git-sich 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,1570 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { realpathSync as realpathSync3, statSync } from "node:fs";
+import { resolve as resolve6 } from "node:path";
+// package.json
+var version = "0.1.0";
+
+// src/ui.ts
+class SichError extends Error {
+}
+function fail(message) {
+  throw new SichError(message);
+}
+var colorOut = !!process.stdout.isTTY && !process.env.NO_COLOR;
+var colorErr = colorOut && !!process.stderr.isTTY;
+function painter(enabled) {
+  const wrap = (code) => (s) => enabled ? `\x1B[${code}m${s}\x1B[0m` : s;
+  return {
+    bold: wrap("1"),
+    dim: wrap("2"),
+    red: wrap("31"),
+    green: wrap("32"),
+    yellow: wrap("33"),
+    cyan: wrap("36")
+  };
+}
+var c = painter(colorOut);
+var ce = painter(colorErr);
+function out(line = "") {
+  process.stdout.write(line + `
+`);
+}
+function note(line) {
+  out(c.dim(line));
+}
+function warn(message) {
+  process.stderr.write(`${ce.yellow("warning:")} ${message}
+`);
+}
+function printError(message) {
+  process.stderr.write(`${ce.red("sich:")} ${message}
+`);
+}
+function plural(n, word, pluralWord = word + "s") {
+  return `${n} ${n === 1 ? word : pluralWord}`;
+}
+function shellQuote(s) {
+  return /^[\w@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function listSome(items, max = 5) {
+  if (items.length <= max)
+    return items.join(", ");
+  return `${items.slice(0, max).join(", ")} and ${items.length - max} more`;
+}
+
+// src/args.ts
+function parseArgs(argv, spec, aliases = {}) {
+  const flags = {};
+  const positionals = [];
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (!arg.startsWith("-") || arg === "-") {
+      positionals.push(arg);
+      continue;
+    }
+    let name = arg;
+    let value;
+    const eq = arg.indexOf("=");
+    if (arg.startsWith("--") && eq > 0) {
+      name = arg.slice(0, eq);
+      value = arg.slice(eq + 1);
+    }
+    name = aliases[name] ?? name;
+    const kind = spec[name];
+    if (!kind)
+      fail(`unknown option '${arg}'`);
+    if (kind === "bool") {
+      if (value !== undefined)
+        fail(`option '${name}' takes no value`);
+      flags[name] = true;
+    } else if (kind === "value") {
+      if (value === undefined) {
+        value = argv[++i];
+        if (value === undefined)
+          fail(`option '${name}' needs a value`);
+      }
+      flags[name] = value;
+    } else {
+      const next = argv[i + 1];
+      if (value === undefined && next !== undefined && !next.startsWith("-")) {
+        value = next;
+        i++;
+      }
+      flags[name] = value ?? true;
+    }
+  }
+  return { flags, positionals };
+}
+function str(p, name) {
+  const v = p.flags[name];
+  return typeof v === "string" ? v : undefined;
+}
+function wantsHelp(argv) {
+  for (const a of argv) {
+    if (a === "--")
+      return false;
+    if (a === "--help" || a === "-h")
+      return true;
+  }
+  return false;
+}
+
+// src/claims.ts
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+var isDirClaim = (c2) => c2.endsWith("/");
+var bare = (c2) => isDirClaim(c2) ? c2.slice(0, -1) : c2;
+function samePath(a, b) {
+  return bare(a) === bare(b);
+}
+function isInside(p, dir) {
+  return bare(p).startsWith(bare(dir) + "/");
+}
+function covers(claim, p) {
+  return samePath(claim, p) || isDirClaim(claim) && isInside(p, claim);
+}
+function cleanClaim(raw) {
+  let p = raw.trim();
+  while (p.startsWith("./"))
+    p = p.slice(2);
+  if (p.startsWith("/"))
+    p = p.replace(/^\/+/, "");
+  const dir = p.endsWith("/");
+  const segs = bare(p).split("/");
+  if (!p || segs.some((s) => s === "" || s === "." || s === "..") || p.includes("\x00"))
+    return null;
+  if (segs[0] === ".git" || segs[0] === ".sich")
+    return null;
+  return segs.join("/") + (dir ? "/" : "");
+}
+function storable(claim) {
+  return !/[\r\n]/.test(claim) && !claim.startsWith("#") && cleanClaim(claim) === claim;
+}
+function normalizeClaims(claims) {
+  const unique = [...new Set(claims)];
+  const kept = unique.filter((c2) => !(!isDirClaim(c2) && unique.includes(c2 + "/")));
+  return kept.filter((c2) => !kept.some((d) => d !== c2 && isDirClaim(d) && isInside(c2, d))).sort();
+}
+var warned = new Set;
+function warnOnce(message) {
+  if (warned.has(message))
+    return;
+  warned.add(message);
+  warn(message);
+}
+function readManifest(file, layer) {
+  if (!existsSync(file))
+    return { claims: [], comments: [] };
+  const claims = [];
+  const comments = [];
+  for (const line of readFileSync(file, "utf8").split(`
+`)) {
+    const t = line.trim();
+    if (!t)
+      continue;
+    if (t.startsWith("#")) {
+      comments.push(line.trimEnd());
+      continue;
+    }
+    const claim = cleanClaim(t);
+    if (claim)
+      claims.push(claim);
+    else
+      warnOnce(`${layer}: ignoring invalid claim ${JSON.stringify(t)} in .sich/${layer}.paths`);
+  }
+  return { claims: normalizeClaims(claims), comments };
+}
+function writeManifest(file, m) {
+  const body = [...m.comments, ...normalizeClaims(m.claims)];
+  writeFileSync(file, body.length ? body.join(`
+`) + `
+` : "");
+}
+function ownerOf(all, p, icase = false) {
+  const fold = (s) => icase ? s.toLowerCase() : s;
+  const path = fold(p);
+  let best = null;
+  for (const [layer, claims] of all) {
+    for (const claim of claims) {
+      if (covers(fold(claim), path) && (!best || bare(claim).length > bare(best.claim).length)) {
+        best = { layer, claim };
+      }
+    }
+  }
+  return best;
+}
+
+// src/context.ts
+import { existsSync as existsSync3, lstatSync, readdirSync, realpathSync } from "node:fs";
+import { basename, dirname as dirname2, isAbsolute, join, relative as relative2, resolve as resolve2, sep } from "node:path";
+
+// src/excludes.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+
+// src/git.ts
+import { spawnSync } from "node:child_process";
+var STRIPPED_ENV = [
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR",
+  "GIT_PREFIX",
+  "GIT_NAMESPACE",
+  "GIT_QUARANTINE_PATH",
+  "GIT_IMPLICIT_WORK_TREE",
+  "GIT_INTERNAL_SUPER_PREFIX",
+  "GIT_LITERAL_PATHSPECS",
+  "GIT_GLOB_PATHSPECS",
+  "GIT_NOGLOB_PATHSPECS",
+  "GIT_ICASE_PATHSPECS"
+];
+function cleanEnv(extra = {}) {
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (v !== undefined && !STRIPPED_ENV.includes(k))
+      env[k] = v;
+  }
+  return { ...env, ...extra };
+}
+function spawn(cmd, cwd, env, inherit) {
+  const r = spawnSync(cmd[0], cmd.slice(1), {
+    cwd,
+    env,
+    encoding: "utf8",
+    stdio: inherit ? "inherit" : ["ignore", "pipe", "pipe"],
+    maxBuffer: 1024 ** 3
+  });
+  if (r.error)
+    fail(`cannot run ${cmd[0]}: ${r.error.message}`);
+  return { code: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+}
+function repoArgs(repo) {
+  return [`--git-dir=${repo.gitDir}`, `--work-tree=${repo.workTree}`];
+}
+function git(repo, args, opts = {}) {
+  const literal = opts.literal ?? true;
+  const env = cleanEnv({ GIT_LITERAL_PATHSPECS: literal ? "1" : "0", GIT_OPTIONAL_LOCKS: "0", ...opts.env });
+  const result = spawn(["git", ...repoArgs(repo), ...args], opts.cwd ?? repo.workTree, env, false);
+  if (result.code !== 0 && !opts.allowFail) {
+    const msg = result.stderr.trim().split(`
+`).filter(Boolean).pop() ?? `exit code ${result.code}`;
+    fail(`${repo.name}: git ${args[0]} failed: ${msg}`);
+  }
+  return result;
+}
+function gitInherit(repo, args, cwd) {
+  return spawn(["git", ...repoArgs(repo), ...args], cwd ?? repo.workTree, cleanEnv(), true).code;
+}
+function gitPlain(args, cwd) {
+  return spawn(["git", ...args], cwd, cleanEnv(), false);
+}
+function splitZ(s) {
+  return s.split("\x00").filter((x) => x !== "");
+}
+function lines(s) {
+  return s.split(`
+`).filter((x) => x !== "");
+}
+function trackedUnder(repo, paths) {
+  if (paths.length === 0)
+    return [];
+  return splitZ(git(repo, ["ls-files", "-z", "--cached", "--", ...paths]).stdout);
+}
+function isIgnored(repo, path, noIndex = false) {
+  const args = ["check-ignore", "-q", ...noIndex ? ["--no-index"] : [], "--", path];
+  return git(repo, args, { allowFail: true, literal: false }).code === 0;
+}
+function currentBranch(repo) {
+  const r = git(repo, ["symbolic-ref", "--short", "-q", "HEAD"], { allowFail: true });
+  return r.code === 0 ? r.stdout.trim() : null;
+}
+function upstreamOf(repo) {
+  const r = git(repo, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], { allowFail: true });
+  return r.code === 0 && r.stdout.trim() ? r.stdout.trim() : null;
+}
+function remotesOf(repo) {
+  return lines(git(repo, ["remote"]).stdout);
+}
+
+// src/excludes.ts
+var BLOCK_BEGIN = "# >>> sich: managed, do not edit >>>";
+var BLOCK_END = "# <<< sich <<<";
+function escapePattern(p) {
+  return p.replace(/[\\*?[]/g, (m) => "\\" + m).replace(/ $/, "\\ ");
+}
+function baseExcludeLines(allClaims) {
+  const patterns = [...new Set(allClaims)].sort().map((c2) => "/" + escapePattern(c2));
+  return ["/.sich/", ...patterns];
+}
+function layerExcludeLines(layer, own, others) {
+  const root = { kind: "parent", children: new Map };
+  const insert = (claim) => {
+    const segs = bare(claim).split("/");
+    let node = root;
+    for (let i = 0;i < segs.length; i++) {
+      const seg = segs[i];
+      let child = node.children.get(seg);
+      if (!child) {
+        child = { kind: "parent", children: new Map };
+        node.children.set(seg, child);
+      }
+      if (child.kind !== "parent")
+        return;
+      if (i === segs.length - 1) {
+        child.kind = isDirClaim(claim) ? "dir" : "file";
+        child.children.clear();
+      }
+      node = child;
+    }
+  };
+  const ownWithManifest = [...own, `.sich/${layer}.paths`];
+  [...ownWithManifest].sort((a, b) => bare(a).split("/").length - bare(b).split("/").length).forEach(insert);
+  const out2 = ["/*"];
+  const emit = (node, prefix) => {
+    for (const name of [...node.children.keys()].sort()) {
+      const child = node.children.get(name);
+      const p = escapePattern(prefix + name);
+      if (child.kind === "dir")
+        out2.push(`!/${p}/`);
+      else if (child.kind === "file")
+        out2.push(`!/${p}`);
+      else {
+        out2.push(`!/${p}/`, `/${p}/*`);
+        emit(child, prefix + name + "/");
+      }
+    }
+  };
+  emit(root, "");
+  const carve = [...new Set(others)].filter((o) => !own.some((c2) => samePath(o, c2) || isInside(c2, o))).sort();
+  for (const o of carve)
+    out2.push("/" + escapePattern(o));
+  return out2;
+}
+function spliceBlock(content, body) {
+  const block = [BLOCK_BEGIN, ...body, BLOCK_END].join(`
+`) + `
+`;
+  const start = content.indexOf(BLOCK_BEGIN);
+  if (start === -1) {
+    const pre = content && !content.endsWith(`
+`) ? content + `
+` : content;
+    return pre + block;
+  }
+  const end = content.indexOf(BLOCK_END, start);
+  let after = end === -1 ? "" : content.slice(end + BLOCK_END.length);
+  if (after.startsWith(`
+`))
+    after = after.slice(1);
+  return content.slice(0, start) + block + after;
+}
+function excludeFile(repo) {
+  const p = git(repo, ["rev-parse", "--git-path", "info/exclude"]).stdout.trim();
+  return resolve(repo.workTree, p);
+}
+function excludeFileShown(repo) {
+  return relative(repo.workTree, excludeFile(repo));
+}
+function describeExclude(t) {
+  const file = excludeFileShown(t.repo);
+  if (t.repo.name !== "base")
+    return `${t.repo.name} ignores everything except its claims -> ${file}`;
+  const claims = t.lines.length - 1;
+  return `excluded .sich/${claims ? ` and ${plural(claims, "private path")}` : ""} from base -> ${file}`;
+}
+function applyExclude(t, write) {
+  const file = excludeFile(t.repo);
+  const current = existsSync2(file) ? readFileSync2(file, "utf8") : "";
+  const next = spliceBlock(current, t.lines);
+  if (next === current)
+    return false;
+  if (write) {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync2(file, next);
+  }
+  return true;
+}
+
+// src/context.ts
+var COMMANDS = [
+  "init",
+  "new",
+  "attach",
+  "add",
+  "rm",
+  "which",
+  "ls",
+  "status",
+  "commit",
+  "pull",
+  "push",
+  "sync",
+  "check",
+  "help"
+];
+var LAYER_NAME = /^[a-z0-9][a-z0-9._-]*$/;
+function validateLayerName(name) {
+  if (name === "base" || COMMANDS.includes(name)) {
+    fail(`'${name}' is reserved and cannot be a layer name`);
+  }
+  if (!LAYER_NAME.test(name)) {
+    fail(`invalid layer name '${name}' (use lowercase letters, digits, '.', '_' or '-', starting with a letter or digit)`);
+  }
+  if (name.endsWith(".paths") || name.endsWith(".lock"))
+    fail(`invalid layer name '${name}'`);
+}
+function loadCtx(cwd) {
+  let dir = cwd;
+  while (!existsSync3(join(dir, ".git"))) {
+    const up = dirname2(dir);
+    if (up === dir)
+      fail("not inside a git repository (sich needs a base repo: run git init first)");
+    dir = up;
+  }
+  const r = gitPlain(["rev-parse", "--absolute-git-dir"], dir);
+  if (r.code !== 0)
+    fail(`cannot read the git repository at ${dir}: ${r.stderr.trim()}`);
+  const root = dir;
+  return {
+    cwd,
+    root,
+    base: { name: "base", gitDir: r.stdout.trim(), workTree: root },
+    sichDir: join(root, ".sich")
+  };
+}
+function isInitialized(ctx) {
+  return existsSync3(ctx.sichDir);
+}
+function requireInit(ctx) {
+  if (!isInitialized(ctx))
+    fail(`sich is not initialized in ${ctx.root} (run: sich init)`);
+}
+function layerRepo(ctx, name) {
+  return { name, gitDir: join(ctx.sichDir, name), workTree: ctx.root };
+}
+function manifestPath(ctx, layer) {
+  return join(ctx.sichDir, `${layer}.paths`);
+}
+function manifestRel(layer) {
+  return `.sich/${layer}.paths`;
+}
+function layerNames(ctx) {
+  if (!existsSync3(ctx.sichDir))
+    return [];
+  return readdirSync(ctx.sichDir, { withFileTypes: true }).filter((e) => e.isDirectory() && LAYER_NAME.test(e.name) && existsSync3(join(ctx.sichDir, e.name, "HEAD"))).map((e) => e.name).sort();
+}
+function layerExists(ctx, name) {
+  return layerNames(ctx).includes(name);
+}
+function requireLayer(ctx, name) {
+  if (!name)
+    fail("missing layer name");
+  if (name === "base")
+    fail("'base' is the public repo, not a layer");
+  if (!layerExists(ctx, name))
+    fail(`no such layer '${name}' (layers: ${layerNames(ctx).join(", ") || "none"})`);
+  return layerRepo(ctx, name);
+}
+function repoByName(ctx, name) {
+  if (name === "base")
+    return ctx.base;
+  return requireLayer(ctx, name);
+}
+function allClaims(ctx) {
+  const m = new Map;
+  for (const l of layerNames(ctx))
+    m.set(l, readManifest(manifestPath(ctx, l), l).claims);
+  return m;
+}
+function excludeTargets(ctx) {
+  const claims = allClaims(ctx);
+  const everything = [...claims.values()].flat();
+  const targets = [{ repo: ctx.base, lines: baseExcludeLines(everything) }];
+  for (const [layer, own] of claims) {
+    const others = [...claims].filter(([l]) => l !== layer).flatMap(([, cs]) => cs);
+    targets.push({ repo: layerRepo(ctx, layer), lines: layerExcludeLines(layer, own, others) });
+  }
+  return targets;
+}
+function syncExcludes(ctx) {
+  if (!isInitialized(ctx))
+    return;
+  for (const t of excludeTargets(ctx))
+    applyExclude(t, true);
+}
+function ignoresCase(ctx) {
+  const r = git(ctx.base, ["config", "--type=bool", "--get", "core.ignorecase"], { allowFail: true });
+  return r.stdout.trim() === "true";
+}
+function onDiskName(dir, name) {
+  try {
+    lstatSync(join(dir, name));
+    const entries = readdirSync(dir);
+    if (entries.includes(name))
+      return name;
+    return entries.find((e) => e.toLowerCase() === name.toLowerCase()) ?? name;
+  } catch {
+    return name;
+  }
+}
+function realParent(abs) {
+  const parent = dirname2(abs);
+  if (parent === abs)
+    return abs;
+  let real;
+  try {
+    real = realpathSync.native(parent);
+  } catch {
+    real = realParent(parent);
+  }
+  return join(real, onDiskName(real, basename(abs)));
+}
+function resolveUserPath(ctx, input, opts = {}) {
+  const abs = realParent(resolve2(ctx.cwd, input));
+  const rel = relative2(ctx.root, abs);
+  if (rel === "")
+    fail(`'${input}' is the repository root`);
+  if (rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel))
+    fail(`'${input}' is outside the repository`);
+  const posix = rel.split(sep).join("/");
+  const first = posix.split("/")[0];
+  if (first === ".git" || first === ".sich" && !opts.allowSich)
+    fail(`'${input}' is inside ${first}/`);
+  let exists = false;
+  let isDir = false;
+  try {
+    const st = lstatSync(abs);
+    exists = true;
+    isDir = st.isDirectory();
+  } catch {}
+  return { rel: posix, exists, isDir };
+}
+function collisions(ctx, paths) {
+  const hits = new Set;
+  const kind = (rel) => {
+    try {
+      return lstatSync(join(ctx.root, rel)).isDirectory() ? "dir" : "file";
+    } catch {
+      return null;
+    }
+  };
+  for (const p of paths) {
+    if (kind(p))
+      hits.add(p);
+    const segs = p.split("/");
+    for (let i = 1;i < segs.length; i++) {
+      const parent = segs.slice(0, i).join("/");
+      if (kind(parent) === "file")
+        hits.add(parent);
+    }
+  }
+  return [...hits].sort();
+}
+
+// src/commands/add.ts
+function cmdAdd(ctx, args) {
+  const p = parseArgs(args, { "--move": "bool" });
+  const [layer, ...inputs] = p.positionals;
+  if (!layer || inputs.length === 0)
+    fail("usage: sich add <layer> <path...> [--move]");
+  const move = p.flags["--move"] === true;
+  const repo = requireLayer(ctx, layer);
+  const claims = allClaims(ctx);
+  const own = claims.get(layer) ?? [];
+  const icase = ignoresCase(ctx);
+  const fold = (s) => icase ? s.toLowerCase() : s;
+  const targets = [];
+  for (const input of inputs) {
+    const up = resolveUserPath(ctx, input);
+    if (!up.exists)
+      fail(`'${input}' does not exist`);
+    const claim = up.isDir ? up.rel + "/" : up.rel;
+    if (!storable(claim)) {
+      fail(`cannot claim '${up.rel}': claims can't start with '#', start or end with whitespace, ` + `or contain line breaks (rename it, or claim a directory containing it)`);
+    }
+    if (!targets.includes(claim))
+      targets.push(claim);
+  }
+  const moves = [];
+  for (const t of targets) {
+    const inBase = trackedUnder(ctx.base, [t]);
+    if (inBase.length) {
+      if (!move) {
+        fail(`${t} is tracked by base (${listSome(inBase, 3)}); use --move to move it into ${layer}`);
+      }
+      moves.push({ from: ctx.base, claim: t, files: inBase, dropClaims: [] });
+    }
+    for (const other of layerNames(ctx)) {
+      if (other === layer)
+        continue;
+      const theirs = claims.get(other) ?? [];
+      const outer = theirs.find((cl) => isDirClaim(cl) && isInside(fold(t), fold(cl)));
+      if (outer) {
+        fail(`${t} is inside ${outer}, claimed by layer ${other}; claims can't nest across layers ` + `(to move all of it: sich add ${layer} ${outer} --move)`);
+      }
+      const inner = theirs.filter((cl) => covers(fold(t), fold(cl)));
+      const tracked = trackedUnder(layerRepo(ctx, other), [t]);
+      if (inner.length === 0 && tracked.length === 0)
+        continue;
+      if (!move) {
+        const why = inner.some((cl) => samePath(fold(cl), fold(t))) ? `is claimed by layer ${other}` : inner.length ? `contains ${listSome(inner, 3)}, claimed by layer ${other}` : `is tracked by layer ${other}`;
+        fail(`${t} ${why}; use --move to move it into ${layer}`);
+      }
+      moves.push({ from: layerRepo(ctx, other), claim: t, files: tracked, dropClaims: inner });
+    }
+  }
+  for (const m of moves) {
+    if (m.files.length)
+      git(m.from, ["rm", "--cached", "-q", "--", ...m.files]);
+    if (m.dropClaims.length) {
+      const file2 = manifestPath(ctx, m.from.name);
+      const man2 = readManifest(file2, m.from.name);
+      writeManifest(file2, { ...man2, claims: man2.claims.filter((cl) => !m.dropClaims.includes(cl)) });
+      git(m.from, ["add", "-f", "--", manifestRel(m.from.name)]);
+    }
+    if (m.from.name === "base") {
+      warn(`moved ${m.claim} out of base: its removal is staged in base, commit it there (git commit). ` + `Old versions remain in base's history (and on its remote, which may be public). ` + `Rewrite that history and rotate any secrets if that matters.`);
+    } else {
+      const changes = [
+        m.dropClaims.length && `dropped its ${plural(m.dropClaims.length, "claim")} ${listSome(m.dropClaims)} -> ${manifestRel(m.from.name)}`,
+        m.files.length && `untracked ${plural(m.files.length, "file")} there`
+      ].filter(Boolean);
+      warn(`moved ${m.claim} from ${m.from.name}: ${changes.join("; ")} ` + `(commit with: sich commit ${m.from.name} -m <msg>)`);
+    }
+  }
+  const file = manifestPath(ctx, layer);
+  const man = readManifest(file, layer);
+  const already = targets.filter((t) => own.some((cl) => covers(cl, t)));
+  writeManifest(file, { ...man, claims: normalizeClaims([...man.claims, ...targets]) });
+  syncExcludes(ctx);
+  for (const t of targets)
+    stage(repo, t);
+  git(repo, ["add", "-f", "--", manifestRel(layer)]);
+  for (const t of already)
+    note(`${t} was already claimed by ${layer}`);
+  out(`${c.green("claimed")} ${listSome(targets)} for ${c.bold(layer)} -> ${manifestRel(layer)}`);
+  out(`hidden from base -> ${excludeFileShown(ctx.base)}`);
+  note(`staged in ${layer}; commit with: sich commit ${layer} -m <msg>`);
+  return 0;
+}
+function stage(repo, claim) {
+  if (!isDirClaim(claim)) {
+    git(repo, ["add", "-f", "--", claim]);
+    return;
+  }
+  const candidates = splitZ(git(repo, ["ls-files", "-z", "-c", "-o", "--exclude-standard", "--", claim]).stdout);
+  if (candidates.length) {
+    git(repo, ["add", "-A", "--", claim]);
+  } else if (isIgnored(repo, bare(claim))) {
+    warn(`${claim} is ignored by a .gitignore, so nothing in it was staged; claim individual files instead`);
+  } else {
+    note(`${claim} has no files yet; new files in it will belong to ${repo.name}`);
+  }
+}
+function cmdRm(ctx, args) {
+  const p = parseArgs(args, {});
+  const [layer, ...inputs] = p.positionals;
+  if (!layer || inputs.length === 0)
+    fail("usage: sich rm <layer> <path...>");
+  const repo = requireLayer(ctx, layer);
+  const file = manifestPath(ctx, layer);
+  const man = readManifest(file, layer);
+  const remove = [];
+  for (const input of inputs) {
+    const up = resolveUserPath(ctx, input);
+    const forms = up.exists ? [up.isDir ? up.rel + "/" : up.rel] : [up.rel, up.rel + "/"];
+    const hit = man.claims.find((cl) => forms.includes(cl));
+    if (!hit) {
+      const parent = man.claims.find((cl) => covers(cl, up.rel));
+      fail(`${up.rel} is not claimed by ${layer}` + (parent ? ` (it is inside the claim ${parent})` : ""));
+    }
+    if (!remove.includes(hit))
+      remove.push(hit);
+  }
+  writeManifest(file, { ...man, claims: man.claims.filter((cl) => !remove.includes(cl)) });
+  for (const cl of remove)
+    git(repo, ["rm", "--cached", "-r", "-q", "--ignore-unmatch", "--", cl]);
+  syncExcludes(ctx);
+  git(repo, ["add", "-f", "--", manifestRel(layer)]);
+  out(`${c.green("released")} ${listSome(remove)} from ${c.bold(layer)} -> ${manifestRel(layer)}`);
+  out(`no longer hidden from base -> ${excludeFileShown(ctx.base)}`);
+  note(`staged in ${layer}; commit with: sich commit ${layer} -m <msg>`);
+  note(`${plural(remove.length, "path")} left on disk; they now show as untracked in base (add, delete or .gitignore them)`);
+  return 0;
+}
+
+// src/commands/check.ts
+import { realpathSync as realpathSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname3, resolve as resolve3 } from "node:path";
+function hookIndexEnv(ctx) {
+  const raw = process.env.GIT_INDEX_FILE;
+  if (!raw)
+    return {};
+  try {
+    const abs = resolve3(raw);
+    const real = resolve3(realpathSync2(dirname3(abs)), basename2(abs));
+    const gitDir = realpathSync2(ctx.base.gitDir);
+    return real.startsWith(gitDir + "/") ? { GIT_INDEX_FILE: real } : {};
+  } catch {
+    return {};
+  }
+}
+function cmdCheck(ctx, args) {
+  const p = parseArgs(args, { "--fix": "bool", "--staged": "bool" });
+  if (p.positionals.length)
+    fail("usage: sich check [--fix] [--staged]");
+  if (!isInitialized(ctx)) {
+    if (p.flags["--staged"])
+      return 0;
+    requireInit(ctx);
+  }
+  const problems = [];
+  const stale = [];
+  const fixed = [];
+  const hints = [];
+  const claims = allClaims(ctx);
+  const layers = layerNames(ctx);
+  const indexEnv = hookIndexEnv(ctx);
+  const icase = ignoresCase(ctx);
+  const fold = (s) => icase ? s.toLowerCase() : s;
+  const owner = (f) => ownerOf(claims, f, icase);
+  const isSich = (f) => fold(f).startsWith(".sich/");
+  const flat = [...claims].flatMap(([layer, cs]) => cs.map((claim) => ({ layer, claim })));
+  for (const [i, a] of flat.entries()) {
+    for (const b of flat.slice(i + 1)) {
+      if (a.layer === b.layer)
+        continue;
+      const [x, y] = [fold(a.claim), fold(b.claim)];
+      if (samePath(x, y)) {
+        problems.push(`${bare(a.claim)} is claimed by more than one layer: ${a.layer}, ${b.layer}`);
+      } else if (covers(x, y) || covers(y, x)) {
+        const [outer, inner] = covers(x, y) ? [a, b] : [b, a];
+        problems.push(`${inner.claim} (${inner.layer}) is nested inside ${outer.claim} (${outer.layer}); ` + `claims can't nest across layers (fix: sich rm ${inner.layer} ${shellQuote(inner.claim)})`);
+      }
+    }
+  }
+  const trackedBy = new Map;
+  for (const layer of layers) {
+    for (const f of splitZ(git(layerRepo(ctx, layer), ["ls-files", "-z"]).stdout)) {
+      if (f === manifestRel(layer))
+        continue;
+      trackedBy.set(f, [...trackedBy.get(f) ?? [], layer]);
+    }
+  }
+  for (const [f, ls] of trackedBy) {
+    const by = owner(f)?.layer;
+    if (ls.length > 1) {
+      problems.push(`${f} is tracked by more than one layer: ${ls.join(", ")}${by ? ` (owner: ${by})` : ""}`);
+    } else if (by !== ls[0]) {
+      const why = by ? `it belongs to ${by}` : "none of its claims cover it";
+      problems.push(`${ls[0]} tracks ${f} but ${why} (fix: sich ${ls[0]} rm --cached -- ${shellQuote(f)})`);
+    }
+  }
+  const reported = new Set;
+  if (p.flags["--staged"]) {
+    const staged = splitZ(git(ctx.base, ["diff", "--cached", "--name-only", "--no-renames", "--diff-filter=d", "-z"], { env: indexEnv }).stdout);
+    const stagedPrivate = staged.filter((f) => isSich(f) || owner(f));
+    for (const f of stagedPrivate) {
+      const by = owner(f);
+      problems.push(`base has a staged change to private path ${f}${by ? ` (claimed by ${by.layer})` : ""}`);
+      reported.add(f);
+    }
+    if (stagedPrivate.length) {
+      hints.push(`unstage with: git restore --staged -- ${stagedPrivate.map(shellQuote).join(" ")}`);
+    }
+  }
+  let sichFiles = 0;
+  for (const f of splitZ(git(ctx.base, ["ls-files", "-z"], { env: indexEnv }).stdout)) {
+    if (reported.has(f))
+      continue;
+    if (isSich(f)) {
+      sichFiles++;
+      continue;
+    }
+    const by = owner(f);
+    if (by)
+      problems.push(`base tracks ${f}, which is claimed by ${by.layer} (fix: git rm --cached -- ${shellQuote(f)})`);
+  }
+  if (sichFiles) {
+    problems.push(`base tracks ${plural(sichFiles, "file")} under .sich/ (fix: git rm -r --cached -- .sich/)`);
+  }
+  for (const t of excludeTargets(ctx)) {
+    if (!applyExclude(t, false))
+      continue;
+    if (p.flags["--fix"]) {
+      applyExclude(t, true);
+      fixed.push(`rewrote: ${describeExclude(t)}`);
+    } else {
+      stale.push(`stale exclude rules of ${t.repo.name} in ${excludeFileShown(t.repo)} (fix: sich check --fix)`);
+    }
+  }
+  const hook = p.flags["--staged"] === true;
+  const blocking = hook ? problems : [...problems, ...stale];
+  for (const f of fixed)
+    out(`${c.green("✓")} ${f}`);
+  if (hook)
+    for (const s of stale)
+      warn(`${s}; not blocking this commit`);
+  for (const i of blocking)
+    out(`${c.red("✗")} ${i}`);
+  for (const h of hints)
+    out(`  ${h}`);
+  if (blocking.length) {
+    out(c.red(`sich check: ${plural(blocking.length, "issue")} found`));
+    return 1;
+  }
+  if (!hook)
+    out(c.green("sich check: ok"));
+  return 0;
+}
+
+// src/commands/commit.ts
+function cmdCommit(ctx, args) {
+  const p = parseArgs(args, { "-m": "value" }, { "--message": "-m" });
+  const message = str(p, "-m");
+  if (!message)
+    fail("usage: sich commit [repo...] -m <msg>");
+  const named = p.positionals.length > 0;
+  const names = named ? [...new Set(p.positionals)] : ["base", ...layerNames(ctx)];
+  const repos = names.map((n) => repoByName(ctx, n));
+  const claims = allClaims(ctx);
+  const icase = ignoresCase(ctx);
+  const ownerRepo = (f) => {
+    if (f.startsWith(".sich/"))
+      return layerNames(ctx).find((l) => f === manifestRel(l)) ?? null;
+    return ownerOf(claims, f, icase)?.layer ?? "base";
+  };
+  let committed = 0;
+  for (const repo of repos) {
+    git(repo, ["add", "-A"]);
+    const changed = git(repo, ["diff", "--cached", "--name-only", "--no-renames", "--diff-filter=d", "-z"]).stdout;
+    const stray = splitZ(changed).filter((f) => ownerRepo(f) !== repo.name);
+    if (stray.length) {
+      git(repo, ["reset", "-q", "--", ...stray]);
+      warn(`${repo.name}: left out ${plural(stray.length, "file")} it doesn't own: ${listSome(stray)} (see: sich check)`);
+    }
+    const files = splitZ(git(repo, ["diff", "--cached", "--name-only", "-z"]).stdout);
+    if (files.length === 0) {
+      if (named)
+        note(`${repo.name}: nothing to commit`);
+      continue;
+    }
+    const r = git(repo, ["commit", "-q", "-m", message], { allowFail: true });
+    if (r.code !== 0) {
+      process.stderr.write(r.stderr + r.stdout);
+      fail(`${repo.name}: commit failed (nothing committed there)`);
+    }
+    const sha = git(repo, ["rev-parse", "--short", "HEAD"]).stdout.trim();
+    out(`${c.bold(repo.name)}: committed ${c.yellow(sha)} (${plural(files.length, "file")}): ${listSome(files)}`);
+    committed++;
+  }
+  if (committed === 0 && !named)
+    note("nothing to commit");
+  return 0;
+}
+
+// src/commands/init.ts
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join2, relative as relative3, resolve as resolve4 } from "node:path";
+var HOOK_MARKER = /sich\S*\s+check --staged/;
+var HOOK_HEADER = "# Installed by sich:";
+var HOOK_LINE = '"${SICH_BIN:-sich}" check --staged || exit 1';
+var HOOK_BODY = `#!/bin/sh
+${HOOK_HEADER} stop private (layer-claimed) files from being committed to base.
+sich="\${SICH_BIN:-sich}"
+if ! command -v "$sich" >/dev/null 2>&1; then
+  echo "sich: commit blocked: '$sich' not found; put sich on PATH or set SICH_BIN (skip once: git commit --no-verify)" >&2
+  exit 1
+fi
+exec "$sich" check --staged
+`;
+function ensureInit(ctx) {
+  const fresh = !isInitialized(ctx);
+  if (fresh) {
+    mkdirSync2(ctx.sichDir, { recursive: true });
+    out(`created ${c.bold(".sich/")} (holds every layer's git data and claims list)`);
+  }
+  for (const t of excludeTargets(ctx)) {
+    if (applyExclude(t, true))
+      out(describeExclude(t));
+  }
+  installHook(ctx);
+}
+function installHook(ctx) {
+  const hooksDir = resolve4(ctx.root, git(ctx.base, ["rev-parse", "--git-path", "hooks"]).stdout.trim());
+  const hook = join2(hooksDir, "pre-commit");
+  const shown = relative3(ctx.root, hook) || hook;
+  const hooksPath = git(ctx.base, ["config", "--get", "core.hooksPath"], { allowFail: true }).stdout.trim();
+  if (existsSync4(hook)) {
+    const current = readFileSync3(hook, "utf8");
+    if (current.includes(HOOK_HEADER)) {
+      if (current !== HOOK_BODY) {
+        writeFileSync3(hook, HOOK_BODY);
+        chmodSync(hook, 493);
+        out(`updated pre-commit hook -> ${shown}`);
+      }
+      return;
+    }
+    if (HOOK_MARKER.test(current))
+      return;
+    out(`${c.yellow("pre-commit hook exists")} (${shown}); add this line to it:`);
+    out(`  ${HOOK_LINE}`);
+    return;
+  }
+  if (hooksPath) {
+    out(`${c.yellow("core.hooksPath is set")} (${hooksPath}); add this line to its pre-commit hook:`);
+    out(`  ${HOOK_LINE}`);
+    return;
+  }
+  mkdirSync2(hooksDir, { recursive: true });
+  writeFileSync3(hook, HOOK_BODY);
+  chmodSync(hook, 493);
+  out(`installed pre-commit hook -> ${shown}`);
+}
+function cmdInit(ctx, args) {
+  if (parseArgs(args, {}).positionals.length)
+    fail("usage: sich init");
+  const already = isInitialized(ctx);
+  ensureInit(ctx);
+  out(already ? `sich already initialized in ${ctx.root}` : `${c.green("initialized")} sich in ${ctx.root}`);
+  return 0;
+}
+
+// src/commands/inspect.ts
+function cmdWhich(ctx, args) {
+  const p = parseArgs(args, {});
+  const [input, ...extra] = p.positionals;
+  if (!input || extra.length)
+    fail("usage: sich which <path>");
+  const up = resolveUserPath(ctx, input, { allowSich: true });
+  const path = up.rel;
+  const owner = ownerOf(allClaims(ctx), path);
+  if (owner) {
+    const tracked = trackedUnder(layerRepo(ctx, owner.layer), [path]).length > 0;
+    out(tracked ? owner.layer : `${owner.layer} ${c.dim("(claimed, not yet committed)")}`);
+    return 0;
+  }
+  for (const layer of layerNames(ctx)) {
+    if (trackedUnder(layerRepo(ctx, layer), [path]).length) {
+      out(layer);
+      return 0;
+    }
+  }
+  if (trackedUnder(ctx.base, [path]).length) {
+    out("base");
+    return 0;
+  }
+  out(isIgnored(ctx.base, path, true) ? "ignored" : "untracked");
+  return 0;
+}
+function cmdLs(ctx, args) {
+  const p = parseArgs(args, {});
+  if (p.positionals.length > 1)
+    fail("usage: sich ls [layer]");
+  const only = p.positionals[0];
+  if (only)
+    requireLayer(ctx, only);
+  const claims = allClaims(ctx);
+  const layers = only ? [only] : layerNames(ctx);
+  if (layers.length === 0) {
+    note("no layers yet (create one with: sich new <layer>)");
+    return 0;
+  }
+  layers.forEach((layer, i) => {
+    if (i > 0)
+      out();
+    out(c.bold(layer));
+    const own = claims.get(layer) ?? [];
+    out(`  claims:${own.length ? "" : c.dim(" (none)")}`);
+    for (const cl of own)
+      out(`    ${cl}`);
+    const files = splitZ(git(layerRepo(ctx, layer), ["ls-files", "-z"]).stdout);
+    out(`  tracked:${files.length ? "" : c.dim(" (none)")}`);
+    for (const f of files)
+      out(`    ${f}`);
+  });
+  return 0;
+}
+
+// src/commands/layer.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename3, isAbsolute as isAbsolute2, join as join3, resolve as resolve5 } from "node:path";
+function assertFree(ctx, layer) {
+  validateLayerName(layer);
+  if (existsSync5(join3(ctx.sichDir, layer)))
+    fail(`layer '${layer}' already exists (.sich/${layer}/)`);
+  if (existsSync5(manifestPath(ctx, layer)))
+    fail(`.sich/${layer}.paths already exists; remove it first`);
+}
+function createGitDir(ctx, layer) {
+  const repo = layerRepo(ctx, layer);
+  git(repo, ["init", "-q", "--initial-branch=main"], { cwd: ctx.root });
+  git(repo, ["config", "core.worktree", "../.."]);
+  git(repo, ["config", "core.bare", "false"]);
+  return repo;
+}
+function remoteUrl(ctx, url) {
+  if (isAbsolute2(url) || /^[a-z][a-z0-9+.-]*:\/\//i.test(url))
+    return url;
+  const local = resolve5(ctx.cwd, url);
+  return existsSync5(local) ? local : url;
+}
+function baseRepoName(ctx) {
+  const url = git(ctx.base, ["config", "--get", "remote.origin.url"], { allowFail: true }).stdout.trim();
+  if (url) {
+    const last = url.replace(/\/+$/, "").replace(/\.git$/, "").split(/[/:]/).pop();
+    if (last)
+      return last;
+  }
+  return basename3(ctx.root);
+}
+function runGh(args, capture) {
+  const bin = process.env.SICH_GH || "gh";
+  const r = spawnSync2(bin, args, {
+    encoding: "utf8",
+    stdio: ["inherit", capture ? "pipe" : "inherit", "inherit"]
+  });
+  if (r.error)
+    fail(`cannot run ${bin}: ${r.error.message}`);
+  if (r.status !== 0)
+    fail(`${bin} ${args.join(" ")} failed (exit ${r.status ?? "?"})`);
+  return r.stdout?.trim() ?? "";
+}
+function cmdNew(ctx, args) {
+  const p = parseArgs(args, { "--remote": "value", "--gh": "optional" });
+  const [layer, ...extra] = p.positionals;
+  if (!layer || extra.length)
+    fail("usage: sich new <layer> [--remote <url> | --gh [name]]");
+  const given = str(p, "--remote");
+  const remote = given && remoteUrl(ctx, given);
+  const gh = p.flags["--gh"];
+  if (remote && gh)
+    fail("use either --remote or --gh, not both");
+  assertFree(ctx, layer);
+  ensureInit(ctx);
+  let url = remote;
+  if (gh) {
+    const name = typeof gh === "string" ? gh : `${baseRepoName(ctx)}-${layer}`;
+    runGh(["repo", "create", name, "--private"], false);
+    url = runGh(["repo", "view", name, "--json", "sshUrl", "-q", ".sshUrl"], true);
+    if (!url)
+      fail(`could not read the SSH URL of GitHub repo ${name}`);
+  }
+  const repo = createGitDir(ctx, layer);
+  try {
+    writeFileSync4(manifestPath(ctx, layer), `# Paths owned by sich layer '${layer}': one root-relative path per line, directories end with /
+`);
+    syncExcludes(ctx);
+    git(repo, ["add", "-f", "--", manifestRel(layer)]);
+    git(repo, ["commit", "-q", "-m", `sich: create layer ${layer}`]);
+    if (url)
+      git(repo, ["remote", "add", "origin", url]);
+  } catch (e) {
+    rmSync(repo.gitDir, { recursive: true, force: true });
+    rmSync(manifestPath(ctx, layer), { force: true });
+    syncExcludes(ctx);
+    throw e;
+  }
+  out(`${c.green("created")} layer ${c.bold(layer)}: git data -> .sich/${layer}/, claims list -> ${manifestRel(layer)}`);
+  if (url)
+    out(`set origin of ${layer} -> ${url}`);
+  note(`next: sich add ${layer} <path>...  then  sich commit ${layer} -m <msg>${url ? `  and  sich push ${layer}` : ""}`);
+  return 0;
+}
+function cmdAttach(ctx, args) {
+  const p = parseArgs(args, {});
+  const [layer, given, ...extra] = p.positionals;
+  if (!layer || !given || extra.length)
+    fail("usage: sich attach <layer> <url>");
+  const url = remoteUrl(ctx, given);
+  assertFree(ctx, layer);
+  ensureInit(ctx);
+  const repo = createGitDir(ctx, layer);
+  const cleanup = () => rmSync(repo.gitDir, { recursive: true, force: true });
+  try {
+    git(repo, ["remote", "add", "origin", url]);
+    const fetched = git(repo, ["fetch", "-q", "origin"], { allowFail: true });
+    if (fetched.code !== 0)
+      fail(`cannot fetch ${url}: ${fetched.stderr.trim().split(`
+`).pop()}`);
+    const head = git(repo, ["ls-remote", "--symref", "origin", "HEAD"], { allowFail: true }).stdout;
+    const branch = /^ref: refs\/heads\/(\S+)\s+HEAD$/m.exec(head)?.[1] ?? "main";
+    const ref = `refs/remotes/origin/${branch}`;
+    if (git(repo, ["rev-parse", "--verify", "-q", ref], { allowFail: true }).code !== 0) {
+      fail(`${url} has no branch '${branch}' (is it a sich layer? create new layers with sich new)`);
+    }
+    const files = splitZ(git(repo, ["ls-tree", "-r", "-z", "--name-only", ref]).stdout);
+    const clash = collisions(ctx, files);
+    if (clash.length) {
+      fail(`attach would overwrite existing files: ${listSome(clash)} (move them away and retry)`);
+    }
+    git(repo, ["checkout", "-q", "-B", branch, "--track", `origin/${branch}`]);
+    if (!existsSync5(manifestPath(ctx, layer))) {
+      warn(`${url} has no .sich/${layer}.paths; is the layer name right?`);
+    }
+    syncExcludes(ctx);
+    out(`${c.green("attached")} layer ${c.bold(layer)} from ${url} -> .sich/${layer}/ (branch ${branch})`);
+    out(`checked out ${plural(files.length, "file")}: ${listSome(files)}`);
+    return 0;
+  } catch (e) {
+    cleanup();
+    throw e;
+  }
+}
+
+// src/commands/status.ts
+function parseStatus(raw) {
+  const s = {
+    branch: "?",
+    upstream: null,
+    ahead: 0,
+    behind: 0,
+    gone: false,
+    staged: 0,
+    modified: 0,
+    untracked: 0,
+    conflicted: 0,
+    files: []
+  };
+  const entries = splitZ(raw);
+  let sawAb = false;
+  for (let i = 0;i < entries.length; i++) {
+    const e = entries[i];
+    if (e.startsWith("# branch.head "))
+      s.branch = e.slice(14);
+    else if (e.startsWith("# branch.upstream "))
+      s.upstream = e.slice(18);
+    else if (e.startsWith("# branch.ab ")) {
+      sawAb = true;
+      const m = /\+(\d+) -(\d+)/.exec(e);
+      s.ahead = Number(m?.[1] ?? 0);
+      s.behind = Number(m?.[2] ?? 0);
+    } else if (e.startsWith("? ")) {
+      s.untracked++;
+      s.files.push(`?? ${e.slice(2)}`);
+    } else if (e[0] === "1" || e[0] === "2" || e[0] === "u") {
+      const n = e[0] === "1" ? 8 : e[0] === "2" ? 9 : 10;
+      const parts = e.split(" ");
+      const xy = parts[1] ?? "..";
+      const path = parts.slice(n).join(" ");
+      if (e[0] === "2")
+        i++;
+      if (e[0] === "u")
+        s.conflicted++;
+      else {
+        if (xy[0] !== ".")
+          s.staged++;
+        if (xy[1] !== ".")
+          s.modified++;
+      }
+      s.files.push(`${xy.replace(/\./g, " ")} ${path}`);
+    }
+  }
+  s.gone = s.upstream !== null && !sawAb;
+  return s;
+}
+function repoStatus(repo) {
+  return parseStatus(git(repo, ["status", "--porcelain=v2", "--branch", "-z"]).stdout);
+}
+function tracking(s) {
+  if (!s.upstream)
+    return c.dim("no upstream");
+  if (s.gone)
+    return `${s.upstream} ${c.red("gone")}`;
+  const parts = [];
+  if (s.ahead)
+    parts.push(c.green(`ahead ${s.ahead}`));
+  if (s.behind)
+    parts.push(c.yellow(`behind ${s.behind}`));
+  return `${s.upstream} ${parts.length ? parts.join(", ") : c.dim("up to date")}`;
+}
+function changes(s) {
+  const parts = [];
+  if (s.conflicted)
+    parts.push(c.red(`${s.conflicted} conflicted`));
+  if (s.staged)
+    parts.push(c.green(`${s.staged} staged`));
+  if (s.modified)
+    parts.push(c.yellow(`${s.modified} modified`));
+  if (s.untracked)
+    parts.push(c.red(`${s.untracked} untracked`));
+  return parts.length ? parts.join(", ") : c.dim("clean");
+}
+var visible = (s) => s.replace(/\x1b\[[0-9;]*m/g, "").length;
+var pad = (s, w) => s + " ".repeat(Math.max(0, w - visible(s)));
+function cmdStatus(ctx, args) {
+  const p = parseArgs(args, { "-v": "bool", "--fetch": "bool" }, { "--verbose": "-v" });
+  if (p.positionals.length)
+    fail("usage: sich status [-v] [--fetch]");
+  const repos = [ctx.base, ...layerNames(ctx).map((l) => layerRepo(ctx, l))];
+  if (p.flags["--fetch"]) {
+    for (const r of repos) {
+      if (remotesOf(r).length === 0)
+        continue;
+      const f = git(r, ["fetch", "--quiet"], { allowFail: true });
+      if (f.code !== 0)
+        warn(`${r.name}: fetch failed: ${f.stderr.trim().split(`
+`).pop()}`);
+    }
+  }
+  const rows = repos.map((r) => ({ repo: r, s: repoStatus(r) }));
+  const rendered = rows.map(({ repo, s }) => [c.bold(repo.name), c.cyan(s.branch), tracking(s), changes(s)]);
+  const widths = [0, 1, 2].map((i) => Math.max(...rendered.map((cols) => visible(cols[i]))));
+  rows.forEach(({ s }, idx) => {
+    const cols = rendered[idx];
+    out(cols.map((col, i) => i < 3 ? pad(col, widths[i]) : col).join("  "));
+    if (p.flags["-v"])
+      for (const f of s.files)
+        out(`    ${f}`);
+  });
+  return 0;
+}
+
+// src/commands/sync.ts
+class StepFailed extends Error {
+  repo;
+  action;
+  reason;
+  constructor(repo, action, reason) {
+    super(`${action} failed in ${repo}`);
+    this.repo = repo;
+    this.action = action;
+    this.reason = reason;
+  }
+}
+function header(repo, argv) {
+  out(`${c.bold(repo.name)}: ${c.dim("git " + argv.join(" "))}`);
+}
+function exec(repo, action, argv) {
+  const code = gitInherit(repo, argv);
+  if (code !== 0)
+    throw new StepFailed(repo.name, action, `git exit ${code}`);
+}
+function defaultRemote(remotes) {
+  return remotes.includes("origin") ? "origin" : remotes[0];
+}
+function refuseOverwrite(ctx, repo, incoming) {
+  const hasHead = git(repo, ["rev-parse", "--verify", "-q", "HEAD"], { allowFail: true }).code === 0;
+  const added = hasHead ? git(repo, ["diff", "--name-only", "-z", "--no-renames", "--diff-filter=A", "HEAD", incoming]).stdout : git(repo, ["ls-tree", "-r", "-z", "--name-only", incoming]).stdout;
+  const clash = collisions(ctx, splitZ(added)).filter((p) => trackedUnder(repo, [p]).length === 0);
+  if (clash.length === 0)
+    return;
+  const claims = allClaims(ctx);
+  const shown = clash.map((p) => {
+    const owner = ownerOf(claims, p)?.layer;
+    return owner && owner !== repo.name ? `${p} (${owner})` : p;
+  });
+  printError(`${repo.name}: pull would overwrite ${plural(clash.length, "local path")} it doesn't track: ` + `${listSome(shown)} (move aside and retry)`);
+  throw new StepFailed(repo.name, "pull", "would overwrite local files");
+}
+function pull(ctx, repo, remotes) {
+  const argv = ["pull", "--rebase", "--autostash"];
+  let fetch;
+  let incoming;
+  if (upstreamOf(repo)) {
+    fetch = [];
+    incoming = "@{u}";
+  } else {
+    const branch = currentBranch(repo);
+    if (!branch) {
+      note(`${repo.name}: detached HEAD and no upstream, skipped pull`);
+      return;
+    }
+    const remote = defaultRemote(remotes);
+    const has = git(repo, ["ls-remote", "--exit-code", "--heads", remote, branch], { allowFail: true }).code === 0;
+    if (!has) {
+      note(`${repo.name}: no upstream and nothing on ${remote} yet, skipped pull`);
+      return;
+    }
+    fetch = [remote, branch];
+    incoming = "FETCH_HEAD";
+    argv.push(remote, branch);
+  }
+  header(repo, argv);
+  exec(repo, "pull", ["fetch", "-q", ...fetch]);
+  refuseOverwrite(ctx, repo, incoming);
+  exec(repo, "pull", argv);
+  syncExcludes(ctx);
+}
+function push(repo, remotes) {
+  if (upstreamOf(repo)) {
+    header(repo, ["push"]);
+    exec(repo, "push", ["push"]);
+    return;
+  }
+  const branch = currentBranch(repo);
+  if (!branch) {
+    printError(`${repo.name}: detached HEAD, cannot push`);
+    throw new StepFailed(repo.name, "push", "detached HEAD");
+  }
+  const argv = ["push", "-u", defaultRemote(remotes), branch];
+  header(repo, argv);
+  exec(repo, "push", argv);
+}
+function cmdRemote(ctx, command, args) {
+  const p = parseArgs(args, {});
+  const names = p.positionals.length ? [...new Set(p.positionals)] : ["base", ...layerNames(ctx)];
+  const repos = names.map((n) => repoByName(ctx, n));
+  const actions = command === "sync" ? ["pull", "push"] : [command];
+  for (let i = 0;i < repos.length; i++) {
+    const repo = repos[i];
+    const remotes = remotesOf(repo);
+    if (remotes.length === 0) {
+      note(`${repo.name}: no remote, skipped`);
+      continue;
+    }
+    try {
+      for (const a of actions) {
+        if (a === "pull")
+          pull(ctx, repo, remotes);
+        else
+          push(repo, remotes);
+      }
+    } catch (e) {
+      if (!(e instanceof StepFailed))
+        throw e;
+      syncExcludes(ctx);
+      const rest = repos.slice(i + 1).map((r) => r.name);
+      fail(`${e.action} failed in ${e.repo} (${e.reason})` + (rest.length ? `; stopped before: ${rest.join(", ")}` : ""));
+    }
+  }
+  return 0;
+}
+
+// src/help.ts
+var MAIN_HELP = `sich - private git layers that share one working tree with a normal repo
+
+  base    your normal repo (.git), usually public
+  layer   a private repo in .sich/<layer>/ with its own remote and access list
+  claim   a file or folder a layer owns; base and other layers never see it
+
+usage: sich [-C <dir>] <command> [args]
+       sich [-C <dir>] <layer|base> <git args...>
+
+setup
+  init                              set up .sich/, base excludes, commit guard
+  new <layer> [--remote <url> | --gh [name]]
+                                    create a layer (--gh: private GitHub repo)
+  attach <layer> <url>              join an existing layer (collaborators)
+
+ownership
+  add <layer> <path...> [--move]    claim files/folders for a layer, stage them
+                                    (--move: take them from base/another layer)
+  rm <layer> <path...>              release claims; files stay on disk
+  which <path>                      show who owns a path
+  ls [layer]                        list claims and tracked files
+
+everyday
+  status [-v] [--fetch]             per repo: branch, ahead/behind, changes
+  commit [repo...] -m <msg>         add -A + commit base + all layers (or named)
+  pull [repo...]                    pull --rebase base + all layers (or named)
+  push [repo...]                    push base + all layers (or named)
+  sync [repo...]                    pull, then push
+  check [--fix] [--staged]          find leaks and ownership problems
+                                    (--staged: what the pre-commit hook runs)
+
+passthrough
+  <layer> <git args...>             run git in a layer, e.g. sich notes log
+  base <git args...>                run git in the base repo
+
+options
+  -C <dir>                          run as if started in <dir>
+  -h, --help                        show help (also: sich <command> --help)
+  -V, --version                     print version
+
+environment
+  SICH_BIN                          sich binary the pre-commit hook runs
+                                    (default: sich on PATH)
+  SICH_GH                           gh binary for new --gh (default: gh)
+  NO_COLOR                          disable colors
+
+Layer names match ^[a-z0-9][a-z0-9._-]*$; base and command names are reserved.
+Claims can't nest across layers.
+`;
+var COMMAND_HELP = {
+  init: `usage: sich init
+
+Creates .sich/, writes the managed block in the base repo's info/exclude, and
+installs a pre-commit hook that runs 'sich check --staged'. If a pre-commit hook
+already exists or core.hooksPath is set, prints the line to add instead.
+The hook runs $SICH_BIN (default: sich on PATH) and blocks the commit if it
+can't be found. Safe to run again.`,
+  new: `usage: sich new <layer> [--remote <url> | --gh [name]]
+
+Creates layer <layer> (.sich/<layer>/ git dir sharing this working tree) with an
+empty claims manifest .sich/<layer>.paths and an initial commit.
+  --remote <url>   set origin
+  --gh [name]      create a private GitHub repo with gh (default name:
+                   <base-repo>-<layer>) and set origin to its SSH URL.
+                   The gh binary can be overridden with SICH_GH.`,
+  attach: `usage: sich attach <layer> <url>
+
+Joins an existing layer: fetches <url> and checks out its default branch into
+this working tree. Refuses to overwrite existing files.`,
+  add: `usage: sich add <layer> <path...> [--move]
+
+Claims paths (files or directories, relative to the current directory) for a
+layer, then stages them and the manifest in that layer (no commit).
+Refuses paths tracked by base or owned by another layer unless --move is given;
+--move untracks them from the previous owner (old versions stay in its history).
+Claims can't nest across layers: a path inside another layer's claimed directory
+is always refused (move the whole directory instead).`,
+  rm: `usage: sich rm <layer> <path...>
+
+Removes exact claims from a layer and untracks them there. The files stay on
+disk and show up as untracked in base (or, if another layer's directory claim
+contains them, now belong to that layer).`,
+  which: `usage: sich which <path>
+
+Prints the owner of a path: a layer name, 'base', 'ignored' or 'untracked'.`,
+  ls: `usage: sich ls [layer]
+
+Lists each layer's claims and tracked files.`,
+  status: `usage: sich status [-v] [--fetch]
+
+One row per repo (base first): branch, ahead/behind upstream, and counts of
+staged / modified / untracked files.
+  -v, --verbose   list the files
+  --fetch         fetch every repo with a remote first`,
+  commit: `usage: sich commit [repo...] -m <msg>
+
+Stages everything (git add -A) and commits, in base and every layer with
+changes, or only in the named repos ('base' or layer names). Excludes keep each
+repo to its own files; anything a repo doesn't own (e.g. let in by a '!' rule in
+a .gitignore) is left out with a warning. Base commits run its pre-commit hook.`,
+  pull: `usage: sich pull [repo...]
+
+git pull --rebase --autostash in base and every layer (or the named repos,
+'base' allowed). Repos without a remote are skipped. Stops at the first failure.
+Refuses to pull a repo if that would overwrite a file it doesn't track, such as
+another layer's (git would do that silently: to it, those files are ignored).`,
+  push: `usage: sich push [repo...]
+
+git push in base and every layer (or the named repos). Sets the upstream
+(-u origin <branch>) when there is none. Stops at the first failure.`,
+  sync: `usage: sich sync [repo...]
+
+pull then push, repo by repo. Stops at the first failure.`,
+  check: `usage: sich check [--fix] [--staged]
+
+Reports: paths claimed or tracked by two layers, base tracking claimed paths or
+.sich/, layers tracking files they don't own, and stale exclude blocks.
+  --fix      rewrite stale exclude blocks
+  --staged   also fail if base's index stages claimed paths or .sich/
+             (this is what the pre-commit hook runs; silent when all is well,
+             stale excludes only warn, and a no-op where sich isn't set up,
+             e.g. a linked worktree)
+Exits 1 if any issue remains.`,
+  help: `usage: sich help [command]`
+};
+
+// src/cli.ts
+var VERSION = version;
+var HANDLERS = {
+  init: cmdInit,
+  new: cmdNew,
+  attach: cmdAttach,
+  add: cmdAdd,
+  rm: cmdRm,
+  which: cmdWhich,
+  ls: cmdLs,
+  status: cmdStatus,
+  commit: cmdCommit,
+  pull: (ctx, a) => cmdRemote(ctx, "pull", a),
+  push: (ctx, a) => cmdRemote(ctx, "push", a),
+  sync: (ctx, a) => cmdRemote(ctx, "sync", a),
+  check: cmdCheck
+};
+var SELF_INIT = new Set(["init", "new", "attach", "check"]);
+function changeDir(cwd, dir) {
+  const target = resolve6(cwd, dir);
+  try {
+    if (!statSync(target).isDirectory())
+      fail(`-C ${dir}: not a directory`);
+    return realpathSync3.native(target);
+  } catch (e) {
+    if (e instanceof SichError)
+      throw e;
+    fail(`-C ${dir}: no such directory`);
+  }
+}
+function main(argv) {
+  let cwd = realpathSync3.native(process.cwd());
+  let i = 0;
+  for (;i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-C") {
+      const dir = argv[++i];
+      if (dir === undefined)
+        fail("-C needs a directory");
+      cwd = changeDir(cwd, dir);
+    } else if (a.startsWith("-C") && a.length > 2) {
+      cwd = changeDir(cwd, a.slice(2));
+    } else if (a === "-h" || a === "--help") {
+      out(MAIN_HELP.trimEnd());
+      return 0;
+    } else if (a === "-V" || a === "--version") {
+      out(`sich ${VERSION}`);
+      return 0;
+    } else if (a.startsWith("-")) {
+      fail(`unknown option '${a}' (see sich --help)`);
+    } else
+      break;
+  }
+  const name = argv[i];
+  const rest = argv.slice(i + 1);
+  if (name === undefined) {
+    out(MAIN_HELP.trimEnd());
+    return 0;
+  }
+  if (name === "help") {
+    const topic = rest[0];
+    if (topic && !COMMAND_HELP[topic])
+      fail(`no help for '${topic}'`);
+    out((topic ? COMMAND_HELP[topic] : MAIN_HELP).trimEnd());
+    return 0;
+  }
+  if (Object.hasOwn(HANDLERS, name)) {
+    if (wantsHelp(rest)) {
+      out(COMMAND_HELP[name]);
+      return 0;
+    }
+    const ctx2 = loadCtx(cwd);
+    if (!SELF_INIT.has(name))
+      requireInit(ctx2);
+    if (name !== "check")
+      syncExcludes(ctx2);
+    return HANDLERS[name](ctx2, rest);
+  }
+  const ctx = loadCtx(cwd);
+  if (name !== "base" && !layerExists(ctx, name)) {
+    fail(`unknown command or layer '${name}' (see sich --help)`);
+  }
+  syncExcludes(ctx);
+  const code = gitInherit(repoByName(ctx, name), rest, ctx.cwd);
+  syncExcludes(ctx);
+  return code;
+}
+var code;
+try {
+  code = main(process.argv.slice(2));
+} catch (e) {
+  if (e instanceof SichError)
+    printError(e.message);
+  else
+    printError(process.env.SICH_DEBUG ? String(e.stack) : String(e.message ?? e));
+  code = 1;
+}
+process.exit(code);
+export {
+  main
+};