git-sich 0.1.0 → 0.3.0

package/README.md

@@ -1,5 +1,7 @@
 # sich
 
+[![npm](https://img.shields.io/npm/v/git-sich)](https://www.npmjs.com/package/git-sich)
+
 CLI for managing multiple git repositories within a single base git repo.
 
 Useful for:
@@ -13,7 +15,7 @@ Works with GitHub out of the box: every new layer can automatically become a new
 Plain `git` commands only ever see **base** files. Files from other layers never appear in the
 **base** repo: not in commits, not in `.gitignore`. Other contributors never even know that `sich` is in use or that the other repositories exist; everything works for them as usual.
 
-**The name** is a shortened (easier-to-type) version of *sietch*, the hidden cave communities of the Fremen in Frank Herbert's *Dune*, where only the tribe knows the way in. Such are the layers of `sich`: only visible to those with access to them.
+**The name** is a shortened (easier-to-type) version of *sietch*, the hidden cave communities of the Fremen in Frank Herbert's *Dune*, where only the tribe knows the way in. Such are the layers of `sich`: only visible to those with access to them. It's pronounced like *sietch* ("seech").
 
 ## Why
 
@@ -33,25 +35,46 @@ npm install -g git-sich      # the package is git-sich; the command is sich
 ## Quickstart
 
 ```sh
-cd myproject                          # an existing git repo, called base from now on; say it has a public remote at git@github.com:user/myproject.git
-sich init                             # creates an empty .sich folder, excludes it from base (.git/info/exclude) and installs the pre-commit guard
-sich new personal --gh                # creates a layer (a sietch) called "personal": .sich/personal is a separate git repo, in the same format as the top-level .git that defines base
-# with --gh it also creates the private GitHub repo user/myproject-personal and sets it as the remote (git@github.com:user/myproject-personal.git)
-sich add personal my-notes.md         # the personal layer claims my-notes.md; base now ignores it automatically
-sich personal commit -m "adding notes" # commits in the personal repo; or `sich commit -m "..."` commits base + every layer with changes at once
-sich push personal                    # pushes personal to its remote (setting its upstream the first time); or `sich push` pushes base + all layers
-
-sich new team --gh                    # creates another layer, "team", and the private repo user/myproject-team, which you can share with your team
-sich add team roadmap.md api-keys.env llm-transcripts/ # claims these for the team layer; base's exclude now hides all three
-# ...
-
-# A collaborator with sich installed and access to user/myproject-team:
+# Start in an existing git repo, called base from now on.
+# Say it has a public remote at git@github.com:user/myproject.git.
+cd myproject
+
+# Create an empty .sich folder, exclude it from base (.git/info/exclude)
+# and install the commit guard hooks (every layer gets them too).
+sich init
+
+# Create a layer (a sietch) called "personal": .sich/personal is a separate
+# git repo, in the same format as the top-level .git that defines base.
+# --gh also creates the private GitHub repo user/myproject-personal
+# and sets it as the layer's remote.
+sich new personal --gh
+
+# The personal layer claims my-notes.md; base now ignores it automatically.
+sich claim personal my-notes.md
+
+# Commit in the personal repo.
+# (`sich commit -m "..."` commits base + every layer with changes at once.)
+sich personal commit -m "adding notes"
+
+# Push personal to its remote, setting its upstream the first time.
+# (`sich push` pushes base + all layers.)
+sich push personal
+
+# Create another layer, "team", and the private repo user/myproject-team,
+# which you can share with your team.
+sich new team --gh
+
+# Claim these for the team layer; base's exclude now hides all three.
+sich claim team roadmap.md api-keys.env llm-transcripts/
+
+# A collaborator with sich installed and access to user/myproject-team
+# clones base, then attaches the team layer.
 git clone git@github.com:user/myproject.git && cd myproject
 sich attach team git@github.com:user/myproject-team.git
 ```
 
-For a full walkthrough with real output, the resulting files and every file sich
-generates, see **[docs/example.md](docs/example.md)**.
+To see every file this generates, look at
+**[section 4 of the example](docs/example.md#4-the-files-sich-generates)**.
 
 ## CLI
 
@@ -67,15 +90,16 @@ usage: sich [-C <dir>] <command> [args]
        sich [-C <dir>] <layer|base> <git args...>
 
 setup
-  init                              set up .sich/, base excludes, commit guard
+  init                              set up .sich/, excludes, commit guards
   new <layer> [--remote <url> | --gh [name]]
                                     create a layer (--gh: private GitHub repo)
   attach <layer> <url>              join an existing layer (collaborators)
+  detach <layer> [--force] [--yes]  remove a layer here; files and remote stay
 
 ownership
-  add <layer> <path...> [--move]    claim files/folders for a layer, stage them
+  claim <layer> <path...> [--move]  claim files/folders for a layer, stage them
                                     (--move: take them from base/another layer)
-  rm <layer> <path...>              release claims; files stay on disk
+  unclaim <layer> <path...>         release claims; files stay on disk
   which <path>                      show who owns a path
   ls [layer]                        list claims and tracked files
 
@@ -86,7 +110,7 @@ everyday
   push [repo...]                    push base + all layers (or named)
   sync [repo...]                    pull, then push
   check [--fix] [--staged]          find leaks and ownership problems
-                                    (--staged: what the pre-commit hook runs)
+                                    (--staged: what the commit/merge hooks run)
 
 passthrough
   <layer> <git args...>             run git in a layer, e.g. sich notes log
@@ -98,7 +122,7 @@ options
   -V, --version                     print version
 
 environment
-  SICH_BIN                          sich binary the pre-commit hook runs
+  SICH_BIN                          sich binary the commit/merge hooks run
                                     (default: sich on PATH)
   SICH_GH                           gh binary for new --gh (default: gh)
   NO_COLOR                          disable colors
@@ -110,8 +134,6 @@ Claims can't nest across layers.
 ## How it works
 
 It's plain git all the way down; `sich` is a tiny wrapper on top.
-To see every file it generates for a real project, look at
-[section 4 of the example](docs/example.md#4-the-files-sich-generates).
 
 **Layers.** Layer `L` is a regular, non-bare git dir at `.sich/L/` with
 `core.worktree = ../..`, so its working tree is the project root. sich always
@@ -142,13 +164,35 @@ the same folder can still belong to different layers.
 Because each layer only "sees" its claims, `git add -A` in a layer is safe, and
 new files created inside a claimed directory automatically belong to that layer.
 
-**Guard.** The base `pre-commit` hook runs `sich check --staged`. It blocks a
-base commit that stages a claimed path or anything under `.sich/` (e.g. after
-`git add -f`; on case-insensitive filesystems under any spelling), and it blocks
-while ownership between layers is ambiguous (overlapping claims, a file tracked
-by the wrong layer), since that could leak one layer's files into another.
-Stale exclude rules only warn. Where sich isn't set up (a linked `git worktree`)
-it does nothing. Skip the check once with `git commit --no-verify`.
+**Guard.** Base and every layer get a `pre-commit` and a `pre-merge-commit`
+hook that run `sich check --staged`, since a layer may be public or shared with
+a different audience too. It checks the repo whose index git is committing, so
+the same lines also work in a `core.hooksPath` shared by every repo. In base it
+blocks a commit that stages a claimed path or anything under `.sich/` (e.g.
+after `git add -f`; on case-insensitive filesystems under any spelling). In
+layer `L` it blocks a commit that stages a path `L` doesn't own: unclaimed (e.g.
+after `sich L add -f`) or not yet in the claims list being committed, claimed by
+another layer, or under `.sich/` (other than `L`'s own claims list). Staged
+deletions never block, so untracking a stray file (`sich L rm --cached -- <path>`)
+can be committed. Every hook also blocks while ownership between layers is
+ambiguous (overlapping claims, a file tracked by the wrong layer), since that
+could leak one layer's files into another. Stale exclude rules only warn. Where
+sich isn't set up (a linked `git worktree`) the hooks do nothing. Skip the check
+once with `git commit --no-verify` (in a layer: `sich L commit --no-verify`).
+
+**Merges.** Merge commits are guarded too: git runs `pre-merge-commit` for a
+merge commit made without conflicts (`git merge`, `git pull` without
+`--rebase`), and `pre-commit` when you finish a conflicted merge with
+`git commit`. The check covers what the merge brings in, e.g. a stray file
+committed on a branch with `--no-verify`. By then git has already written the
+merge result to the working tree, possibly over another repo's copy of an
+incoming path, so a blocked merge says how to back out (`git merge --abort`)
+and restore that copy afterwards, rather than how to unstage it. Skip the check
+once with `git merge --no-verify` (in a layer: `sich L merge --no-verify`).
+Fast-forward merges, rebase and cherry-pick run no hook at all, so what they
+bring in isn't checked as it arrives; plain `sich check` catches it afterwards.
+`sich check` also warns about any repo whose hooks don't run sich, and
+`sich init` installs the missing ones.
 
 ## FAQ
 
@@ -167,10 +211,13 @@ That said, sometimes you do want a base commit to pin a submodule version: when
 No. Visibility is set per repo, and anyone who can clone a repo gets every file in it.
 Their per-repo access control is great, though, and sich builds on it!
 
+**What's the difference between `sich claim notes x` and `sich notes add x`?**
+`sich claim` gives `x` to the layer: it records the claim in `.sich/notes.paths`, hides `x` from base and the other layers, and stages it. `sich notes add` is plain `git add` run in the layer, which refuses files the layer hasn't claimed. Likewise `sich unclaim` releases a claim and keeps the file on disk, while `sich notes rm` is plain `git rm` and deletes it.
+
 **Is this like git-crypt or sops?**
 No. sich doesn't encrypt anything; it relies on who can access each repo. You can combine the two for real secrets.
 
-## Caveats and contributing
+## Contributing
 
 [CONTRIBUTING.md](CONTRIBUTING.md)
 

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { realpathSync as realpathSync3, statSync } from "node:fs";
 import { resolve as resolve6 } from "node:path";
 // package.json
-var version = "0.1.0";
+var version = "0.3.0";
 
 // src/ui.ts
 class SichError extends Error {
@@ -42,6 +42,23 @@ function printError(message) {
   process.stderr.write(`${ce.red("sich:")} ${message}
 `);
 }
+async function confirm(question) {
+  process.stderr.write(`${question} [y/N] `);
+  let answer = "";
+  try {
+    for await (const chunk of process.stdin) {
+      answer += String(chunk);
+      if (answer.includes(`
+`))
+        break;
+    }
+  } catch {}
+  if (!process.stdin.isTTY)
+    process.stderr.write(`
+`);
+  return /^y(es)?$/i.test(answer.split(`
+`)[0].trim());
+}
 function plural(n, word, pluralWord = word + "s") {
   return `${n} ${n === 1 ? word : pluralWord}`;
 }
@@ -115,6 +132,10 @@ function wantsHelp(argv) {
   return false;
 }
 
+// src/commands/check.ts
+import { existsSync as existsSync5, realpathSync as realpathSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname4, join as join3, resolve as resolve4 } from "node:path";
+
 // src/claims.ts
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 var isDirClaim = (c2) => c2.endsWith("/");
@@ -160,9 +181,12 @@ function warnOnce(message) {
 function readManifest(file, layer) {
   if (!existsSync(file))
     return { claims: [], comments: [] };
+  return parseManifest(readFileSync(file, "utf8"), layer);
+}
+function parseManifest(text, layer) {
   const claims = [];
   const comments = [];
-  for (const line of readFileSync(file, "utf8").split(`
+  for (const line of text.split(`
 `)) {
     const t = line.trim();
     if (!t)
@@ -398,6 +422,9 @@ var COMMANDS = [
   "init",
   "new",
   "attach",
+  "detach",
+  "claim",
+  "unclaim",
   "add",
   "rm",
   "which",
@@ -569,12 +596,363 @@ function collisions(ctx, paths) {
   return [...hits].sort();
 }
 
-// src/commands/add.ts
-function cmdAdd(ctx, args) {
+// src/commands/init.ts
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join2, relative as relative3, resolve as resolve3 } from "node:path";
+var HOOK_HEADER = "# Installed by sich:";
+var GUARD_HOOKS = {
+  "pre-commit": { op: "commit", check: "check --staged" },
+  "pre-merge-commit": { op: "merge", check: "check --staged --merge" }
+};
+var HOOK_NAMES = Object.keys(GUARD_HOOKS);
+function hookLine(hook) {
+  return `"\${SICH_BIN:-sich}" ${GUARD_HOOKS[hook].check} || exit 1`;
+}
+var HOOK_MARKER = /sich\S*\s+check --staged/;
+var BASE_HOOK = {
+  header: HOOK_HEADER,
+  body: (hook) => hookBody(`${HOOK_HEADER} stop private (layer-claimed) files from being committed to base.`, hook, "git")
+};
+function layerHook(layer) {
+  const header = `# Installed by sich for layer ${layer}:`;
+  return {
+    header,
+    body: (hook) => hookBody(`${header} stop files ${layer} doesn't own from being committed to it.`, hook, `sich ${layer}`)
+  };
+}
+function hookBody(header, hook, run) {
+  const { op, check } = GUARD_HOOKS[hook];
+  return `#!/bin/sh
+${header}
+sich="\${SICH_BIN:-sich}"
+if ! command -v "$sich" >/dev/null 2>&1; then
+  echo "sich: ${op} blocked: '$sich' not found; put sich on PATH or set SICH_BIN (skip once: ${run} ${op} --no-verify)" >&2
+  exit 1
+fi
+exec "$sich" ${check}
+`;
+}
+function hookFiles(ctx, repo) {
+  const hooksDir = resolve3(ctx.root, git(repo, ["rev-parse", "--git-path", "hooks"]).stdout.trim());
+  return HOOK_NAMES.map((name) => {
+    const hook = join2(hooksDir, name);
+    return { name, hook, shown: relative3(ctx.root, hook) || hook };
+  });
+}
+function unguarded(ctx, repo) {
+  const names = [];
+  const files = [];
+  for (const { name, hook, shown } of hookFiles(ctx, repo)) {
+    if (existsSync4(hook) && HOOK_MARKER.test(readFileSync3(hook, "utf8")))
+      continue;
+    names.push(name);
+    files.push(shown);
+  }
+  return { names, files };
+}
+function hooksNamed(names) {
+  return `${names.join(" and ")} hook${names.length > 1 ? "s" : ""}`;
+}
+function ensureInit(ctx) {
+  const fresh = !isInitialized(ctx);
+  if (fresh) {
+    mkdirSync2(ctx.sichDir, { recursive: true });
+    out(`created ${c.bold(".sich/")} (holds every layer's git data and claims list)`);
+  }
+  for (const t of excludeTargets(ctx)) {
+    if (applyExclude(t, true))
+      out(describeExclude(t));
+  }
+  installHooks(ctx, ctx.base, BASE_HOOK);
+  for (const layer of layerNames(ctx))
+    installLayerHooks(ctx, layer);
+}
+function installLayerHooks(ctx, layer) {
+  installHooks(ctx, layerRepo(ctx, layer), layerHook(layer));
+}
+function installHooks(ctx, repo, spec) {
+  const hooksPath = git(repo, ["config", "--get", "core.hooksPath"], { allowFail: true }).stdout.trim();
+  const of = repo.name === "base" ? "" : ` of ${repo.name}`;
+  for (const { name, hook, shown } of hookFiles(ctx, repo)) {
+    const body = spec.body(name);
+    if (existsSync4(hook)) {
+      const current = readFileSync3(hook, "utf8");
+      if (current.includes(spec.header)) {
+        if (current !== body) {
+          writeFileSync3(hook, body);
+          chmodSync(hook, 493);
+          out(`updated ${name} hook${of} -> ${shown}`);
+        }
+        continue;
+      }
+      if (HOOK_MARKER.test(current))
+        continue;
+      out(`${c.yellow(`${name} hook${of} exists`)} (${shown}); add this line to it:`);
+      out(`  ${hookLine(name)}`);
+      continue;
+    }
+    if (hooksPath) {
+      out(`${c.yellow(`core.hooksPath${of} is set`)} (${hooksPath}); add this line to its ${name} hook:`);
+      out(`  ${hookLine(name)}`);
+      continue;
+    }
+    mkdirSync2(dirname3(hook), { recursive: true });
+    writeFileSync3(hook, body);
+    chmodSync(hook, 493);
+    out(`installed ${name} hook${of} -> ${shown}`);
+  }
+}
+function cmdInit(ctx, args) {
+  if (parseArgs(args, {}).positionals.length)
+    fail("usage: sich init");
+  const already = isInitialized(ctx);
+  ensureInit(ctx);
+  out(already ? `sich already initialized in ${ctx.root}` : `${c.green("initialized")} sich in ${ctx.root}`);
+  return 0;
+}
+
+// src/commands/check.ts
+function hookIndexFile() {
+  const raw = process.env.GIT_INDEX_FILE;
+  if (!raw)
+    return null;
+  try {
+    const abs = resolve4(raw);
+    return resolve4(realpathSync2(dirname4(abs)), basename2(abs));
+  } catch {
+    return null;
+  }
+}
+function isInsideDir(file, dir) {
+  try {
+    return file.startsWith(realpathSync2(dir) + "/");
+  } catch {
+    return false;
+  }
+}
+function committingRepo(ctx, named, index) {
+  if (named !== undefined)
+    return repoByName(ctx, named);
+  if (!index || isInsideDir(index, ctx.base.gitDir))
+    return ctx.base;
+  const layer = layerNames(ctx).find((l) => isInsideDir(index, layerRepo(ctx, l).gitDir));
+  if (layer)
+    return layerRepo(ctx, layer);
+  if (isInsideDir(index, ctx.sichDir))
+    fail(`cannot tell which layer is committing (index ${index})`);
+  return ctx.base;
+}
+function mergeHints(ctx, committing, blocked, fold) {
+  const inLayer = committing.name !== ctx.base.name;
+  const run = inLayer ? `sich ${committing.name}` : "git";
+  const hints = [`this merge isn't committed; back it out with: ${run} merge --abort`];
+  const wanted = new Set(blocked.map(fold));
+  for (const repo of [ctx.base, ...layerNames(ctx).map((l) => layerRepo(ctx, l))]) {
+    if (repo.name === committing.name)
+      continue;
+    const copies = splitZ(git(repo, ["ls-files", "-z"]).stdout).filter((f) => wanted.has(fold(f)));
+    if (!copies.length)
+      continue;
+    const restore = repo.name === ctx.base.name ? "git restore" : `sich ${repo.name} restore`;
+    hints.push(`the merge may have overwritten ${copies.join(", ")} (tracked by ${repo.name}); after aborting, ` + `restore with: ${restore} -- ${copies.map(shellQuote).join(" ")}`);
+  }
+  hints.push(`don't ${inLayer ? "untrack" : "unstage"} them and commit the merge: that drops the other side's changes to them`);
+  hints.push(inLayer ? "fix them where they come from (claim or untrack them on that branch), then merge again" : "settle who owns them before merging again (sich pull refuses up front to overwrite such files)");
+  return hints;
+}
+function cmdCheck(ctx, args) {
+  const p = parseArgs(args, { "--fix": "bool", "--staged": "bool", "--merge": "bool", "--repo": "value" });
+  if (p.positionals.length)
+    fail("usage: sich check [--fix] [--staged [--merge] [--repo <repo>]]");
+  const repoName = str(p, "--repo");
+  if (repoName !== undefined && !p.flags["--staged"])
+    fail("--repo only applies with --staged");
+  if (p.flags["--merge"] && !p.flags["--staged"])
+    fail("--merge only applies with --staged");
+  if (!isInitialized(ctx)) {
+    if (p.flags["--staged"])
+      return 0;
+    requireInit(ctx);
+  }
+  const index = p.flags["--staged"] ? hookIndexFile() : null;
+  const committing = committingRepo(ctx, repoName, index);
+  const indexEnv = index && isInsideDir(index, committing.gitDir) ? { GIT_INDEX_FILE: index } : {};
+  const merging = p.flags["--staged"] === true && (p.flags["--merge"] === true || existsSync5(join3(committing.gitDir, "MERGE_HEAD")));
+  const mergeBlocked = [];
+  const problems = [];
+  const stale = [];
+  const staleWhere = [];
+  const fixed = [];
+  const hints = [];
+  const claims = allClaims(ctx);
+  const layers = layerNames(ctx);
+  const icase = ignoresCase(ctx);
+  const fold = (s) => icase ? s.toLowerCase() : s;
+  const owner = (f) => ownerOf(claims, f, icase);
+  const isSich = (f) => fold(f).startsWith(".sich/");
+  const flat = [...claims].flatMap(([layer, cs]) => cs.map((claim) => ({ layer, claim })));
+  for (const [i, a] of flat.entries()) {
+    for (const b of flat.slice(i + 1)) {
+      if (a.layer === b.layer)
+        continue;
+      const [x, y] = [fold(a.claim), fold(b.claim)];
+      if (samePath(x, y)) {
+        problems.push(`${bare(a.claim)} is claimed by more than one layer: ${a.layer}, ${b.layer}`);
+      } else if (covers(x, y) || covers(y, x)) {
+        const [outer, inner] = covers(x, y) ? [a, b] : [b, a];
+        problems.push(`${inner.claim} (${inner.layer}) is nested inside ${outer.claim} (${outer.layer}); ` + `claims can't nest across layers (fix: sich unclaim ${inner.layer} ${shellQuote(inner.claim)})`);
+      }
+    }
+  }
+  const stagedStray = new Map;
+  if (p.flags["--staged"] && committing !== ctx.base) {
+    const layer = committing.name;
+    const manifest = manifestRel(layer);
+    const staged = splitZ(git(committing, ["diff", "--cached", "--name-only", "--no-renames", "--diff-filter=d", "-z"], { env: indexEnv }).stdout);
+    const committed = git(committing, ["show", `:${manifest}`], { env: indexEnv, allowFail: true });
+    const committedClaims = new Map([
+      [layer, committed.code === 0 ? parseManifest(committed.stdout, layer).claims : []]
+    ]);
+    const unrecorded = [];
+    for (const f of staged) {
+      if (fold(f) === fold(manifest))
+        continue;
+      const by = isSich(f) ? undefined : owner(f)?.layer;
+      if (by === layer) {
+        if (!ownerOf(committedClaims, f, icase)) {
+          unrecorded.push(f);
+          problems.push(`${layer} has a staged change to ${f}, which ${manifest} as committed doesn't claim`);
+        }
+        continue;
+      }
+      const why = isSich(f) ? "which is under .sich/" : by ? `which is claimed by ${by}` : "which none of its claims cover";
+      stagedStray.set(f, why);
+      problems.push(`${layer} has a staged change to ${f}, ${why}`);
+    }
+    const files = [...stagedStray.keys()];
+    if (merging) {
+      mergeBlocked.push(...files, ...unrecorded);
+    } else {
+      if (unrecorded.length) {
+        hints.push(`commit ${manifest} along with it (sich ${layer} add ${manifest}; with 'commit -- <paths>', list it too)`);
+      }
+      const claimable = files.filter((f) => !isSich(f) && !owner(f));
+      const baseTracked = new Set(splitZ(git(ctx.base, ["ls-files", "-z"]).stdout).map(fold));
+      const plain = claimable.filter((f) => !baseTracked.has(fold(f)));
+      const moved = claimable.filter((f) => baseTracked.has(fold(f)));
+      if (plain.length)
+        hints.push(`claim with: sich claim ${layer} ${plain.map(shellQuote).join(" ")}`);
+      if (moved.length) {
+        const list = moved.map(shellQuote).join(" ");
+        hints.push(`claim with (base tracks ${list}): sich claim ${layer} ${list} --move`);
+      }
+      if (files.length) {
+        const verb = claimable.length ? "or untrack" : "untrack";
+        hints.push(`${verb} with: sich ${layer} rm --cached -- ${files.map(shellQuote).join(" ")}`);
+      }
+    }
+  }
+  const trackedBy = new Map;
+  for (const layer of layers) {
+    const env = layer === committing.name ? indexEnv : {};
+    for (const f of splitZ(git(layerRepo(ctx, layer), ["ls-files", "-z"], { env }).stdout)) {
+      if (f === manifestRel(layer))
+        continue;
+      trackedBy.set(f, [...trackedBy.get(f) ?? [], layer]);
+    }
+  }
+  for (const [f, all] of trackedBy) {
+    const ls = stagedStray.has(f) ? all.filter((l) => l !== committing.name) : all;
+    const by = owner(f)?.layer;
+    if (ls.length > 1) {
+      problems.push(`${f} is tracked by more than one layer: ${ls.join(", ")}${by ? ` (owner: ${by})` : ""}`);
+    } else if (ls.length === 1 && by !== ls[0]) {
+      const why = by ? `it belongs to ${by}` : "none of its claims cover it";
+      problems.push(`${ls[0]} tracks ${f} but ${why} (fix: sich ${ls[0]} rm --cached -- ${shellQuote(f)})`);
+    }
+  }
+  const reported = new Set;
+  if (p.flags["--staged"] && committing === ctx.base) {
+    const staged = splitZ(git(ctx.base, ["diff", "--cached", "--name-only", "--no-renames", "--diff-filter=d", "-z"], { env: indexEnv }).stdout);
+    const stagedPrivate = staged.filter((f) => isSich(f) || owner(f));
+    for (const f of stagedPrivate) {
+      const by = owner(f);
+      problems.push(`base has a staged change to private path ${f}${by ? ` (claimed by ${by.layer})` : ""}`);
+      reported.add(f);
+    }
+    if (merging) {
+      mergeBlocked.push(...stagedPrivate);
+    } else if (stagedPrivate.length) {
+      hints.push(`unstage with: git restore --staged -- ${stagedPrivate.map(shellQuote).join(" ")}`);
+    }
+  }
+  let sichFiles = 0;
+  const baseEnv = committing === ctx.base ? indexEnv : {};
+  for (const f of splitZ(git(ctx.base, ["ls-files", "-z"], { env: baseEnv }).stdout)) {
+    if (reported.has(f))
+      continue;
+    if (isSich(f)) {
+      sichFiles++;
+      continue;
+    }
+    const by = owner(f);
+    if (by)
+      problems.push(`base tracks ${f}, which is claimed by ${by.layer} (fix: git rm --cached -- ${shellQuote(f)})`);
+  }
+  if (sichFiles) {
+    problems.push(`base tracks ${plural(sichFiles, "file")} under .sich/ (fix: git rm -r --cached -- .sich/)`);
+  }
+  if (mergeBlocked.length)
+    hints.push(...mergeHints(ctx, committing, mergeBlocked, fold));
+  for (const t of excludeTargets(ctx)) {
+    if (!applyExclude(t, false))
+      continue;
+    if (p.flags["--fix"]) {
+      applyExclude(t, true);
+      fixed.push(`rewrote: ${describeExclude(t)}`);
+    } else {
+      const where = `${t.repo.name} in ${excludeFileShown(t.repo)}`;
+      stale.push(`stale exclude rules of ${where} (fix: sich check --fix)`);
+      staleWhere.push(where);
+    }
+  }
+  const unhooked = [];
+  if (!p.flags["--staged"]) {
+    for (const repo of [ctx.base, ...layers.map((l) => layerRepo(ctx, l))]) {
+      const { names, files } = unguarded(ctx, repo);
+      if (names.length) {
+        unhooked.push(`${repo.name} has no ${hooksNamed(names)} running sich check --staged (${files.join(", ")}); fix: sich init`);
+      }
+    }
+  }
+  const hook = p.flags["--staged"] === true;
+  const blocking = hook ? problems : [...problems, ...stale];
+  for (const f of fixed)
+    out(`${c.green("✓")} ${f}`);
+  if (hook && staleWhere.length) {
+    warn(`stale exclude rules of ${staleWhere.join(", ")} (fix: sich check --fix); not blocking`);
+  }
+  for (const u of unhooked)
+    warn(u);
+  for (const i of blocking)
+    out(`${c.red("✗")} ${i}`);
+  for (const h of hints)
+    out(`  ${h}`);
+  if (blocking.length) {
+    out(c.red(`sich check: ${plural(blocking.length, "issue")} found`));
+    return 1;
+  }
+  if (!hook)
+    out(c.green("sich check: ok"));
+  return 0;
+}
+
+// src/commands/claim.ts
+function cmdClaim(ctx, args) {
   const p = parseArgs(args, { "--move": "bool" });
   const [layer, ...inputs] = p.positionals;
   if (!layer || inputs.length === 0)
-    fail("usage: sich add <layer> <path...> [--move]");
+    fail("usage: sich claim <layer> <path...> [--move]");
   const move = p.flags["--move"] === true;
   const repo = requireLayer(ctx, layer);
   const claims = allClaims(ctx);
@@ -608,7 +986,7 @@ function cmdAdd(ctx, args) {
       const theirs = claims.get(other) ?? [];
       const outer = theirs.find((cl) => isDirClaim(cl) && isInside(fold(t), fold(cl)));
       if (outer) {
-        fail(`${t} is inside ${outer}, claimed by layer ${other}; claims can't nest across layers ` + `(to move all of it: sich add ${layer} ${outer} --move)`);
+        fail(`${t} is inside ${outer}, claimed by layer ${other}; claims can't nest across layers ` + `(to move all of it: sich claim ${layer} ${outer} --move)`);
       }
       const inner = theirs.filter((cl) => covers(fold(t), fold(cl)));
       const tracked = trackedUnder(layerRepo(ctx, other), [t]);
@@ -669,11 +1047,11 @@ function stage(repo, claim) {
     note(`${claim} has no files yet; new files in it will belong to ${repo.name}`);
   }
 }
-function cmdRm(ctx, args) {
+function cmdUnclaim(ctx, args) {
   const p = parseArgs(args, {});
   const [layer, ...inputs] = p.positionals;
   if (!layer || inputs.length === 0)
-    fail("usage: sich rm <layer> <path...>");
+    fail("usage: sich unclaim <layer> <path...>");
   const repo = requireLayer(ctx, layer);
   const file = manifestPath(ctx, layer);
   const man = readManifest(file, layer);
@@ -701,131 +1079,6 @@ function cmdRm(ctx, args) {
   return 0;
 }
 
-// src/commands/check.ts
-import { realpathSync as realpathSync2 } from "node:fs";
-import { basename as basename2, dirname as dirname3, resolve as resolve3 } from "node:path";
-function hookIndexEnv(ctx) {
-  const raw = process.env.GIT_INDEX_FILE;
-  if (!raw)
-    return {};
-  try {
-    const abs = resolve3(raw);
-    const real = resolve3(realpathSync2(dirname3(abs)), basename2(abs));
-    const gitDir = realpathSync2(ctx.base.gitDir);
-    return real.startsWith(gitDir + "/") ? { GIT_INDEX_FILE: real } : {};
-  } catch {
-    return {};
-  }
-}
-function cmdCheck(ctx, args) {
-  const p = parseArgs(args, { "--fix": "bool", "--staged": "bool" });
-  if (p.positionals.length)
-    fail("usage: sich check [--fix] [--staged]");
-  if (!isInitialized(ctx)) {
-    if (p.flags["--staged"])
-      return 0;
-    requireInit(ctx);
-  }
-  const problems = [];
-  const stale = [];
-  const fixed = [];
-  const hints = [];
-  const claims = allClaims(ctx);
-  const layers = layerNames(ctx);
-  const indexEnv = hookIndexEnv(ctx);
-  const icase = ignoresCase(ctx);
-  const fold = (s) => icase ? s.toLowerCase() : s;
-  const owner = (f) => ownerOf(claims, f, icase);
-  const isSich = (f) => fold(f).startsWith(".sich/");
-  const flat = [...claims].flatMap(([layer, cs]) => cs.map((claim) => ({ layer, claim })));
-  for (const [i, a] of flat.entries()) {
-    for (const b of flat.slice(i + 1)) {
-      if (a.layer === b.layer)
-        continue;
-      const [x, y] = [fold(a.claim), fold(b.claim)];
-      if (samePath(x, y)) {
-        problems.push(`${bare(a.claim)} is claimed by more than one layer: ${a.layer}, ${b.layer}`);
-      } else if (covers(x, y) || covers(y, x)) {
-        const [outer, inner] = covers(x, y) ? [a, b] : [b, a];
-        problems.push(`${inner.claim} (${inner.layer}) is nested inside ${outer.claim} (${outer.layer}); ` + `claims can't nest across layers (fix: sich rm ${inner.layer} ${shellQuote(inner.claim)})`);
-      }
-    }
-  }
-  const trackedBy = new Map;
-  for (const layer of layers) {
-    for (const f of splitZ(git(layerRepo(ctx, layer), ["ls-files", "-z"]).stdout)) {
-      if (f === manifestRel(layer))
-        continue;
-      trackedBy.set(f, [...trackedBy.get(f) ?? [], layer]);
-    }
-  }
-  for (const [f, ls] of trackedBy) {
-    const by = owner(f)?.layer;
-    if (ls.length > 1) {
-      problems.push(`${f} is tracked by more than one layer: ${ls.join(", ")}${by ? ` (owner: ${by})` : ""}`);
-    } else if (by !== ls[0]) {
-      const why = by ? `it belongs to ${by}` : "none of its claims cover it";
-      problems.push(`${ls[0]} tracks ${f} but ${why} (fix: sich ${ls[0]} rm --cached -- ${shellQuote(f)})`);
-    }
-  }
-  const reported = new Set;
-  if (p.flags["--staged"]) {
-    const staged = splitZ(git(ctx.base, ["diff", "--cached", "--name-only", "--no-renames", "--diff-filter=d", "-z"], { env: indexEnv }).stdout);
-    const stagedPrivate = staged.filter((f) => isSich(f) || owner(f));
-    for (const f of stagedPrivate) {
-      const by = owner(f);
-      problems.push(`base has a staged change to private path ${f}${by ? ` (claimed by ${by.layer})` : ""}`);
-      reported.add(f);
-    }
-    if (stagedPrivate.length) {
-      hints.push(`unstage with: git restore --staged -- ${stagedPrivate.map(shellQuote).join(" ")}`);
-    }
-  }
-  let sichFiles = 0;
-  for (const f of splitZ(git(ctx.base, ["ls-files", "-z"], { env: indexEnv }).stdout)) {
-    if (reported.has(f))
-      continue;
-    if (isSich(f)) {
-      sichFiles++;
-      continue;
-    }
-    const by = owner(f);
-    if (by)
-      problems.push(`base tracks ${f}, which is claimed by ${by.layer} (fix: git rm --cached -- ${shellQuote(f)})`);
-  }
-  if (sichFiles) {
-    problems.push(`base tracks ${plural(sichFiles, "file")} under .sich/ (fix: git rm -r --cached -- .sich/)`);
-  }
-  for (const t of excludeTargets(ctx)) {
-    if (!applyExclude(t, false))
-      continue;
-    if (p.flags["--fix"]) {
-      applyExclude(t, true);
-      fixed.push(`rewrote: ${describeExclude(t)}`);
-    } else {
-      stale.push(`stale exclude rules of ${t.repo.name} in ${excludeFileShown(t.repo)} (fix: sich check --fix)`);
-    }
-  }
-  const hook = p.flags["--staged"] === true;
-  const blocking = hook ? problems : [...problems, ...stale];
-  for (const f of fixed)
-    out(`${c.green("✓")} ${f}`);
-  if (hook)
-    for (const s of stale)
-      warn(`${s}; not blocking this commit`);
-  for (const i of blocking)
-    out(`${c.red("✗")} ${i}`);
-  for (const h of hints)
-    out(`  ${h}`);
-  if (blocking.length) {
-    out(c.red(`sich check: ${plural(blocking.length, "issue")} found`));
-    return 1;
-  }
-  if (!hook)
-    out(c.green("sich check: ok"));
-  return 0;
-}
-
 // src/commands/commit.ts
 function cmdCommit(ctx, args) {
   const p = parseArgs(args, { "-m": "value" }, { "--message": "-m" });
@@ -871,73 +1124,6 @@ function cmdCommit(ctx, args) {
   return 0;
 }
 
-// src/commands/init.ts
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join2, relative as relative3, resolve as resolve4 } from "node:path";
-var HOOK_MARKER = /sich\S*\s+check --staged/;
-var HOOK_HEADER = "# Installed by sich:";
-var HOOK_LINE = '"${SICH_BIN:-sich}" check --staged || exit 1';
-var HOOK_BODY = `#!/bin/sh
-${HOOK_HEADER} stop private (layer-claimed) files from being committed to base.
-sich="\${SICH_BIN:-sich}"
-if ! command -v "$sich" >/dev/null 2>&1; then
-  echo "sich: commit blocked: '$sich' not found; put sich on PATH or set SICH_BIN (skip once: git commit --no-verify)" >&2
-  exit 1
-fi
-exec "$sich" check --staged
-`;
-function ensureInit(ctx) {
-  const fresh = !isInitialized(ctx);
-  if (fresh) {
-    mkdirSync2(ctx.sichDir, { recursive: true });
-    out(`created ${c.bold(".sich/")} (holds every layer's git data and claims list)`);
-  }
-  for (const t of excludeTargets(ctx)) {
-    if (applyExclude(t, true))
-      out(describeExclude(t));
-  }
-  installHook(ctx);
-}
-function installHook(ctx) {
-  const hooksDir = resolve4(ctx.root, git(ctx.base, ["rev-parse", "--git-path", "hooks"]).stdout.trim());
-  const hook = join2(hooksDir, "pre-commit");
-  const shown = relative3(ctx.root, hook) || hook;
-  const hooksPath = git(ctx.base, ["config", "--get", "core.hooksPath"], { allowFail: true }).stdout.trim();
-  if (existsSync4(hook)) {
-    const current = readFileSync3(hook, "utf8");
-    if (current.includes(HOOK_HEADER)) {
-      if (current !== HOOK_BODY) {
-        writeFileSync3(hook, HOOK_BODY);
-        chmodSync(hook, 493);
-        out(`updated pre-commit hook -> ${shown}`);
-      }
-      return;
-    }
-    if (HOOK_MARKER.test(current))
-      return;
-    out(`${c.yellow("pre-commit hook exists")} (${shown}); add this line to it:`);
-    out(`  ${HOOK_LINE}`);
-    return;
-  }
-  if (hooksPath) {
-    out(`${c.yellow("core.hooksPath is set")} (${hooksPath}); add this line to its pre-commit hook:`);
-    out(`  ${HOOK_LINE}`);
-    return;
-  }
-  mkdirSync2(hooksDir, { recursive: true });
-  writeFileSync3(hook, HOOK_BODY);
-  chmodSync(hook, 493);
-  out(`installed pre-commit hook -> ${shown}`);
-}
-function cmdInit(ctx, args) {
-  if (parseArgs(args, {}).positionals.length)
-    fail("usage: sich init");
-  const already = isInitialized(ctx);
-  ensureInit(ctx);
-  out(already ? `sich already initialized in ${ctx.root}` : `${c.green("initialized")} sich in ${ctx.root}`);
-  return 0;
-}
-
 // src/commands/inspect.ts
 function cmdWhich(ctx, args) {
   const p = parseArgs(args, {});
@@ -996,13 +1182,13 @@ function cmdLs(ctx, args) {
 
 // src/commands/layer.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { basename as basename3, isAbsolute as isAbsolute2, join as join3, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync2, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename3, isAbsolute as isAbsolute2, join as join4, resolve as resolve5 } from "node:path";
 function assertFree(ctx, layer) {
   validateLayerName(layer);
-  if (existsSync5(join3(ctx.sichDir, layer)))
+  if (existsSync6(join4(ctx.sichDir, layer)))
     fail(`layer '${layer}' already exists (.sich/${layer}/)`);
-  if (existsSync5(manifestPath(ctx, layer)))
+  if (existsSync6(manifestPath(ctx, layer)))
     fail(`.sich/${layer}.paths already exists; remove it first`);
 }
 function createGitDir(ctx, layer) {
@@ -1016,7 +1202,7 @@ function remoteUrl(ctx, url) {
   if (isAbsolute2(url) || /^[a-z][a-z0-9+.-]*:\/\//i.test(url))
     return url;
   const local = resolve5(ctx.cwd, url);
-  return existsSync5(local) ? local : url;
+  return existsSync6(local) ? local : url;
 }
 function baseRepoName(ctx) {
   const url = git(ctx.base, ["config", "--get", "remote.origin.url"], { allowFail: true }).stdout.trim();
@@ -1077,7 +1263,8 @@ function cmdNew(ctx, args) {
   out(`${c.green("created")} layer ${c.bold(layer)}: git data -> .sich/${layer}/, claims list -> ${manifestRel(layer)}`);
   if (url)
     out(`set origin of ${layer} -> ${url}`);
-  note(`next: sich add ${layer} <path>...  then  sich commit ${layer} -m <msg>${url ? `  and  sich push ${layer}` : ""}`);
+  installLayerHooks(ctx, layer);
+  note(`next: sich claim ${layer} <path>...  then  sich commit ${layer} -m <msg>${url ? `  and  sich push ${layer}` : ""}`);
   return 0;
 }
 function cmdAttach(ctx, args) {
@@ -1108,17 +1295,178 @@ function cmdAttach(ctx, args) {
       fail(`attach would overwrite existing files: ${listSome(clash)} (move them away and retry)`);
     }
     git(repo, ["checkout", "-q", "-B", branch, "--track", `origin/${branch}`]);
-    if (!existsSync5(manifestPath(ctx, layer))) {
+    if (!existsSync6(manifestPath(ctx, layer))) {
       warn(`${url} has no .sich/${layer}.paths; is the layer name right?`);
     }
     syncExcludes(ctx);
     out(`${c.green("attached")} layer ${c.bold(layer)} from ${url} -> .sich/${layer}/ (branch ${branch})`);
     out(`checked out ${plural(files.length, "file")}: ${listSome(files)}`);
-    return 0;
   } catch (e) {
     cleanup();
     throw e;
   }
+  installLayerHooks(ctx, layer);
+  return 0;
+}
+var IN_PROGRESS = [
+  ["MERGE_HEAD", "merge"],
+  ["rebase-merge", "rebase"],
+  ["rebase-apply/applying", "am"],
+  ["rebase-apply", "rebase"],
+  ["CHERRY_PICK_HEAD", "cherry-pick"],
+  ["REVERT_HEAD", "revert"]
+];
+var preferredRemote = (remotes) => remotes.includes("origin") ? "origin" : remotes[0];
+function onlyInGitDir(repo) {
+  const run = `sich ${repo.name}`;
+  const losses = [];
+  const count = (revs, allowFail = false) => Number(git(repo, ["rev-list", "--count", ...revs, "--"], { allowFail }).stdout.trim() || 0);
+  const remote = preferredRemote(remotesOf(repo));
+  if (!remote) {
+    const n = count(["--exclude=refs/stash", "--all"]);
+    losses.push({
+      what: `${plural(n, "commit")} with no remote to push to`,
+      fix: `${run} remote add origin <url>, then sich push ${repo.name}`
+    });
+  } else {
+    const current = currentBranch(repo);
+    const refs = lines(git(repo, ["for-each-ref", "--format=%(objectname) %(refname)"]).stdout).map((l) => {
+      const [oid, ref] = l.split(" ");
+      return { oid, ref };
+    });
+    for (const { ref } of refs.filter((r) => r.ref.startsWith("refs/heads/"))) {
+      const n = count([ref, "--not", "--remotes"]);
+      if (!n)
+        continue;
+      const branch = ref.slice("refs/heads/".length);
+      losses.push({
+        what: `${plural(n, "commit")} on ${branch} not on any remote`,
+        fix: branch === current ? `sich push ${repo.name}` : `${run} push -u ${remote} ${shellQuote(branch)}`
+      });
+    }
+    let advertised;
+    const remoteHas = (oid) => {
+      if (advertised === undefined) {
+        const r = git(repo, ["ls-remote", remote], { allowFail: true });
+        advertised = r.code === 0 ? new Set(lines(r.stdout).map((l) => l.split("\t")[0])) : null;
+      }
+      return advertised?.has(oid) ?? false;
+    };
+    const others = refs.filter((r) => !/^refs\/(heads|remotes|prefetch)\//.test(r.ref) && r.ref !== "refs/stash");
+    for (const { oid, ref } of others) {
+      const n = count([`${ref}^{commit}`, "--not", "--remotes", "--branches"], true);
+      if (!n || remoteHas(oid))
+        continue;
+      const name = ref.startsWith("refs/tags/") ? ref.slice("refs/tags/".length) : ref;
+      const unchecked = advertised === null ? ` (could not reach ${remote} to check)` : "";
+      losses.push({
+        what: `${plural(n, "commit")} only on ${name === ref ? ref : `tag ${name}`}${unchecked}`,
+        fix: `${run} push ${remote} ${shellQuote(name)}`
+      });
+    }
+    if (current === null) {
+      const n = count(["HEAD", "--not", "--remotes", "--branches", "--tags"]);
+      if (n) {
+        losses.push({ what: `${plural(n, "commit")} only on the detached HEAD`, fix: `${run} switch -c <branch>` });
+      }
+    }
+  }
+  const stashes = lines(git(repo, ["stash", "list"]).stdout).length;
+  if (stashes) {
+    losses.push({ what: plural(stashes, "stash entry", "stash entries"), fix: `${run} stash pop, then commit` });
+  }
+  const staged = splitZ(git(repo, ["diff", "--cached", "--name-only", "-z", "--no-renames", "--diff-filter=du"]).stdout);
+  const changed = new Set(splitZ(git(repo, ["diff", "--name-only", "-z", "--no-renames"]).stdout));
+  for (const e of splitZ(git(repo, ["ls-files", "-v", "-z"]).stdout)) {
+    if (/^[a-zS] /.test(e))
+      changed.add(e.slice(2));
+  }
+  const stagedOnly = staged.filter((f) => changed.has(f));
+  if (stagedOnly.length) {
+    losses.push({
+      what: `staged versions of ${listSome(stagedOnly)} that differ from what is on disk`,
+      fix: `${run} commit -m <msg>, then sich push ${repo.name}`
+    });
+  }
+  const worktrees = lines(git(repo, ["worktree", "list", "--porcelain"]).stdout).filter((l) => l.startsWith("worktree ")).slice(1).map((l) => l.slice("worktree ".length));
+  if (worktrees.length) {
+    losses.push({
+      what: `${plural(worktrees.length, "linked worktree")}: ${listSome(worktrees)}`,
+      fix: `${run} worktree remove <path>`
+    });
+  }
+  const modules = join4(repo.gitDir, "modules");
+  if (existsSync6(modules) && readdirSync2(modules).length) {
+    losses.push({ what: `submodule repos in .sich/${repo.name}/modules/`, fix: `push and remove the submodules` });
+  }
+  const op = IN_PROGRESS.find(([file]) => existsSync6(join4(repo.gitDir, file)))?.[1];
+  if (op)
+    losses.push({ what: `a ${op} in progress`, fix: `finish it, or ${run} ${op} --abort` });
+  return losses;
+}
+async function cmdDetach(ctx, args) {
+  const p = parseArgs(args, { "--force": "bool", "--yes": "bool" }, { "-y": "--yes" });
+  const [layer, ...extra] = p.positionals;
+  if (!layer || extra.length)
+    fail("usage: sich detach <layer> [--force] [--yes]");
+  const repo = requireLayer(ctx, layer);
+  const losses = onlyInGitDir(repo);
+  if (losses.length && !p.flags["--force"]) {
+    for (const l of losses)
+      out(`${c.red("✗")} ${l.what} (fix: ${l.fix})`);
+    fail(`detaching ${layer} would lose what exists only in .sich/${layer}/ (see above); --force discards it`);
+  }
+  const claims = readManifest(manifestPath(ctx, layer), layer).claims;
+  const remote = preferredRemote(remotesOf(repo));
+  const url = remote && git(repo, ["remote", "get-url", remote], { allowFail: true }).stdout.trim();
+  if (p.flags["--yes"]) {
+    for (const l of losses)
+      warn(`discarding ${l.what}`);
+  } else {
+    const onDisk = claims.filter((cl) => existsSync6(join4(ctx.root, bare(cl))));
+    const row = (label, text) => out(`  ${label}${" ".repeat(10 - label.length)}${text}`);
+    out(`detaching ${c.bold(layer)}:`);
+    row("deletes", `.sich/${layer}/ (its git data: local history, index, hooks, config)`);
+    if (existsSync6(manifestPath(ctx, layer))) {
+      row("deletes", `${manifestRel(layer)} (claims list: ${claims.length ? listSome(claims) : "empty"})`);
+    }
+    for (const l of losses)
+      row("discards", l.what);
+    row("keeps", onDisk.length ? `${listSome(onDisk)} on disk, no longer hidden from base` : "files: none on disk");
+    if (url)
+      row("keeps", `remote ${remote} (${url}) and everything pushed to it`);
+    if (!await confirm(`Detach ${layer}?`)) {
+      fail(process.stdin.isTTY ? "not detached" : "not detached (no answer on stdin; --yes skips the question)");
+    }
+    const shown = new Set(losses.map((l) => l.what));
+    const added = onlyInGitDir(repo).filter((l) => !shown.has(l.what));
+    if (added.length) {
+      for (const l of added)
+        out(`${c.red("✗")} ${l.what} (fix: ${l.fix})`);
+      fail(`${layer} changed while waiting for the answer (see above); not detached`);
+    }
+  }
+  const manifest = existsSync6(manifestPath(ctx, layer));
+  rmSync(repo.gitDir, { recursive: true, force: true });
+  rmSync(manifestPath(ctx, layer), { force: true });
+  const deleted = `git data -> .sich/${layer}/${manifest ? `, claims list -> ${manifestRel(layer)}` : ""}`;
+  out(`${c.green("detached")} layer ${c.bold(layer)}: deleted ${deleted}`);
+  for (const t of excludeTargets(ctx)) {
+    if (!applyExclude(t, true))
+      continue;
+    const file = excludeFileShown(t.repo);
+    out(t.repo.name === "base" ? `no longer hidden from base -> ${file}` : `updated the excludes of ${t.repo.name} -> ${file}`);
+  }
+  const untracked = ["ls-files", "-z", "--others", "--exclude-standard", "--directory", "--no-empty-directory"];
+  const visible = claims.length ? splitZ(git(ctx.base, [...untracked, "--", ...claims]).stdout) : [];
+  if (visible.length) {
+    warn(`base now sees ${listSome(visible)} as untracked ` + `(delete, .gitignore or claim ${visible.length === 1 ? "it" : "them"} before committing base)`);
+  }
+  if (url) {
+    const away = claims.some((cl) => existsSync6(join4(ctx.root, bare(cl)))) ? "move its files away, then " : "";
+    note(`its remote is untouched; to attach again: ${away}sich attach ${layer} ${shellQuote(url)}`);
+  }
+  return 0;
 }
 
 // src/commands/status.ts
@@ -1351,15 +1699,16 @@ usage: sich [-C <dir>] <command> [args]
        sich [-C <dir>] <layer|base> <git args...>
 
 setup
-  init                              set up .sich/, base excludes, commit guard
+  init                              set up .sich/, excludes, commit guards
   new <layer> [--remote <url> | --gh [name]]
                                     create a layer (--gh: private GitHub repo)
   attach <layer> <url>              join an existing layer (collaborators)
+  detach <layer> [--force] [--yes]  remove a layer here; files and remote stay
 
 ownership
-  add <layer> <path...> [--move]    claim files/folders for a layer, stage them
+  claim <layer> <path...> [--move]  claim files/folders for a layer, stage them
                                     (--move: take them from base/another layer)
-  rm <layer> <path...>              release claims; files stay on disk
+  unclaim <layer> <path...>         release claims; files stay on disk
   which <path>                      show who owns a path
   ls [layer]                        list claims and tracked files
 
@@ -1370,7 +1719,7 @@ everyday
   push [repo...]                    push base + all layers (or named)
   sync [repo...]                    pull, then push
   check [--fix] [--staged]          find leaks and ownership problems
-                                    (--staged: what the pre-commit hook runs)
+                                    (--staged: what the commit/merge hooks run)
 
 passthrough
   <layer> <git args...>             run git in a layer, e.g. sich notes log
@@ -1382,7 +1731,7 @@ options
   -V, --version                     print version
 
 environment
-  SICH_BIN                          sich binary the pre-commit hook runs
+  SICH_BIN                          sich binary the commit/merge hooks run
                                     (default: sich on PATH)
   SICH_GH                           gh binary for new --gh (default: gh)
   NO_COLOR                          disable colors
@@ -1393,15 +1742,21 @@ Claims can't nest across layers.
 var COMMAND_HELP = {
   init: `usage: sich init
 
-Creates .sich/, writes the managed block in the base repo's info/exclude, and
-installs a pre-commit hook that runs 'sich check --staged'. If a pre-commit hook
-already exists or core.hooksPath is set, prints the line to add instead.
-The hook runs $SICH_BIN (default: sich on PATH) and blocks the commit if it
-can't be found. Safe to run again.`,
+Creates .sich/, writes the managed blocks in each repo's info/exclude, and
+installs pre-commit and pre-merge-commit hooks in base and in every layer that
+run 'sich check --staged' (git runs pre-merge-commit instead of pre-commit for
+a merge commit made without conflicts). Fast-forwards, rebase and cherry-pick
+run no hook; plain 'sich check' catches what they bring in afterwards. If such
+a hook already exists or core.hooksPath is set, prints the line to add instead
+(each line works in base, in every layer and in a core.hooksPath they share).
+The hooks run $SICH_BIN (default: sich on PATH) and block the commit if it
+can't be found. Safe to run again; refreshes hooks sich wrote and adds missing
+ones.`,
   new: `usage: sich new <layer> [--remote <url> | --gh [name]]
 
 Creates layer <layer> (.sich/<layer>/ git dir sharing this working tree) with an
-empty claims manifest .sich/<layer>.paths and an initial commit.
+empty claims manifest .sich/<layer>.paths and an initial commit, and installs
+its pre-commit and pre-merge-commit hooks (see sich init).
   --remote <url>   set origin
   --gh [name]      create a private GitHub repo with gh (default name:
                    <base-repo>-<layer>) and set origin to its SSH URL.
@@ -1409,20 +1764,40 @@ empty claims manifest .sich/<layer>.paths and an initial commit.
   attach: `usage: sich attach <layer> <url>
 
 Joins an existing layer: fetches <url> and checks out its default branch into
-this working tree. Refuses to overwrite existing files.`,
-  add: `usage: sich add <layer> <path...> [--move]
+this working tree, and installs its pre-commit and pre-merge-commit hooks (see
+sich init). Refuses to overwrite existing files.`,
+  detach: `usage: sich detach <layer> [--force] [--yes]
+
+The opposite of attach: removes a layer from this working tree by deleting its
+git data (.sich/<layer>/) and claims list (.sich/<layer>.paths). Its files stay
+on disk, no longer hidden from base (nothing stops base from committing them
+any more), and its remote is left alone: attach it again any time.
+Refuses if that would lose what exists only in .sich/<layer>/: commits on no
+remote (for branches: as of the last fetch or push), stashes, staged versions
+of files that changed again on disk, linked worktrees, submodule repos, or a
+merge, rebase or similar in progress. Uncommitted changes to files don't
+count, since the files stay.
+Lists what it deletes and what it keeps, then asks before doing it (no answer,
+e.g. without a terminal, means no).
+  --force     detach anyway, discarding all of that
+  -y, --yes   don't ask`,
+  claim: `usage: sich claim <layer> <path...> [--move]
 
 Claims paths (files or directories, relative to the current directory) for a
 layer, then stages them and the manifest in that layer (no commit).
 Refuses paths tracked by base or owned by another layer unless --move is given;
 --move untracks them from the previous owner (old versions stay in its history).
 Claims can't nest across layers: a path inside another layer's claimed directory
-is always refused (move the whole directory instead).`,
-  rm: `usage: sich rm <layer> <path...>
+is always refused (move the whole directory instead).
+Not the same as 'sich <layer> add', which runs plain git add in the layer.
+Alias: sich add.`,
+  unclaim: `usage: sich unclaim <layer> <path...>
 
 Removes exact claims from a layer and untracks them there. The files stay on
 disk and show up as untracked in base (or, if another layer's directory claim
-contains them, now belong to that layer).`,
+contains them, now belong to that layer).
+Not the same as 'sich <layer> rm', which runs plain git rm (deleting files).
+Alias: sich rm.`,
   which: `usage: sich which <path>
 
 Prints the owner of a path: a layer name, 'base', 'ignored' or 'untracked'.`,
@@ -1440,7 +1815,8 @@ staged / modified / untracked files.
 Stages everything (git add -A) and commits, in base and every layer with
 changes, or only in the named repos ('base' or layer names). Excludes keep each
 repo to its own files; anything a repo doesn't own (e.g. let in by a '!' rule in
-a .gitignore) is left out with a warning. Base commits run its pre-commit hook.`,
+a .gitignore) is left out with a warning. Each commit runs that repo's
+pre-commit hook.`,
   pull: `usage: sich pull [repo...]
 
 git pull --rebase --autostash in base and every layer (or the named repos,
@@ -1454,18 +1830,32 @@ git push in base and every layer (or the named repos). Sets the upstream
   sync: `usage: sich sync [repo...]
 
 pull then push, repo by repo. Stops at the first failure.`,
-  check: `usage: sich check [--fix] [--staged]
+  check: `usage: sich check [--fix] [--staged [--merge] [--repo <repo>]]
 
 Reports: paths claimed or tracked by two layers, base tracking claimed paths or
-.sich/, layers tracking files they don't own, and stale exclude blocks.
-  --fix      rewrite stale exclude blocks
-  --staged   also fail if base's index stages claimed paths or .sich/
-             (this is what the pre-commit hook runs; silent when all is well,
-             stale excludes only warn, and a no-op where sich isn't set up,
-             e.g. a linked worktree)
+.sich/, layers tracking files they don't own, and stale exclude blocks. Warns
+about base or layers whose pre-commit or pre-merge-commit hook doesn't run sich
+(fix: sich init).
+  --fix          rewrite stale exclude blocks
+  --staged       also check the commit in progress (this is what the
+                 pre-commit and pre-merge-commit hooks run; for a merge, what
+                 it brings in). In base, fail if it stages claimed paths or
+                 .sich/. In a layer, fail if it stages a path that none of its
+                 claims cover (in the claims list as committed too), another
+                 layer's, or .sich/. Staged deletions are fine. The repo is
+                 the one whose index git is committing (else base). Silent
+                 when all is well, stale excludes only warn, and a no-op where
+                 sich isn't set up (e.g. a linked worktree)
+  --merge        with --staged: the commit is a merge (the pre-merge-commit
+                 hooks pass it; finishing a conflicted merge counts without
+                 it). A blocked merge prints how to back out and restore what
+                 it overwrote, instead of commit hints
+  --repo <repo>  with --staged: check this repo ('base' or a layer) instead
 Exits 1 if any issue remains.`,
   help: `usage: sich help [command]`
 };
+COMMAND_HELP.add = COMMAND_HELP.claim;
+COMMAND_HELP.rm = COMMAND_HELP.unclaim;
 
 // src/cli.ts
 var VERSION = version;
@@ -1473,8 +1863,11 @@ var HANDLERS = {
   init: cmdInit,
   new: cmdNew,
   attach: cmdAttach,
-  add: cmdAdd,
-  rm: cmdRm,
+  detach: cmdDetach,
+  claim: cmdClaim,
+  unclaim: cmdUnclaim,
+  add: cmdClaim,
+  rm: cmdUnclaim,
   which: cmdWhich,
   ls: cmdLs,
   status: cmdStatus,
@@ -1497,7 +1890,7 @@ function changeDir(cwd, dir) {
     fail(`-C ${dir}: no such directory`);
   }
 }
-function main(argv) {
+async function main(argv) {
   let cwd = realpathSync3.native(process.cwd());
   let i = 0;
   for (;i < argv.length; i++) {
@@ -1556,7 +1949,7 @@ function main(argv) {
 }
 var code;
 try {
-  code = main(process.argv.slice(2));
+  code = await main(process.argv.slice(2));
 } catch (e) {
   if (e instanceof SichError)
     printError(e.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-sich",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Private git layers sharing one working tree with a normal (public) repo",
   "keywords": [
     "git",