shadow-git 0.1.0 → 1.0.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command } from "commander";
+import { Command as Command2 } from "commander";
 
 // src/core/repository.ts
 import { access, lstat } from "fs/promises";
@@ -35,7 +35,14 @@ var SgitError = class extends Error {
 };
 var NotGitRepoError = class extends SgitError {
   constructor() {
-    super("not a git repository");
+    super("not a git repository (no .git in current directory)");
+  }
+};
+var NoGitIdentityError = class extends SgitError {
+  constructor() {
+    super(
+      "git user identity not configured; set user.name and user.email with 'git config'"
+    );
   }
 };
 var AlreadyInitializedError = class extends SgitError {
@@ -45,7 +52,7 @@ var AlreadyInitializedError = class extends SgitError {
 };
 var NotInitializedError = class extends SgitError {
   constructor() {
-    super("not a shadow git repository; run 'sgit track init' first");
+    super("not a shadow git repository; run 'sgit track init' or 'sgit track clone <url>'");
   }
 };
 var PathNotFoundError = class extends SgitError {
@@ -66,11 +73,25 @@ var PathNotTrackedError = class extends SgitError {
 
 // src/core/repository.ts
 async function findRoot() {
+  const cwd = process.cwd();
   try {
-    return await execGit(["rev-parse", "--show-toplevel"]);
+    await access(join(cwd, ".git"), constants.F_OK);
   } catch {
     throw new NotGitRepoError();
   }
+  return cwd;
+}
+async function validateGitIdentity(root) {
+  try {
+    await execGit(["config", "user.name"], { cwd: root });
+  } catch {
+    throw new NoGitIdentityError();
+  }
+  try {
+    await execGit(["config", "user.email"], { cwd: root });
+  } catch {
+    throw new NoGitIdentityError();
+  }
 }
 async function validateShadowRepo(root) {
   try {
@@ -142,7 +163,11 @@ import { readFile, writeFile } from "fs/promises";
 import { join as join3 } from "path";
 async function readManifest(root) {
   const content = await readFile(join3(root, ".sgit.json"), "utf-8");
-  return JSON.parse(content);
+  const data = JSON.parse(content);
+  if (!Array.isArray(data.ignore)) {
+    data.ignore = [];
+  }
+  return data;
 }
 async function writeManifest(root, data) {
   await writeFile(
@@ -169,81 +194,106 @@ async function removePath(root, normalizedPath) {
   await writeManifest(root, manifest);
   return true;
 }
+async function addIgnore(root, normalizedPath) {
+  const manifest = await readManifest(root);
+  if (manifest.ignore.includes(normalizedPath)) {
+    return false;
+  }
+  manifest.ignore.push(normalizedPath);
+  await writeManifest(root, manifest);
+  return true;
+}
+async function removeIgnore(root, normalizedPath) {
+  const manifest = await readManifest(root);
+  const index = manifest.ignore.indexOf(normalizedPath);
+  if (index === -1) {
+    return false;
+  }
+  manifest.ignore.splice(index, 1);
+  await writeManifest(root, manifest);
+  return true;
+}
 
 // src/core/exclude.ts
-var SGIT_MARKER = "# sgit";
-var SGIT_MANAGED_HEADER = "# sgit-managed (do not edit below this line)";
+var SGIT_BLOCK_START = "# sgit-managed";
+var SGIT_BLOCK_END = "# end: sgit-managed";
 function generateMainExclude(existingContent, manifestPaths) {
   const lines = existingContent.split("\n");
   const preserved = [];
+  let insideBlock = false;
   let skipNext = false;
   for (const line of lines) {
-    if (line === SGIT_MANAGED_HEADER) {
-      skipNext = false;
+    if (line === SGIT_BLOCK_START || line === "# sgit-managed (do not edit below this line)") {
+      insideBlock = true;
       continue;
     }
-    if (line === SGIT_MARKER) {
-      skipNext = true;
+    if (line === SGIT_BLOCK_END) {
+      insideBlock = false;
       continue;
     }
-    if (line.endsWith(` ${SGIT_MARKER}`)) {
+    if (insideBlock) continue;
+    if (line === "# sgit") {
+      skipNext = true;
       continue;
     }
     if (skipNext) {
       skipNext = false;
       continue;
     }
+    if (line.endsWith(" # sgit")) continue;
     preserved.push(line);
   }
   while (preserved.length > 0 && preserved[preserved.length - 1].trim() === "") {
     preserved.pop();
   }
-  const sgitEntries = [".sgit", ".sgit.json", ...manifestPaths];
-  const sgitLines = sgitEntries.flatMap((entry) => [SGIT_MARKER, entry]);
-  const sections = [
+  const sgitEntries = [".sgit", ".sgit.json", ".gitignore-sgit.bat", ...manifestPaths];
+  return [
     ...preserved,
     "",
-    SGIT_MANAGED_HEADER,
-    ...sgitLines
-  ];
-  return sections.join("\n") + "\n";
-}
-function generateShadowExclude(manifestPaths) {
-  const lines = [
-    "# Exclude everything by default",
-    "*",
-    "",
-    "# .sgit.json (always tracked)",
-    "!.sgit.json"
-  ];
+    SGIT_BLOCK_START,
+    ...sgitEntries,
+    SGIT_BLOCK_END
+  ].join("\n") + "\n";
+}
+function generateShadowExclude(manifestPaths, ignorePaths = []) {
   const emitted = /* @__PURE__ */ new Set();
+  const entryLines = [];
   for (const trackedPath of manifestPaths) {
-    const pathLines = [];
     const ancestors = getAncestors(trackedPath);
     for (const ancestor of ancestors) {
       const unignore = `!${ancestor}/`;
       const reignore = `${ancestor}/*`;
       if (!emitted.has(unignore)) {
-        pathLines.push(unignore);
+        entryLines.push(unignore);
         emitted.add(unignore);
       }
       if (!emitted.has(reignore)) {
-        pathLines.push(reignore);
+        entryLines.push(reignore);
         emitted.add(reignore);
       }
     }
     const target = `!${trackedPath}`;
     if (!emitted.has(target)) {
-      pathLines.push(target);
+      entryLines.push(target);
       emitted.add(target);
     }
-    if (pathLines.length > 0) {
-      lines.push("");
-      lines.push(`# ${trackedPath}`);
-      lines.push(...pathLines);
+    if (trackedPath.endsWith("/")) {
+      const recursive = `!${trackedPath}**`;
+      if (!emitted.has(recursive)) {
+        entryLines.push(recursive);
+        emitted.add(recursive);
+      }
     }
   }
-  return lines.join("\n") + "\n";
+  return [
+    SGIT_BLOCK_START,
+    "*",
+    "!.sgit.json",
+    ...entryLines,
+    ...ignorePaths,
+    ".gitignore-sgit.bat",
+    SGIT_BLOCK_END
+  ].join("\n") + "\n";
 }
 function getAncestors(path) {
   const cleanPath = path.endsWith("/") ? path.slice(0, -1) : path;
@@ -296,6 +346,16 @@ else
   echo "sgit: not found in PATH, skipping pre-commit check" >&2
 fi
 `;
+var SHADOW_POST_MERGE_HOOK = `#!/bin/sh
+if command -v sgit >/dev/null 2>&1; then
+  sgit track sync
+fi
+`;
+var SHADOW_POST_CHECKOUT_HOOK = `#!/bin/sh
+if command -v sgit >/dev/null 2>&1; then
+  sgit track sync
+fi
+`;
 async function getHookDir(root) {
   try {
     const hookPath = await execGit(["config", "core.hooksPath"], {
@@ -337,6 +397,12 @@ async function installShadowHook(sgitDir) {
   await mkdir(hooksDir, { recursive: true });
   await writeFile2(join4(hooksDir, "pre-commit"), SHADOW_HOOK, { mode: 493 });
 }
+async function installShadowSyncHooks(sgitDir) {
+  const hooksDir = join4(sgitDir, "hooks");
+  await mkdir(hooksDir, { recursive: true });
+  await writeFile2(join4(hooksDir, "post-merge"), SHADOW_POST_MERGE_HOOK, { mode: 493 });
+  await writeFile2(join4(hooksDir, "post-checkout"), SHADOW_POST_CHECKOUT_HOOK, { mode: 493 });
+}
 async function uninstallMainHook(root) {
   const hookDir = await getHookDir(root);
   const preCommitPath = join4(hookDir, "pre-commit");
@@ -380,6 +446,7 @@ async function trackInit() {
   const root = await findRoot();
   await validateNotWorktree(root);
   await validateNotSubmodule(root);
+  await validateGitIdentity(root);
   const sgitDir = join5(root, ".sgit");
   try {
     await access3(sgitDir, constants3.F_OK);
@@ -409,7 +476,7 @@ async function trackInit() {
     join5(sgitDir, "info", "exclude"),
     generateShadowExclude([])
   );
-  await writeManifest(root, { paths: [] });
+  await writeManifest(root, { paths: [], ignore: [] });
   const mainExcludePath = join5(root, ".git", "info", "exclude");
   let existingExclude = "";
   try {
@@ -420,6 +487,7 @@ async function trackInit() {
   await writeFile3(mainExcludePath, generateMainExclude(existingExclude, []));
   await installMainHook(root);
   await installShadowHook(sgitDir);
+  await installShadowSyncHooks(sgitDir);
   await execGit(["add", "-f", ".sgit.json"], {
     gitDir: sgitDir,
     workTree: root
@@ -450,7 +518,7 @@ async function syncExcludes(root) {
   );
   const sgitExcludePath = join6(root, ".sgit", "info", "exclude");
   await mkdir3(join6(root, ".sgit", "info"), { recursive: true });
-  await writeFile4(sgitExcludePath, generateShadowExclude(manifest.paths));
+  await writeFile4(sgitExcludePath, generateShadowExclude(manifest.paths, manifest.ignore));
   for (const p of manifest.paths) {
     const checkPath = p.endsWith("/") ? p.slice(0, -1) : p;
     try {
@@ -494,21 +562,35 @@ async function normalizePath(inputPath, root) {
   }
   return rel;
 }
-function isPathCoveredByManifest(filePath, manifestPaths) {
+function isPathCoveredByManifest(filePath, manifestPaths, ignorePaths = []) {
   const caseInsensitive = process.platform === "darwin";
   const normalize = caseInsensitive ? (s) => s.toLowerCase() : (s) => s;
   const normalizedFile = normalize(filePath);
+  let covered = false;
   for (const mPath of manifestPaths) {
     const normalizedManifest = normalize(mPath);
-    if (normalizedManifest === normalizedFile) return true;
+    if (normalizedManifest === normalizedFile) {
+      covered = true;
+      break;
+    }
     if (normalizedManifest.endsWith("/") && normalizedFile.startsWith(normalizedManifest)) {
-      return true;
+      covered = true;
+      break;
     }
   }
-  return false;
+  if (!covered) return false;
+  for (const iPath of ignorePaths) {
+    const normalizedIgnore = normalize(iPath);
+    if (normalizedIgnore === normalizedFile) return false;
+    if (normalizedIgnore.endsWith("/") && normalizedFile.startsWith(normalizedIgnore)) {
+      return false;
+    }
+  }
+  return true;
 }
 
 // src/commands/track/add.ts
+var BLOCKED_BASENAMES = /* @__PURE__ */ new Set([".gitignore", ".gitignore-sgit.bat"]);
 async function trackAdd(paths, opts = {}) {
   const root = await findRoot();
   await validateShadowRepo(root);
@@ -516,6 +598,12 @@ async function trackAdd(paths, opts = {}) {
   const added = [];
   for (const inputPath of paths) {
     const normalized = await normalizePath(inputPath, root);
+    const basename = normalized.split("/").pop() ?? "";
+    if (BLOCKED_BASENAMES.has(basename)) {
+      throw new SgitError(
+        `cannot track ${normalized}: .gitignore files are managed by sgit and cannot be tracked directly`
+      );
+    }
     const checkPath = normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
     try {
       await access5(join7(root, checkPath), constants5.F_OK);
@@ -614,41 +702,252 @@ async function trackList() {
 }
 
 // src/commands/track/verify.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
+
+// src/core/gitignore.ts
+import {
+  readdirSync,
+  renameSync,
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  unlinkSync
+} from "fs";
+import { join as join9, relative as relative3, sep as sep3 } from "path";
+var DISABLED_NAME = ".gitignore-sgit.bat";
+var LOCK_FILE = ".gitignore-guard";
+function enableGitignores(root, manifestPaths) {
+  const disabled = findInTrackedDirs(root, manifestPaths, DISABLED_NAME);
+  const enabled = [];
+  for (const relPath of disabled) {
+    const absPath = join9(root, relPath);
+    const restoredPath = absPath.substring(0, absPath.length - DISABLED_NAME.length) + ".gitignore";
+    renameSync(absPath, restoredPath);
+    enabled.push(relPath);
+  }
+  return enabled;
+}
+function findStaleGitignores(root, manifestPaths) {
+  return findInTrackedDirs(root, manifestPaths, DISABLED_NAME);
+}
+function isGuardActive(root) {
+  const lockPath = join9(root, ".sgit", LOCK_FILE);
+  try {
+    const pid = parseInt(readFileSync(lockPath, "utf-8").trim(), 10);
+    if (isNaN(pid)) return false;
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function setupGitignoreGuard(root, manifestPaths) {
+  const lockPath = join9(root, ".sgit", LOCK_FILE);
+  if (isGuardActive(root)) {
+    return () => {
+    };
+  }
+  const stale = findInTrackedDirs(root, manifestPaths, DISABLED_NAME);
+  if (stale.length > 0) {
+    warn(
+      "found stale .gitignore-sgit.bat files from a previous crash; restoring"
+    );
+    enableGitignores(root, manifestPaths);
+  }
+  cleanStaleLock(lockPath);
+  const gitignores = findInTrackedDirs(root, manifestPaths, ".gitignore");
+  if (gitignores.length === 0) {
+    return () => {
+    };
+  }
+  for (const relPath of gitignores) {
+    const absPath = join9(root, relPath);
+    const dir = absPath.substring(0, absPath.length - ".gitignore".length);
+    renameSync(absPath, dir + DISABLED_NAME);
+  }
+  try {
+    writeFileSync(lockPath, String(process.pid));
+  } catch {
+  }
+  let cleaned = false;
+  const cleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    try {
+      enableGitignores(root, manifestPaths);
+    } catch {
+    }
+    try {
+      unlinkSync(lockPath);
+    } catch {
+    }
+  };
+  const onSigint = () => {
+    cleanup();
+    process.exit(130);
+  };
+  const onSigterm = () => {
+    cleanup();
+    process.exit(143);
+  };
+  process.on("SIGINT", onSigint);
+  process.on("SIGTERM", onSigterm);
+  process.on("exit", cleanup);
+  return () => {
+    process.removeListener("SIGINT", onSigint);
+    process.removeListener("SIGTERM", onSigterm);
+    process.removeListener("exit", cleanup);
+    cleanup();
+  };
+}
+function findInTrackedDirs(root, manifestPaths, targetName) {
+  const found = /* @__PURE__ */ new Set();
+  for (const mPath of manifestPaths) {
+    for (const ancestor of getAncestorDirs(mPath)) {
+      const dirAbs = ancestor === "" ? root : join9(root, ancestor);
+      const targetPath = join9(dirAbs, targetName);
+      if (existsSync(targetPath)) {
+        found.add(targetPath);
+      }
+    }
+    if (mPath.endsWith("/")) {
+      const dirAbs = join9(root, mPath);
+      if (existsSync(dirAbs)) {
+        walkSync(dirAbs, targetName, found);
+      }
+    }
+  }
+  return [...found].map((abs) => relative3(root, abs).split(sep3).join("/"));
+}
+function getAncestorDirs(path) {
+  const clean = path.endsWith("/") ? path.slice(0, -1) : path;
+  const parts = clean.split("/");
+  parts.pop();
+  const ancestors = [""];
+  for (let i = 1; i <= parts.length; i++) {
+    ancestors.push(parts.slice(0, i).join("/"));
+  }
+  return ancestors;
+}
+function walkSync(dir, targetName, results) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory() && (entry.name === ".git" || entry.name === ".sgit")) {
+      continue;
+    }
+    const fullPath = join9(dir, entry.name);
+    if (entry.isDirectory()) {
+      walkSync(fullPath, targetName, results);
+    } else if (entry.name === targetName) {
+      results.add(fullPath);
+    }
+  }
+}
+function cleanStaleLock(lockPath) {
+  try {
+    unlinkSync(lockPath);
+  } catch {
+  }
+}
+
+// src/commands/track/verify.ts
 async function verifyMain(root) {
   const manifest = await readManifest(root);
-  let staged;
+  const violations = [];
+  if (!isGuardActive(root)) {
+    const stale = findStaleGitignores(root, manifest.paths);
+    violations.push(
+      ...stale.map(
+        (f) => `${f} (stale .gitignore-sgit.bat \u2014 rename back to .gitignore)`
+      )
+    );
+  }
   try {
-    staged = await execGit(["diff", "--cached", "--name-only"], {
-      gitDir: join9(root, ".git"),
+    const staged = await execGit(["diff", "--cached", "--name-only", "--diff-filter=ACMR"], {
+      gitDir: join10(root, ".git"),
       workTree: root
     });
+    if (staged.trim()) {
+      const stagedFiles = staged.trim().split("\n");
+      violations.push(
+        ...stagedFiles.filter((f) => isPathCoveredByManifest(f, manifest.paths, manifest.ignore))
+      );
+    }
   } catch {
-    return { valid: true, violations: [] };
   }
-  if (!staged.trim()) return { valid: true, violations: [] };
-  const stagedFiles = staged.trim().split("\n");
-  const violations = stagedFiles.filter(
-    (f) => isPathCoveredByManifest(f, manifest.paths)
-  );
   return { valid: violations.length === 0, violations };
 }
 async function verifyShadow(root) {
-  const manifest = await readManifest(root);
-  let staged;
+  let manifest;
+  try {
+    manifest = await readManifest(root);
+  } catch {
+    return {
+      valid: false,
+      violations: [".sgit.json (missing or invalid on disk)"]
+    };
+  }
+  const sgitDir = join10(root, ".sgit");
+  const violations = [];
+  if (!isGuardActive(root)) {
+    const stale = findStaleGitignores(root, manifest.paths);
+    violations.push(
+      ...stale.map(
+        (f) => `${f} (stale .gitignore-sgit.bat \u2014 rename back to .gitignore)`
+      )
+    );
+  }
   try {
-    staged = await execGit(["diff", "--cached", "--name-only"], {
-      gitDir: join9(root, ".sgit"),
+    const deleted = await execGit(["diff", "--cached", "--name-only", "--diff-filter=D"], {
+      gitDir: sgitDir,
       workTree: root
     });
+    if (deleted.trim().split("\n").includes(".sgit.json")) {
+      violations.push(".sgit.json (cannot delete sgit manifest)");
+    }
+  } catch {
+  }
+  try {
+    const modified = await execGit(["diff", "--cached", "--name-only", "--diff-filter=M"], {
+      gitDir: sgitDir,
+      workTree: root
+    });
+    if (modified.trim().split("\n").includes(".sgit.json")) {
+      const content = await execGit(["show", ":0:.sgit.json"], {
+        gitDir: sgitDir,
+        workTree: root
+      });
+      try {
+        const parsed = JSON.parse(content);
+        if (!Array.isArray(parsed.paths)) {
+          violations.push('.sgit.json (invalid: missing "paths" array)');
+        }
+      } catch {
+        violations.push(".sgit.json (invalid JSON)");
+      }
+    }
+  } catch {
+  }
+  try {
+    const staged = await execGit(["diff", "--cached", "--name-only"], {
+      gitDir: sgitDir,
+      workTree: root
+    });
+    if (staged.trim()) {
+      const stagedFiles = staged.trim().split("\n");
+      violations.push(
+        ...stagedFiles.filter(
+          (f) => f !== ".sgit.json" && !isPathCoveredByManifest(f, manifest.paths, manifest.ignore)
+        )
+      );
+    }
   } catch {
-    return { valid: true, violations: [] };
   }
-  if (!staged.trim()) return { valid: true, violations: [] };
-  const stagedFiles = staged.trim().split("\n");
-  const violations = stagedFiles.filter(
-    (f) => f !== ".sgit.json" && !isPathCoveredByManifest(f, manifest.paths)
-  );
   return { valid: violations.length === 0, violations };
 }
 async function trackVerify(opts) {
@@ -687,71 +986,359 @@ async function trackVerify(opts) {
   }
 }
 
-// src/commands/track/destroy.ts
-import { join as join10 } from "path";
-import { readFile as readFile5, writeFile as writeFile5, rm as rm2 } from "fs/promises";
+// src/commands/track/clone.ts
+import { join as join11, extname } from "path";
+import { access as access6, readFile as readFile5, writeFile as writeFile5, rename as rename2, mkdir as mkdir4, rm as rm2 } from "fs/promises";
+import { constants as constants6 } from "fs";
 import { createInterface } from "readline";
+import { randomBytes } from "crypto";
+async function trackClone(url, opts = {}) {
+  const root = await findRoot();
+  await validateNotWorktree(root);
+  await validateNotSubmodule(root);
+  await validateGitIdentity(root);
+  const sgitDir = join11(root, ".sgit");
+  try {
+    await access6(sgitDir, constants6.F_OK);
+    throw new AlreadyInitializedError();
+  } catch (err) {
+    if (err instanceof AlreadyInitializedError) throw err;
+  }
+  try {
+    await execGit(["clone", "--bare", url, sgitDir]);
+  } catch {
+    try {
+      await rm2(sgitDir, { recursive: true, force: true });
+    } catch {
+    }
+    throw new SgitError(`failed to clone from ${url}`);
+  }
+  await execGit(["config", "core.bare", "false"], { gitDir: sgitDir });
+  await execGit(["config", "core.worktree", root], { gitDir: sgitDir });
+  try {
+    const name = await execGit(["config", "user.name"], { cwd: root });
+    if (name) {
+      await execGit(["config", "user.name", name], { gitDir: sgitDir });
+    }
+  } catch {
+  }
+  try {
+    const email = await execGit(["config", "user.email"], { cwd: root });
+    if (email) {
+      await execGit(["config", "user.email", email], { gitDir: sgitDir });
+    }
+  } catch {
+  }
+  let manifest;
+  try {
+    const manifestJson = await execGit(["show", "HEAD:.sgit.json"], { gitDir: sgitDir });
+    manifest = JSON.parse(manifestJson);
+  } catch {
+    manifest = { paths: [], ignore: [] };
+  }
+  let trackedFiles = [];
+  try {
+    const output = await execGit(["ls-tree", "-r", "--name-only", "HEAD"], { gitDir: sgitDir });
+    if (output.trim()) {
+      trackedFiles = output.trim().split("\n");
+    }
+  } catch {
+  }
+  const conflicts = [];
+  for (const file of trackedFiles) {
+    try {
+      await access6(join11(root, file), constants6.F_OK);
+      conflicts.push(file);
+    } catch {
+    }
+  }
+  let choice = 1;
+  if (conflicts.length > 0) {
+    if (opts.onConflict) {
+      choice = opts.onConflict;
+    } else {
+      warn(`${conflicts.length} file(s) already exist on disk:`);
+      for (const f of conflicts) {
+        info(`  ${f}`);
+      }
+      choice = await promptConflictResolution();
+    }
+    if (choice === 2) {
+      const savedContent = /* @__PURE__ */ new Map();
+      for (const file of conflicts) {
+        savedContent.set(file, await readFile5(join11(root, file)));
+      }
+      if (trackedFiles.length > 0) {
+        await execGit(["checkout", "HEAD", "--", "."], { gitDir: sgitDir, workTree: root });
+      }
+      for (const [file, content] of savedContent) {
+        await mkdir4(join11(root, file, ".."), { recursive: true });
+        await writeFile5(join11(root, file), content);
+      }
+    } else if (choice === 3) {
+      for (const file of conflicts) {
+        const renamed = generateOriginalName(file);
+        await rename2(join11(root, file), join11(root, renamed));
+      }
+      if (trackedFiles.length > 0) {
+        await execGit(["checkout", "HEAD", "--", "."], { gitDir: sgitDir, workTree: root });
+      }
+    } else {
+      if (trackedFiles.length > 0) {
+        await execGit(["checkout", "HEAD", "--", "."], { gitDir: sgitDir, workTree: root });
+      }
+    }
+  } else {
+    if (trackedFiles.length > 0) {
+      await execGit(["checkout", "HEAD", "--", "."], { gitDir: sgitDir, workTree: root });
+    }
+  }
+  await syncExcludes(root);
+  await installMainHook(root);
+  await installShadowHook(sgitDir);
+  await installShadowSyncHooks(sgitDir);
+  const fileCount = trackedFiles.filter((f) => f !== ".sgit.json").length;
+  success(`Shadow repository cloned from ${url}`);
+  info(`  ${fileCount} file(s) checked out`);
+  if (conflicts.length > 0) {
+    switch (choice) {
+      case 1:
+        info(`  ${conflicts.length} conflicting file(s) overwritten`);
+        break;
+      case 2:
+        info(`  ${conflicts.length} local file(s) kept (shadow repo shows them as modified)`);
+        break;
+      case 3:
+        info(`  ${conflicts.length} local file(s) renamed with -original~ suffix`);
+        break;
+    }
+  }
+}
+async function promptConflictResolution() {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolve5) => {
+    process.stdout.write("\nHow should conflicts be resolved?\n");
+    process.stdout.write("  1 - Keep sgit (overwrite local files)\n");
+    process.stdout.write("  2 - Keep originals (local files stay, sgit shows them as modified)\n");
+    process.stdout.write("  3 - Rename originals (add -original~ suffix, checkout sgit versions)\n");
+    rl.question("\nChoice [1/2/3]: ", (answer) => {
+      rl.close();
+      const num = parseInt(answer.trim(), 10);
+      if (num === 1 || num === 2 || num === 3) {
+        resolve5(num);
+      } else {
+        resolve5(2);
+      }
+    });
+  });
+}
+function generateOriginalName(filePath) {
+  const suffix = randomBytes(2).toString("hex");
+  const ext = extname(filePath);
+  if (ext) {
+    const base = filePath.slice(0, filePath.length - ext.length);
+    return `${base}-original~${suffix}${ext}`;
+  }
+  return `${filePath}-original~${suffix}`;
+}
+
+// src/commands/track/destroy.ts
+import { join as join12, dirname as dirname2 } from "path";
+import { readFile as readFile6, writeFile as writeFile6, rm as rm3, rmdir, unlink as unlink2 } from "fs/promises";
+import { createInterface as createInterface2 } from "readline";
 async function trackDestroy(opts) {
   const root = await findRoot();
   await validateShadowRepo(root);
+  const sgitDir = join12(root, ".sgit");
+  let trackedFiles = [];
+  try {
+    const output = await execGit(["ls-tree", "-r", "--name-only", "HEAD"], {
+      gitDir: sgitDir,
+      workTree: root
+    });
+    if (output.trim()) {
+      trackedFiles = output.trim().split("\n").filter((f) => f !== ".sgit.json");
+    }
+  } catch {
+  }
+  let uncommittedStatus = "";
+  try {
+    uncommittedStatus = await execGit(["status", "--porcelain"], {
+      gitDir: sgitDir,
+      workTree: root
+    });
+  } catch {
+  }
+  const hasUncommitted = uncommittedStatus.trim().length > 0;
   if (!opts.force) {
-    const confirmed = await confirm(
-      "This will permanently remove the shadow repository. Continue?"
-    );
+    if (hasUncommitted) {
+      warn("there are uncommitted changes in the shadow repository:");
+      for (const line of uncommittedStatus.trim().split("\n")) {
+        info(`  ${line}`);
+      }
+      process.stdout.write("\n");
+    }
+    let message;
+    if (opts.keepFiles) {
+      message = hasUncommitted ? "This will remove the shadow repository. Tracked files remain on disk but shadow history will be lost. Continue?" : "This will remove the shadow repository. Tracked files will remain on disk. Continue?";
+    } else {
+      message = hasUncommitted ? `This will permanently remove the shadow repository and delete ${trackedFiles.length} tracked file(s). Uncommitted changes will be lost. Continue?` : `This will permanently remove the shadow repository and delete ${trackedFiles.length} tracked file(s). Continue?`;
+    }
+    const confirmed = await confirm(message);
     if (!confirmed) {
       info("Aborted.");
       return;
     }
   }
-  const excludePath = join10(root, ".git", "info", "exclude");
+  const excludePath = join12(root, ".git", "info", "exclude");
   try {
-    const content = await readFile5(excludePath, "utf-8");
+    const content = await readFile6(excludePath, "utf-8");
     const lines = content.split("\n");
     const result = [];
+    let insideBlock = false;
     let skipNext = false;
     for (const line of lines) {
-      if (line === SGIT_MANAGED_HEADER) {
-        skipNext = false;
+      if (line === SGIT_BLOCK_START || line === "# sgit-managed (do not edit below this line)") {
+        insideBlock = true;
         continue;
       }
-      if (line === SGIT_MARKER) {
-        skipNext = true;
+      if (line === SGIT_BLOCK_END) {
+        insideBlock = false;
         continue;
       }
-      if (line.endsWith(` ${SGIT_MARKER}`)) {
+      if (insideBlock) continue;
+      if (line === "# sgit") {
+        skipNext = true;
         continue;
       }
       if (skipNext) {
         skipNext = false;
         continue;
       }
+      if (line.endsWith(" # sgit")) continue;
       result.push(line);
     }
     const cleaned = result.join("\n");
-    await writeFile5(excludePath, cleaned.replace(/\n+$/, "\n"));
+    await writeFile6(excludePath, cleaned.replace(/\n+$/, "\n"));
   } catch {
   }
   await uninstallMainHook(root);
-  await rm2(join10(root, ".sgit"), { recursive: true, force: true });
-  await rm2(join10(root, ".sgit.json"), { force: true });
-  success("Shadow repository removed.");
+  if (!opts.keepFiles && trackedFiles.length > 0) {
+    for (const file of trackedFiles) {
+      try {
+        await unlink2(join12(root, file));
+      } catch {
+      }
+    }
+    const dirs = /* @__PURE__ */ new Set();
+    for (const file of trackedFiles) {
+      let dir = dirname2(file);
+      while (dir !== ".") {
+        dirs.add(dir);
+        dir = dirname2(dir);
+      }
+    }
+    const sortedDirs = [...dirs].sort((a, b) => b.length - a.length);
+    for (const dir of sortedDirs) {
+      try {
+        await rmdir(join12(root, dir));
+      } catch {
+      }
+    }
+  }
+  await rm3(join12(root, ".sgit"), { recursive: true, force: true });
+  await rm3(join12(root, ".sgit.json"), { force: true });
+  if (opts.keepFiles) {
+    success("Shadow repository removed. Tracked files kept on disk.");
+  } else {
+    success("Shadow repository and tracked files removed.");
+  }
 }
 async function confirm(message) {
-  const rl = createInterface({
+  const rl = createInterface2({
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
-      resolve4(answer.toLowerCase() === "y");
+      resolve5(answer.toLowerCase() === "y");
     });
   });
 }
 
+// src/commands/track/ignore.ts
+import { join as join13 } from "path";
+async function trackIgnore(paths) {
+  const root = await findRoot();
+  await validateShadowRepo(root);
+  const sgitDir = join13(root, ".sgit");
+  const added = [];
+  for (const inputPath of paths) {
+    const normalized = await normalizePath(inputPath, root);
+    const manifest = await readManifest(root);
+    if (!isPathCoveredByManifest(normalized, manifest.paths)) {
+      throw new PathNotTrackedError(normalized);
+    }
+    const wasAdded = await addIgnore(root, normalized);
+    if (wasAdded) {
+      added.push(normalized);
+      const rmPath = normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+      try {
+        const rmArgs = normalized.endsWith("/") ? ["rm", "--cached", "-r", rmPath] : ["rm", "--cached", rmPath];
+        await execGit(rmArgs, { gitDir: sgitDir, workTree: root });
+      } catch {
+      }
+    }
+  }
+  await syncExcludes(root);
+  if (added.length > 0) {
+    success(`Ignoring ${added.length} path(s):`);
+    for (const p of added) {
+      info(`  ${p}`);
+    }
+  } else {
+    info("All paths already ignored.");
+  }
+}
+
+// src/commands/track/unignore.ts
+import { resolve as resolve4, relative as relative4, sep as sep4 } from "path";
+async function trackUnignore(paths) {
+  const root = await findRoot();
+  await validateShadowRepo(root);
+  const removed = [];
+  for (const inputPath of paths) {
+    const absolute = resolve4(process.cwd(), inputPath);
+    let normalized = relative4(root, absolute).split(sep4).join("/");
+    if (inputPath.endsWith("/") && !normalized.endsWith("/")) {
+      normalized += "/";
+    }
+    const manifest = await readManifest(root);
+    const exactPath = manifest.ignore.find((p) => p === normalized) || manifest.ignore.find((p) => p === normalized + "/") || (normalized.endsWith("/") ? manifest.ignore.find((p) => p === normalized.slice(0, -1)) : void 0);
+    if (!exactPath) {
+      throw new SgitError(`${normalized} is not in the ignore list`);
+    }
+    const wasRemoved = await removeIgnore(root, exactPath);
+    if (wasRemoved) {
+      removed.push(exactPath);
+    }
+  }
+  await syncExcludes(root);
+  if (removed.length > 0) {
+    success(`Unignored ${removed.length} path(s):`);
+    for (const p of removed) {
+      info(`  ${p}`);
+    }
+  }
+}
+
 // src/commands/track/completion.ts
-import { join as join11, dirname as dirname2 } from "path";
-import { mkdir as mkdir4, writeFile as writeFile6 } from "fs/promises";
+import { join as join14, dirname as dirname3 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile7 } from "fs/promises";
 import { homedir } from "os";
 function bashCompletion() {
   return `# sgit bash completion
@@ -761,7 +1348,7 @@ _sgit() {
 
   if [[ \${words[1]} == "track" ]]; then
     if [[ $cword -eq 2 ]]; then
-      COMPREPLY=($(compgen -W "init add remove list sync verify destroy completion" -- "$cur"))
+      COMPREPLY=($(compgen -W "init clone add remove list sync verify ignore unignore destroy completion" -- "$cur"))
       return
     fi
 
@@ -774,24 +1361,34 @@ _sgit() {
           _filedir
         fi
         ;;
+      clone)
+        ;;
       remove)
         local paths
         paths=$(sgit track list 2>/dev/null)
         COMPREPLY=($(compgen -W "$paths" -- "$cur"))
         ;;
+      ignore)
+        _filedir
+        ;;
+      unignore)
+        local ignored
+        ignored=$(python3 -c "import json; d=json.load(open('.sgit.json')); print(' '.join(d.get('ignore',[])))" 2>/dev/null)
+        COMPREPLY=($(compgen -W "$ignored" -- "$cur"))
+        ;;
       verify)
         COMPREPLY=($(compgen -W "--main --shadow" -- "$cur"))
         ;;
       destroy)
-        COMPREPLY=($(compgen -W "--force" -- "$cur"))
+        COMPREPLY=($(compgen -W "--force --keep-files" -- "$cur"))
         ;;
       completion)
         if [[ $prev == "--shell" ]]; then
           COMPREPLY=($(compgen -W "bash zsh fish" -- "$cur"))
-        elif [[ $cur == -* ]]; then
-          COMPREPLY=($(compgen -W "--shell" -- "$cur"))
+        elif [[ $cword -eq 3 ]]; then
+          COMPREPLY=($(compgen -W "install --shell" -- "$cur"))
         else
-          COMPREPLY=($(compgen -W "install" -- "$cur"))
+          COMPREPLY=($(compgen -W "--shell" -- "$cur"))
         fi
         ;;
     esac
@@ -824,11 +1421,14 @@ _sgit_track() {
   local -a subcmds
   subcmds=(
     'init:Initialize shadow repository'
+    'clone:Clone shadow repository from remote URL'
     'add:Start shadow-tracking paths'
     'remove:Stop shadow-tracking paths'
     'list:List all shadow-tracked paths'
     'sync:Regenerate exclude files'
     'verify:Validate staged files'
+    'ignore:Ignore paths within tracked directories'
+    'unignore:Stop ignoring paths within tracked directories'
     'destroy:Remove shadow repository'
     'completion:Install shell completions'
   )
@@ -839,6 +1439,9 @@ _sgit_track() {
   fi
 
   case "\${words[2]}" in
+    clone)
+      _arguments '1:url:'
+      ;;
     add)
       _arguments '--adopt[Move main-git-tracked files to shadow tracking]' '*:file:_files'
       ;;
@@ -847,11 +1450,19 @@ _sgit_track() {
       paths=(\${(f)"$(sgit track list 2>/dev/null)"})
       _describe 'tracked path' paths
       ;;
+    ignore)
+      _files
+      ;;
+    unignore)
+      local -a ignored
+      ignored=(\${(f)"$(python3 -c "import json; d=json.load(open('.sgit.json')); print('\\\\n'.join(d.get('ignore',[])))" 2>/dev/null)"})
+      _describe 'ignored path' ignored
+      ;;
     verify)
       _arguments '--main[Check main repo]' '--shadow[Check shadow repo]'
       ;;
     destroy)
-      _arguments '--force[Skip confirmation]'
+      _arguments '--force[Skip confirmation]' '--keep-files[Keep tracked files on disk]'
       ;;
     completion)
       _arguments '--shell[Shell type]:shell:(bash zsh fish)' '1:action:(install)'
@@ -896,14 +1507,18 @@ complete -c sgit -w git
 complete -c sgit -n '__fish_use_subcommand' -a track -d 'Manage shadow-tracked paths'
 
 # Track subcommands
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a init -d 'Initialize shadow repository'
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a add -d 'Start shadow-tracking paths'
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a remove -d 'Stop shadow-tracking paths'
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a list -d 'List all shadow-tracked paths'
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a sync -d 'Regenerate exclude files'
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a verify -d 'Validate staged files'
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a destroy -d 'Remove shadow repository'
-complete -c sgit -n '__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from init add remove list sync verify destroy completion' -a completion -d 'Install shell completions'
+set -l __sgit_track_cmds init clone add remove list sync verify ignore unignore destroy completion
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a init -d 'Initialize shadow repository'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a clone -d 'Clone shadow repository from remote URL'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a add -d 'Start shadow-tracking paths'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a remove -d 'Stop shadow-tracking paths'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a list -d 'List all shadow-tracked paths'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a sync -d 'Regenerate exclude files'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a verify -d 'Validate staged files'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a ignore -d 'Ignore paths within tracked directories'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a unignore -d 'Stop ignoring paths within tracked directories'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a destroy -d 'Remove shadow repository'
+complete -c sgit -n "__fish_seen_subcommand_from track; and not __fish_seen_subcommand_from $__sgit_track_cmds" -a completion -d 'Install shell completions'
 
 # Track add options and file completions
 complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from add' -l adopt -d 'Move main-git-tracked files'
@@ -912,15 +1527,22 @@ complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcomma
 # Track remove \u2014 complete from manifest
 complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from remove' -a '(sgit track list 2>/dev/null)'
 
+# Track ignore \u2014 file completions
+complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from ignore' -F
+
+# Track unignore \u2014 complete from .sgit.json ignore list
+complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from unignore' -a "(python3 -c \\"import json; d=json.load(open('.sgit.json')); print(' '.join(d.get('ignore',[])))\\" 2>/dev/null)"
+
 # Track verify options
 complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from verify' -l main -d 'Check main repo'
 complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from verify' -l shadow -d 'Check shadow repo'
 
 # Track destroy options
 complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from destroy' -l force -d 'Skip confirmation'
+complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from destroy' -l keep-files -d 'Keep tracked files on disk'
 
 # Track completion options
-complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from completion' -a install -d 'Install completions'
+complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from completion; and not __fish_seen_subcommand_from install' -a install -d 'Install completions'
 complete -c sgit -n '__fish_seen_subcommand_from track; and __fish_seen_subcommand_from completion' -l shell -d 'Shell type' -ra 'bash zsh fish'
 `;
 }
@@ -944,11 +1566,11 @@ function getInstallPath(shell) {
   const home = homedir();
   switch (shell) {
     case "zsh":
-      return join11(home, ".zsh", "completions", "_sgit");
+      return join14(home, ".zsh", "completions", "_sgit");
     case "fish":
-      return join11(home, ".config", "fish", "completions", "sgit.fish");
+      return join14(home, ".config", "fish", "completions", "sgit.fish");
     default:
-      return join11(home, ".local", "share", "bash-completion", "completions", "sgit");
+      return join14(home, ".local", "share", "bash-completion", "completions", "sgit");
   }
 }
 async function trackCompletion(action, opts) {
@@ -960,8 +1582,8 @@ async function trackCompletion(action, opts) {
   }
   if (action === "install") {
     const installPath = getInstallPath(shell);
-    await mkdir4(dirname2(installPath), { recursive: true });
-    await writeFile6(installPath, script, { mode: 420 });
+    await mkdir5(dirname3(installPath), { recursive: true });
+    await writeFile7(installPath, script, { mode: 420 });
     success(`Installed ${shell} completions to ${installPath}`);
     if (shell === "zsh") {
       info(
@@ -978,6 +1600,7 @@ async function trackCompletion(action, opts) {
 function registerTrackCommands(program) {
   const track = program.command("track").description("Manage shadow-tracked paths");
   track.command("init").description("Initialize shadow repository").action(wrapAction(trackInit));
+  track.command("clone").description("Clone a shadow repository from a remote URL").argument("<url>").action(wrapAction(async (url) => trackClone(url)));
   track.command("add").description("Start shadow-tracking paths").argument("<paths...>").option("--adopt", "Move main-git-tracked files to shadow tracking").action(wrapAction(async (paths, opts) => trackAdd(paths, opts)));
   track.command("remove").description("Stop shadow-tracking paths").argument("<paths...>").action(wrapAction(async (paths) => trackRemove(paths)));
   track.command("list").description("List all shadow-tracked paths").action(wrapAction(async () => {
@@ -989,7 +1612,9 @@ function registerTrackCommands(program) {
       async (opts) => trackVerify(opts)
     )
   );
-  track.command("destroy").description("Remove shadow repository entirely").option("--force", "Skip confirmation prompt").action(
+  track.command("ignore").description("Ignore paths within tracked directories").argument("<paths...>").action(wrapAction(async (paths) => trackIgnore(paths)));
+  track.command("unignore").description("Stop ignoring paths within tracked directories").argument("<paths...>").action(wrapAction(async (paths) => trackUnignore(paths)));
+  track.command("destroy").description("Remove shadow repository entirely").option("--force", "Skip confirmation prompt").option("--keep-files", "Keep tracked files on disk (default: delete them)").action(
     wrapAction(async (opts) => trackDestroy(opts))
   );
   track.command("completion").description("Install shell completion scripts").argument("[action]", "Action (install)").option("--shell <name>", "Shell (bash, zsh, fish)").action(
@@ -1012,20 +1637,81 @@ function wrapAction(fn) {
   };
 }
 
+// src/commands/debug/index.ts
+import { Command } from "commander";
+
+// src/commands/debug/gitignores.ts
+async function debugGitignores() {
+  const root = await findRoot();
+  await validateShadowRepo(root);
+  const manifest = await readManifest(root);
+  const cleanup = setupGitignoreGuard(root, manifest.paths);
+  try {
+    info("gitignores disabled \u2014 waiting 10 seconds\u2026");
+    for (let i = 10; i > 0; i--) {
+      process.stdout.write(`\r  ${i}s remaining `);
+      await sleep(1e3);
+    }
+    process.stdout.write("\r                \r");
+    success("re-enabling gitignores");
+  } finally {
+    cleanup();
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+
+// src/commands/debug/index.ts
+function registerDebugCommands(program) {
+  const debug = new Command("debug").description("Debug utilities");
+  debug.command("gitignores").description("Disable .gitignore files for 10 seconds, then re-enable").action(wrapAction2(debugGitignores));
+  program.addCommand(debug, { hidden: true });
+}
+function wrapAction2(fn) {
+  return async (...args) => {
+    try {
+      await fn(...args);
+    } catch (err) {
+      if (err instanceof SgitError) {
+        error(err.message);
+        process.exit(1);
+      }
+      throw err;
+    }
+  };
+}
+
 // src/cli.ts
+var COMMANDER_COMMANDS = /* @__PURE__ */ new Set(["track", "debug"]);
 async function run() {
   const args = process.argv.slice(2);
-  if (args.length === 0 || args[0] === "track" || args[0].startsWith("-")) {
-    const program = new Command("sgit").description("Shadow Git \u2014 a secondary git repository for your project").version("0.1.0");
-    registerTrackCommands(program);
-    program.addHelpText(
-      "after",
-      `
+  const skipGuard = args[0] === "track" && (args[1] === "init" || args[1] === "clone") || args[0] === "debug";
+  let guardCleanup;
+  if (!skipGuard) {
+    try {
+      const root = await findRoot();
+      const manifest = await readManifest(root);
+      guardCleanup = setupGitignoreGuard(root, manifest.paths);
+    } catch {
+    }
+  }
+  try {
+    if (args.length === 0 || COMMANDER_COMMANDS.has(args[0]) || args[0].startsWith("-")) {
+      const program = new Command2("sgit").description("Shadow Git \u2014 a secondary git repository for your project").version("0.1.0");
+      registerTrackCommands(program);
+      registerDebugCommands(program);
+      program.addHelpText(
+        "after",
+        `
 Track commands:
   sgit track init          Initialize shadow repository
+  sgit track clone         Clone shadow repository from remote URL
   sgit track add           Start shadow-tracking paths (--adopt to move from main git)
   sgit track remove        Stop shadow-tracking paths
   sgit track list          List all shadow-tracked paths
+  sgit track ignore        Ignore paths within tracked directories
+  sgit track unignore      Stop ignoring paths
   sgit track sync          Regenerate exclude files
   sgit track verify        Validate staged files
   sgit track destroy       Remove shadow repository
@@ -1033,13 +1719,18 @@ Track commands:
 
 All other commands are forwarded to git in the shadow repository:
   sgit status, sgit commit, sgit log, sgit diff, ...`
-    );
-    await program.parseAsync(process.argv);
-  } else {
-    const root = await findRoot();
-    await validateShadowRepo(root);
-    const exitCode = forwardToGit(root, args);
-    process.exit(exitCode);
+      );
+      await program.parseAsync(process.argv);
+    } else {
+      const root = await findRoot();
+      await validateShadowRepo(root);
+      const exitCode = forwardToGit(root, args);
+      guardCleanup?.();
+      guardCleanup = void 0;
+      process.exit(exitCode);
+    }
+  } finally {
+    guardCleanup?.();
   }
 }
 run().catch((err) => {