392,10 @@ var setupGitHubRepo = async (tuckDir) => {
     }
     prompts.log.info("Please complete the authentication in your browser...");
     try {
-      const { execFile: execFile3 } = await import("child_process");
-      const { promisify: promisify4 } = await import("util");
-      const execFileAsync3 = promisify4(execFile3);
-      await execFileAsync3("gh", ["auth", "login", "--web"]);
+      const { execFile: execFile6 } = await import("child_process");
+      const { promisify: promisify7 } = await import("util");
+      const execFileAsync6 = promisify7(execFile6);
+      await execFileAsync6("gh", ["auth", "login", "--web"]);
       if (!await isGhAuthenticated()) {
         prompts.log.warning("Authentication may have failed");
         return await setupAlternativeAuth(tuckDir);
@@ -7120,11 +8747,25 @@ var runInteractiveInit = async () => {
     prompts.outro("Use `tuck status` to see current state");
     return;
   }
+  console.log();
+  let providerResult = null;
+  providerResult = await setupProvider();
+  if (!providerResult) {
+    providerResult = {
+      success: true,
+      mode: "local",
+      config: buildRemoteConfig("local"),
+      provider: getProvider("local")
+    };
+  }
+  console.log();
+  prompts.log.info(`Provider: ${describeProviderConfig(providerResult.config)}`);
   let skipExistingRepoQuestion = false;
-  let remoteUrl = null;
+  let remoteUrl = providerResult.remoteUrl || null;
   let existingRepoToUseAsRemote = null;
+  const canSearchForRepos = providerResult.mode === "github" || providerResult.mode === "gitlab";
   const ghInstalled = await isGhInstalled();
-  const ghAuth = ghInstalled && await isGhAuthenticated();
+  const ghAuth = canSearchForRepos && providerResult.mode === "github" && ghInstalled && await isGhAuthenticated();
   if (ghAuth) {
     const spinner4 = prompts.spinner();
     spinner4.start("Checking for existing dotfiles repository on GitHub...");
@@ -7238,7 +8879,7 @@ var runInteractiveInit = async () => {
     if (hasExisting === "yes") {
       const repoUrl = await prompts.text("Enter repository URL:", {
         placeholder: "git@host:user/dotfiles.git or https://host/user/dotfiles.git",
-        validate: validateGitUrl
+        validate: validateGitUrl2
       });
       await initFromRemote(tuckDir, repoUrl);
       prompts.log.success("Repository cloned successfully!");
@@ -7257,7 +8898,7 @@ var runInteractiveInit = async () => {
       return;
     }
   }
-  await initFromScratch(tuckDir, {});
+  await initFromScratch(tuckDir, { remoteConfig: providerResult.config });
   if (existingRepoToUseAsRemote) {
     const protocol = await getPreferredRemoteProtocol();
     remoteUrl = protocol === "ssh" ? `git@github.com:${existingRepoToUseAsRemote}.git` : `https://github.com/${existingRepoToUseAsRemote}.git`;
@@ -7266,7 +8907,7 @@ var runInteractiveInit = async () => {
     prompts.log.info("Your next push will update the remote repository");
     console.log();
   }
-  if (!remoteUrl) {
+  if (!remoteUrl && providerResult.mode !== "local") {
     const wantsRemote = await prompts.confirm(
       "Would you like to set up a remote repository?",
       true
@@ -7498,9 +9139,11 @@ var runInit = async (options) => {
     logger.info("Run `tuck restore --all` to restore dotfiles");
     return;
   }
+  const detectedConfig = options.remote ? buildRemoteConfig(detectProviderFromUrl(options.remote), { url: options.remote }) : buildRemoteConfig("local");
   await initFromScratch(tuckDir, {
     remote: options.remote,
-    bare: options.bare
+    bare: options.bare,
+    remoteConfig: detectedConfig
   });
   logger.success(`Tuck initialized at ${collapsePath(tuckDir)}`);
   nextSteps([
@@ -8107,11 +9750,54 @@ init_sync();
 init_ui();
 init_paths();
 init_manifest();
+import { Command as Command7 } from "commander";
+
+// src/lib/remoteChecks.ts
+init_ui();
+init_config();
+var checkLocalMode = async (tuckDir) => {
+  try {
+    const config = await loadConfig(tuckDir);
+    if (config.remote?.mode === "local") {
+      return true;
+    }
+  } catch {
+  }
+  return false;
+};
+var showLocalModeWarningForPull = async () => {
+  prompts.log.warning("Tuck is configured for local-only mode (no remote sync).");
+  console.log();
+  prompts.note(
+    "Your dotfiles are tracked locally but not synced to a remote.\n\nTo enable remote sync, run:\n  tuck config remote\n\nOr re-initialize with:\n  tuck init",
+    "Local Mode"
+  );
+};
+var showLocalModeWarningForPush = async () => {
+  prompts.log.warning("Tuck is configured for local-only mode (no remote sync).");
+  console.log();
+  prompts.note(
+    "Your dotfiles are tracked locally but not synced to a remote.\n\nTo enable remote sync, run:\n  tuck config remote\n\nOr re-initialize with:\n  tuck init",
+    "Local Mode"
+  );
+  console.log();
+  const configureNow = await prompts.confirm("Would you like to configure a remote now?");
+  if (configureNow) {
+    prompts.log.info("Run 'tuck config remote' to set up a remote repository.");
+  }
+  return configureNow;
+};
+
+// src/commands/push.ts
 init_git();
 init_errors();
-import { Command as Command7 } from "commander";
 var runInteractivePush = async (tuckDir) => {
   prompts.intro("tuck push");
+  if (await checkLocalMode(tuckDir)) {
+    await showLocalModeWarningForPush();
+    prompts.outro("");
+    return;
+  }
   const hasRemoteRepo = await hasRemote(tuckDir);
   if (!hasRemoteRepo) {
     prompts.log.warning("No remote configured");
@@ -8201,6 +9887,12 @@ var runPush = async (options) => {
   } catch {
     throw new NotInitializedError();
   }
+  if (await checkLocalMode(tuckDir)) {
+    throw new GitError(
+      "Cannot push in local-only mode",
+      "Run 'tuck config remote' to configure a remote repository"
+    );
+  }
   if (!options.force && !options.setUpstream) {
     await runInteractivePush(tuckDir);
     return;
@@ -8240,11 +9932,16 @@ var pushCommand = new Command7("push").description("Push changes to remote repos
 init_ui();
 init_paths();
 init_manifest();
+import { Command as Command8 } from "commander";
 init_git();
 init_errors();
-import { Command as Command8 } from "commander";
 var runInteractivePull = async (tuckDir) => {
   prompts.intro("tuck pull");
+  if (await checkLocalMode(tuckDir)) {
+    await showLocalModeWarningForPull();
+    prompts.outro("");
+    return;
+  }
   const hasRemoteRepo = await hasRemote(tuckDir);
   if (!hasRemoteRepo) {
     prompts.log.error("No remote configured");
@@ -8300,6 +9997,12 @@ var runPull = async (options) => {
   } catch {
     throw new NotInitializedError();
   }
+  if (await checkLocalMode(tuckDir)) {
+    throw new GitError(
+      "Cannot pull in local-only mode",
+      "Run 'tuck config remote' to configure a remote repository"
+    );
+  }
   if (!options.rebase && !options.restore) {
     await runInteractivePull(tuckDir);
     return;
@@ -8958,6 +10661,7 @@ init_ui();
 init_paths();
 init_config();
 init_manifest();
+init_git();
 init_errors();
 import { Command as Command12 } from "commander";
 import { spawn } from "child_process";
@@ -9166,6 +10870,12 @@ var runConfigReset = async () => {
 };
 var showConfigView = async (config) => {
   const configObj = config;
+  if (config.remote) {
+    console.log(colors.bold.cyan("~ Remote Provider"));
+    console.log(colors.dim("-".repeat(40)));
+    console.log(`  ${describeProviderConfig(config.remote)}`);
+    console.log();
+  }
   const sections = [
     { key: "repository", title: "Repository Settings", icon: "*" },
     { key: "files", title: "File Management", icon: ">" },
@@ -9291,6 +11001,7 @@ var runInteractiveConfig = async () => {
   const action = await prompts.select("What would you like to do?", [
     { value: "view", label: "View current configuration", hint: "See all settings" },
     { value: "edit", label: "Edit a setting", hint: "Modify a specific value" },
+    { value: "remote", label: "Configure remote", hint: "Set up GitHub, GitLab, or local mode" },
     { value: "wizard", label: "Run setup wizard", hint: "Guided configuration" },
     { value: "reset", label: "Reset to defaults", hint: "Restore default values" },
     { value: "open", label: "Open in editor", hint: `Edit with ${process.env.EDITOR || "vim"}` }
@@ -9303,6 +11014,10 @@ var runInteractiveConfig = async () => {
     case "edit":
       await editConfigInteractive(config, tuckDir);
       break;
+    case "remote":
+      await runConfigRemote();
+      return;
+    // runConfigRemote has its own outro
     case "wizard":
       await runConfigWizard(config, tuckDir);
       break;
@@ -9315,6 +11030,105 @@ var runInteractiveConfig = async () => {
   }
   prompts.outro("Done!");
 };
+var runConfigRemote = async () => {
+  banner();
+  prompts.intro("tuck config remote");
+  const tuckDir = getTuckDir();
+  const config = await loadConfig(tuckDir);
+  if (config.remote) {
+    console.log();
+    console.log(colors.dim("Current remote configuration:"));
+    console.log(`  ${describeProviderConfig(config.remote)}`);
+    console.log();
+  }
+  const shouldChange = await prompts.confirm("Configure remote provider?", true);
+  if (!shouldChange) {
+    prompts.outro("No changes made");
+    return;
+  }
+  const result = await setupProvider();
+  if (!result) {
+    prompts.outro("Configuration cancelled");
+    return;
+  }
+  const updatedConfig = {
+    ...config,
+    remote: result.config
+  };
+  await saveConfig(updatedConfig, tuckDir);
+  if (result.remoteUrl) {
+    try {
+      if (await hasRemote(tuckDir)) {
+        await removeRemote(tuckDir, "origin");
+      }
+      await addRemote(tuckDir, "origin", result.remoteUrl);
+      prompts.log.success("Git remote updated");
+    } catch (error) {
+      prompts.log.warning(
+        `Could not update git remote: ${error instanceof Error ? error.message : String(error)}`
+      );
+      prompts.log.info(`Manually add remote: git remote add origin ${result.remoteUrl}`);
+    }
+  }
+  if (result.mode !== "local" && result.mode !== "custom" && !result.remoteUrl) {
+    const shouldCreateRepo = await prompts.confirm(
+      "Would you like to create a repository now?",
+      true
+    );
+    if (shouldCreateRepo) {
+      const provider = getProvider(result.mode, result.config);
+      const repoName = await prompts.text("Repository name:", {
+        defaultValue: "dotfiles",
+        placeholder: "dotfiles",
+        validate: (value) => {
+          if (!value) return "Repository name is required";
+          if (!/^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$/.test(value)) {
+            return "Repository name must start and end with alphanumeric characters";
+          }
+          return void 0;
+        }
+      });
+      const visibility = await prompts.select("Repository visibility:", [
+        { value: "private", label: "Private (recommended)", hint: "Only you can see it" },
+        { value: "public", label: "Public", hint: "Anyone can see it" }
+      ]);
+      try {
+        const spinner4 = prompts.spinner();
+        spinner4.start("Creating repository...");
+        const repo = await provider.createRepo({
+          name: repoName,
+          description: "My dotfiles managed with tuck",
+          isPrivate: visibility === "private"
+        });
+        spinner4.stop(`Repository created: ${repo.fullName}`);
+        const remoteUrl = await provider.getPreferredRepoUrl(repo);
+        try {
+          if (await hasRemote(tuckDir)) {
+            await removeRemote(tuckDir, "origin");
+          }
+          await addRemote(tuckDir, "origin", remoteUrl);
+          prompts.log.success("Remote configured");
+        } catch (error) {
+          prompts.log.warning(
+            `Could not add remote: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+        updatedConfig.remote = {
+          ...updatedConfig.remote,
+          repoName
+        };
+        await saveConfig(updatedConfig, tuckDir);
+      } catch (error) {
+        prompts.log.error(
+          `Failed to create repository: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  }
+  console.log();
+  prompts.log.success(`Remote configured: ${describeProviderConfig(result.config)}`);
+  prompts.outro("Done!");
+};
 var configCommand = new Command12("config").description("Manage tuck configuration").action(async () => {
   const tuckDir = getTuckDir();
   try {
@@ -9373,6 +11187,16 @@ var configCommand = new Command12("config").description("Manage tuck configurati
     }
     await runConfigReset();
   })
+).addCommand(
+  new Command12("remote").description("Configure remote provider").action(async () => {
+    const tuckDir = getTuckDir();
+    try {
+      await loadManifest(tuckDir);
+    } catch {
+      throw new NotInitializedError();
+    }
+    await runConfigRemote();
+  })
 );
 
 // src/commands/apply.ts
@@ -10723,13 +12547,155 @@ init_secrets2();
 // src/index.ts
 init_errors();
 init_constants();
+
+// src/lib/updater.ts
+init_constants();
+import updateNotifier from "update-notifier";
+import { execSync, spawnSync } from "child_process";
+import chalk5 from "chalk";
+import boxen3 from "boxen";
+import { createInterface } from "readline";
+var pkg = {
+  name: "@prnv/tuck",
+  version: VERSION
+};
+var detectPackageManager = () => {
+  const userAgent = process.env.npm_config_user_agent || "";
+  if (userAgent.includes("pnpm")) {
+    return "pnpm";
+  }
+  try {
+    const pnpmList = execSync("pnpm list -g --depth=0 2>/dev/null", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (pnpmList.includes("@prnv/tuck")) {
+      return "pnpm";
+    }
+  } catch {
+  }
+  return "npm";
+};
+var getUpdateCommand = (packageManager) => {
+  if (packageManager === "pnpm") {
+    return "pnpm update -g @prnv/tuck";
+  }
+  return "npm update -g @prnv/tuck";
+};
+var waitForEnterOrCancel = () => {
+  return new Promise((resolve2) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.on("close", () => {
+      resolve2(false);
+    });
+    rl.on("line", () => {
+      rl.close();
+      resolve2(true);
+    });
+    process.on("SIGINT", () => {
+      rl.close();
+      resolve2(false);
+    });
+  });
+};
+var executeUpdate = (packageManager) => {
+  const command = getUpdateCommand(packageManager);
+  console.log(chalk5.dim(`
+Updating ${APP_NAME} via ${packageManager}...`));
+  try {
+    const result = spawnSync(packageManager, ["update", "-g", "@prnv/tuck"], {
+      stdio: "inherit",
+      shell: true
+    });
+    if (result.status === 0) {
+      console.log(chalk5.green(`
+Successfully updated ${APP_NAME}!`));
+      console.log(chalk5.dim("Restart tuck to use the new version.\n"));
+      return true;
+    } else {
+      console.log(chalk5.red("\nUpdate failed."));
+      console.log(chalk5.dim(`Run manually: ${command}
+`));
+      return false;
+    }
+  } catch (error) {
+    console.log(chalk5.red("\nUpdate failed."));
+    console.log(chalk5.dim(`Run manually: ${command}
+`));
+    return false;
+  }
+};
+var shouldSkipUpdateCheck = () => {
+  if (process.env.CI) {
+    return true;
+  }
+  const execPath = process.env.npm_execpath || "";
+  if (execPath.includes("npx")) {
+    return true;
+  }
+  if (process.env.NO_UPDATE_CHECK) {
+    return true;
+  }
+  if (!process.stdin.isTTY) {
+    return true;
+  }
+  return false;
+};
+var checkForUpdates = async () => {
+  if (shouldSkipUpdateCheck()) {
+    return;
+  }
+  const notifier = updateNotifier({
+    pkg,
+    updateCheckInterval: 1e3 * 60 * 60 * 24
+    // 24 hours
+  });
+  if (!notifier.update || notifier.update.latest === VERSION) {
+    return;
+  }
+  const { latest } = notifier.update;
+  const packageManager = detectPackageManager();
+  const updateCommand = getUpdateCommand(packageManager);
+  const message = [
+    "",
+    chalk5.bold(`Update available: ${chalk5.red(VERSION)} ${chalk5.dim("->")} ${chalk5.green(latest)}`),
+    "",
+    chalk5.dim("Press Enter to update, or Ctrl+C to skip"),
+    ""
+  ].join("\n");
+  console.log(
+    boxen3(message, {
+      padding: { top: 0, bottom: 0, left: 2, right: 2 },
+      margin: { top: 1, bottom: 0, left: 0, right: 0 },
+      borderStyle: "round",
+      borderColor: "cyan",
+      textAlignment: "center"
+    })
+  );
+  const shouldUpdate = await waitForEnterOrCancel();
+  if (shouldUpdate) {
+    const success = executeUpdate(packageManager);
+    if (success) {
+      process.exit(0);
+    }
+  } else {
+    console.log(chalk5.dim(`
+Skipped. Run '${updateCommand}' to update later.
+`));
+  }
+};
+
+// src/index.ts
 init_banner();
 init_paths();
 init_manifest();
 init_git();
 var program = new Command16();
 program.name("tuck").description(DESCRIPTION).version(VERSION, "-v, --version", "Display version number").configureOutput({
-  outputError: (str, write) => write(chalk5.red(str))
+  outputError: (str, write) => write(chalk6.red(str))
 }).addHelpText("before", customHelp(VERSION)).helpOption("-h, --help", "Display this help message").showHelpAfterError(false);
 program.addCommand(initCommand);
 program.addCommand(addCommand);
@@ -10750,12 +12716,12 @@ var runDefaultAction = async () => {
   const tuckDir = getTuckDir();
   if (!await pathExists(tuckDir)) {
     miniBanner();
-    console.log(chalk5.bold("Get started with tuck:\n"));
-    console.log(chalk5.cyan("  tuck init") + chalk5.dim("   - Set up tuck and create a GitHub repo"));
-    console.log(chalk5.cyan("  tuck scan") + chalk5.dim("   - Find dotfiles to track"));
+    console.log(chalk6.bold("Get started with tuck:\n"));
+    console.log(chalk6.cyan("  tuck init") + chalk6.dim("   - Set up tuck and create a GitHub repo"));
+    console.log(chalk6.cyan("  tuck scan") + chalk6.dim("   - Find dotfiles to track"));
     console.log();
-    console.log(chalk5.dim("On a new machine:"));
-    console.log(chalk5.cyan("  tuck apply <username>") + chalk5.dim(" - Apply your dotfiles"));
+    console.log(chalk6.dim("On a new machine:"));
+    console.log(chalk6.cyan("  tuck apply <username>") + chalk6.dim(" - Apply your dotfiles"));
     console.log();
     return;
   }
@@ -10764,38 +12730,38 @@ var runDefaultAction = async () => {
     const trackedCount = Object.keys(manifest.files).length;
     const gitStatus = await getStatus(tuckDir);
     miniBanner();
-    console.log(chalk5.bold("Status:\n"));
-    console.log(`  Tracked files: ${chalk5.cyan(trackedCount.toString())}`);
+    console.log(chalk6.bold("Status:\n"));
+    console.log(`  Tracked files: ${chalk6.cyan(trackedCount.toString())}`);
     const pendingChanges = gitStatus.modified.length + gitStatus.staged.length;
     if (pendingChanges > 0) {
-      console.log(`  Pending changes: ${chalk5.yellow(pendingChanges.toString())}`);
+      console.log(`  Pending changes: ${chalk6.yellow(pendingChanges.toString())}`);
     } else {
-      console.log(`  Pending changes: ${chalk5.dim("none")}`);
+      console.log(`  Pending changes: ${chalk6.dim("none")}`);
     }
     if (gitStatus.ahead > 0) {
-      console.log(`  Commits to push: ${chalk5.yellow(gitStatus.ahead.toString())}`);
+      console.log(`  Commits to push: ${chalk6.yellow(gitStatus.ahead.toString())}`);
     }
     console.log();
-    console.log(chalk5.bold("Next steps:\n"));
+    console.log(chalk6.bold("Next steps:\n"));
     if (trackedCount === 0) {
-      console.log(chalk5.cyan("  tuck scan") + chalk5.dim("  - Find dotfiles to track"));
-      console.log(chalk5.cyan("  tuck add <file>") + chalk5.dim(" - Track a specific file"));
+      console.log(chalk6.cyan("  tuck scan") + chalk6.dim("  - Find dotfiles to track"));
+      console.log(chalk6.cyan("  tuck add <file>") + chalk6.dim(" - Track a specific file"));
     } else if (pendingChanges > 0) {
-      console.log(chalk5.cyan("  tuck sync") + chalk5.dim("  - Commit and push your changes"));
-      console.log(chalk5.cyan("  tuck diff") + chalk5.dim("  - Preview what changed"));
+      console.log(chalk6.cyan("  tuck sync") + chalk6.dim("  - Commit and push your changes"));
+      console.log(chalk6.cyan("  tuck diff") + chalk6.dim("  - Preview what changed"));
     } else if (gitStatus.ahead > 0) {
-      console.log(chalk5.cyan("  tuck push") + chalk5.dim("  - Push commits to GitHub"));
+      console.log(chalk6.cyan("  tuck push") + chalk6.dim("  - Push commits to GitHub"));
     } else {
-      console.log(chalk5.dim("  All synced! Your dotfiles are up to date."));
+      console.log(chalk6.dim("  All synced! Your dotfiles are up to date."));
       console.log();
-      console.log(chalk5.cyan("  tuck scan") + chalk5.dim("  - Find more dotfiles to track"));
-      console.log(chalk5.cyan("  tuck list") + chalk5.dim("  - See tracked files"));
+      console.log(chalk6.cyan("  tuck scan") + chalk6.dim("  - Find more dotfiles to track"));
+      console.log(chalk6.cyan("  tuck list") + chalk6.dim("  - See tracked files"));
     }
     console.log();
   } catch {
     miniBanner();
-    console.log(chalk5.yellow("Tuck directory exists but may be corrupted."));
-    console.log(chalk5.dim("Run `tuck init` to reinitialize."));
+    console.log(chalk6.yellow("Tuck directory exists but may be corrupted."));
+    console.log(chalk6.dim("Run `tuck init` to reinitialize."));
     console.log();
   }
 };
@@ -10804,9 +12770,16 @@ process.on("uncaughtException", handleError);
 process.on("unhandledRejection", (reason) => {
   handleError(reason instanceof Error ? reason : new Error(String(reason)));
 });
-if (!hasCommand && !process.argv.includes("--help") && !process.argv.includes("-h") && !process.argv.includes("--version") && !process.argv.includes("-v")) {
-  runDefaultAction().catch(handleError);
-} else {
-  program.parseAsync(process.argv).catch(handleError);
-}
+var isHelpOrVersion = process.argv.includes("--help") || process.argv.includes("-h") || process.argv.includes("--version") || process.argv.includes("-v");
+var main = async () => {
+  if (!isHelpOrVersion) {
+    await checkForUpdates();
+  }
+  if (!hasCommand && !isHelpOrVersion) {
+    await runDefaultAction();
+  } else {
+    await program.parseAsync(process.argv);
+  }
+};
+main().catch(handleError);
 //# sourceMappingURL=index.js.map