@prnv/tuck 1.8.0 → 1.9.0

package/dist/index.js

@@ -722,10 +722,14 @@ __export(paths_exports, {
   getCategoryDir: () => getCategoryDir,
   getConfigPath: () => getConfigPath,
   getDestinationPath: () => getDestinationPath,
+  getDestinationPathFromSource: () => getDestinationPathFromSource,
   getFilesDir: () => getFilesDir,
+  getHomeRelativeSourcePath: () => getHomeRelativeSourcePath,
   getManifestPath: () => getManifestPath,
   getRelativeDestination: () => getRelativeDestination,
+  getRelativeDestinationFromSource: () => getRelativeDestinationFromSource,
   getRelativePath: () => getRelativePath,
+  getSafeRepoPathFromDestination: () => getSafeRepoPathFromDestination,
   getTuckDir: () => getTuckDir,
   isDirectory: () => isDirectory,
   isFile: () => isFile,
@@ -735,13 +739,16 @@ __export(paths_exports, {
   isWritable: () => isWritable,
   pathExists: () => pathExists,
   sanitizeFilename: () => sanitizeFilename,
+  validatePathWithinRoot: () => validatePathWithinRoot,
+  validateSafeDestinationPath: () => validateSafeDestinationPath,
+  validateSafeManifestDestination: () => validateSafeManifestDestination,
   validateSafeSourcePath: () => validateSafeSourcePath
 });
 import { homedir as homedir3 } from "os";
-import { join as join2, basename, dirname as dirname2, relative, isAbsolute, resolve, sep } from "path";
-import { stat, access } from "fs/promises";
+import { join as join2, basename, dirname as dirname2, relative, isAbsolute, resolve, sep, posix } from "path";
+import { stat, lstat, access } from "fs/promises";
 import { constants } from "fs";
-var expandPath, collapsePath, getTuckDir, getManifestPath, getConfigPath, getFilesDir, getCategoryDir, getDestinationPath, getRelativeDestination, sanitizeFilename, detectCategory, pathExists, isDirectory, isFile, isSymlink, isReadable, isWritable, getRelativePath, isPathWithinHome, validateSafeSourcePath, generateFileId;
+var expandPath, collapsePath, getTuckDir, getManifestPath, getConfigPath, getFilesDir, getCategoryDir, getDestinationPath, getRelativeDestination, getHomeRelativeSourcePath, getRelativeDestinationFromSource, getDestinationPathFromSource, sanitizeFilename, detectCategory, pathExists, isDirectory, isFile, isSymlink, isReadable, isWritable, getRelativePath, isPathWithinHome, validateSafeSourcePath, validatePathWithinRoot, validateSafeManifestDestination, getSafeRepoPathFromDestination, validateSafeDestinationPath, generateFileId;
 var init_paths = __esm({
   "src/lib/paths.ts"() {
     "use strict";
@@ -770,7 +777,13 @@ var init_paths = __esm({
       return path;
     };
     getTuckDir = (customDir) => {
-      return expandPath(customDir || DEFAULT_TUCK_DIR);
+      const tuckDir = expandPath(customDir || DEFAULT_TUCK_DIR);
+      if (customDir && !isPathWithinHome(customDir)) {
+        throw new Error(
+          `Unsafe path detected: ${customDir} - custom tuck directory must be within home directory`
+        );
+      }
+      return tuckDir;
     };
     getManifestPath = (tuckDir) => {
       return join2(tuckDir, MANIFEST_FILE);
@@ -788,11 +801,40 @@ var init_paths = __esm({
       return join2(getCategoryDir(tuckDir, category), filename);
     };
     getRelativeDestination = (category, filename) => {
-      return join2(FILES_DIR, category, filename);
+      return posix.join(FILES_DIR, toPosixPath(category), toPosixPath(filename));
+    };
+    getHomeRelativeSourcePath = (sourcePath) => {
+      const expandedSource = resolve(expandPath(sourcePath));
+      const resolvedHome = resolve(homedir3());
+      if (!(expandedSource === resolvedHome || expandedSource.startsWith(resolvedHome + sep))) {
+        throw new Error(
+          `Unsafe path detected: ${sourcePath} - source path must be within home directory`
+        );
+      }
+      const relativePath = toPosixPath(relative(resolvedHome, expandedSource));
+      const segments = relativePath.split("/").filter(Boolean).filter((segment) => segment !== ".");
+      if (segments.some((segment) => segment === "..")) {
+        throw new Error(`Unsafe path detected: ${sourcePath} - path traversal is not allowed`);
+      }
+      return segments.length > 0 ? segments.join("/") : "home";
+    };
+    getRelativeDestinationFromSource = (category, sourcePath, customFilename) => {
+      const relativeSource = getHomeRelativeSourcePath(sourcePath).split("/");
+      if (customFilename) {
+        const sanitizedCustomName = sanitizeFilename(customFilename);
+        relativeSource[relativeSource.length - 1] = toPosixPath(sanitizedCustomName);
+      }
+      return posix.join(FILES_DIR, toPosixPath(category), ...relativeSource);
+    };
+    getDestinationPathFromSource = (tuckDir, category, sourcePath, customFilename) => {
+      return join2(tuckDir, getRelativeDestinationFromSource(category, sourcePath, customFilename));
     };
     sanitizeFilename = (filepath) => {
       const base = basename(filepath);
       const result = base.startsWith(".") ? base.slice(1) : base;
+      if (result === "." || result === "..") {
+        return "file";
+      }
       return result || "file";
     };
     detectCategory = (filepath) => {
@@ -837,7 +879,7 @@ var init_paths = __esm({
     };
     isSymlink = async (path) => {
       try {
-        const stats = await stat(path);
+        const stats = await lstat(path);
         return stats.isSymbolicLink();
       } catch {
         return false;
@@ -894,6 +936,63 @@ var init_paths = __esm({
         throw new Error(`Unsafe path detected: ${source} - paths must be within home directory`);
       }
     };
+    validatePathWithinRoot = (pathToValidate, root, label = "path") => {
+      const resolvedPath = resolve(expandPath(pathToValidate));
+      const resolvedRoot = resolve(expandPath(root));
+      const isWithinRoot = resolvedPath === resolvedRoot || resolvedPath.startsWith(resolvedRoot + sep);
+      if (!isWithinRoot) {
+        throw new Error(
+          `Unsafe ${label} path detected: ${pathToValidate} - path must be within ${root}`
+        );
+      }
+    };
+    validateSafeManifestDestination = (destination) => {
+      const trimmedDestination = destination.trim();
+      if (!trimmedDestination) {
+        throw new Error("Unsafe manifest destination detected: destination cannot be empty");
+      }
+      if (isAbsolute(trimmedDestination) || /^[A-Za-z]:[\\/]/.test(trimmedDestination) || trimmedDestination.startsWith("\\\\")) {
+        throw new Error(
+          `Unsafe manifest destination detected: ${destination} - destination must be a relative path`
+        );
+      }
+      const normalized = trimmedDestination.replace(/\\/g, "/");
+      if (normalized.includes("../") || normalized.split("/").includes("..")) {
+        throw new Error(
+          `Unsafe manifest destination detected: ${destination} - path traversal is not allowed`
+        );
+      }
+      if (!(normalized === FILES_DIR || normalized.startsWith(`${FILES_DIR}/`))) {
+        throw new Error(
+          `Unsafe manifest destination detected: ${destination} - destination must be inside ${FILES_DIR}/`
+        );
+      }
+    };
+    getSafeRepoPathFromDestination = (tuckDir, destination) => {
+      validateSafeManifestDestination(destination);
+      const repoPath = join2(tuckDir, destination);
+      validatePathWithinRoot(repoPath, tuckDir, "manifest destination");
+      return repoPath;
+    };
+    validateSafeDestinationPath = (destination, allowedRoots) => {
+      const resolvedDestination = resolve(expandPath(destination));
+      const roots = (allowedRoots && allowedRoots.length > 0 ? allowedRoots : [homedir3()]).map(
+        (r) => resolve(expandPath(r))
+      );
+      const isWithinAllowedRoot = roots.some((root) => {
+        try {
+          validatePathWithinRoot(resolvedDestination, root, "destination");
+          return true;
+        } catch {
+          return false;
+        }
+      });
+      if (!isWithinAllowedRoot) {
+        throw new Error(
+          `Unsafe destination path detected: ${destination} - destination must be within allowed roots`
+        );
+      }
+    };
     generateFileId = (source) => {
       const collapsed = collapsePath(source);
       const normalized = toPosixPath(collapsed);
@@ -2547,6 +2646,7 @@ __export(github_exports, {
   MIN_GITHUB_TOKEN_LENGTH: () => MIN_GITHUB_TOKEN_LENGTH,
   checkSSHKeys: () => checkSSHKeys,
   configureGitCredentialHelper: () => configureGitCredentialHelper,
+  configureGitCredentialHelperWithOptions: () => configureGitCredentialHelperWithOptions,
   createRepo: () => createRepo,
   detectTokenType: () => detectTokenType,
   diagnoseAuthIssue: () => diagnoseAuthIssue,
@@ -2573,7 +2673,7 @@ __export(github_exports, {
 });
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
-var execFileAsync4, API_REQUEST_TIMEOUT_MS, GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS, TOKEN_EXPIRATION_WARNING_DAYS, MIN_GITHUB_TOKEN_LENGTH, GITHUB_TOKEN_PREFIXES, validateRepoName2, isGhInstalled, isGhAuthenticated, getAuthenticatedUser, repoExists, diagnoseRepoCreationFailure, createRepo, getPreferredRemoteProtocol, getRepoInfo, ghCloneRepo, findDotfilesRepo, getPreferredRepoUrl, checkSSHKeys, getStrictHostKeyCheckingOption, testSSHConnection, getSSHKeyInstructions, getFineGrainedTokenInstructions, getClassicTokenInstructions, getGitHubCLIInstallInstructions, getAuthMethods, configureGitCredentialHelper, getCredentialsPath, storeGitHubCredentials, getStoredCredentialMetadata, removeStoredCredentials, testStoredCredentials, diagnoseAuthIssue, updateStoredCredentials, detectTokenType;
+var execFileAsync4, API_REQUEST_TIMEOUT_MS, GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS, TOKEN_EXPIRATION_WARNING_DAYS, MIN_GITHUB_TOKEN_LENGTH, GITHUB_TOKEN_PREFIXES, validateRepoName2, isGhInstalled, isGhAuthenticated, getAuthenticatedUser, repoExists, diagnoseRepoCreationFailure, createRepo, getPreferredRemoteProtocol, getRepoInfo, ghCloneRepo, findDotfilesRepo, getPreferredRepoUrl, checkSSHKeys, getStrictHostKeyCheckingOption, testSSHConnection, getSSHKeyInstructions, getFineGrainedTokenInstructions, getClassicTokenInstructions, getGitHubCLIInstallInstructions, getAuthMethods, configureGitCredentialHelper, configureGitCredentialHelperWithOptions, getCredentialsPath, storeGitHubCredentials, getStoredCredentialMetadata, removeStoredCredentials, testStoredCredentials, diagnoseAuthIssue, updateStoredCredentials, detectTokenType;
 var init_github = __esm({
   "src/lib/github.ts"() {
     "use strict";
@@ -2868,14 +2968,14 @@ var init_github = __esm({
       return protocol === "ssh" ? repo.sshUrl : repo.httpsUrl;
     };
     checkSSHKeys = async () => {
-      const { homedir: homedir7 } = await import("os");
-      const { join: join20 } = await import("path");
+      const { homedir: homedir8 } = await import("os");
+      const { join: join19 } = await import("path");
       const { readFile: readFile15 } = await import("fs/promises");
       const { pathExists: pathExists6 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
-      const sshDir = join20(homedir7(), ".ssh");
+      const sshDir = join19(homedir8(), ".ssh");
       const keyTypes = ["id_ed25519", "id_rsa", "id_ecdsa"];
       for (const keyType of keyTypes) {
-        const privateKeyPath = join20(sshDir, keyType);
+        const privateKeyPath = join19(sshDir, keyType);
         const publicKeyPath = `${privateKeyPath}.pub`;
         if (await pathExists6(publicKeyPath)) {
           try {
@@ -2897,17 +2997,17 @@ var init_github = __esm({
       }
       return {
         exists: false,
-        path: join20(sshDir, "id_ed25519"),
-        publicKeyPath: join20(sshDir, "id_ed25519.pub")
+        path: join19(sshDir, "id_ed25519"),
+        publicKeyPath: join19(sshDir, "id_ed25519.pub")
       };
     };
     getStrictHostKeyCheckingOption = async () => {
       try {
-        const { homedir: homedir7 } = await import("os");
-        const { join: join20 } = await import("path");
+        const { homedir: homedir8 } = await import("os");
+        const { join: join19 } = await import("path");
         const { readFile: readFile15 } = await import("fs/promises");
-        const sshDir = join20(homedir7(), ".ssh");
-        const knownHostsPath = join20(sshDir, "known_hosts");
+        const sshDir = join19(homedir8(), ".ssh");
+        const knownHostsPath = join19(sshDir, "known_hosts");
         const knownHostsContent = await readFile15(knownHostsPath, "utf-8");
         const hasGitHubEntry = knownHostsContent.split("\n").some((line) => {
           const trimmed = line.trim();
@@ -3017,11 +3117,13 @@ To create a Fine-grained Personal Access Token (recommended):
    - Username: your-github-username
    - Password: github_pat_xxxxxxxxxxxx (your token)
 
-   Or configure credential storage:
-   git config --global credential.helper store
+   Configure a secure credential helper instead:
+   - macOS: git config --global credential.helper osxkeychain
+   - Linux: git config --global credential.helper libsecret
+   - Windows: git config --global credential.helper manager-core
+   - Or with GitHub CLI: gh auth setup-git
 
-   Then on first push, enter your token as the password
-   and it will be saved for future use.
+   Then on first push, enter your token as the password.
 `.trim();
     };
     getClassicTokenInstructions = () => {
@@ -3060,8 +3162,11 @@ but classic tokens work if you need broader access.
    - Username: your-github-username
    - Password: ghp_xxxxxxxxxxxx (your token)
 
-   Or configure credential storage:
-   git config --global credential.helper store
+   Configure a secure credential helper instead:
+   - macOS: git config --global credential.helper osxkeychain
+   - Linux: git config --global credential.helper libsecret
+   - Windows: git config --global credential.helper manager-core
+   - Or with GitHub CLI: gh auth setup-git
 
    Then on first push, enter your token as the password.
 `.trim();
@@ -3144,7 +3249,11 @@ Learn more: https://cli.github.com/
       ];
     };
     configureGitCredentialHelper = async () => {
+      await configureGitCredentialHelperWithOptions();
+    };
+    configureGitCredentialHelperWithOptions = async (options = {}) => {
       const { platform: platform2 } = process;
+      const allowGlobalConfigChange = options.allowGlobalConfigChange ?? false;
       try {
         const { stdout } = await execFileAsync4("git", ["config", "--global", "credential.helper"]);
         if (stdout.trim()) {
@@ -3152,6 +3261,9 @@ Learn more: https://cli.github.com/
         }
       } catch {
       }
+      if (!allowGlobalConfigChange) {
+        return;
+      }
       try {
         if (platform2 === "darwin") {
           await execFileAsync4("git", ["config", "--global", "credential.helper", "osxkeychain"]);
@@ -3165,21 +3277,33 @@ Learn more: https://cli.github.com/
             await execFileAsync4("git", ["config", "--global", "credential.helper", `cache --timeout=${GIT_CREDENTIAL_CACHE_FALLBACK_TIMEOUT_SECONDS}`]);
           }
         } else if (platform2 === "win32") {
-          await execFileAsync4("git", ["config", "--global", "credential.helper", "manager"]);
+          try {
+            await execFileAsync4("git", ["config", "--global", "credential.helper", "manager-core"]);
+          } catch {
+            await execFileAsync4("git", ["config", "--global", "credential.helper", "manager"]);
+          }
         }
-      } catch {
-        await execFileAsync4("git", ["config", "--global", "credential.helper", "store"]);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new GitHubCliError(
+          `Failed to configure git credential helper securely: ${message}`,
+          [
+            "Configure a helper manually (recommended):",
+            "  macOS: git config --global credential.helper osxkeychain",
+            "  Linux: git config --global credential.helper libsecret",
+            "  Windows: git config --global credential.helper manager-core"
+          ]
+        );
       }
     };
     getCredentialsPath = async () => {
-      const { homedir: homedir7 } = await import("os");
-      const { join: join20 } = await import("path");
-      return join20(homedir7(), ".tuck", ".credentials.json");
+      const { homedir: homedir8 } = await import("os");
+      const { join: join19 } = await import("path");
+      return join19(homedir8(), ".tuck", ".credentials.json");
     };
     storeGitHubCredentials = async (username, token, type) => {
       const { writeFile: writeFile11, mkdir: mkdir2 } = await import("fs/promises");
       const { dirname: dirname9 } = await import("path");
-      await configureGitCredentialHelper();
       if (/[\r\n]/.test(username) || /[\r\n]/.test(token)) {
         throw new GitHubCliError("Username or token contains invalid newline characters.", [
           "Newline characters are not allowed in GitHub usernames or tokens because git's credential helper protocol is line-based.",
@@ -3195,7 +3319,7 @@ password=${token}
 `;
       try {
         const { spawn: spawn3 } = await import("child_process");
-        await new Promise((resolve2, reject) => {
+        await new Promise((resolve3, reject) => {
           const proc = spawn3("git", ["credential", "approve"], {
             stdio: ["pipe", "pipe", "pipe"]
           });
@@ -3203,7 +3327,7 @@ password=${token}
           proc.stdin.end();
           proc.on("close", (code) => {
             if (code === 0) {
-              resolve2();
+              resolve3();
             } else {
               reject(new Error("git credential approve failed"));
             }
@@ -3281,14 +3405,14 @@ password=${token}
       const { pathExists: pathExists6 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
       try {
         const { spawn: spawn3 } = await import("child_process");
-        await new Promise((resolve2) => {
+        await new Promise((resolve3) => {
           const proc = spawn3("git", ["credential", "reject"], {
             stdio: ["pipe", "pipe", "pipe"]
           });
           proc.stdin.write("protocol=https\nhost=github.com\n\n");
           proc.stdin.end();
-          proc.on("close", () => resolve2());
-          proc.on("error", () => resolve2());
+          proc.on("close", () => resolve3());
+          proc.on("error", () => resolve3());
         });
       } catch {
       }
@@ -3309,7 +3433,7 @@ password=${token}
       let password2 = null;
       try {
         const { spawn: spawn3 } = await import("child_process");
-        const credentialOutput = await new Promise((resolve2, reject) => {
+        const credentialOutput = await new Promise((resolve3, reject) => {
           const proc = spawn3("git", ["credential", "fill"], {
             stdio: ["pipe", "pipe", "pipe"]
           });
@@ -3321,7 +3445,7 @@ password=${token}
           });
           proc.on("close", (code) => {
             if (code === 0) {
-              resolve2(output);
+              resolve3(output);
             } else {
               reject(new Error("git credential fill failed"));
             }
@@ -4262,7 +4386,7 @@ var init_detect = __esm({
 
 // src/lib/files.ts
 import { createHash } from "crypto";
-import { readFile as readFile3, stat as stat3, lstat, readdir as readdir2, copyFile, symlink, unlink, rm } from "fs/promises";
+import { readFile as readFile3, stat as stat3, lstat as lstat2, readdir as readdir2, copyFile, symlink, unlink, rm } from "fs/promises";
 import { copy, ensureDir } from "fs-extra";
 import { join as join5, dirname as dirname3, basename as basename3 } from "path";
 import { constants as constants2 } from "fs";
@@ -4297,11 +4421,12 @@ var init_files = __esm({
       }
       try {
         const stats = await stat3(expandedPath);
+        const linkStats = await lstat2(expandedPath);
         const permissions = IS_WINDOWS ? stats.isDirectory() ? "755" : "644" : (stats.mode & 511).toString(8).padStart(3, "0");
         return {
           path: expandedPath,
           isDirectory: stats.isDirectory(),
-          isSymlink: stats.isSymbolicLink(),
+          isSymlink: linkStats.isSymbolicLink(),
           size: stats.size,
           permissions,
           modified: stats.mtime
@@ -4353,7 +4478,7 @@ var init_files = __esm({
           continue;
         }
         try {
-          const lstats = await lstat(entryPath);
+          const lstats = await lstat2(entryPath);
           if (lstats.isSymbolicLink()) {
             continue;
           }
@@ -4382,6 +4507,7 @@ var init_files = __esm({
       if (!await pathExists(expandedSource)) {
         throw new FileNotFoundError(source);
       }
+      validateSafeDestinationPath(expandedDest);
       await ensureDir(dirname3(expandedDest));
       const sourceIsDir = await isDirectory(expandedSource);
       try {
@@ -4419,10 +4545,11 @@ var init_files = __esm({
       if (!await pathExists(expandedTarget)) {
         throw new FileNotFoundError(target);
       }
+      validateSafeDestinationPath(expandedLink);
       await ensureDir(dirname3(expandedLink));
       if (options?.overwrite && await pathExists(expandedLink)) {
         try {
-          const linkStats = await lstat(expandedLink);
+          const linkStats = await lstat2(expandedLink);
           if (linkStats.isDirectory()) {
             await rm(expandedLink, { recursive: true });
           } else {
@@ -4539,6 +4666,7 @@ var init_fileTracking = __esm({
     init_files();
     init_config();
     init_constants();
+    init_platform();
     SENSITIVE_FILE_PATTERNS = [
       /^\.netrc$/,
       /^\.aws\/credentials$/,
@@ -4582,7 +4710,12 @@ var init_fileTracking = __esm({
       const total = files.length;
       const errors = [];
       const sensitiveFiles = [];
+      const trackedDestinations = /* @__PURE__ */ new Map();
       let succeeded = 0;
+      const manifest = await loadManifest(tuckDir);
+      for (const existingFile of Object.values(manifest.files)) {
+        trackedDestinations.set(toPosixPath(existingFile.destination), existingFile.source);
+      }
       console.log();
       console.log(chalk3.bold.cyan(`${actionVerb} ${total} ${total === 1 ? "file" : "files"}...`));
       console.log(chalk3.dim("\u2500".repeat(50)));
@@ -4592,20 +4725,35 @@ var init_fileTracking = __esm({
         const expandedPath = expandPath(file.path);
         const indexStr = chalk3.dim(`[${i + 1}/${total}]`);
         const category = file.category || detectCategory(expandedPath);
-        const filename = sanitizeFilename(expandedPath);
         const categoryInfo = CATEGORIES[category];
         const icon = categoryInfo?.icon || "\u25CB";
+        const sourcePath = collapsePath(file.path);
+        const relativeDestination = getRelativeDestinationFromSource(category, expandedPath, file.name);
+        const normalizedDestination = toPosixPath(relativeDestination);
+        const existingSource = trackedDestinations.get(normalizedDestination);
         const spinner4 = ora({
-          text: `${indexStr} ${actionVerb} ${chalk3.cyan(collapsePath(file.path))}`,
+          text: `${indexStr} ${actionVerb} ${chalk3.cyan(sourcePath)}`,
           color: "cyan",
           spinner: "dots",
           indent: 2
         }).start();
         try {
-          const destination = getDestinationPath(tuckDir, category, filename);
+          if (existingSource && existingSource !== sourcePath) {
+            throw new Error(
+              `Destination collision detected: ${relativeDestination} is already used by ${existingSource}`
+            );
+          }
+          const destination = getDestinationPathFromSource(tuckDir, category, expandedPath, file.name);
           await ensureDir2(dirname4(destination));
           if (strategy === "symlink") {
-            await createSymlink(expandedPath, destination, { overwrite: true });
+            await copyFileOrDir(expandedPath, destination, { overwrite: true });
+            try {
+              await createSymlink(destination, expandedPath, { overwrite: true });
+            } catch (error) {
+              await deleteFileOrDir(expandedPath).catch(() => void 0);
+              await copyFileOrDir(destination, expandedPath, { overwrite: true }).catch(() => void 0);
+              throw error;
+            }
           } else {
             await copyFileOrDir(expandedPath, destination, { overwrite: true });
           }
@@ -4614,8 +4762,8 @@ var init_fileTracking = __esm({
           const now = (/* @__PURE__ */ new Date()).toISOString();
           const id = generateFileId(file.path);
           await addFileToManifest(tuckDir, id, {
-            source: collapsePath(file.path),
-            destination: getRelativeDestination(category, filename),
+            source: sourcePath,
+            destination: relativeDestination,
             category,
             strategy,
             // TODO: Encryption and templating are planned for a future version
@@ -4628,16 +4776,17 @@ var init_fileTracking = __esm({
           });
           spinner4.stop();
           const categoryStr = showCategory ? chalk3.dim(` ${icon} ${category}`) : "";
-          console.log(`  ${chalk3.green("\u2713")} ${indexStr} ${collapsePath(file.path)}${categoryStr}`);
-          if (isSensitiveFile(collapsePath(file.path))) {
+          console.log(`  ${chalk3.green("\u2713")} ${indexStr} ${sourcePath}${categoryStr}`);
+          if (isSensitiveFile(sourcePath)) {
             sensitiveFiles.push(file.path);
           }
+          trackedDestinations.set(normalizedDestination, sourcePath);
           succeeded++;
           if (onProgress) {
             onProgress(i + 1, total);
           }
           if (i < files.length - 1 && delayBetween > 0) {
-            await new Promise((resolve2) => setTimeout(resolve2, delayBetween));
+            await new Promise((resolve3) => setTimeout(resolve3, delayBetween));
           }
         } catch (error) {
           spinner4.stop();
@@ -4675,184 +4824,468 @@ var init_fileTracking = __esm({
   }
 });
 
-// src/lib/backup.ts
-import { join as join6 } from "path";
-import { copy as copy2, ensureDir as ensureDir3, pathExists as pathExists2 } from "fs-extra";
-var getBackupDir, formatDateForBackup, getTimestampedBackupDir, createBackup;
-var init_backup = __esm({
-  "src/lib/backup.ts"() {
+// src/lib/binary.ts
+import { open, stat as stat4 } from "fs/promises";
+import { basename as basename4, dirname as dirname5 } from "path";
+var MAGIC_NUMBERS, SCRIPT_EXTENSIONS, WINDOWS_EXECUTABLE_EXTENSIONS, bufferStartsWith, isBinaryExecutable, isScriptFile, shouldExcludeFromBin;
+var init_binary = __esm({
+  "src/lib/binary.ts"() {
     "use strict";
-    init_constants();
     init_paths();
     init_platform();
-    getBackupDir = () => {
-      return expandPath(BACKUP_DIR);
-    };
-    formatDateForBackup = (date) => {
-      return date.toISOString().slice(0, 10);
-    };
-    getTimestampedBackupDir = (date) => {
-      const backupRoot = getBackupDir();
-      const timestamp = formatDateForBackup(date);
-      return join6(backupRoot, timestamp);
-    };
-    createBackup = async (sourcePath, customBackupDir) => {
-      const expandedSource = expandPath(sourcePath);
-      const date = /* @__PURE__ */ new Date();
-      if (!await pathExists(expandedSource)) {
-        throw new Error(`Source path does not exist: ${sourcePath}`);
+    MAGIC_NUMBERS = {
+      // ELF (Linux)
+      ELF: Buffer.from([127, 69, 76, 70]),
+      // Mach-O (macOS) - 32-bit
+      MACHO_32: Buffer.from([254, 237, 250, 206]),
+      // Mach-O (macOS) - 64-bit
+      MACHO_64: Buffer.from([207, 250, 237, 254]),
+      // Mach-O (macOS) - Universal binary
+      MACHO_UNIVERSAL: Buffer.from([202, 254, 186, 190]),
+      // PE (Windows)
+      PE: Buffer.from([77, 90])
+      // "MZ"
+    };
+    SCRIPT_EXTENSIONS = [
+      // Unix shells
+      ".sh",
+      ".bash",
+      ".zsh",
+      ".fish",
+      // Cross-platform scripting languages
+      ".py",
+      ".rb",
+      ".pl",
+      ".js",
+      ".ts",
+      ".lua",
+      ".php",
+      ".tcl",
+      ".awk",
+      ".sed",
+      // Windows scripts
+      ".ps1",
+      // PowerShell
+      ".psm1",
+      // PowerShell module
+      ".psd1",
+      // PowerShell data
+      ".bat",
+      // Batch file
+      ".cmd",
+      // Command script
+      ".vbs",
+      // VBScript
+      ".wsf"
+      // Windows Script File
+    ];
+    WINDOWS_EXECUTABLE_EXTENSIONS = [".exe", ".com", ".dll"];
+    bufferStartsWith = (buffer, magic) => {
+      if (buffer.length < magic.length) {
+        return false;
       }
-      const backupRoot = customBackupDir ? expandPath(customBackupDir) : getTimestampedBackupDir(date);
-      await ensureDir3(backupRoot);
-      const collapsed = toPosixPath(collapsePath(expandedSource));
-      const backupName = collapsed.replace(/^~\//, "").replace(/\//g, "_").replace(/^\./, "dot-");
-      const timestamp = date.toISOString().replace(/[:.]/g, "-").slice(11, 19);
-      const backupPath = join6(backupRoot, `${backupName}_${timestamp}`);
-      await copy2(expandedSource, backupPath, { overwrite: true });
-      return {
-        originalPath: expandedSource,
-        backupPath,
-        date
-      };
+      for (let i = 0; i < magic.length; i++) {
+        if (buffer[i] !== magic[i]) {
+          return false;
+        }
+      }
+      return true;
     };
-  }
-});
-
-// src/lib/hooks.ts
-import { exec, execSync } from "child_process";
-import { promisify as promisify5 } from "util";
-import chalk4 from "chalk";
-var execAsync, getWindowsShell, runHook, runPreSyncHook, runPostSyncHook, runPreRestoreHook, runPostRestoreHook;
-var init_hooks = __esm({
-  "src/lib/hooks.ts"() {
-    "use strict";
-    init_config();
-    init_logger();
-    init_prompts();
-    init_platform();
-    execAsync = promisify5(exec);
-    getWindowsShell = () => {
+    isBinaryExecutable = async (path) => {
+      const expandedPath = expandPath(path);
       try {
-        execSync("pwsh -Version", { stdio: "ignore" });
-        return "pwsh";
+        const stats = await stat4(expandedPath);
+        if (stats.isDirectory()) {
+          return false;
+        }
+        if (IS_WINDOWS) {
+          const lowerPath = expandedPath.toLowerCase();
+          if (WINDOWS_EXECUTABLE_EXTENSIONS.some((ext) => lowerPath.endsWith(ext))) {
+            return true;
+          }
+        }
+        const hasExecutePermission = !IS_WINDOWS && (stats.mode & 73) !== 0;
+        let fileHandle;
+        try {
+          fileHandle = await open(expandedPath, "r");
+          const buffer = Buffer.alloc(512);
+          await fileHandle.read(buffer, 0, 512, 0);
+          if (bufferStartsWith(buffer, MAGIC_NUMBERS.ELF) || bufferStartsWith(buffer, MAGIC_NUMBERS.MACHO_32) || bufferStartsWith(buffer, MAGIC_NUMBERS.MACHO_64) || bufferStartsWith(buffer, MAGIC_NUMBERS.MACHO_UNIVERSAL) || bufferStartsWith(buffer, MAGIC_NUMBERS.PE)) {
+            return true;
+          }
+          if (hasExecutePermission) {
+            const startsWithShebang = buffer[0] === 35 && buffer[1] === 33;
+            return !startsWithShebang;
+          }
+          return false;
+        } finally {
+          if (fileHandle) {
+            await fileHandle.close();
+          }
+        }
       } catch {
+        return false;
       }
+    };
+    isScriptFile = async (path) => {
+      const expandedPath = expandPath(path);
       try {
-        execSync("powershell.exe -Version", { stdio: "ignore" });
-        return "powershell.exe";
+        const hasScriptExtension = SCRIPT_EXTENSIONS.some((ext) => expandedPath.endsWith(ext));
+        if (hasScriptExtension) {
+          return true;
+        }
+        const stats = await stat4(expandedPath);
+        if (stats.isDirectory()) {
+          return false;
+        }
+        let fileHandle;
+        try {
+          fileHandle = await open(expandedPath, "r");
+          const buffer = Buffer.alloc(2);
+          await fileHandle.read(buffer, 0, 2, 0);
+          return buffer[0] === 35 && buffer[1] === 33;
+        } finally {
+          if (fileHandle) {
+            await fileHandle.close();
+          }
+        }
       } catch {
+        return false;
       }
-      return "cmd.exe";
     };
-    runHook = async (hookType, tuckDir, options) => {
-      if (options?.skipHooks) {
-        return { success: true, skipped: true };
-      }
-      const config = await loadConfig(tuckDir);
-      const command = config.hooks[hookType];
-      if (!command) {
-        return { success: true };
-      }
-      if (!options?.trustHooks) {
-        console.log();
-        console.log(chalk4.yellow.bold("WARNING: Hook Execution"));
-        console.log(chalk4.dim("\u2500".repeat(50)));
-        console.log(chalk4.white(`Hook type: ${chalk4.cyan(hookType)}`));
-        console.log(chalk4.white("Command:"));
-        console.log(chalk4.red(`  ${command}`));
-        console.log(chalk4.dim("\u2500".repeat(50)));
-        console.log(
-          chalk4.yellow(
-            "SECURITY: Hooks can execute arbitrary commands on your system."
-          )
-        );
-        console.log(
-          chalk4.yellow(
-            "Only proceed if you trust the source of this configuration."
-          )
-        );
-        console.log();
-        const confirmed = await prompts.confirm(
-          "Execute this hook?",
-          false
-          // Default to NO for safety
-        );
-        if (!confirmed) {
-          logger.warning(`Hook ${hookType} skipped by user`);
-          return { success: true, skipped: true };
-        }
-      }
-      if (!options?.silent) {
-        logger.dim(`Running ${hookType} hook...`);
+    shouldExcludeFromBin = async (path) => {
+      const expandedPath = expandPath(path);
+      const parentDir = dirname5(expandedPath);
+      const parentBasename = basename4(parentDir);
+      const isInBinDir = parentBasename === "bin";
+      if (!isInBinDir) {
+        return false;
       }
       try {
-        const shellOptions = IS_WINDOWS ? { shell: getWindowsShell() } : {};
-        const { stdout, stderr } = await execAsync(command, {
-          cwd: tuckDir,
-          timeout: 3e4,
-          // 30 second timeout
-          env: {
-            ...process.env,
-            TUCK_DIR: tuckDir,
-            TUCK_HOOK: hookType
-          },
-          ...shellOptions
-        });
-        if (stdout && !options?.silent) {
-          logger.dim(stdout.trim());
-        }
-        if (stderr && !options?.silent) {
-          logger.warning(stderr.trim());
-        }
-        return { success: true, output: stdout };
-      } catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        if (!options?.silent) {
-          logger.error(`Hook ${hookType} failed: ${errorMessage}`);
+        const stats = await stat4(expandedPath);
+        if (stats.isDirectory()) {
+          return false;
         }
-        return { success: false, error: errorMessage };
+      } catch {
+        return false;
       }
-    };
-    runPreSyncHook = async (tuckDir, options) => {
-      return runHook("preSync", tuckDir, options);
-    };
-    runPostSyncHook = async (tuckDir, options) => {
-      return runHook("postSync", tuckDir, options);
-    };
-    runPreRestoreHook = async (tuckDir, options) => {
-      return runHook("preRestore", tuckDir, options);
-    };
-    runPostRestoreHook = async (tuckDir, options) => {
-      return runHook("postRestore", tuckDir, options);
+      if (await isScriptFile(expandedPath)) {
+        return false;
+      }
+      return await isBinaryExecutable(expandedPath);
     };
   }
 });
 
-// src/lib/secrets/patterns.ts
-var CLOUD_PROVIDER_PATTERNS, API_TOKEN_PATTERNS, PRIVATE_KEY_PATTERNS, GENERIC_PATTERNS, ALL_SECRET_PATTERNS, getPatternsAboveSeverity, createCustomPattern, BINARY_EXTENSIONS, shouldSkipFile;
-var init_patterns = __esm({
-  "src/lib/secrets/patterns.ts"() {
+// src/lib/tuckignore.ts
+import { join as join6 } from "path";
+import { readFile as readFile4, writeFile as writeFile3, appendFile } from "fs/promises";
+var TUCKIGNORE_FILENAME, TUCKIGNORE_HEADER, getTuckignorePath, loadTuckignore, addToTuckignore, isIgnored;
+var init_tuckignore = __esm({
+  "src/lib/tuckignore.ts"() {
     "use strict";
-    CLOUD_PROVIDER_PATTERNS = [
-      {
-        id: "aws-access-key",
-        name: "AWS Access Key ID",
-        pattern: /\b(AKIA[0-9A-Z]{16})\b/g,
-        severity: "critical",
-        description: "AWS Access Key ID",
-        placeholder: "AWS_ACCESS_KEY_ID"
-      },
-      {
-        id: "aws-secret-key",
-        name: "AWS Secret Access Key",
-        // AWS secret keys are 40 characters, base64-ish
-        // Look for context clues (assignment to aws_secret, etc.)
-        pattern: /(?:aws_secret_access_key|aws_secret|secret_access_key)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
-        severity: "critical",
-        description: "AWS Secret Access Key",
-        placeholder: "AWS_SECRET_ACCESS_KEY"
-      },
-      {
+    init_paths();
+    TUCKIGNORE_FILENAME = ".tuckignore";
+    TUCKIGNORE_HEADER = `# .tuckignore - Files to exclude from tracking
+# One exact file path per line (no globs)
+# Lines starting with # are comments
+#
+# Example:
+# ~/bin/large-binary
+# ~/.docker/config.json
+`;
+    getTuckignorePath = (tuckDir) => {
+      return join6(tuckDir, TUCKIGNORE_FILENAME);
+    };
+    loadTuckignore = async (tuckDir) => {
+      const ignorePath = getTuckignorePath(tuckDir);
+      const ignoredPaths = /* @__PURE__ */ new Set();
+      if (!await pathExists(ignorePath)) {
+        return ignoredPaths;
+      }
+      try {
+        const content = await readFile4(ignorePath, "utf-8");
+        const lines = content.split("\n");
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (!trimmed || trimmed.startsWith("#")) {
+            continue;
+          }
+          const expanded = expandPath(trimmed);
+          const collapsed = collapsePath(expanded);
+          ignoredPaths.add(collapsed);
+        }
+      } catch {
+      }
+      return ignoredPaths;
+    };
+    addToTuckignore = async (tuckDir, path) => {
+      const ignorePath = getTuckignorePath(tuckDir);
+      const expanded = expandPath(path);
+      const collapsed = collapsePath(expanded);
+      const existingPaths = await loadTuckignore(tuckDir);
+      if (existingPaths.has(collapsed)) {
+        return;
+      }
+      if (!await pathExists(ignorePath)) {
+        await writeFile3(ignorePath, TUCKIGNORE_HEADER + "\n", "utf-8");
+      }
+      await appendFile(ignorePath, collapsed + "\n", "utf-8");
+    };
+    isIgnored = async (tuckDir, path) => {
+      const ignoredPaths = await loadTuckignore(tuckDir);
+      const expanded = expandPath(path);
+      const collapsed = collapsePath(expanded);
+      return ignoredPaths.has(collapsed);
+    };
+  }
+});
+
+// src/lib/audit.ts
+import { appendFile as appendFile2, mkdir } from "fs/promises";
+import { join as join7 } from "path";
+import { homedir as homedir4 } from "os";
+import { existsSync } from "fs";
+function getAuditLogPath() {
+  return join7(homedir4(), ".tuck", AUDIT_FILENAME);
+}
+async function logAuditEntry(action, command, details) {
+  try {
+    const tuckDir = join7(homedir4(), ".tuck");
+    if (!existsSync(tuckDir)) {
+      await mkdir(tuckDir, { recursive: true });
+    }
+    const entry = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      action,
+      command,
+      details,
+      user: process.env.USER || process.env.USERNAME,
+      cwd: process.cwd()
+    };
+    const logLine = JSON.stringify(entry) + "\n";
+    const logPath = getAuditLogPath();
+    await appendFile2(logPath, logLine, "utf-8");
+  } catch {
+    if (process.env.DEBUG) {
+      console.error("[DEBUG] Failed to write audit log");
+    }
+  }
+}
+async function logForceSecretBypass(command, filesCount) {
+  await logAuditEntry(
+    "FORCE_SECRET_BYPASS",
+    command,
+    `Bypassed secret scanning for ${filesCount} file(s)`
+  );
+}
+async function logForcePush(branch) {
+  await logAuditEntry("FORCE_PUSH", "tuck push --force", `Force pushed to branch: ${branch}`);
+}
+var AUDIT_FILENAME;
+var init_audit = __esm({
+  "src/lib/audit.ts"() {
+    "use strict";
+    AUDIT_FILENAME = "audit.log";
+  }
+});
+
+// src/lib/secrets/regexSafety.ts
+var MAX_CUSTOM_PATTERN_LENGTH, MAX_GROUP_DEPTH, ALLOWED_CUSTOM_REGEX_FLAGS, parseBraceQuantifier, getSafetyIssue, normalizeCustomRegexFlags, assertSafeCustomRegex;
+var init_regexSafety = __esm({
+  "src/lib/secrets/regexSafety.ts"() {
+    "use strict";
+    MAX_CUSTOM_PATTERN_LENGTH = 500;
+    MAX_GROUP_DEPTH = 16;
+    ALLOWED_CUSTOM_REGEX_FLAGS = /* @__PURE__ */ new Set(["d", "g", "i", "m", "s", "u", "y"]);
+    parseBraceQuantifier = (source, start) => {
+      if (source[start] !== "{") {
+        return null;
+      }
+      let index = start + 1;
+      let min = "";
+      let max = "";
+      let hasComma = false;
+      while (index < source.length && /[0-9]/.test(source[index])) {
+        min += source[index];
+        index++;
+      }
+      if (source[index] === ",") {
+        hasComma = true;
+        index++;
+        while (index < source.length && /[0-9]/.test(source[index])) {
+          max += source[index];
+          index++;
+        }
+      }
+      if (source[index] !== "}") {
+        return null;
+      }
+      if (min.length === 0) {
+        return null;
+      }
+      const unbounded = hasComma && max.length === 0;
+      const variable = hasComma && (max.length === 0 || max !== min);
+      return { endIndex: index, variable, unbounded };
+    };
+    getSafetyIssue = (source) => {
+      const stack = [{ hasVariableQuantifier: false, hasAlternation: false }];
+      let lastToken = { type: "none" };
+      let inCharClass = false;
+      for (let i = 0; i < source.length; ) {
+        const char = source[i];
+        if (char === "\\") {
+          const next = source[i + 1];
+          if (next && /[1-9]/.test(next)) {
+            return "backreferences are not allowed";
+          }
+          if (next === "k" && source[i + 2] === "<") {
+            return "named backreferences are not allowed";
+          }
+          lastToken = { type: "literal" };
+          i += 2;
+          continue;
+        }
+        if (inCharClass) {
+          if (char === "]") {
+            inCharClass = false;
+          }
+          i++;
+          continue;
+        }
+        if (char === "[") {
+          inCharClass = true;
+          lastToken = { type: "literal" };
+          i++;
+          continue;
+        }
+        if (char === "(") {
+          if (source.startsWith("(?<=", i) || source.startsWith("(?<!", i)) {
+            return "lookbehind assertions are not allowed";
+          }
+          stack.push({ hasVariableQuantifier: false, hasAlternation: false });
+          if (stack.length > MAX_GROUP_DEPTH) {
+            return `pattern nesting is too deep (max ${MAX_GROUP_DEPTH} groups)`;
+          }
+          lastToken = { type: "none" };
+          i++;
+          continue;
+        }
+        if (char === ")") {
+          if (stack.length > 1) {
+            const closed = stack.pop();
+            lastToken = { type: "group", group: closed };
+          } else {
+            lastToken = { type: "literal" };
+          }
+          i++;
+          continue;
+        }
+        if (char === "|") {
+          stack[stack.length - 1].hasAlternation = true;
+          lastToken = { type: "none" };
+          i++;
+          continue;
+        }
+        const braceQuantifier = parseBraceQuantifier(source, i);
+        if (braceQuantifier && (lastToken.type === "literal" || lastToken.type === "group")) {
+          if (braceQuantifier.variable) {
+            stack[stack.length - 1].hasVariableQuantifier = true;
+          }
+          if (lastToken.type === "group" && braceQuantifier.unbounded) {
+            if (lastToken.group?.hasVariableQuantifier) {
+              return "nested quantified groups are not allowed";
+            }
+            if (lastToken.group?.hasAlternation) {
+              return "unbounded quantifiers on alternation groups are not allowed";
+            }
+          }
+          lastToken = { type: "quantifier" };
+          i = braceQuantifier.endIndex + 1;
+          if (source[i] === "?") {
+            i++;
+          }
+          continue;
+        }
+        if ((char === "*" || char === "+" || char === "?") && (lastToken.type === "literal" || lastToken.type === "group")) {
+          stack[stack.length - 1].hasVariableQuantifier = true;
+          const unbounded = char === "*" || char === "+";
+          if (lastToken.type === "group" && unbounded) {
+            if (lastToken.group?.hasVariableQuantifier) {
+              return "nested quantified groups are not allowed";
+            }
+            if (lastToken.group?.hasAlternation) {
+              return "unbounded quantifiers on alternation groups are not allowed";
+            }
+          }
+          lastToken = { type: "quantifier" };
+          i++;
+          if (source[i] === "?") {
+            i++;
+          }
+          continue;
+        }
+        lastToken = { type: "literal" };
+        i++;
+      }
+      return null;
+    };
+    normalizeCustomRegexFlags = (flags = "g") => {
+      const merged = `${flags}g`;
+      let normalized = "";
+      const seen = /* @__PURE__ */ new Set();
+      for (const flag of merged) {
+        if (!ALLOWED_CUSTOM_REGEX_FLAGS.has(flag)) {
+          throw new Error(`Unsupported regex flag "${flag}" in custom pattern`);
+        }
+        if (!seen.has(flag)) {
+          seen.add(flag);
+          normalized += flag;
+        }
+      }
+      return normalized;
+    };
+    assertSafeCustomRegex = (source) => {
+      if (!source.trim()) {
+        throw new Error("Custom pattern cannot be empty");
+      }
+      if (source.length > MAX_CUSTOM_PATTERN_LENGTH) {
+        throw new Error(`Custom pattern is too long (${source.length} > ${MAX_CUSTOM_PATTERN_LENGTH})`);
+      }
+      const issue = getSafetyIssue(source);
+      if (issue) {
+        throw new Error(`Unsafe custom regex pattern rejected: ${issue}`);
+      }
+    };
+  }
+});
+
+// src/lib/secrets/patterns.ts
+var CLOUD_PROVIDER_PATTERNS, API_TOKEN_PATTERNS, PRIVATE_KEY_PATTERNS, GENERIC_PATTERNS, ALL_SECRET_PATTERNS, getPatternsAboveSeverity, createCustomPattern, BINARY_EXTENSIONS, shouldSkipFile;
+var init_patterns = __esm({
+  "src/lib/secrets/patterns.ts"() {
+    "use strict";
+    init_regexSafety();
+    CLOUD_PROVIDER_PATTERNS = [
+      {
+        id: "aws-access-key",
+        name: "AWS Access Key ID",
+        pattern: /\b(AKIA[0-9A-Z]{16})\b/g,
+        severity: "critical",
+        description: "AWS Access Key ID",
+        placeholder: "AWS_ACCESS_KEY_ID"
+      },
+      {
+        id: "aws-secret-key",
+        name: "AWS Secret Access Key",
+        // AWS secret keys are 40 characters, base64-ish
+        // Look for context clues (assignment to aws_secret, etc.)
+        pattern: /(?:aws_secret_access_key|aws_secret|secret_access_key)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
+        severity: "critical",
+        description: "AWS Secret Access Key",
+        placeholder: "AWS_SECRET_ACCESS_KEY"
+      },
+      {
         id: "aws-session-token",
         name: "AWS Session Token",
         pattern: /(?:aws_session_token)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{100,1000})['"]?/gi,
@@ -5445,10 +5878,19 @@ var init_patterns = __esm({
       return ALL_SECRET_PATTERNS.filter((p4) => severityOrder[p4.severity] <= minLevel);
     };
     createCustomPattern = (id, name, pattern, options) => {
+      const normalizedFlags = normalizeCustomRegexFlags(options?.flags);
+      assertSafeCustomRegex(pattern);
+      let compiledPattern;
+      try {
+        compiledPattern = new RegExp(pattern, normalizedFlags);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Invalid custom regex pattern: ${message}`);
+      }
       return {
         id: `custom-${id}`,
         name,
-        pattern: new RegExp(pattern, options?.flags || "g"),
+        pattern: compiledPattern,
         severity: options?.severity || "high",
         description: options?.description || `Custom pattern: ${name}`,
         placeholder: options?.placeholder || id.toUpperCase().replace(/-/g, "_")
@@ -5535,7 +5977,7 @@ __export(scanner_exports, {
   scanFile: () => scanFile,
   scanFiles: () => scanFiles
 });
-import { readFile as readFile4, stat as stat4 } from "fs/promises";
+import { readFile as readFile5, stat as stat5 } from "fs/promises";
 var MAX_FILE_SIZE, MAX_FILES_PER_SCAN, WARN_FILES_THRESHOLD, SCAN_TIMEOUT_MS, PATTERN_TIMEOUT_MS, redactSecret, getPosition, getContext, clonePattern, scanContent, scanFile, scanFiles, generateUniquePlaceholder, getSecretsWithPlaceholders;
 var init_scanner = __esm({
   "src/lib/secrets/scanner.ts"() {
@@ -5612,7 +6054,8 @@ var init_scanner = __esm({
       }
     };
     clonePattern = (pattern) => {
-      return new RegExp(pattern.source, pattern.flags);
+      const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+      return new RegExp(pattern.source, flags);
     };
     scanContent = (content, options = {}) => {
       const matches = [];
@@ -5627,6 +6070,9 @@ var init_scanner = __esm({
         patterns = ALL_SECRET_PATTERNS;
       }
       if (options.customPatterns) {
+        for (const customPattern of options.customPatterns) {
+          assertSafeCustomRegex(customPattern.pattern.source);
+        }
         patterns = [...patterns, ...options.customPatterns];
       }
       if (options.excludePatternIds && options.excludePatternIds.length > 0) {
@@ -5711,7 +6157,7 @@ var init_scanner = __esm({
         };
       }
       try {
-        const stats = await stat4(expandedPath);
+        const stats = await stat5(expandedPath);
         if (stats.size > maxSize) {
           return {
             path: expandedPath,
@@ -5755,7 +6201,7 @@ var init_scanner = __esm({
         };
       }
       try {
-        const content = await readFile4(expandedPath, "utf-8");
+        const content = await readFile5(expandedPath, "utf-8");
         const matches = scanContent(content, options);
         return {
           path: expandedPath,
@@ -5860,9 +6306,9 @@ var init_scanner = __esm({
 });
 
 // src/lib/secrets/store.ts
-import { readFile as readFile5, writeFile as writeFile3, chmod, stat as stat5 } from "fs/promises";
-import { join as join7 } from "path";
-import { ensureDir as ensureDir4 } from "fs-extra";
+import { readFile as readFile6, writeFile as writeFile4, chmod, stat as stat6 } from "fs/promises";
+import { join as join8 } from "path";
+import { ensureDir as ensureDir3 } from "fs-extra";
 var SECRETS_FILE_MODE, TUCK_DIR_MODE, SECRETS_FILENAME, getSecretsPath, loadSecretsStore, windowsPermissionWarningShown, saveSecretsStore, setSecret, getSecret, unsetSecret, listSecrets, getAllSecrets, getSecretCount, ensureSecretsGitignored, MAX_SECRET_NAME_LENGTH, MIN_SECRET_NAME_LENGTH, isValidSecretName, normalizeSecretName;
 var init_store = __esm({
   "src/lib/secrets/store.ts"() {
@@ -5873,7 +6319,7 @@ var init_store = __esm({
     TUCK_DIR_MODE = 448;
     SECRETS_FILENAME = "secrets.local.json";
     getSecretsPath = (tuckDir) => {
-      return join7(tuckDir, SECRETS_FILENAME);
+      return join8(tuckDir, SECRETS_FILENAME);
     };
     loadSecretsStore = async (tuckDir) => {
       const secretsPath = getSecretsPath(tuckDir);
@@ -5884,7 +6330,7 @@ var init_store = __esm({
         };
       }
       try {
-        const stats = await stat5(secretsPath);
+        const stats = await stat6(secretsPath);
         const mode = stats.mode & 511;
         if ((mode & 63) !== 0) {
           await chmod(secretsPath, SECRETS_FILE_MODE);
@@ -5892,7 +6338,7 @@ var init_store = __esm({
       } catch {
       }
       try {
-        const content = await readFile5(secretsPath, "utf-8");
+        const content = await readFile6(secretsPath, "utf-8");
         const parsed = JSON.parse(content);
         return secretsStoreSchema.parse(parsed);
       } catch (error) {
@@ -5917,13 +6363,13 @@ var init_store = __esm({
     windowsPermissionWarningShown = false;
     saveSecretsStore = async (tuckDir, store) => {
       const secretsPath = getSecretsPath(tuckDir);
-      await ensureDir4(tuckDir);
+      await ensureDir3(tuckDir);
       try {
         await chmod(tuckDir, TUCK_DIR_MODE);
       } catch {
       }
       const content = JSON.stringify(store, null, 2) + "\n";
-      await writeFile3(secretsPath, content, "utf-8");
+      await writeFile4(secretsPath, content, "utf-8");
       try {
         await chmod(secretsPath, SECRETS_FILE_MODE);
       } catch {
@@ -5985,10 +6431,10 @@ var init_store = __esm({
       return Object.keys(store.secrets).length;
     };
     ensureSecretsGitignored = async (tuckDir) => {
-      const gitignorePath = join7(tuckDir, ".gitignore");
+      const gitignorePath = join8(tuckDir, ".gitignore");
       let gitignoreContent = "";
       if (await pathExists(gitignorePath)) {
-        gitignoreContent = await readFile5(gitignorePath, "utf-8");
+        gitignoreContent = await readFile6(gitignorePath, "utf-8");
       }
       if (gitignoreContent.includes(SECRETS_FILENAME)) {
         return;
@@ -6000,7 +6446,7 @@ ${SECRETS_FILENAME}
 ` : `# Local secrets (NEVER commit)
 ${SECRETS_FILENAME}
 `;
-      await writeFile3(gitignorePath, newContent, "utf-8");
+      await writeFile4(gitignorePath, newContent, "utf-8");
     };
     MAX_SECRET_NAME_LENGTH = 100;
     MIN_SECRET_NAME_LENGTH = 1;
@@ -6105,13 +6551,13 @@ during 'tuck add' or 'tuck sync' operations.`;
 
 // src/lib/secretBackends/onepassword.ts
 import { execFile as execFile5 } from "child_process";
-import { promisify as promisify6 } from "util";
+import { promisify as promisify5 } from "util";
 var execFileAsync5, OnePasswordBackend;
 var init_onepassword = __esm({
   "src/lib/secretBackends/onepassword.ts"() {
     "use strict";
     init_errors();
-    execFileAsync5 = promisify6(execFile5);
+    execFileAsync5 = promisify5(execFile5);
     OnePasswordBackend = class {
       name = "1password";
       displayName = "1Password";
@@ -6275,13 +6721,13 @@ Path format: op://vault-name/item-name/field-name
 
 // src/lib/secretBackends/bitwarden.ts
 import { execFile as execFile6 } from "child_process";
-import { promisify as promisify7 } from "util";
+import { promisify as promisify6 } from "util";
 var execFileAsync6, BitwardenBackend;
 var init_bitwarden = __esm({
   "src/lib/secretBackends/bitwarden.ts"() {
     "use strict";
     init_errors();
-    execFileAsync6 = promisify7(execFile6);
+    execFileAsync6 = promisify6(execFile6);
     BitwardenBackend = class {
       name = "bitwarden";
       displayName = "Bitwarden";
@@ -6456,7 +6902,7 @@ Examples:
 
 // src/lib/secretBackends/pass.ts
 import { execFile as execFile7 } from "child_process";
-import { promisify as promisify8 } from "util";
+import { promisify as promisify7 } from "util";
 import { access as access2 } from "fs/promises";
 var execFileAsync7, fileExists, PassBackend;
 var init_pass = __esm({
@@ -6464,7 +6910,7 @@ var init_pass = __esm({
     "use strict";
     init_errors();
     init_paths();
-    execFileAsync7 = promisify8(execFile7);
+    execFileAsync7 = promisify7(execFile7);
     fileExists = async (path) => {
       try {
         await access2(path);
@@ -6809,8 +7255,8 @@ var init_secretMappings_schema = __esm({
 });
 
 // src/lib/secretBackends/mappings.ts
-import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
-import { join as join8 } from "path";
+import { readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
+import { join as join9 } from "path";
 var DEFAULT_MAPPINGS_FILENAME, getMappingsPath, loadMappings, saveMappings, getMapping, setMapping, listMappings, getBackendPath;
 var init_mappings = __esm({
   "src/lib/secretBackends/mappings.ts"() {
@@ -6819,7 +7265,7 @@ var init_mappings = __esm({
     init_secretMappings_schema();
     DEFAULT_MAPPINGS_FILENAME = "secrets.mappings.json";
     getMappingsPath = (tuckDir, customPath) => {
-      return join8(tuckDir, customPath || DEFAULT_MAPPINGS_FILENAME);
+      return join9(tuckDir, customPath || DEFAULT_MAPPINGS_FILENAME);
     };
     loadMappings = async (tuckDir, customPath) => {
       const mappingsPath = getMappingsPath(tuckDir, customPath);
@@ -6827,7 +7273,7 @@ var init_mappings = __esm({
         return { ...defaultMappingsFile };
       }
       try {
-        const content = await readFile6(mappingsPath, "utf-8");
+        const content = await readFile7(mappingsPath, "utf-8");
         const parsed = JSON.parse(content);
         return secretMappingsFileSchema.parse(parsed);
       } catch (error) {
@@ -6839,7 +7285,7 @@ var init_mappings = __esm({
     saveMappings = async (tuckDir, mappings, customPath) => {
       const mappingsPath = getMappingsPath(tuckDir, customPath);
       const content = JSON.stringify(mappings, null, 2) + "\n";
-      await writeFile4(mappingsPath, content, "utf-8");
+      await writeFile5(mappingsPath, content, "utf-8");
     };
     getMapping = async (tuckDir, name, customPath) => {
       const mappings = await loadMappings(tuckDir, customPath);
@@ -7147,9 +7593,9 @@ var init_resolver = __esm({
 });
 
 // src/lib/secrets/redactor.ts
-import { readFile as readFile7, writeFile as writeFile5, rename, unlink as unlink2, stat as stat6 } from "fs/promises";
+import { readFile as readFile8, writeFile as writeFile6, rename, unlink as unlink2, stat as stat7 } from "fs/promises";
 import { randomBytes } from "crypto";
-import { dirname as dirname5, basename as basename4, join as join9 } from "path";
+import { dirname as dirname6, basename as basename5, join as join10 } from "path";
 var atomicWriteFile, formatPlaceholder, PLACEHOLDER_REGEX, redactContent, redactFile, restoreContent, findPlaceholders, restoreFiles;
 var init_redactor = __esm({
   "src/lib/secrets/redactor.ts"() {
@@ -7160,20 +7606,20 @@ var init_redactor = __esm({
     init_config();
     atomicWriteFile = async (filepath, content) => {
       const tempSuffix = randomBytes(8).toString("hex");
-      const tempPath = join9(dirname5(filepath), `.${basename4(filepath)}.tmp.${tempSuffix}`);
+      const tempPath = join10(dirname6(filepath), `.${basename5(filepath)}.tmp.${tempSuffix}`);
       try {
         let mode;
         let fileExists2 = false;
         try {
-          const stats = await stat6(filepath);
+          const stats = await stat7(filepath);
           mode = stats.mode;
           fileExists2 = true;
         } catch {
         }
-        if (!fileExists2 && basename4(filepath).startsWith(".")) {
+        if (!fileExists2 && basename5(filepath).startsWith(".")) {
           mode = 384;
         }
-        await writeFile5(tempPath, content, { encoding: "utf-8", mode });
+        await writeFile6(tempPath, content, { encoding: "utf-8", mode });
         await rename(tempPath, filepath);
       } catch (error) {
         try {
@@ -7211,7 +7657,7 @@ var init_redactor = __esm({
     };
     redactFile = async (filepath, matches, placeholderMap) => {
       const expandedPath = expandPath(filepath);
-      const content = await readFile7(expandedPath, "utf-8");
+      const content = await readFile8(expandedPath, "utf-8");
       const result = redactContent(content, matches, placeholderMap);
       await atomicWriteFile(expandedPath, result.redactedContent);
       return result;
@@ -7260,7 +7706,7 @@ var init_redactor = __esm({
         if (!await pathExists(expandedPath)) {
           continue;
         }
-        const content = await readFile7(expandedPath, "utf-8");
+        const content = await readFile8(expandedPath, "utf-8");
         const result = restoreContent(content, secrets);
         if (result.restored > 0) {
           await atomicWriteFile(expandedPath, result.restoredContent);
@@ -7282,7 +7728,7 @@ var init_redactor = __esm({
 
 // src/lib/secrets/external.ts
 import { execFile as execFile8 } from "child_process";
-import { promisify as promisify9 } from "util";
+import { promisify as promisify8 } from "util";
 import { z as z5 } from "zod";
 var execFileAsync8, gitleaksResultSchema, gitleaksOutputSchema, isGitleaksInstalled, isTrufflehogInstalled, mapGitleaksSeverity, generatePlaceholderFromRule, GITLEAKS_FAILED, scanWithGitleaks, scanWithScanner;
 var init_external = __esm({
@@ -7290,7 +7736,7 @@ var init_external = __esm({
     "use strict";
     init_scanner();
     init_paths();
-    execFileAsync8 = promisify9(execFile8);
+    execFileAsync8 = promisify8(execFile8);
     gitleaksResultSchema = z5.object({
       Description: z5.string(),
       StartLine: z5.number(),
@@ -7600,52 +8046,495 @@ var init_secrets = __esm({
   }
 });
 
-// src/commands/restore.ts
-var restore_exports = {};
-__export(restore_exports, {
-  restoreCommand: () => restoreCommand,
-  runRestore: () => runRestore
-});
-import { Command } from "commander";
-import { join as join10 } from "path";
-import { chmod as chmod2, stat as stat7 } from "fs/promises";
-var fixSSHPermissions, fixGPGPermissions, prepareFilesToRestore, restoreFilesInternal, runInteractiveRestore, displaySecretSummary, runRestore, runRestoreCommand, restoreCommand;
-var init_restore = __esm({
-  "src/commands/restore.ts"() {
+// src/lib/trackPipeline.ts
+import { basename as basename6 } from "path";
+var PRIVATE_KEY_PATTERNS2, SENSITIVE_FILE_PATTERNS2, isPrivateKey, isSensitiveFile2, displaySecretWarning, handleFileSizePolicy, applySecretPolicy, preparePathsForTracking;
+var init_trackPipeline = __esm({
+  "src/lib/trackPipeline.ts"() {
     "use strict";
-    init_theme();
     init_ui();
     init_paths();
     init_manifest();
-    init_config();
     init_files();
-    init_backup();
-    init_hooks();
+    init_binary();
+    init_tuckignore();
     init_errors();
-    init_constants();
+    init_audit();
     init_secrets();
-    fixSSHPermissions = async (path) => {
-      const expandedPath = expandPath(path);
-      if (!path.includes(".ssh/") && !path.endsWith(".ssh")) {
-        return;
+    PRIVATE_KEY_PATTERNS2 = [
+      /^id_rsa$/,
+      /^id_dsa$/,
+      /^id_ecdsa$/,
+      /^id_ed25519$/,
+      /^id_.*$/,
+      /\.pem$/,
+      /\.key$/,
+      /^.*_key$/
+    ];
+    SENSITIVE_FILE_PATTERNS2 = [
+      /^\.netrc$/,
+      /^\.aws\/credentials$/,
+      /^\.docker\/config\.json$/,
+      /^\.npmrc$/,
+      /^\.pypirc$/,
+      /^\.kube\/config$/,
+      /^\.ssh\/config$/,
+      /^\.gnupg\//,
+      /credentials/i,
+      /secrets?/i,
+      /tokens?\.json$/i,
+      /\.env$/,
+      /\.env\./
+    ];
+    isPrivateKey = (collapsedPath) => {
+      const name = basename6(collapsedPath);
+      if (collapsedPath.includes(".ssh/") && !name.endsWith(".pub")) {
+        return PRIVATE_KEY_PATTERNS2.some((pattern) => pattern.test(name));
       }
-      try {
-        const stats = await stat7(expandedPath);
-        if (stats.isDirectory()) {
-          await chmod2(expandedPath, 448);
-        } else {
-          await chmod2(expandedPath, 384);
+      return name.endsWith(".pem") || name.endsWith(".key");
+    };
+    isSensitiveFile2 = (collapsedPath) => {
+      const pathToTest = collapsedPath.startsWith("~/") ? collapsedPath.slice(2) : collapsedPath;
+      return SENSITIVE_FILE_PATTERNS2.some((pattern) => pattern.test(pathToTest));
+    };
+    displaySecretWarning = (summary) => {
+      console.log();
+      console.log(colors.error(colors.bold(`  Security Warning: Found ${summary.totalSecrets} potential secret(s)`)));
+      console.log();
+      for (const result of summary.results) {
+        console.log(`  ${colors.brand(result.collapsedPath)}`);
+        for (const match of result.matches) {
+          const severityColor = match.severity === "critical" ? colors.error : match.severity === "high" ? colors.warning : match.severity === "medium" ? colors.info : colors.muted;
+          console.log(
+            `    ${colors.muted(`Line ${match.line}:`)} ${match.redactedValue} ${severityColor(`[${match.severity}]`)}`
+          );
         }
-      } catch {
+        console.log();
       }
     };
-    fixGPGPermissions = async (path) => {
-      const expandedPath = expandPath(path);
-      if (!path.includes(".gnupg/") && !path.endsWith(".gnupg")) {
-        return;
+    handleFileSizePolicy = async (collapsedPath, sizeBytes, tuckDir, secretHandling) => {
+      const sizeLabel = formatFileSize(sizeBytes);
+      const isWarn = sizeBytes >= 50 * 1024 * 1024;
+      const isBlock = sizeBytes >= 100 * 1024 * 1024;
+      if (!isWarn && !isBlock) {
+        return true;
       }
-      try {
-        const stats = await stat7(expandedPath);
+      if (secretHandling === "strict") {
+        if (isBlock) {
+          throw new OperationCancelledError("file size exceeds GitHub limit");
+        }
+        logger.warning(`File ${collapsedPath} is ${sizeLabel}. GitHub recommends files under 50MB.`);
+        return true;
+      }
+      if (isBlock) {
+        logger.warning(`File ${collapsedPath} is ${sizeLabel} (exceeds GitHub's 100MB limit)`);
+        const action2 = await prompts.select("How would you like to proceed?", [
+          { value: "ignore", label: "Add to .tuckignore and skip" },
+          { value: "cancel", label: "Cancel operation" }
+        ]);
+        if (action2 === "ignore") {
+          await addToTuckignore(tuckDir, collapsedPath);
+          logger.success(`Added ${collapsedPath} to .tuckignore`);
+          return false;
+        }
+        throw new OperationCancelledError("file size exceeds GitHub limit");
+      }
+      logger.warning(`File ${collapsedPath} is ${sizeLabel}. GitHub recommends files under 50MB.`);
+      const action = await prompts.select("How would you like to proceed?", [
+        { value: "continue", label: "Track it anyway" },
+        { value: "ignore", label: "Add to .tuckignore and skip" },
+        { value: "cancel", label: "Cancel operation" }
+      ]);
+      if (action === "ignore") {
+        await addToTuckignore(tuckDir, collapsedPath);
+        logger.success(`Added ${collapsedPath} to .tuckignore`);
+        return false;
+      }
+      if (action === "cancel") {
+        throw new OperationCancelledError("file size warning");
+      }
+      return true;
+    };
+    applySecretPolicy = async (files, tuckDir, options) => {
+      if (files.length === 0) {
+        return files;
+      }
+      if (!await isSecretScanningEnabled(tuckDir)) {
+        return files;
+      }
+      const secretHandling = options.secretHandling ?? "interactive";
+      if (options.force) {
+        if (secretHandling === "interactive") {
+          const confirmed2 = await prompts.confirmDangerous(
+            "Using --force bypasses secret scanning.\nAny secrets in these files may be committed to git and potentially exposed.",
+            "force"
+          );
+          if (!confirmed2) {
+            logger.info("Operation cancelled");
+            return [];
+          }
+        }
+        logger.warning("Secret scanning bypassed with --force");
+        await logForceSecretBypass(options.forceBypassCommand ?? "tuck add --force", files.length);
+        return files;
+      }
+      const filePaths = files.map((f) => expandPath(f.source));
+      const summary = await scanForSecrets(filePaths, tuckDir);
+      if (summary.filesWithSecrets === 0) {
+        return files;
+      }
+      if (secretHandling === "strict") {
+        const shouldBlock = await shouldBlockOnSecrets(tuckDir);
+        if (shouldBlock) {
+          const filesWithSecrets = summary.results.filter((result) => result.hasSecrets).map((result) => collapsePath(result.path));
+          throw new SecretsDetectedError(summary.totalSecrets, filesWithSecrets);
+        }
+        logger.warning("Secrets detected but blockOnSecrets is disabled - proceeding with tracking");
+        logger.warning("Make sure your repository is private!");
+        return files;
+      }
+      displaySecretWarning(summary);
+      const action = await prompts.select("How would you like to proceed?", [
+        { value: "abort", label: "Abort operation", hint: "Do not track these files" },
+        {
+          value: "redact",
+          label: "Replace with placeholders",
+          hint: "Store originals in secrets.local.json (never committed)"
+        },
+        { value: "ignore", label: "Add files to .tuckignore", hint: "Skip these files permanently" },
+        { value: "proceed", label: "Proceed anyway", hint: "Track files with secrets (dangerous!)" }
+      ]);
+      if (action === "abort") {
+        logger.info("Operation aborted");
+        return [];
+      }
+      if (action === "redact") {
+        const redactionMaps = await processSecretsForRedaction(summary.results, tuckDir);
+        let totalRedacted = 0;
+        for (const result of summary.results) {
+          const placeholderMap = redactionMaps.get(result.path);
+          if (placeholderMap && placeholderMap.size > 0) {
+            const redactionResult = await redactFile(result.path, result.matches, placeholderMap);
+            totalRedacted += redactionResult.replacements.length;
+          }
+        }
+        console.log();
+        logger.success(`Replaced ${totalRedacted} secret(s) with placeholders`);
+        logger.dim(`Secrets stored in: ${collapsePath(getSecretsPath(tuckDir))} (never committed)`);
+        logger.dim("Run 'tuck secrets list' to see stored secrets");
+        console.log();
+        return files;
+      }
+      if (action === "ignore") {
+        const filesWithSecrets = new Set(summary.results.map((result) => result.collapsedPath));
+        for (const file of files) {
+          const normalizedSource = collapsePath(file.source);
+          if (filesWithSecrets.has(normalizedSource)) {
+            await addToTuckignore(tuckDir, file.source);
+            logger.success(`Added ${normalizedSource} to .tuckignore`);
+          }
+        }
+        const remaining = files.filter((file) => !filesWithSecrets.has(collapsePath(file.source)));
+        if (remaining.length === 0) {
+          logger.info("No files remaining to track");
+        }
+        return remaining;
+      }
+      const confirmed = await prompts.confirm(
+        colors.error("Are you SURE you want to track files containing secrets?"),
+        false
+      );
+      if (!confirmed) {
+        logger.info("Operation aborted");
+        return [];
+      }
+      logger.warning("Proceeding with secrets - be careful not to push to a public repository!");
+      return files;
+    };
+    preparePathsForTracking = async (candidates, tuckDir, options = {}) => {
+      const secretHandling = options.secretHandling ?? "interactive";
+      const prepared = [];
+      for (const candidate of candidates) {
+        const expandedPath = expandPath(candidate.path);
+        const collapsedPath = collapsePath(expandedPath);
+        validateSafeSourcePath(collapsedPath);
+        if (isPrivateKey(collapsedPath)) {
+          throw new PrivateKeyError(candidate.path);
+        }
+        if (!await pathExists(expandedPath)) {
+          throw new FileNotFoundError(candidate.path);
+        }
+        if (!options.allowAlreadyTracked && await isFileTracked(tuckDir, collapsedPath)) {
+          throw new FileAlreadyTrackedError(candidate.path);
+        }
+        if (await isIgnored(tuckDir, collapsedPath)) {
+          logger.info(`Skipping ${collapsedPath} (in .tuckignore)`);
+          continue;
+        }
+        if (await shouldExcludeFromBin(expandedPath)) {
+          const sizeCheck2 = await checkFileSizeThreshold(expandedPath);
+          logger.info(
+            `Skipping binary executable: ${collapsedPath}${sizeCheck2.size > 0 ? ` (${formatFileSize(sizeCheck2.size)})` : ""} - Add to .tuckignore to customize`
+          );
+          continue;
+        }
+        const sizeCheck = await checkFileSizeThreshold(expandedPath);
+        const shouldTrack = await handleFileSizePolicy(
+          collapsedPath,
+          sizeCheck.size,
+          tuckDir,
+          secretHandling
+        );
+        if (!shouldTrack) {
+          continue;
+        }
+        const isDir = await isDirectory(expandedPath);
+        const fileCount = isDir ? await getDirectoryFileCount(expandedPath) : 1;
+        const category = candidate.category || options.category || detectCategory(expandedPath);
+        const customName = candidate.name ?? options.name;
+        const nameOverride = customName ? sanitizeFilename(customName) : void 0;
+        const filename = nameOverride || sanitizeFilename(expandedPath);
+        prepared.push({
+          source: collapsedPath,
+          destination: getDestinationPathFromSource(tuckDir, category, expandedPath, nameOverride),
+          category,
+          filename,
+          nameOverride,
+          isDir,
+          fileCount,
+          sensitive: isSensitiveFile2(collapsedPath)
+        });
+      }
+      return applySecretPolicy(prepared, tuckDir, options);
+    };
+  }
+});
+
+// src/lib/backup.ts
+import { join as join11 } from "path";
+import { copy as copy2, ensureDir as ensureDir4, pathExists as pathExists2 } from "fs-extra";
+var getBackupDir, formatDateForBackup, getTimestampedBackupDir, createBackup;
+var init_backup = __esm({
+  "src/lib/backup.ts"() {
+    "use strict";
+    init_constants();
+    init_paths();
+    init_platform();
+    init_config();
+    init_errors();
+    getBackupDir = async (customBackupDir, tuckDir) => {
+      if (customBackupDir) {
+        const resolved = expandPath(customBackupDir);
+        if (!isPathWithinHome(resolved)) {
+          throw new BackupError(
+            `Unsafe backup directory: ${customBackupDir} - backup directory must be within home directory`
+          );
+        }
+        return resolved;
+      }
+      try {
+        const config = await loadConfig(tuckDir);
+        const backupDir = config.files.backupDir || BACKUP_DIR;
+        const resolved = expandPath(backupDir);
+        if (!isPathWithinHome(resolved)) {
+          throw new BackupError(
+            `Unsafe backup directory: ${backupDir} - backup directory must be within home directory`
+          );
+        }
+        return resolved;
+      } catch (error) {
+        if (error instanceof BackupError) {
+          throw error;
+        }
+        return expandPath(BACKUP_DIR);
+      }
+    };
+    formatDateForBackup = (date) => {
+      return date.toISOString().slice(0, 10);
+    };
+    getTimestampedBackupDir = (date, backupRoot) => {
+      const timestamp = formatDateForBackup(date);
+      return join11(backupRoot, timestamp);
+    };
+    createBackup = async (sourcePath, customBackupDir, tuckDir) => {
+      const expandedSource = expandPath(sourcePath);
+      const date = /* @__PURE__ */ new Date();
+      if (!await pathExists(expandedSource)) {
+        throw new Error(`Source path does not exist: ${sourcePath}`);
+      }
+      const backupRoot = await getBackupDir(customBackupDir, tuckDir);
+      const datedBackupDir = getTimestampedBackupDir(date, backupRoot);
+      await ensureDir4(datedBackupDir);
+      const collapsed = toPosixPath(collapsePath(expandedSource));
+      const backupName = collapsed.replace(/^~\//, "").replace(/\//g, "_").replace(/^\./, "dot-");
+      const timestamp = date.toISOString().replace(/[:.]/g, "-").slice(11, 19);
+      const backupPath = join11(datedBackupDir, `${backupName}_${timestamp}`);
+      await copy2(expandedSource, backupPath, { overwrite: true });
+      return {
+        originalPath: expandedSource,
+        backupPath,
+        date
+      };
+    };
+  }
+});
+
+// src/lib/hooks.ts
+import { exec, execSync } from "child_process";
+import { promisify as promisify9 } from "util";
+import chalk4 from "chalk";
+var execAsync, getWindowsShell, runHook, runPreSyncHook, runPostSyncHook, runPreRestoreHook, runPostRestoreHook;
+var init_hooks = __esm({
+  "src/lib/hooks.ts"() {
+    "use strict";
+    init_config();
+    init_logger();
+    init_prompts();
+    init_platform();
+    execAsync = promisify9(exec);
+    getWindowsShell = () => {
+      try {
+        execSync("pwsh -Version", { stdio: "ignore" });
+        return "pwsh";
+      } catch {
+      }
+      try {
+        execSync("powershell.exe -Version", { stdio: "ignore" });
+        return "powershell.exe";
+      } catch {
+      }
+      return "cmd.exe";
+    };
+    runHook = async (hookType, tuckDir, options) => {
+      if (options?.skipHooks) {
+        return { success: true, skipped: true };
+      }
+      const config = await loadConfig(tuckDir);
+      const command = config.hooks[hookType];
+      if (!command) {
+        return { success: true };
+      }
+      if (!options?.trustHooks) {
+        console.log();
+        console.log(chalk4.yellow.bold("WARNING: Hook Execution"));
+        console.log(chalk4.dim("\u2500".repeat(50)));
+        console.log(chalk4.white(`Hook type: ${chalk4.cyan(hookType)}`));
+        console.log(chalk4.white("Command:"));
+        console.log(chalk4.red(`  ${command}`));
+        console.log(chalk4.dim("\u2500".repeat(50)));
+        console.log(
+          chalk4.yellow(
+            "SECURITY: Hooks can execute arbitrary commands on your system."
+          )
+        );
+        console.log(
+          chalk4.yellow(
+            "Only proceed if you trust the source of this configuration."
+          )
+        );
+        console.log();
+        const confirmed = await prompts.confirm(
+          "Execute this hook?",
+          false
+          // Default to NO for safety
+        );
+        if (!confirmed) {
+          logger.warning(`Hook ${hookType} skipped by user`);
+          return { success: true, skipped: true };
+        }
+      }
+      if (!options?.silent) {
+        logger.dim(`Running ${hookType} hook...`);
+      }
+      try {
+        const shellOptions = IS_WINDOWS ? { shell: getWindowsShell() } : {};
+        const { stdout, stderr } = await execAsync(command, {
+          cwd: tuckDir,
+          timeout: 3e4,
+          // 30 second timeout
+          env: {
+            ...process.env,
+            TUCK_DIR: tuckDir,
+            TUCK_HOOK: hookType
+          },
+          ...shellOptions
+        });
+        if (stdout && !options?.silent) {
+          logger.dim(stdout.trim());
+        }
+        if (stderr && !options?.silent) {
+          logger.warning(stderr.trim());
+        }
+        return { success: true, output: stdout };
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        if (!options?.silent) {
+          logger.error(`Hook ${hookType} failed: ${errorMessage}`);
+        }
+        return { success: false, error: errorMessage };
+      }
+    };
+    runPreSyncHook = async (tuckDir, options) => {
+      return runHook("preSync", tuckDir, options);
+    };
+    runPostSyncHook = async (tuckDir, options) => {
+      return runHook("postSync", tuckDir, options);
+    };
+    runPreRestoreHook = async (tuckDir, options) => {
+      return runHook("preRestore", tuckDir, options);
+    };
+    runPostRestoreHook = async (tuckDir, options) => {
+      return runHook("postRestore", tuckDir, options);
+    };
+  }
+});
+
+// src/commands/restore.ts
+var restore_exports = {};
+__export(restore_exports, {
+  restoreCommand: () => restoreCommand,
+  runRestore: () => runRestore
+});
+import { Command } from "commander";
+import { join as join12 } from "path";
+import { chmod as chmod2, stat as stat8 } from "fs/promises";
+var fixSSHPermissions, fixGPGPermissions, prepareFilesToRestore, restoreFilesInternal, runInteractiveRestore, displaySecretSummary, runRestore, runRestoreCommand, restoreCommand;
+var init_restore = __esm({
+  "src/commands/restore.ts"() {
+    "use strict";
+    init_theme();
+    init_ui();
+    init_paths();
+    init_manifest();
+    init_config();
+    init_files();
+    init_backup();
+    init_hooks();
+    init_errors();
+    init_constants();
+    init_secrets();
+    fixSSHPermissions = async (path) => {
+      const expandedPath = expandPath(path);
+      if (!path.includes(".ssh/") && !path.endsWith(".ssh")) {
+        return;
+      }
+      try {
+        const stats = await stat8(expandedPath);
+        if (stats.isDirectory()) {
+          await chmod2(expandedPath, 448);
+        } else {
+          await chmod2(expandedPath, 384);
+        }
+      } catch {
+      }
+    };
+    fixGPGPermissions = async (path) => {
+      const expandedPath = expandPath(path);
+      if (!path.includes(".gnupg/") && !path.endsWith(".gnupg")) {
+        return;
+      }
+      try {
+        const stats = await stat8(expandedPath);
         if (stats.isDirectory()) {
           await chmod2(expandedPath, 448);
         } else {
@@ -7665,21 +8554,29 @@ var init_restore = __esm({
           if (!tracked) {
             throw new FileNotFoundError(`Not tracked: ${path}`);
           }
+          validateSafeSourcePath(tracked.file.source);
+          validateSafeManifestDestination(tracked.file.destination);
+          const repositoryPath = join12(tuckDir, tracked.file.destination);
+          validatePathWithinRoot(repositoryPath, tuckDir, "restore source");
           filesToRestore.push({
             id: tracked.id,
             source: tracked.file.source,
-            destination: join10(tuckDir, tracked.file.destination),
+            destination: repositoryPath,
             category: tracked.file.category,
             existsAtTarget: await pathExists(expandedPath)
           });
         }
       } else {
         for (const [id, file] of Object.entries(allFiles)) {
+          validateSafeSourcePath(file.source);
+          validateSafeManifestDestination(file.destination);
+          const repositoryPath = join12(tuckDir, file.destination);
+          validatePathWithinRoot(repositoryPath, tuckDir, "restore source");
           const targetPath = expandPath(file.source);
           filesToRestore.push({
             id,
             source: file.source,
-            destination: join10(tuckDir, file.destination),
+            destination: repositoryPath,
             category: file.category,
             existsAtTarget: await pathExists(targetPath)
           });
@@ -7699,6 +8596,8 @@ var init_restore = __esm({
       let restoredCount = 0;
       const restoredPaths = [];
       for (const file of files) {
+        validateSafeSourcePath(file.source);
+        validatePathWithinRoot(file.destination, tuckDir, "restore source");
         const targetPath = expandPath(file.source);
         if (!await pathExists(file.destination)) {
           logger.warning(`Source not found in repository: ${file.source}`);
@@ -7714,7 +8613,7 @@ var init_restore = __esm({
         }
         if (shouldBackup && file.existsAtTarget) {
           await withSpinner(`Backing up ${file.source}...`, async () => {
-            await createBackup(targetPath);
+            await createBackup(targetPath, config.files.backupDir, tuckDir);
           });
         }
         await withSpinner(`Restoring ${file.source}...`, async () => {
@@ -7866,135 +8765,22 @@ var init_restore = __esm({
         return;
       }
       if (options.dryRun) {
-        logger.heading("Dry run - would restore:");
-      } else {
-        logger.heading("Restoring:");
-      }
-      const result = await restoreFilesInternal(tuckDir, files, options);
-      logger.blank();
-      if (options.dryRun) {
-        logger.info(`Would restore ${files.length} file${files.length > 1 ? "s" : ""}`);
-      } else {
-        displaySecretSummary(result);
-        logger.success(`Restored ${result.restoredCount} file${result.restoredCount !== 1 ? "s" : ""}`);
-      }
-    };
-    restoreCommand = new Command("restore").description("Restore dotfiles to the system").argument("[paths...]", "Paths to restore (or use --all)").option("-a, --all", "Restore all tracked files").option("--symlink", "Create symlinks instead of copies").option("--backup", "Backup existing files before restore").option("--no-backup", "Skip backup of existing files").option("--dry-run", "Show what would be done").option("--no-hooks", "Skip execution of pre/post restore hooks").option("--trust-hooks", "Trust and run hooks without confirmation (use with caution)").option("--no-secrets", "Skip restoring secrets (keep placeholders as-is)").action(async (paths, options) => {
-      await runRestoreCommand(paths, options);
-    });
-  }
-});
-
-// src/lib/tuckignore.ts
-import { join as join12 } from "path";
-import { readFile as readFile9, writeFile as writeFile7, appendFile } from "fs/promises";
-var TUCKIGNORE_FILENAME, TUCKIGNORE_HEADER, getTuckignorePath, loadTuckignore, addToTuckignore, isIgnored;
-var init_tuckignore = __esm({
-  "src/lib/tuckignore.ts"() {
-    "use strict";
-    init_paths();
-    TUCKIGNORE_FILENAME = ".tuckignore";
-    TUCKIGNORE_HEADER = `# .tuckignore - Files to exclude from tracking
-# One exact file path per line (no globs)
-# Lines starting with # are comments
-#
-# Example:
-# ~/bin/large-binary
-# ~/.docker/config.json
-`;
-    getTuckignorePath = (tuckDir) => {
-      return join12(tuckDir, TUCKIGNORE_FILENAME);
-    };
-    loadTuckignore = async (tuckDir) => {
-      const ignorePath = getTuckignorePath(tuckDir);
-      const ignoredPaths = /* @__PURE__ */ new Set();
-      if (!await pathExists(ignorePath)) {
-        return ignoredPaths;
-      }
-      try {
-        const content = await readFile9(ignorePath, "utf-8");
-        const lines = content.split("\n");
-        for (const line of lines) {
-          const trimmed = line.trim();
-          if (!trimmed || trimmed.startsWith("#")) {
-            continue;
-          }
-          const expanded = expandPath(trimmed);
-          const collapsed = collapsePath(expanded);
-          ignoredPaths.add(collapsed);
-        }
-      } catch {
-      }
-      return ignoredPaths;
-    };
-    addToTuckignore = async (tuckDir, path) => {
-      const ignorePath = getTuckignorePath(tuckDir);
-      const expanded = expandPath(path);
-      const collapsed = collapsePath(expanded);
-      const existingPaths = await loadTuckignore(tuckDir);
-      if (existingPaths.has(collapsed)) {
-        return;
-      }
-      if (!await pathExists(ignorePath)) {
-        await writeFile7(ignorePath, TUCKIGNORE_HEADER + "\n", "utf-8");
-      }
-      await appendFile(ignorePath, collapsed + "\n", "utf-8");
-    };
-    isIgnored = async (tuckDir, path) => {
-      const ignoredPaths = await loadTuckignore(tuckDir);
-      const expanded = expandPath(path);
-      const collapsed = collapsePath(expanded);
-      return ignoredPaths.has(collapsed);
-    };
-  }
-});
-
-// src/lib/audit.ts
-import { appendFile as appendFile2, mkdir } from "fs/promises";
-import { join as join13 } from "path";
-import { homedir as homedir4 } from "os";
-import { existsSync } from "fs";
-function getAuditLogPath() {
-  return join13(homedir4(), ".tuck", AUDIT_FILENAME);
-}
-async function logAuditEntry(action, command, details) {
-  try {
-    const tuckDir = join13(homedir4(), ".tuck");
-    if (!existsSync(tuckDir)) {
-      await mkdir(tuckDir, { recursive: true });
-    }
-    const entry = {
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      action,
-      command,
-      details,
-      user: process.env.USER || process.env.USERNAME,
-      cwd: process.cwd()
-    };
-    const logLine = JSON.stringify(entry) + "\n";
-    const logPath = getAuditLogPath();
-    await appendFile2(logPath, logLine, "utf-8");
-  } catch {
-    if (process.env.DEBUG) {
-      console.error("[DEBUG] Failed to write audit log");
-    }
-  }
-}
-async function logForceSecretBypass(command, filesCount) {
-  await logAuditEntry(
-    "FORCE_SECRET_BYPASS",
-    command,
-    `Bypassed secret scanning for ${filesCount} file(s)`
-  );
-}
-async function logForcePush(branch) {
-  await logAuditEntry("FORCE_PUSH", "tuck push --force", `Force pushed to branch: ${branch}`);
-}
-var AUDIT_FILENAME;
-var init_audit = __esm({
-  "src/lib/audit.ts"() {
-    "use strict";
-    AUDIT_FILENAME = "audit.log";
+        logger.heading("Dry run - would restore:");
+      } else {
+        logger.heading("Restoring:");
+      }
+      const result = await restoreFilesInternal(tuckDir, files, options);
+      logger.blank();
+      if (options.dryRun) {
+        logger.info(`Would restore ${files.length} file${files.length > 1 ? "s" : ""}`);
+      } else {
+        displaySecretSummary(result);
+        logger.success(`Restored ${result.restoredCount} file${result.restoredCount !== 1 ? "s" : ""}`);
+      }
+    };
+    restoreCommand = new Command("restore").description("Restore dotfiles to the system").argument("[paths...]", "Paths to restore (or use --all)").option("-a, --all", "Restore all tracked files").option("--symlink", "Create symlinks from source paths to tuck repo files").option("--backup", "Backup existing files before restore").option("--no-backup", "Skip backup of existing files").option("--dry-run", "Show what would be done").option("--no-hooks", "Skip execution of pre/post restore hooks").option("--trust-hooks", "Trust and run hooks without confirmation (use with caution)").option("--no-secrets", "Skip restoring secrets (keep placeholders as-is)").action(async (paths, options) => {
+      await runRestoreCommand(paths, options);
+    });
   }
 });
 
@@ -8587,11 +9373,13 @@ var init_secrets2 = __esm({
 var sync_exports = {};
 __export(sync_exports, {
   runSync: () => runSync,
+  runSyncCommand: () => runSyncCommand,
   syncCommand: () => syncCommand
 });
 import { Command as Command4 } from "commander";
-import { join as join14, basename as basename6 } from "path";
-var detectChanges, pullIfBehind, detectNewDotfiles, generateCommitMessage, syncFiles, scanAndHandleSecrets, runInteractiveSync, pushWithSpinner, runSync, runSyncCommand, syncCommand;
+import { join as join14, basename as basename7 } from "path";
+import { realpath } from "fs/promises";
+var pathsResolveToSameLocation, detectChanges, pullIfBehind, detectNewDotfiles, generateCommitMessage, syncFiles, scanAndHandleSecrets, runInteractiveSync, pushWithSpinner, runSync, runSyncCommand, syncCommand;
 var init_sync = __esm({
   "src/commands/sync.ts"() {
     "use strict";
@@ -8605,14 +9393,28 @@ var init_sync = __esm({
     init_errors();
     init_detect();
     init_fileTracking();
+    init_trackPipeline();
     init_secrets();
     init_secrets2();
     init_audit();
+    pathsResolveToSameLocation = async (sourcePath, destinationPath) => {
+      try {
+        const [resolvedSource, resolvedDestination] = await Promise.all([
+          realpath(sourcePath),
+          realpath(destinationPath)
+        ]);
+        return resolvedSource === resolvedDestination;
+      } catch {
+        return false;
+      }
+    };
     detectChanges = async (tuckDir) => {
       const files = await getAllTrackedFiles(tuckDir);
       const ignoredPaths = await loadTuckignore(tuckDir);
       const changes = [];
       for (const [, file] of Object.entries(files)) {
+        validateSafeSourcePath(file.source);
+        validateSafeManifestDestination(file.destination);
         if (ignoredPaths.has(file.source)) {
           continue;
         }
@@ -8731,11 +9533,19 @@ var init_sync = __esm({
       };
       await runPreSyncHook(tuckDir, hookOptions);
       for (const change of changes) {
+        validateSafeSourcePath(change.source);
+        if (!change.destination) {
+          throw new Error(`Unsafe manifest entry detected: missing destination for ${change.source}`);
+        }
+        validateSafeManifestDestination(change.destination);
         const sourcePath = expandPath(change.source);
         const destPath = join14(tuckDir, change.destination);
+        validatePathWithinRoot(destPath, tuckDir, "sync destination");
         if (change.status === "modified") {
           await withSpinner(`Syncing ${change.path}...`, async () => {
-            await copyFileOrDir(sourcePath, destPath, { overwrite: true });
+            if (!await pathsResolveToSameLocation(sourcePath, destPath)) {
+              await copyFileOrDir(sourcePath, destPath, { overwrite: true });
+            }
             const newChecksum = await getFileChecksum(destPath);
             const files = await getAllTrackedFiles(tuckDir);
             const fileId = Object.entries(files).find(([, f]) => f.source === change.source)?.[0];
@@ -8746,7 +9556,7 @@ var init_sync = __esm({
               });
             }
           });
-          result.modified.push(basename6(change.path) || change.path);
+          result.modified.push(basename7(change.path) || change.path);
         } else if (change.status === "deleted") {
           await withSpinner(`Removing ${change.path}...`, async () => {
             await deleteFileOrDir(destPath);
@@ -8756,7 +9566,7 @@ var init_sync = __esm({
               await removeFileFromManifest(tuckDir, fileId);
             }
           });
-          result.deleted.push(basename6(change.path) || change.path);
+          result.deleted.push(basename7(change.path) || change.path);
         }
       }
       if (!options.noCommit && (result.modified.length > 0 || result.deleted.length > 0)) {
@@ -8923,6 +9733,7 @@ var init_sync = __esm({
           }
         }
       }
+      let filesToTrackCandidates = [];
       let filesToTrack = [];
       if (newFiles.length > 0) {
         console.log();
@@ -8956,7 +9767,13 @@ var init_sync = __esm({
           const selected = await prompts.multiselect("Select files to track:", selectOptions, {
             initialValues
           });
-          filesToTrack = selected.map((path) => ({ path }));
+          filesToTrackCandidates = selected.map((path) => {
+            const matched = newFiles.find((file) => file.path === path);
+            return {
+              path,
+              category: matched?.category
+            };
+          });
         }
       }
       const largeFiles = [];
@@ -8999,7 +9816,7 @@ var init_sync = __esm({
               }
             }
             prompts.log.success("Added large files to .tuckignore");
-            if (changes.length === 0 && filesToTrack.length === 0) {
+            if (changes.length === 0 && filesToTrackCandidates.length === 0) {
               prompts.log.info("No changes remaining to sync");
               return;
             }
@@ -9023,7 +9840,7 @@ var init_sync = __esm({
               }
             }
             prompts.log.success("Added large files to .tuckignore");
-            if (changes.length === 0 && filesToTrack.length === 0) {
+            if (changes.length === 0 && filesToTrackCandidates.length === 0) {
               prompts.log.info("No changes remaining to sync");
               return;
             }
@@ -9033,6 +9850,19 @@ var init_sync = __esm({
           }
         }
       }
+      if (filesToTrackCandidates.length > 0) {
+        const prepared = await preparePathsForTracking(filesToTrackCandidates, tuckDir, {
+          secretHandling: "interactive"
+        });
+        filesToTrack = prepared.map((file) => ({
+          path: file.source,
+          category: file.category
+        }));
+      }
+      if (changes.length === 0 && filesToTrack.length === 0 && filesToTrackCandidates.length > 0) {
+        prompts.log.info("No changes remaining to sync");
+        return;
+      }
       if (filesToTrack.length > 0) {
         console.log();
         await trackFilesWithProgress(filesToTrack, tuckDir, {
@@ -9173,7 +10003,7 @@ var init_sync = __esm({
 });
 
 // src/index.ts
-import { Command as Command17 } from "commander";
+import { Command as Command18 } from "commander";
 import chalk6 from "chalk";
 
 // src/commands/init.ts
@@ -9183,8 +10013,8 @@ init_config();
 init_manifest();
 init_git();
 import { Command as Command2 } from "commander";
-import { join as join11 } from "path";
-import { writeFile as writeFile6 } from "fs/promises";
+import { join as join13 } from "path";
+import { writeFile as writeFile7 } from "fs/promises";
 import { ensureDir as ensureDir5 } from "fs-extra";
 
 // src/lib/providerSetup.ts
@@ -9774,11 +10604,11 @@ For SSH URLs (git@...):
 
 For HTTPS URLs:
 1. Create a personal access token on your hosting service
-2. Configure git credential helper:
-   git config --global credential.helper store
-3. On first push, enter your token as password
-
-Or use git credential manager for more secure storage.`;
+2. Configure a secure git credential helper:
+   - macOS: git config --global credential.helper osxkeychain
+   - Linux: git config --global credential.helper libsecret
+   - Windows: git config --global credential.helper manager-core
+3. On first push, enter your token as password`;
   }
   // -------------------------------------------------------------------------
   // Private Helpers
@@ -10221,10 +11051,11 @@ init_errors();
 init_constants();
 init_config_schema();
 init_fileTracking();
+init_trackPipeline();
 init_validation();
 import { copy as copy3 } from "fs-extra";
 import { tmpdir } from "os";
-import { readFile as readFile8, rm as rm2 } from "fs/promises";
+import { readFile as readFile9, rm as rm2 } from "fs/promises";
 var GITIGNORE_TEMPLATE = `# OS generated files
 .DS_Store
 .DS_Store?
@@ -10244,8 +11075,19 @@ Thumbs.db
 # .env.local
 `;
 var trackFilesWithProgressInit = async (selectedPaths, tuckDir) => {
-  const filesToTrack = selectedPaths.map((path) => ({
-    path
+  const prepared = await preparePathsForTracking(
+    selectedPaths.map((path) => ({ path })),
+    tuckDir,
+    {
+      secretHandling: "interactive"
+    }
+  );
+  if (prepared.length === 0) {
+    return 0;
+  }
+  const filesToTrack = prepared.map((file) => ({
+    path: file.source,
+    category: file.category
   }));
   const result = await trackFilesWithProgress(filesToTrack, tuckDir, {
     showCategory: true,
@@ -10336,13 +11178,13 @@ var createDirectoryStructure = async (tuckDir) => {
   }
 };
 var createDefaultFiles = async (tuckDir, machine) => {
-  const gitignorePath = join11(tuckDir, ".gitignore");
+  const gitignorePath = join13(tuckDir, ".gitignore");
   if (!await pathExists(gitignorePath)) {
-    await writeFile6(gitignorePath, GITIGNORE_TEMPLATE, "utf-8");
+    await writeFile7(gitignorePath, GITIGNORE_TEMPLATE, "utf-8");
   }
-  const readmePath = join11(tuckDir, "README.md");
+  const readmePath = join13(tuckDir, "README.md");
   if (!await pathExists(readmePath)) {
-    await writeFile6(readmePath, README_TEMPLATE(machine), "utf-8");
+    await writeFile7(readmePath, README_TEMPLATE(machine), "utf-8");
   }
 };
 var initFromScratch = async (tuckDir, options) => {
@@ -10573,10 +11415,25 @@ var setupTokenAuth = async (tuckDir, preferredType) => {
     );
     prompts.log.info("You may be prompted for credentials when pushing");
   }
-  await configureGitCredentialHelper().catch((error) => {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    logger?.debug?.(`Failed to configure git credential helper (non-fatal): ${errorMsg}`);
-  });
+  const configureHelper = await prompts.confirm(
+    "Configure a global Git credential helper now? This updates `git config --global credential.helper`.",
+    true
+  );
+  if (configureHelper) {
+    await configureGitCredentialHelperWithOptions({ allowGlobalConfigChange: true }).catch(
+      (error) => {
+        const errorMsg = error instanceof Error ? error.message : String(error);
+        logger?.debug?.(`Failed to configure git credential helper (non-fatal): ${errorMsg}`);
+        prompts.log.warning(
+          "Could not configure a credential helper automatically. Set one manually for secure token storage (osxkeychain/libsecret/manager-core)."
+        );
+      }
+    );
+  } else {
+    prompts.log.info(
+      "Skipping credential helper setup. Git may prompt for credentials unless a helper is configured."
+    );
+  }
   return await promptForManualRepoUrl(tuckDir, username, "https");
 };
 var promptForManualRepoUrl = async (tuckDir, username, preferredProtocol = "https") => {
@@ -10737,10 +11594,10 @@ tuck apply ${user.login}`,
   return { remoteUrl, pushed: false };
 };
 var analyzeRepository = async (repoDir) => {
-  const manifestPath = join11(repoDir, ".tuckmanifest.json");
+  const manifestPath = join13(repoDir, ".tuckmanifest.json");
   if (await pathExists(manifestPath)) {
     try {
-      const content = await readFile8(manifestPath, "utf-8");
+      const content = await readFile9(manifestPath, "utf-8");
       const manifest = JSON.parse(content);
       if (manifest.files && Object.keys(manifest.files).length > 0) {
         return { type: "valid-tuck", manifest };
@@ -10750,7 +11607,7 @@ var analyzeRepository = async (repoDir) => {
       return { type: "messed-up", reason: "Manifest file is corrupted or invalid" };
     }
   }
-  const filesDir = join11(repoDir, "files");
+  const filesDir = join13(repoDir, "files");
   const hasFilesDir = await pathExists(filesDir);
   const commonPatterns = [
     ".zshrc",
@@ -10771,7 +11628,7 @@ var analyzeRepository = async (repoDir) => {
     try {
       const categories = await readdir5(filesDir);
       for (const category of categories) {
-        const categoryPath = join11(filesDir, category);
+        const categoryPath = join13(filesDir, category);
         const categoryStats = await import("fs/promises").then(
           (fs) => fs.stat(categoryPath).catch((e) => {
             logger.debug?.(errorToMessage(e, `Failed to stat category path ${categoryPath}`));
@@ -10914,7 +11771,7 @@ var importExistingRepo = async (tuckDir, repoName, analysis, repoDir) => {
         for (const entry of entries) {
           if (entry === ".git" || entry === ".tuckmanifest.json" || entry === ".tuckrc.json")
             continue;
-          const fullPath = join11(dir, entry);
+          const fullPath = join13(dir, entry);
           const stats = await stat11(fullPath).catch((e) => {
             logger.debug?.(errorToMessage(e, `Failed to stat ${fullPath}`));
             return null;
@@ -11040,7 +11897,7 @@ var runInteractiveInit = async () => {
         spinner4.stop(`Found repository: ${existingRepoName}`);
         const importRepo = await prompts.confirm(`Import dotfiles from ${existingRepoName}?`, true);
         if (importRepo) {
-          const tempDir = join11(tmpdir(), `tuck-import-${Date.now()}`);
+          const tempDir = join13(tmpdir(), `tuck-import-${Date.now()}`);
           const cloneSpinner = prompts.spinner();
           cloneSpinner.start("Cloning repository...");
           let phase = "cloning";
@@ -11434,424 +12291,25 @@ init_manifest();
 init_fileTracking();
 init_errors();
 init_constants();
-init_files();
+init_trackPipeline();
 import { Command as Command5 } from "commander";
-import { basename as basename7 } from "path";
-
-// src/lib/binary.ts
-init_paths();
-init_platform();
-import { open, stat as stat8 } from "fs/promises";
-import { basename as basename5, dirname as dirname6 } from "path";
-var MAGIC_NUMBERS = {
-  // ELF (Linux)
-  ELF: Buffer.from([127, 69, 76, 70]),
-  // Mach-O (macOS) - 32-bit
-  MACHO_32: Buffer.from([254, 237, 250, 206]),
-  // Mach-O (macOS) - 64-bit
-  MACHO_64: Buffer.from([207, 250, 237, 254]),
-  // Mach-O (macOS) - Universal binary
-  MACHO_UNIVERSAL: Buffer.from([202, 254, 186, 190]),
-  // PE (Windows)
-  PE: Buffer.from([77, 90])
-  // "MZ"
-};
-var SCRIPT_EXTENSIONS = [
-  // Unix shells
-  ".sh",
-  ".bash",
-  ".zsh",
-  ".fish",
-  // Cross-platform scripting languages
-  ".py",
-  ".rb",
-  ".pl",
-  ".js",
-  ".ts",
-  ".lua",
-  ".php",
-  ".tcl",
-  ".awk",
-  ".sed",
-  // Windows scripts
-  ".ps1",
-  // PowerShell
-  ".psm1",
-  // PowerShell module
-  ".psd1",
-  // PowerShell data
-  ".bat",
-  // Batch file
-  ".cmd",
-  // Command script
-  ".vbs",
-  // VBScript
-  ".wsf"
-  // Windows Script File
-];
-var WINDOWS_EXECUTABLE_EXTENSIONS = [".exe", ".com", ".dll"];
-var bufferStartsWith = (buffer, magic) => {
-  if (buffer.length < magic.length) {
-    return false;
-  }
-  for (let i = 0; i < magic.length; i++) {
-    if (buffer[i] !== magic[i]) {
-      return false;
-    }
-  }
-  return true;
-};
-var isBinaryExecutable = async (path) => {
-  const expandedPath = expandPath(path);
-  try {
-    const stats = await stat8(expandedPath);
-    if (stats.isDirectory()) {
-      return false;
-    }
-    if (IS_WINDOWS) {
-      const lowerPath = expandedPath.toLowerCase();
-      if (WINDOWS_EXECUTABLE_EXTENSIONS.some((ext) => lowerPath.endsWith(ext))) {
-        return true;
-      }
-    }
-    const hasExecutePermission = !IS_WINDOWS && (stats.mode & 73) !== 0;
-    let fileHandle;
-    try {
-      fileHandle = await open(expandedPath, "r");
-      const buffer = Buffer.alloc(512);
-      await fileHandle.read(buffer, 0, 512, 0);
-      if (bufferStartsWith(buffer, MAGIC_NUMBERS.ELF) || bufferStartsWith(buffer, MAGIC_NUMBERS.MACHO_32) || bufferStartsWith(buffer, MAGIC_NUMBERS.MACHO_64) || bufferStartsWith(buffer, MAGIC_NUMBERS.MACHO_UNIVERSAL) || bufferStartsWith(buffer, MAGIC_NUMBERS.PE)) {
-        return true;
-      }
-      if (hasExecutePermission) {
-        const startsWithShebang = buffer[0] === 35 && buffer[1] === 33;
-        return !startsWithShebang;
-      }
-      return false;
-    } finally {
-      if (fileHandle) {
-        await fileHandle.close();
-      }
-    }
-  } catch {
-    return false;
-  }
-};
-var isScriptFile = async (path) => {
-  const expandedPath = expandPath(path);
-  try {
-    const hasScriptExtension = SCRIPT_EXTENSIONS.some((ext) => expandedPath.endsWith(ext));
-    if (hasScriptExtension) {
-      return true;
-    }
-    const stats = await stat8(expandedPath);
-    if (stats.isDirectory()) {
-      return false;
-    }
-    let fileHandle;
-    try {
-      fileHandle = await open(expandedPath, "r");
-      const buffer = Buffer.alloc(2);
-      await fileHandle.read(buffer, 0, 2, 0);
-      return buffer[0] === 35 && buffer[1] === 33;
-    } finally {
-      if (fileHandle) {
-        await fileHandle.close();
-      }
-    }
-  } catch {
-    return false;
-  }
-};
-var shouldExcludeFromBin = async (path) => {
-  const expandedPath = expandPath(path);
-  const parentDir = dirname6(expandedPath);
-  const parentBasename = basename5(parentDir);
-  const isInBinDir = parentBasename === "bin";
-  if (!isInBinDir) {
-    return false;
-  }
-  try {
-    const stats = await stat8(expandedPath);
-    if (stats.isDirectory()) {
-      return false;
-    }
-  } catch {
-    return false;
-  }
-  if (await isScriptFile(expandedPath)) {
-    return false;
-  }
-  return await isBinaryExecutable(expandedPath);
-};
-
-// src/commands/add.ts
-init_tuckignore();
-init_config();
-init_audit();
-init_secrets();
-var PRIVATE_KEY_PATTERNS2 = [
-  /^id_rsa$/,
-  /^id_dsa$/,
-  /^id_ecdsa$/,
-  /^id_ed25519$/,
-  /^id_.*$/,
-  // Any id_ file without .pub
-  /\.pem$/,
-  /\.key$/,
-  /^.*_key$/
-  // aws_key, github_key, etc.
-];
-var SENSITIVE_FILE_PATTERNS2 = [
-  /^\.netrc$/,
-  /^\.aws\/credentials$/,
-  /^\.docker\/config\.json$/,
-  /^\.npmrc$/,
-  // May contain tokens
-  /^\.pypirc$/,
-  /^\.kube\/config$/,
-  /^\.ssh\/config$/,
-  /^\.gnupg\//,
-  /credentials/i,
-  /secrets?/i,
-  /tokens?\.json$/i,
-  /\.env$/,
-  /\.env\./
-];
-var isPrivateKey = (path) => {
-  const name = basename7(path);
-  if (path.includes(".ssh/") && !name.endsWith(".pub")) {
-    for (const pattern of PRIVATE_KEY_PATTERNS2) {
-      if (pattern.test(name)) {
-        return true;
-      }
-    }
-  }
-  if (name.endsWith(".pem") || name.endsWith(".key")) {
-    return true;
-  }
-  return false;
-};
-var isSensitiveFile2 = (path) => {
-  const pathToTest = path.startsWith("~/") ? path.slice(2) : path;
-  for (const pattern of SENSITIVE_FILE_PATTERNS2) {
-    if (pattern.test(pathToTest)) {
-      return true;
-    }
-  }
-  return false;
-};
-var validateAndPrepareFiles = async (paths, tuckDir, options) => {
-  const filesToAdd = [];
-  for (const path of paths) {
-    const expandedPath = expandPath(path);
-    const collapsedPath = collapsePath(expandedPath);
-    if (isPrivateKey(collapsedPath)) {
-      throw new PrivateKeyError(path);
-    }
-    if (!await pathExists(expandedPath)) {
-      throw new FileNotFoundError(path);
-    }
-    if (await isFileTracked(tuckDir, collapsedPath)) {
-      throw new FileAlreadyTrackedError(path);
-    }
-    if (await isIgnored(tuckDir, collapsedPath)) {
-      logger.info(`Skipping ${path} (in .tuckignore)`);
-      continue;
-    }
-    if (await shouldExcludeFromBin(expandedPath)) {
-      const sizeCheck2 = await checkFileSizeThreshold(expandedPath);
-      logger.info(
-        `Skipping binary executable: ${path}${sizeCheck2.size > 0 ? ` (${formatFileSize(sizeCheck2.size)})` : ""} - Add to .tuckignore to customize`
-      );
-      continue;
-    }
-    const sizeCheck = await checkFileSizeThreshold(expandedPath);
-    if (sizeCheck.block) {
-      logger.warning(
-        `File ${path} is ${formatFileSize(sizeCheck.size)} (exceeds GitHub's 100MB limit)`
-      );
-      const action = await prompts.select("How would you like to proceed?", [
-        { value: "ignore", label: "Add to .tuckignore and skip" },
-        { value: "cancel", label: "Cancel operation" }
-      ]);
-      if (action === "ignore") {
-        await addToTuckignore(tuckDir, collapsedPath);
-        logger.success(`Added ${path} to .tuckignore`);
-        continue;
-      } else {
-        throw new OperationCancelledError("file size exceeds GitHub limit");
-      }
-    }
-    if (sizeCheck.warn) {
-      logger.warning(
-        `File ${path} is ${formatFileSize(sizeCheck.size)}. GitHub recommends files under 50MB.`
-      );
-      const action = await prompts.select("How would you like to proceed?", [
-        { value: "continue", label: "Track it anyway" },
-        { value: "ignore", label: "Add to .tuckignore and skip" },
-        { value: "cancel", label: "Cancel operation" }
-      ]);
-      if (action === "ignore") {
-        await addToTuckignore(tuckDir, collapsedPath);
-        logger.success(`Added ${path} to .tuckignore`);
-        continue;
-      } else if (action === "cancel") {
-        throw new OperationCancelledError("file size warning");
-      }
-    }
-    const isDir = await isDirectory(expandedPath);
-    const fileCount = isDir ? await getDirectoryFileCount(expandedPath) : 1;
-    const category = options.category || detectCategory(expandedPath);
-    const filename = options.name || sanitizeFilename(expandedPath);
-    const destination = getDestinationPath(tuckDir, category, filename);
-    const sensitive = isSensitiveFile2(collapsedPath);
-    filesToAdd.push({
-      source: collapsedPath,
-      destination,
-      category,
-      filename,
-      isDir,
-      fileCount,
-      sensitive
-    });
-  }
-  return filesToAdd;
-};
 var addFiles = async (filesToAdd, tuckDir, options) => {
-  const filesToTrack = filesToAdd.map((f) => ({
-    path: f.source,
-    category: f.category
-  }));
+  const filesToTrack = filesToAdd.map((f) => {
+    const trackedFile = {
+      path: f.source,
+      category: f.category
+    };
+    if (f.nameOverride) {
+      trackedFile.name = f.nameOverride;
+    }
+    return trackedFile;
+  });
   await trackFilesWithProgress(filesToTrack, tuckDir, {
     showCategory: true,
     strategy: options.symlink ? "symlink" : void 0,
     actionVerb: "Tracking"
   });
 };
-var displaySecretWarning = (summary) => {
-  console.log();
-  console.log(
-    colors.error(colors.bold(`  Security Warning: Found ${summary.totalSecrets} potential secret(s)`))
-  );
-  console.log();
-  for (const result of summary.results) {
-    console.log(`  ${colors.brand(result.collapsedPath)}`);
-    for (const match of result.matches) {
-      const severityColor = match.severity === "critical" ? colors.error : match.severity === "high" ? colors.warning : match.severity === "medium" ? colors.info : colors.muted;
-      console.log(
-        `    ${colors.muted(`Line ${match.line}:`)} ${match.redactedValue} ${severityColor(`[${match.severity}]`)}`
-      );
-    }
-    console.log();
-  }
-};
-var handleSecretsDetected = async (summary, filesToAdd, tuckDir) => {
-  displaySecretWarning(summary);
-  const action = await prompts.select("How would you like to proceed?", [
-    {
-      value: "abort",
-      label: "Abort operation",
-      hint: "Do not track these files"
-    },
-    {
-      value: "redact",
-      label: "Replace with placeholders",
-      hint: "Store originals in secrets.local.json (never committed)"
-    },
-    {
-      value: "ignore",
-      label: "Add files to .tuckignore",
-      hint: "Skip these files permanently"
-    },
-    {
-      value: "proceed",
-      label: "Proceed anyway",
-      hint: "Track files with secrets (dangerous!)"
-    }
-  ]);
-  switch (action) {
-    case "abort":
-      logger.info("Operation aborted");
-      return { continue: false, filesToAdd: [] };
-    case "redact": {
-      const redactionMaps = await processSecretsForRedaction(summary.results, tuckDir);
-      let totalRedacted = 0;
-      for (const result of summary.results) {
-        const placeholderMap = redactionMaps.get(result.path);
-        if (placeholderMap && placeholderMap.size > 0) {
-          const redactionResult = await redactFile(result.path, result.matches, placeholderMap);
-          totalRedacted += redactionResult.replacements.length;
-        }
-      }
-      console.log();
-      logger.success(`Replaced ${totalRedacted} secret(s) with placeholders`);
-      logger.dim(`Secrets stored in: ${collapsePath(getSecretsPath(tuckDir))} (never committed)`);
-      logger.dim("Run 'tuck secrets list' to see stored secrets");
-      console.log();
-      return { continue: true, filesToAdd };
-    }
-    case "ignore": {
-      const filesWithSecrets = new Set(summary.results.map((r) => r.collapsedPath));
-      for (const file of filesToAdd) {
-        const normalizedFileSource = collapsePath(file.source);
-        if (filesWithSecrets.has(normalizedFileSource)) {
-          await addToTuckignore(tuckDir, file.source);
-          logger.success(`Added ${normalizedFileSource} to .tuckignore`);
-        }
-      }
-      const remainingFiles = filesToAdd.filter((f) => {
-        const normalizedSource = collapsePath(f.source);
-        return !filesWithSecrets.has(normalizedSource);
-      });
-      if (remainingFiles.length === 0) {
-        logger.info("No files remaining to track");
-        return { continue: false, filesToAdd: [] };
-      }
-      return { continue: true, filesToAdd: remainingFiles };
-    }
-    case "proceed": {
-      const confirmed = await prompts.confirm(
-        colors.error("Are you SURE you want to track files containing secrets?"),
-        false
-      );
-      if (!confirmed) {
-        logger.info("Operation aborted");
-        return { continue: false, filesToAdd: [] };
-      }
-      logger.warning("Proceeding with secrets - be careful not to push to a public repository!");
-      return { continue: true, filesToAdd };
-    }
-    default:
-      return { continue: false, filesToAdd: [] };
-  }
-};
-var scanAndHandleSecrets2 = async (filesToAdd, tuckDir, options) => {
-  const config = await loadConfig(tuckDir);
-  const security = config.security || {};
-  if (security.scanSecrets === false) {
-    return { continue: true, filesToAdd };
-  }
-  if (options.force) {
-    const confirmed = await prompts.confirmDangerous(
-      "Using --force bypasses secret scanning.\nAny secrets in these files may be committed to git and potentially exposed.",
-      "force"
-    );
-    if (!confirmed) {
-      logger.info("Operation cancelled");
-      return { continue: false, filesToAdd: [] };
-    }
-    logger.warning("Secret scanning bypassed with --force");
-    await logForceSecretBypass("tuck add --force", filesToAdd.length);
-    return { continue: true, filesToAdd };
-  }
-  const filePaths = filesToAdd.map((f) => expandPath(f.source));
-  const summary = await scanForSecrets(filePaths, tuckDir);
-  if (summary.filesWithSecrets === 0) {
-    return { continue: true, filesToAdd };
-  }
-  return handleSecretsDetected(summary, filesToAdd, tuckDir);
-};
 var runInteractiveAdd = async (tuckDir) => {
   prompts.intro("tuck add");
   const pathsInput = await prompts.text("Enter file paths to track (space-separated):", {
@@ -11862,9 +12320,13 @@ var runInteractiveAdd = async (tuckDir) => {
     }
   });
   const paths = pathsInput.split(/\s+/).filter(Boolean);
+  const candidates = paths.map((path) => ({ path }));
   let filesToAdd;
   try {
-    filesToAdd = await validateAndPrepareFiles(paths, tuckDir, {});
+    filesToAdd = await preparePathsForTracking(candidates, tuckDir, {
+      secretHandling: "interactive",
+      forceBypassCommand: "tuck add --force"
+    });
   } catch (error) {
     if (error instanceof Error) {
       prompts.log.error(error.message);
@@ -11872,6 +12334,10 @@ var runInteractiveAdd = async (tuckDir) => {
     prompts.cancel();
     return;
   }
+  if (filesToAdd.length === 0) {
+    logger.info("No files to add");
+    return;
+  }
   for (const file of filesToAdd) {
     prompts.log.step(`${file.source}`);
     const categoryOptions = Object.entries(CATEGORIES).map(([name, config]) => ({
@@ -11886,7 +12352,6 @@ var runInteractiveAdd = async (tuckDir) => {
     });
     const selectedCategory = await prompts.select("Category:", categoryOptions);
     file.category = selectedCategory;
-    file.destination = getDestinationPath(tuckDir, file.category, file.filename);
   }
   const confirm2 = await prompts.confirm(
     `Add ${filesToAdd.length} ${filesToAdd.length === 1 ? "file" : "files"}?`,
@@ -11911,19 +12376,22 @@ var runAdd = async (paths, options) => {
     await runInteractiveAdd(tuckDir);
     return;
   }
-  let filesToAdd = await validateAndPrepareFiles(paths, tuckDir, options);
+  const candidates = paths.map((path) => ({
+    path,
+    category: options.category,
+    name: options.name
+  }));
+  const filesToAdd = await preparePathsForTracking(candidates, tuckDir, {
+    category: options.category,
+    name: options.name,
+    force: options.force,
+    secretHandling: "interactive",
+    forceBypassCommand: "tuck add --force"
+  });
   if (filesToAdd.length === 0) {
     logger.info("No files to add");
     return;
   }
-  const secretScanResult = await scanAndHandleSecrets2(filesToAdd, tuckDir, options);
-  if (!secretScanResult.continue) {
-    return;
-  }
-  filesToAdd = secretScanResult.filesToAdd;
-  if (filesToAdd.length === 0) {
-    return;
-  }
   await addFiles(filesToAdd, tuckDir, options);
   console.log();
   const shouldSync = await prompts.confirm("Would you like to sync these changes now?", true);
@@ -11936,7 +12404,7 @@ var runAdd = async (paths, options) => {
     logger.info("Run 'tuck sync' when you're ready to commit changes");
   }
 };
-var addCommand = new Command5("add").description("Track new dotfiles").argument("[paths...]", "Paths to dotfiles to track").option("-c, --category <name>", "Category to organize under").option("-n, --name <name>", "Custom name for the file in manifest").option("--symlink", "Create symlink instead of copy").option("-f, --force", "Skip secret scanning (not recommended)").action(async (paths, options) => {
+var addCommand = new Command5("add").description("Track new dotfiles").argument("[paths...]", "Paths to dotfiles to track").option("-c, --category <name>", "Category to organize under").option("-n, --name <name>", "Custom name for the file in manifest").option("--symlink", "Copy into tuck repo, then replace source path with a symlink").option("-f, --force", "Skip secret scanning (not recommended)").action(async (paths, options) => {
   await runAdd(paths, options);
 });
 
@@ -11947,8 +12415,7 @@ init_manifest();
 init_files();
 init_errors();
 import { Command as Command6 } from "commander";
-import { join as join15 } from "path";
-var validateAndPrepareFiles2 = async (paths, tuckDir) => {
+var validateAndPrepareFiles = async (paths, tuckDir) => {
   const filesToRemove = [];
   for (const path of paths) {
     const expandedPath = expandPath(path);
@@ -11957,10 +12424,11 @@ var validateAndPrepareFiles2 = async (paths, tuckDir) => {
     if (!tracked) {
       throw new FileNotTrackedError(path);
     }
+    validateSafeSourcePath(tracked.file.source);
     filesToRemove.push({
       id: tracked.id,
       source: tracked.file.source,
-      destination: join15(tuckDir, tracked.file.destination)
+      destination: getSafeRepoPathFromDestination(tuckDir, tracked.file.destination)
     });
   }
   return filesToRemove;
@@ -12014,10 +12482,11 @@ var runInteractiveRemove = async (tuckDir) => {
   }
   const filesToRemove = selectedFiles.map((id) => {
     const file = trackedFiles[id];
+    validateSafeSourcePath(file.source);
     return {
       id,
       source: file.source,
-      destination: join15(tuckDir, file.destination)
+      destination: getSafeRepoPathFromDestination(tuckDir, file.destination)
     };
   });
   await removeFiles(filesToRemove, tuckDir, { delete: shouldDelete });
@@ -12035,7 +12504,7 @@ var runRemove = async (paths, options) => {
     await runInteractiveRemove(tuckDir);
     return;
   }
-  const filesToRemove = await validateAndPrepareFiles2(paths, tuckDir);
+  const filesToRemove = await validateAndPrepareFiles(paths, tuckDir);
   await removeFiles(filesToRemove, tuckDir, options);
   logger.blank();
   logger.success(`Removed ${filesToRemove.length} ${filesToRemove.length === 1 ? "item" : "items"} from tracking`);
@@ -12363,6 +12832,8 @@ var detectFileChanges = async (tuckDir) => {
   const ignoredPaths = await loadTuckignore(tuckDir);
   const changes = [];
   for (const [, file] of Object.entries(files)) {
+    validateSafeSourcePath(file.source);
+    getSafeRepoPathFromDestination(tuckDir, file.destination);
     if (ignoredPaths.has(file.source)) {
       continue;
     }
@@ -12700,9 +13171,9 @@ init_manifest();
 init_git();
 init_files();
 init_errors();
-import { Command as Command11 } from "commander";
-import { join as join16 } from "path";
+init_binary();
 init_tuckignore();
+import { Command as Command11 } from "commander";
 import { readFile as readFile10 } from "fs/promises";
 var isBinary = async (path) => {
   if (!await pathExists(path)) {
@@ -12715,8 +13186,9 @@ var getFileDiff = async (tuckDir, source) => {
   if (!tracked) {
     throw new FileNotFoundError(`Not tracked: ${source}`);
   }
+  validateSafeSourcePath(tracked.file.source);
   const systemPath = expandPath(source);
-  const repoPath = join16(tuckDir, tracked.file.destination);
+  const repoPath = getSafeRepoPathFromDestination(tuckDir, tracked.file.destination);
   const diff = {
     source,
     destination: tracked.file.destination,
@@ -13051,27 +13523,20 @@ var CONFIG_KEYS = [
     description: "Command to run after restore",
     section: "hooks"
   },
-  // Template settings
-  {
-    path: "templates.enabled",
-    type: "boolean",
-    description: "Enable template processing",
-    section: "templates"
-  },
   // Encryption settings
   {
-    path: "encryption.enabled",
+    path: "encryption.backupsEnabled",
     type: "boolean",
-    description: "Enable file encryption",
-    section: "encryption"
-  },
-  {
-    path: "encryption.gpgKey",
-    type: "string",
-    description: "GPG key for encryption",
+    description: "Enable backup encryption",
     section: "encryption"
   }
 ];
+var UNSUPPORTED_CONFIG_KEY_PREFIXES = [
+  "templates",
+  "encryption.enabled",
+  "encryption.gpgKey",
+  "encryption.files"
+];
 var getKeyInfo = (path) => {
   return CONFIG_KEYS.find((k) => k.path === path);
 };
@@ -13133,6 +13598,14 @@ var runConfigGet = async (key) => {
   }
 };
 var runConfigSet = async (key, value) => {
+  const unsupportedPrefix = UNSUPPORTED_CONFIG_KEY_PREFIXES.find(
+    (prefix) => key === prefix || key.startsWith(`${prefix}.`)
+  );
+  if (unsupportedPrefix) {
+    throw new ConfigError(
+      `Unsupported config key: ${key}. This setting is reserved but not wired yet.`
+    );
+  }
   const tuckDir = getTuckDir();
   const config = await loadConfig(tuckDir);
   const parsedValue = parseValue(value);
@@ -13155,14 +13628,14 @@ var runConfigEdit = async () => {
   const configPath = getConfigPath(tuckDir);
   const editor = process.env.EDITOR || process.env.VISUAL || "vim";
   logger.info(`Opening ${collapsePath(configPath)} in ${editor}...`);
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn(editor, [configPath], {
       stdio: "inherit"
     });
     child.on("exit", (code) => {
       if (code === 0) {
         logger.success("Configuration updated");
-        resolve2();
+        resolve3();
       } else {
         reject(new ConfigError(`Editor exited with code ${code}`));
       }
@@ -13198,7 +13671,6 @@ var showConfigView = async (config) => {
     { key: "files", title: "File Management", icon: ">" },
     { key: "ui", title: "User Interface", icon: "#" },
     { key: "hooks", title: "Hooks", icon: "!" },
-    { key: "templates", title: "Templates", icon: "%" },
     { key: "encryption", title: "Encryption", icon: "@" }
   ];
   for (const section of sections) {
@@ -13206,7 +13678,15 @@ var showConfigView = async (config) => {
     if (!sectionConfig || typeof sectionConfig !== "object") continue;
     console.log(colors.bold.cyan(`${section.icon} ${section.title}`));
     console.log(colors.dim("-".repeat(40)));
-    for (const [key, value] of Object.entries(sectionConfig)) {
+    const sectionEntries = Object.entries(sectionConfig).filter(
+      ([key]) => {
+        if (section.key === "encryption") {
+          return getKeyInfo(`${section.key}.${key}`) !== void 0;
+        }
+        return true;
+      }
+    );
+    for (const [key, value] of sectionEntries) {
       const keyInfo = getKeyInfo(`${section.key}.${key}`);
       const displayValue = formatConfigValue(value);
       const description = keyInfo?.description || "";
@@ -13217,6 +13697,10 @@ var showConfigView = async (config) => {
     }
     console.log();
   }
+  if (config.templates?.enabled || Object.keys(config.templates?.variables || {}).length > 0) {
+    console.log(colors.yellow("! Templates config is currently reserved and not applied during restore/sync."));
+    console.log();
+  }
 };
 var runConfigWizard = async (config, tuckDir) => {
   prompts.log.info("Let's configure tuck for your workflow");
@@ -13522,7 +14006,7 @@ init_paths();
 init_git();
 init_github();
 import { Command as Command13 } from "commander";
-import { join as join18, dirname as dirname8 } from "path";
+import { join as join16, dirname as dirname8 } from "path";
 import { readFile as readFile13, writeFile as writeFile9, rm as rm4, chmod as chmod3, stat as stat10 } from "fs/promises";
 import { ensureDir as ensureDir7, pathExists as fsPathExists } from "fs-extra";
 import { tmpdir as tmpdir2 } from "os";
@@ -13530,11 +14014,11 @@ import { tmpdir as tmpdir2 } from "os";
 // src/lib/timemachine.ts
 init_paths();
 init_errors();
-import { join as join17, dirname as dirname7 } from "path";
+import { join as join15, dirname as dirname7, relative as relative2, resolve as resolve2, sep as sep3 } from "path";
 import { readdir as readdir3, readFile as readFile11, writeFile as writeFile8, rm as rm3, stat as stat9 } from "fs/promises";
 import { copy as copy4, ensureDir as ensureDir6, pathExists as pathExists3 } from "fs-extra";
 import { homedir as homedir5 } from "os";
-var TIMEMACHINE_DIR = join17(homedir5(), ".tuck", "backups");
+var TIMEMACHINE_DIR = join15(homedir5(), ".tuck", "backups");
 var generateSnapshotId = () => {
   const now = /* @__PURE__ */ new Date();
   const year = now.getFullYear();
@@ -13546,11 +14030,25 @@ var generateSnapshotId = () => {
   return `${year}-${month}-${day}-${hours}${minutes}${seconds}`;
 };
 var getSnapshotPath = (snapshotId) => {
-  return join17(TIMEMACHINE_DIR, snapshotId);
+  return join15(TIMEMACHINE_DIR, snapshotId);
 };
 var toBackupPath = (originalPath) => {
-  const collapsed = collapsePath(originalPath);
-  return collapsed.replace(/^~[/\\]/, "");
+  const expandedOriginal = expandPath(originalPath);
+  const homePath = resolve2(homedir5());
+  const resolvedOriginal = resolve2(expandedOriginal);
+  const isWithinHome = resolvedOriginal === homePath || resolvedOriginal.startsWith(homePath + sep3);
+  if (!isWithinHome) {
+    throw new BackupError(`Cannot snapshot path outside home directory: ${originalPath}`);
+  }
+  const relativePath = relative2(homePath, resolvedOriginal);
+  const normalizedRelative = relativePath.replace(/\\/g, "/");
+  if (!normalizedRelative || normalizedRelative === ".") {
+    throw new BackupError(`Cannot snapshot home directory root directly: ${originalPath}`);
+  }
+  if (normalizedRelative.startsWith("/") || /^[A-Za-z]:[\\/]/.test(normalizedRelative) || normalizedRelative.split("/").includes("..")) {
+    throw new BackupError(`Unsafe backup path generated from: ${originalPath}`);
+  }
+  return normalizedRelative;
 };
 var createSnapshot = async (filePaths, reason, profile) => {
   const snapshotId = generateSnapshotId();
@@ -13561,7 +14059,7 @@ var createSnapshot = async (filePaths, reason, profile) => {
   for (const filePath of filePaths) {
     const expandedPath = expandPath(filePath);
     const backupRelativePath = toBackupPath(expandedPath);
-    const backupPath = join17(snapshotPath, "files", backupRelativePath);
+    const backupPath = join15(snapshotPath, "files", backupRelativePath);
     const existed = await pathExists(expandedPath);
     if (existed) {
       await ensureDir6(dirname7(backupPath));
@@ -13582,7 +14080,7 @@ var createSnapshot = async (filePaths, reason, profile) => {
     profile
   };
   await writeFile8(
-    join17(snapshotPath, "metadata.json"),
+    join15(snapshotPath, "metadata.json"),
     JSON.stringify(metadata, null, 2),
     "utf-8"
   );
@@ -13608,8 +14106,8 @@ var listSnapshots = async () => {
   const snapshots = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const snapshotPath = join17(TIMEMACHINE_DIR, entry.name);
-    const metadataPath = join17(snapshotPath, "metadata.json");
+    const snapshotPath = join15(TIMEMACHINE_DIR, entry.name);
+    const metadataPath = join15(snapshotPath, "metadata.json");
     if (!await pathExists3(metadataPath)) continue;
     try {
       const content = await readFile11(metadataPath, "utf-8");
@@ -13636,7 +14134,7 @@ var getSnapshot = async (snapshotId) => {
   if (!await pathExists3(snapshotPath)) {
     return null;
   }
-  const metadataPath = join17(snapshotPath, "metadata.json");
+  const metadataPath = join15(snapshotPath, "metadata.json");
   if (!await pathExists3(metadataPath)) {
     return null;
   }
@@ -13723,7 +14221,7 @@ var getSnapshotsSize = async () => {
     let size = 0;
     const entries = await readdir3(dirPath, { withFileTypes: true });
     for (const entry of entries) {
-      const entryPath = join17(dirPath, entry.name);
+      const entryPath = join15(dirPath, entry.name);
       if (entry.isDirectory()) {
         size += await calculateDirSize(entryPath);
       } else {
@@ -13991,6 +14489,7 @@ ${incomingContent.slice(0, 500)}${incomingContent.length > 500 ? "..." : ""}`;
 
 // src/commands/apply.ts
 init_constants();
+init_manifest_schema();
 init_secrets();
 init_secretBackends();
 init_config();
@@ -14047,7 +14546,7 @@ var resolveSource = async (source) => {
   throw new RepositoryNotFoundError(source);
 };
 var cloneSource = async (repoId, isUrl) => {
-  const tempDir = join18(tmpdir2(), `tuck-apply-${Date.now()}`);
+  const tempDir = join16(tmpdir2(), `tuck-apply-${Date.now()}`);
   await ensureDir7(tempDir);
   if (isUrl) {
     await cloneRepo(repoId, tempDir);
@@ -14062,13 +14561,14 @@ var cloneSource = async (repoId, isUrl) => {
   return tempDir;
 };
 var readClonedManifest = async (repoDir) => {
-  const manifestPath = join18(repoDir, ".tuckmanifest.json");
+  const manifestPath = join16(repoDir, ".tuckmanifest.json");
   if (!await fsPathExists(manifestPath)) {
     return null;
   }
   try {
     const content = await readFile13(manifestPath, "utf-8");
-    return JSON.parse(content);
+    const parsed = JSON.parse(content);
+    return tuckManifestSchema.parse(parsed);
   } catch {
     return null;
   }
@@ -14076,14 +14576,21 @@ var readClonedManifest = async (repoDir) => {
 var prepareFilesToApply = async (repoDir, manifest) => {
   const files = [];
   for (const [_id, file] of Object.entries(manifest.files)) {
-    const repoFilePath = join18(repoDir, file.destination);
+    try {
+      validateSafeSourcePath(file.source);
+      validateSafeManifestDestination(file.destination);
+    } catch {
+      logger.warning(`Skipping unsafe manifest entry: ${file.source}`);
+      continue;
+    }
+    const repoFilePath = join16(repoDir, file.destination);
+    try {
+      validatePathWithinRoot(repoFilePath, repoDir, "repository file");
+    } catch {
+      logger.warning(`Skipping unsafe repository path from manifest: ${file.destination}`);
+      continue;
+    }
     if (await fsPathExists(repoFilePath)) {
-      try {
-        validateSafeSourcePath(file.source);
-      } catch (error) {
-        logger.warning(`Skipping unsafe path from manifest: ${file.source}`);
-        continue;
-      }
       files.push({
         source: file.source,
         destination: expandPath(file.source),
@@ -14716,8 +15223,10 @@ init_manifest();
 init_detect();
 init_errors();
 init_fileTracking();
-import { Command as Command15 } from "commander";
+init_trackPipeline();
+init_binary();
 init_tuckignore();
+import { Command as Command15 } from "commander";
 var groupSelectableByCategory = (files) => {
   const grouped = {};
   for (const file of files) {
@@ -14846,9 +15355,22 @@ var showSummary = (selected) => {
   }
 };
 var addFilesWithProgress = async (selected, tuckDir) => {
-  const filesToTrack = selected.map((f) => ({
-    path: f.path,
-    category: f.category
+  const prepared = await preparePathsForTracking(
+    selected.map((file) => ({
+      path: file.path,
+      category: file.category
+    })),
+    tuckDir,
+    {
+      secretHandling: "interactive"
+    }
+  );
+  if (prepared.length === 0) {
+    return 0;
+  }
+  const filesToTrack = prepared.map((file) => ({
+    path: file.source,
+    category: file.category
   }));
   const result = await trackFilesWithProgress(filesToTrack, tuckDir, {
     showCategory: true,
@@ -15151,7 +15673,7 @@ var LinuxKeystore = class {
       account
     ];
     try {
-      await new Promise((resolve2, reject) => {
+      await new Promise((resolve3, reject) => {
         const child = spawn2("secret-tool", args, {
           stdio: ["pipe", "pipe", "pipe"]
         });
@@ -15164,7 +15686,7 @@ var LinuxKeystore = class {
         });
         child.on("close", (code) => {
           if (code === 0) {
-            resolve2();
+            resolve3();
           } else {
             reject(new Error(`secret-tool exited with code ${code}: ${stderr}`));
           }
@@ -15283,7 +15805,7 @@ var WindowsKeystore = class {
 
 // src/lib/crypto/keystore/fallback.ts
 import { readFile as readFile14, writeFile as writeFile10, chmod as chmod4 } from "fs/promises";
-import { join as join19 } from "path";
+import { join as join17 } from "path";
 import { homedir as homedir6, hostname, userInfo } from "os";
 import { createHash as createHash3, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes3 } from "crypto";
 import { ensureDir as ensureDir8, pathExists as pathExists4 } from "fs-extra";
@@ -15292,7 +15814,7 @@ var ALGORITHM = "aes-256-gcm";
 var FallbackKeystore = class {
   keystorePath;
   constructor(customPath) {
-    this.keystorePath = customPath || join19(homedir6(), ".tuck", KEYSTORE_FILE);
+    this.keystorePath = customPath || join17(homedir6(), ".tuck", KEYSTORE_FILE);
   }
   getName() {
     return "Local encrypted file";
@@ -15352,7 +15874,7 @@ var FallbackKeystore = class {
   async saveData(data) {
     const json = JSON.stringify(data, null, 2);
     const encrypted = this.encrypt(Buffer.from(json, "utf-8"));
-    await ensureDir8(join19(homedir6(), ".tuck"));
+    await ensureDir8(join17(homedir6(), ".tuck"));
     await writeFile10(this.keystorePath, encrypted);
     await chmod4(this.keystorePath, 384);
   }
@@ -15616,6 +16138,648 @@ var runEnable = async () => {
 var encryptionCommand = new Command16("encryption").description("Manage backup encryption (power user)").addCommand(new Command16("status").description("Show encryption status").action(runStatus2)).addCommand(new Command16("setup").description("Set up backup encryption").action(runSetup)).addCommand(new Command16("enable").description("Enable backup encryption").action(runEnable)).addCommand(new Command16("disable").description("Disable backup encryption").action(runDisable)).addCommand(new Command16("rotate").description("Change encryption password").action(runRotate));
 encryptionCommand.action(runStatus2);
 
+// src/commands/doctor.ts
+init_ui();
+import { Command as Command17 } from "commander";
+
+// src/lib/doctor.ts
+init_config();
+init_git();
+init_manifest();
+init_paths();
+import { homedir as homedir7 } from "os";
+import { join as join18 } from "path";
+var DOCTOR_CATEGORIES = ["env", "repo", "manifest", "security", "hooks"];
+var checkNodeVersion = {
+  id: "env.node-version",
+  category: "env",
+  run: async () => {
+    const major = Number.parseInt(process.versions.node.split(".")[0] || "0", 10);
+    if (major >= 18) {
+      return {
+        id: "env.node-version",
+        category: "env",
+        status: "pass",
+        message: `Node.js ${process.versions.node} is supported`
+      };
+    }
+    return {
+      id: "env.node-version",
+      category: "env",
+      status: "fail",
+      message: `Node.js ${process.versions.node} is unsupported`,
+      fix: "Upgrade Node.js to version 18 or newer"
+    };
+  }
+};
+var checkHomeDirectory = {
+  id: "env.home-directory",
+  category: "env",
+  run: async () => {
+    const home = homedir7();
+    if (!home || home.trim().length === 0) {
+      return {
+        id: "env.home-directory",
+        category: "env",
+        status: "fail",
+        message: "Home directory could not be resolved",
+        fix: "Ensure the current OS user account has a valid home directory"
+      };
+    }
+    return {
+      id: "env.home-directory",
+      category: "env",
+      status: "pass",
+      message: `Home directory resolved: ${collapsePath(home)}`
+    };
+  }
+};
+var checkTuckDirectory = {
+  id: "repo.tuck-directory",
+  category: "repo",
+  run: async (context) => {
+    if (context.hasTuckDir && context.isTuckDirDirectory) {
+      return {
+        id: "repo.tuck-directory",
+        category: "repo",
+        status: "pass",
+        message: `Tuck directory exists: ${collapsePath(context.tuckDir)}`
+      };
+    }
+    if (context.hasTuckDir && !context.isTuckDirDirectory) {
+      return {
+        id: "repo.tuck-directory",
+        category: "repo",
+        status: "fail",
+        message: `Tuck path is not a directory: ${collapsePath(context.tuckDir)}`,
+        fix: "Remove or rename the conflicting file, then run `tuck init`"
+      };
+    }
+    return {
+      id: "repo.tuck-directory",
+      category: "repo",
+      status: "fail",
+      message: `Tuck directory missing: ${collapsePath(context.tuckDir)}`,
+      fix: "Run `tuck init` to initialize this machine"
+    };
+  }
+};
+var checkGitDirectory = {
+  id: "repo.git-directory",
+  category: "repo",
+  run: async (context) => {
+    if (!context.hasTuckDir) {
+      return {
+        id: "repo.git-directory",
+        category: "repo",
+        status: "warn",
+        message: "Skipped git checks because tuck is not initialized"
+      };
+    }
+    if (context.hasGitDir) {
+      return {
+        id: "repo.git-directory",
+        category: "repo",
+        status: "pass",
+        message: "Git metadata is present in tuck directory"
+      };
+    }
+    return {
+      id: "repo.git-directory",
+      category: "repo",
+      status: "fail",
+      message: "Missing .git directory under tuck repository",
+      fix: "Reinitialize with `tuck init` or restore the git metadata"
+    };
+  }
+};
+var checkGitStatusReadable = {
+  id: "repo.git-status",
+  category: "repo",
+  run: async (context) => {
+    if (!context.hasTuckDir || !context.hasGitDir) {
+      return {
+        id: "repo.git-status",
+        category: "repo",
+        status: "warn",
+        message: "Skipped git status check because repository is unavailable"
+      };
+    }
+    try {
+      await getStatus(context.tuckDir);
+      return {
+        id: "repo.git-status",
+        category: "repo",
+        status: "pass",
+        message: "Git status can be read successfully"
+      };
+    } catch (error) {
+      return {
+        id: "repo.git-status",
+        category: "repo",
+        status: "fail",
+        message: "Failed to read git status",
+        details: error instanceof Error ? error.message : String(error),
+        fix: "Run `git status` inside the tuck directory and resolve repository errors"
+      };
+    }
+  }
+};
+var checkManifestLoadable = {
+  id: "repo.manifest-loadable",
+  category: "repo",
+  run: async (context) => {
+    if (!context.hasTuckDir) {
+      return {
+        id: "repo.manifest-loadable",
+        category: "repo",
+        status: "warn",
+        message: "Skipped manifest load check because tuck is not initialized"
+      };
+    }
+    if (!context.hasManifestFile) {
+      return {
+        id: "repo.manifest-loadable",
+        category: "repo",
+        status: "fail",
+        message: `Manifest missing: ${collapsePath(context.manifestPath)}`,
+        fix: "Recreate with `tuck init` or restore `.tuckmanifest.json` from backup"
+      };
+    }
+    if (context.manifest) {
+      return {
+        id: "repo.manifest-loadable",
+        category: "repo",
+        status: "pass",
+        message: "Manifest is present and valid"
+      };
+    }
+    return {
+      id: "repo.manifest-loadable",
+      category: "repo",
+      status: "fail",
+      message: "Manifest exists but failed to parse",
+      details: context.manifestLoadError,
+      fix: "Repair `.tuckmanifest.json` using a valid schema or restore from git"
+    };
+  }
+};
+var checkConfigLoadable = {
+  id: "repo.config-loadable",
+  category: "repo",
+  run: async (context) => {
+    if (!context.hasTuckDir) {
+      return {
+        id: "repo.config-loadable",
+        category: "repo",
+        status: "warn",
+        message: "Skipped config load check because tuck is not initialized"
+      };
+    }
+    if (!context.hasConfigFile) {
+      return {
+        id: "repo.config-loadable",
+        category: "repo",
+        status: "warn",
+        message: `Config file missing: ${collapsePath(context.configPath)} (defaults will be used)`,
+        fix: "Run `tuck config reset` to generate a config file with defaults"
+      };
+    }
+    if (context.config) {
+      return {
+        id: "repo.config-loadable",
+        category: "repo",
+        status: "pass",
+        message: "Configuration is present and valid"
+      };
+    }
+    return {
+      id: "repo.config-loadable",
+      category: "repo",
+      status: "fail",
+      message: "Configuration exists but failed to parse",
+      details: context.configLoadError,
+      fix: "Repair `.tuckrc.json` or run `tuck config reset`"
+    };
+  }
+};
+var checkManifestPathSafety = {
+  id: "manifest.path-safety",
+  category: "manifest",
+  run: async (context) => {
+    if (!context.manifest) {
+      return {
+        id: "manifest.path-safety",
+        category: "manifest",
+        status: "warn",
+        message: "Skipped manifest path checks because manifest is unavailable"
+      };
+    }
+    const violations = [];
+    for (const [id, file] of Object.entries(context.manifest.files)) {
+      try {
+        validateSafeSourcePath(file.source);
+      } catch (error) {
+        violations.push(`${id}: unsafe source ${file.source} (${error instanceof Error ? error.message : String(error)})`);
+        continue;
+      }
+      try {
+        validateSafeManifestDestination(file.destination);
+      } catch (error) {
+        violations.push(
+          `${id}: unsafe destination ${file.destination} (${error instanceof Error ? error.message : String(error)})`
+        );
+        continue;
+      }
+      try {
+        validatePathWithinRoot(join18(context.tuckDir, file.destination), context.tuckDir, "manifest destination");
+      } catch (error) {
+        violations.push(
+          `${id}: destination escapes tuck dir (${error instanceof Error ? error.message : String(error)})`
+        );
+      }
+    }
+    if (violations.length === 0) {
+      return {
+        id: "manifest.path-safety",
+        category: "manifest",
+        status: "pass",
+        message: "All manifest paths are safe"
+      };
+    }
+    return {
+      id: "manifest.path-safety",
+      category: "manifest",
+      status: "fail",
+      message: `Detected ${violations.length} unsafe manifest path entr${violations.length === 1 ? "y" : "ies"}`,
+      details: violations.slice(0, 3).join("; "),
+      fix: "Replace unsafe paths with home-scoped sources and `files/...` destinations"
+    };
+  }
+};
+var checkManifestDuplicateSources = {
+  id: "manifest.duplicate-sources",
+  category: "manifest",
+  run: async (context) => {
+    if (!context.manifest) {
+      return {
+        id: "manifest.duplicate-sources",
+        category: "manifest",
+        status: "warn",
+        message: "Skipped duplicate source checks because manifest is unavailable"
+      };
+    }
+    const seen = /* @__PURE__ */ new Set();
+    const duplicates = [];
+    for (const file of Object.values(context.manifest.files)) {
+      const normalized = expandPath(file.source);
+      if (seen.has(normalized)) {
+        duplicates.push(file.source);
+      }
+      seen.add(normalized);
+    }
+    if (duplicates.length === 0) {
+      return {
+        id: "manifest.duplicate-sources",
+        category: "manifest",
+        status: "pass",
+        message: "No duplicate source paths detected"
+      };
+    }
+    return {
+      id: "manifest.duplicate-sources",
+      category: "manifest",
+      status: "fail",
+      message: `Detected duplicate source paths (${duplicates.length})`,
+      details: duplicates.slice(0, 5).join(", "),
+      fix: "Keep each source path tracked exactly once in `.tuckmanifest.json`"
+    };
+  }
+};
+var checkManifestDuplicateDestinations = {
+  id: "manifest.duplicate-destinations",
+  category: "manifest",
+  run: async (context) => {
+    if (!context.manifest) {
+      return {
+        id: "manifest.duplicate-destinations",
+        category: "manifest",
+        status: "warn",
+        message: "Skipped duplicate destination checks because manifest is unavailable"
+      };
+    }
+    const seen = /* @__PURE__ */ new Set();
+    const duplicates = [];
+    for (const file of Object.values(context.manifest.files)) {
+      const normalized = file.destination.replace(/\\/g, "/");
+      if (seen.has(normalized)) {
+        duplicates.push(file.destination);
+      }
+      seen.add(normalized);
+    }
+    if (duplicates.length === 0) {
+      return {
+        id: "manifest.duplicate-destinations",
+        category: "manifest",
+        status: "pass",
+        message: "No duplicate repository destinations detected"
+      };
+    }
+    return {
+      id: "manifest.duplicate-destinations",
+      category: "manifest",
+      status: "fail",
+      message: `Detected duplicate destinations (${duplicates.length})`,
+      details: duplicates.slice(0, 5).join(", "),
+      fix: "Assign each tracked file a unique destination under `files/`"
+    };
+  }
+};
+var checkSecretScanning = {
+  id: "security.secret-scanning",
+  category: "security",
+  run: async (context) => {
+    if (!context.config) {
+      return {
+        id: "security.secret-scanning",
+        category: "security",
+        status: "warn",
+        message: "Skipped secret scanning checks because config is unavailable"
+      };
+    }
+    if (!context.config.security.scanSecrets) {
+      return {
+        id: "security.secret-scanning",
+        category: "security",
+        status: "warn",
+        message: "Secret scanning is disabled",
+        fix: "Enable with `tuck config set security.scanSecrets true`"
+      };
+    }
+    return {
+      id: "security.secret-scanning",
+      category: "security",
+      status: "pass",
+      message: "Secret scanning is enabled"
+    };
+  }
+};
+var checkBackupOnRestore = {
+  id: "security.backup-on-restore",
+  category: "security",
+  run: async (context) => {
+    if (!context.config) {
+      return {
+        id: "security.backup-on-restore",
+        category: "security",
+        status: "warn",
+        message: "Skipped backup checks because config is unavailable"
+      };
+    }
+    if (!context.config.files.backupOnRestore) {
+      return {
+        id: "security.backup-on-restore",
+        category: "security",
+        status: "warn",
+        message: "Backup before restore is disabled",
+        fix: "Enable with `tuck config set files.backupOnRestore true`"
+      };
+    }
+    return {
+      id: "security.backup-on-restore",
+      category: "security",
+      status: "pass",
+      message: "Backup before restore is enabled"
+    };
+  }
+};
+var checkHooksSafety = {
+  id: "hooks.commands",
+  category: "hooks",
+  run: async (context) => {
+    if (!context.config) {
+      return {
+        id: "hooks.commands",
+        category: "hooks",
+        status: "warn",
+        message: "Skipped hook checks because config is unavailable"
+      };
+    }
+    const hooks = context.config.hooks;
+    const configuredHooks = Object.entries(hooks).filter(
+      ([, command]) => typeof command === "string" && command.trim().length > 0
+    );
+    if (configuredHooks.length === 0) {
+      return {
+        id: "hooks.commands",
+        category: "hooks",
+        status: "pass",
+        message: "No lifecycle hooks configured"
+      };
+    }
+    const suspiciousPatterns = [/&&/u, /\|\|/u, /;{1}/u, /\$\(/u, /`/u];
+    const suspicious = configuredHooks.filter(
+      ([, command]) => suspiciousPatterns.some((pattern) => pattern.test(command))
+    );
+    if (suspicious.length > 0) {
+      return {
+        id: "hooks.commands",
+        category: "hooks",
+        status: "warn",
+        message: `Detected ${suspicious.length} hook command${suspicious.length === 1 ? "" : "s"} with complex shell syntax`,
+        details: suspicious.map(([name]) => name).join(", "),
+        fix: "Review hook commands and keep them minimal and auditable"
+      };
+    }
+    return {
+      id: "hooks.commands",
+      category: "hooks",
+      status: "pass",
+      message: `Validated ${configuredHooks.length} hook command${configuredHooks.length === 1 ? "" : "s"}`
+    };
+  }
+};
+var doctorChecks = [
+  checkNodeVersion,
+  checkHomeDirectory,
+  checkTuckDirectory,
+  checkGitDirectory,
+  checkGitStatusReadable,
+  checkManifestLoadable,
+  checkConfigLoadable,
+  checkManifestPathSafety,
+  checkManifestDuplicateSources,
+  checkManifestDuplicateDestinations,
+  checkSecretScanning,
+  checkBackupOnRestore,
+  checkHooksSafety
+];
+var buildDoctorSummary = (checks) => {
+  return checks.reduce(
+    (summary, check) => {
+      if (check.status === "pass") {
+        summary.passed += 1;
+      } else if (check.status === "warn") {
+        summary.warnings += 1;
+      } else {
+        summary.failed += 1;
+      }
+      return summary;
+    },
+    {
+      passed: 0,
+      warnings: 0,
+      failed: 0
+    }
+  );
+};
+var buildDoctorContext = async () => {
+  const tuckDir = getTuckDir();
+  const manifestPath = getManifestPath(tuckDir);
+  const configPath = getConfigPath(tuckDir);
+  const hasTuckDir = await pathExists(tuckDir);
+  const isTuckDirDirectory = hasTuckDir ? await isDirectory(tuckDir) : false;
+  const hasGitDir = await pathExists(join18(tuckDir, ".git"));
+  const hasManifestFile = await pathExists(manifestPath);
+  const hasConfigFile = await pathExists(configPath);
+  const context = {
+    tuckDir,
+    manifestPath,
+    configPath,
+    hasTuckDir,
+    isTuckDirDirectory,
+    hasGitDir,
+    hasManifestFile,
+    hasConfigFile
+  };
+  if (hasManifestFile) {
+    try {
+      context.manifest = await loadManifest(tuckDir);
+    } catch (error) {
+      context.manifestLoadError = error instanceof Error ? error.message : String(error);
+    }
+  }
+  if (hasConfigFile) {
+    try {
+      context.config = await loadConfig(tuckDir);
+    } catch (error) {
+      context.configLoadError = error instanceof Error ? error.message : String(error);
+    }
+  }
+  return context;
+};
+var normalizeCategory = (category) => {
+  if (!category) {
+    return void 0;
+  }
+  if (DOCTOR_CATEGORIES.includes(category)) {
+    return category;
+  }
+  return void 0;
+};
+var runDoctorChecks = async (options = {}) => {
+  const context = await buildDoctorContext();
+  const category = normalizeCategory(options.category);
+  const selectedChecks = category ? doctorChecks.filter((check) => check.category === category) : doctorChecks;
+  const checks = [];
+  for (const check of selectedChecks) {
+    try {
+      checks.push(await check.run(context));
+    } catch (error) {
+      checks.push({
+        id: check.id,
+        category: check.category,
+        status: "fail",
+        message: "Doctor check crashed unexpectedly",
+        details: error instanceof Error ? error.message : String(error),
+        fix: "Run with DEBUG=1 and inspect the stack trace"
+      });
+    }
+  }
+  return {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    tuckDir: context.tuckDir,
+    summary: buildDoctorSummary(checks),
+    checks
+  };
+};
+var getDoctorExitCode = (report, strict = false) => {
+  if (report.summary.failed > 0) {
+    return 1;
+  }
+  if (strict && report.summary.warnings > 0) {
+    return 2;
+  }
+  return 0;
+};
+
+// src/commands/doctor.ts
+var isDoctorCategory = (value) => {
+  return DOCTOR_CATEGORIES.includes(value);
+};
+var formatCheckId = (id) => {
+  return id.replace(".", ": ");
+};
+var printHumanReport = (report) => {
+  prompts.intro("tuck doctor");
+  for (const check of report.checks) {
+    const label = `[${check.category}] ${formatCheckId(check.id)} - ${check.message}`;
+    if (check.status === "pass") {
+      logger.success(label);
+    } else if (check.status === "warn") {
+      logger.warning(label);
+    } else {
+      logger.error(label);
+    }
+    if (check.details) {
+      logger.dim(`  Details: ${check.details}`);
+    }
+    if (check.fix) {
+      logger.dim(`  Fix: ${check.fix}`);
+    }
+  }
+  logger.blank();
+  logger.info(
+    `Summary: ${report.summary.passed} passed, ${report.summary.warnings} warnings, ${report.summary.failed} failed`
+  );
+};
+var runDoctor = async (options = {}) => {
+  const report = await runDoctorChecks({
+    category: options.category
+  });
+  if (options.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    printHumanReport(report);
+  }
+  const exitCode = getDoctorExitCode(report, options.strict);
+  process.exitCode = exitCode;
+  if (!options.json) {
+    if (exitCode === 0) {
+      prompts.outro("Doctor checks completed successfully");
+    } else if (exitCode === 2) {
+      prompts.outro("Doctor completed with warnings (strict mode enabled)");
+    } else {
+      prompts.outro("Doctor found blocking issues");
+    }
+  }
+  return report;
+};
+var doctorCommand = new Command17("doctor").description("Run repository health and safety diagnostics").option("--json", "Output as JSON").option("--strict", "Exit non-zero on warnings").option(
+  "-c, --category <category>",
+  `Run only one category (${DOCTOR_CATEGORIES.join("|")})`,
+  (value) => {
+    if (!isDoctorCategory(value)) {
+      throw new Error(
+        `Invalid category "${value}". Expected one of: ${DOCTOR_CATEGORIES.join(", ")}`
+      );
+    }
+    return value;
+  }
+).action(async (options) => {
+  await runDoctor(options);
+});
+
 // src/index.ts
 init_errors();
 init_constants();
@@ -15655,21 +16819,21 @@ var getUpdateCommand = (packageManager) => {
   return "npm update -g @prnv/tuck";
 };
 var waitForEnterOrCancel = () => {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const rl = createInterface({
       input: process.stdin,
       output: process.stdout
     });
     rl.on("close", () => {
-      resolve2(false);
+      resolve3(false);
     });
     rl.on("line", () => {
       rl.close();
-      resolve2(true);
+      resolve3(true);
     });
     process.on("SIGINT", () => {
       rl.close();
-      resolve2(false);
+      resolve3(false);
     });
   });
 };
@@ -15765,7 +16929,7 @@ init_banner();
 init_paths();
 init_manifest();
 init_git();
-var program = new Command17();
+var program = new Command18();
 program.name("tuck").description(DESCRIPTION).version(VERSION, "-v, --version", "Display version number").configureOutput({
   outputError: (str, write) => write(chalk6.red(str))
 }).addHelpText("before", customHelp(VERSION)).helpOption("-h, --help", "Display this help message").showHelpAfterError(false);
@@ -15785,6 +16949,7 @@ program.addCommand(undoCommand);
 program.addCommand(scanCommand);
 program.addCommand(secretsCommand);
 program.addCommand(encryptionCommand);
+program.addCommand(doctorCommand);
 var runDefaultAction = async () => {
   const tuckDir = getTuckDir();
   if (!await pathExists(tuckDir)) {