tether-sync 0.1.0 → 0.4.0

package/bin/{daemon-WGNVBSEJ.js → daemon-5IFWP5O3.js}

@@ -1,13 +1,32 @@
 import {
+  GIT_MODES,
+  VERSION,
+  blobAt,
+  changeFromGit,
+  changesBetween,
+  fileBlob,
   files,
+  findRepo,
+  gitBinary,
+  gitBusy,
+  head,
+  indexBlob,
   ipcEndpoint,
+  isAncestor,
+  isKept,
+  isNewer,
+  isTracked,
   isWindows,
+  latestVersion,
   listen,
+  removeHooks,
+  restage,
+  setKeep,
   tetherHome
-} from "./chunk-MGMU33LE.js";
+} from "./chunk-NMLHD2KU.js";
 
 // packages/client/src/daemon.js
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import path5 from "node:path";
 import http from "node:http";
 import crypto4 from "node:crypto";
@@ -21,7 +40,9 @@ var DEFAULTS = {
   // defaults to the server URL
   tickSeconds: 30,
   graceMs: 2e3,
-  scanRoots: [os.homedir()]
+  scanRoots: [os.homedir()],
+  notifications: "all"
+  // all | errors | off
 };
 var NUMERIC = /* @__PURE__ */ new Set(["tickSeconds", "graceMs"]);
 var Config = class {
@@ -43,6 +64,7 @@ var Config = class {
       value = Number(value);
       if (!Number.isFinite(value) || value <= 0) throw new Error(`${key} must be a positive number`);
     }
+    if (key === "notifications" && !["all", "errors", "off"].includes(value)) throw new Error("notifications must be all, errors or off");
     if (key === "scanRoots" && typeof value === "string") value = value.split(/[;,]/).map((s) => s.trim()).filter(Boolean);
     this.values[key] = value;
     fs.writeFileSync(this.file, JSON.stringify(this.values, null, 2));
@@ -93,11 +115,25 @@ var COLUMNS = {
   needsRestore: "INTEGER DEFAULT 0",
   // write a fresh copy at the expected path on the next tick
   orphanReason: "TEXT",
+  realtime: "INTEGER DEFAULT 0",
+  // this client holds a realtime session and pushes every save
+  remoteRealtime: "TEXT",
+  // JSON { email, since } when someone else edits this file in realtime
+  gitMode: "TEXT",
+  // inside a git repo: keep (Tether reverts git's changes) | follow (git's changes are published)
+  gitRoot: "TEXT",
+  gitDir: "TEXT",
+  gitHooks: "TEXT",
+  // unused since 0.2.1 (hooks were replaced by watching the git directory)
+  gitWaiting: "INTEGER DEFAULT 0",
+  // follow: a newer Tether version came from a git commit not pulled here yet
+  gitOverlay: "INTEGER DEFAULT 0",
+  // follow: holds a Tether-only version that git does not have (hidden from git)
   lastError: "TEXT",
   createdAt: "REAL",
   updatedAt: "REAL"
 };
-var BOOL = /* @__PURE__ */ new Set(["hasBom", "exec", "canDelete", "detached", "needsRestore"]);
+var BOOL = /* @__PURE__ */ new Set(["gitOverlay", "gitWaiting", "realtime", "hasBom", "exec", "canDelete", "detached", "needsRestore"]);
 var LocalDb = class {
   constructor(file) {
     this.db = new DatabaseSync(file);
@@ -322,7 +358,73 @@ function randomString(len) {
 }
 var newInstanceId = () => "i_" + randomString(10);
 
+// packages/shared/src/chunks.js
+var CHUNK_MIN = 2 * 1024;
+var CHUNK_AVG = 8 * 1024;
+var CHUNK_MAX = 64 * 1024;
+var MASK_HARD = 4294836224;
+var MASK_EASY = 4292870144;
+var GEAR = (() => {
+  let a = 2122219134;
+  const t = new Uint32Array(256);
+  for (let i = 0; i < 256; i++) {
+    a = a + 1831565813 | 0;
+    let x = Math.imul(a ^ a >>> 15, 1 | a);
+    x = x + Math.imul(x ^ x >>> 7, 61 | x) ^ x;
+    t[i] = (x ^ x >>> 14) >>> 0;
+  }
+  return t;
+})();
+function chunkBoundaries(buf) {
+  const out = [];
+  const n = buf.length;
+  let start = 0;
+  while (start < n) {
+    if (n - start <= CHUNK_MIN) {
+      out.push({ o: start, s: n - start });
+      break;
+    }
+    const end = Math.min(n, start + CHUNK_MAX);
+    const normal = Math.min(end, start + CHUNK_AVG);
+    let h = 0;
+    let cut = end;
+    let i = start + CHUNK_MIN;
+    for (; i < normal; i++) {
+      h = (h << 1) + GEAR[buf[i]] >>> 0;
+      if ((h & MASK_HARD) === 0) {
+        cut = i + 1;
+        break;
+      }
+    }
+    if (cut === end) {
+      for (; i < end; i++) {
+        h = (h << 1) + GEAR[buf[i]] >>> 0;
+        if ((h & MASK_EASY) === 0) {
+          cut = i + 1;
+          break;
+        }
+      }
+    }
+    out.push({ o: start, s: cut - start });
+    start = cut;
+  }
+  return out;
+}
+function chunkContent(buf) {
+  return chunkBoundaries(buf).map(({ o, s }) => {
+    const bytes = buf.subarray(o, o + s);
+    return { h: sha256(bytes), s, bytes };
+  });
+}
+
 // packages/client/src/api.js
+var PUT_BATCH_BYTES = 1024 * 1024;
+var PUT_PARALLEL = 4;
+var PUT_BATCH_CHUNKS = 100;
+var FETCH_BATCH_BYTES = 1024 * 1024;
+var FETCH_PARALLEL = 4;
+var kb = (n) => n < 1024 ? `${n} B` : n < 1048576 ? `${Math.round(n / 1024)} KB` : `${(n / 1048576).toFixed(1)} MB`;
+var describeTransfer = (t, verb) => t ? `${verb} ${t.moved} of ${t.total} chunk${t.total === 1 ? "" : "s"}, ${kb(t.bytes)}` : "";
 var ApiError = class extends Error {
   constructor(status, body) {
     super(body?.message ?? `HTTP ${status}`);
@@ -355,6 +457,39 @@ var Api = class {
     this.config = config;
     this.credentials = credentials;
     this.accessToken = null;
+    this.manifests = /* @__PURE__ */ new Map();
+    this.transfers = /* @__PURE__ */ new Map();
+  }
+  /** Authenticated POST with a binary body or a binary response; refreshes the token once on 401. */
+  async binary(p, { json, body, headers = {} }) {
+    const send = async (token) => {
+      let res;
+      try {
+        res = await fetch(this.base + "/v1" + p, {
+          method: "POST",
+          headers: { authorization: `Bearer ${token}`, "content-type": json ? "application/json" : "application/octet-stream", ...headers },
+          body: json ? JSON.stringify(json) : body,
+          signal: AbortSignal.timeout(18e4)
+        });
+      } catch (e) {
+        throw new OfflineError(`cannot reach the Tether server at ${this.base} (${e.cause?.code ?? e.message})`);
+      }
+      if (!res.ok) throw new ApiError(res.status, (await res.json().catch(() => ({}))).error);
+      return Buffer.from(await res.arrayBuffer());
+    };
+    try {
+      return await send(await this.token());
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 401 && this.accessToken) {
+        this.accessToken = null;
+        return send(await this.token());
+      }
+      throw e;
+    }
+  }
+  /** The chunk list to commit for content uploaded by uploadBlobs (undefined on old servers). */
+  manifestFor(sha) {
+    return this.manifests.get(sha);
   }
   get base() {
     return this.config.get("server").replace(/\/$/, "");
@@ -465,10 +600,58 @@ var Api = class {
     this.credentials.clear();
     this.accessToken = null;
   }
-  /** Uploads canonical blobs the server doesn't have yet. blobs: [{ sha256, bytes }] */
-  async uploadBlobs(blobs) {
-    const unique = [...new Map(blobs.map((b) => [b.sha256, b])).values()];
-    if (!unique.length) return;
+  /**
+   * Uploads content as chunks (delta sync): every file is split into content-defined chunks and
+   * only the chunks the server does not have are sent. blobs: [{ sha256, bytes }] (canonical).
+   * Afterwards manifestFor(sha) gives each file's chunk list for the commit.
+   */
+  async uploadBlobs(blobs, { artifactId } = {}) {
+    const files2 = [...new Map(blobs.map((b) => [b.sha256, b])).values()];
+    if (!files2.length) return;
+    const all = /* @__PURE__ */ new Map();
+    for (const f of files2) {
+      const parts = chunkContent(f.bytes);
+      this.manifests.set(f.sha256, parts.map(({ h, s }) => ({ h, s })));
+      for (const c of parts) all.set(c.h, c.bytes);
+    }
+    let missing;
+    try {
+      ({ missing } = await this.call("POST", "/chunks/missing", { hashes: [...all.keys()], artifactId }));
+    } catch (e) {
+      if (!(e instanceof ApiError && e.status === 404)) throw e;
+      for (const f of files2) this.manifests.delete(f.sha256);
+      return this.uploadWhole(files2);
+    }
+    const batches = [];
+    let batch = [];
+    let size = 0;
+    for (const h of missing) {
+      const bytes = all.get(h);
+      if (batch.length && (batch.length >= PUT_BATCH_CHUNKS || size + bytes.length > PUT_BATCH_BYTES)) {
+        batches.push(batch);
+        batch = [];
+        size = 0;
+      }
+      batch.push({ h, bytes });
+      size += bytes.length;
+    }
+    if (batch.length) batches.push(batch);
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(PUT_PARALLEL, batches.length) }, async () => {
+      while (next < batches.length) {
+        const b = batches[next++];
+        await this.binary("/chunks/put", { body: Buffer.concat(b.map((c) => c.bytes)), headers: { "x-tether-chunks": b.map((c) => `${c.h}:${c.bytes.length}`).join(",") } });
+      }
+    }));
+    const sent = new Set(missing);
+    for (const f of files2) {
+      const m = this.manifests.get(f.sha256);
+      const moved = m.filter((c) => sent.has(c.h));
+      this.transfers.set(f.sha256, { moved: moved.length, total: m.length, bytes: moved.reduce((a, c) => a + c.s, 0) });
+    }
+  }
+  /** Whole-file upload through signed URLs, for servers without delta sync. */
+  async uploadWhole(unique) {
     const { upload } = await this.call("POST", "/blobs/upload", { blobs: unique.map((b) => ({ sha256: b.sha256, size: b.bytes.length })) });
     const bySha = new Map(unique.map((b) => [b.sha256, b]));
     for (const u of upload) {
@@ -476,10 +659,63 @@ var Api = class {
       if (!res.ok && res.status !== 412) throw new ApiError(res.status, { message: `upload failed (${res.status}): ${(await res.text().catch(() => "")).slice(0, 200)}` });
     }
   }
-  /** Downloads blobs for [{ artifactId, version? }] into the cache; skips blobs already cached. */
+  /**
+   * Downloads content into the cache, by chunks (delta sync). items: [{ artifactId, version, sha,
+   * base? }] where base is content already cached (usually the version on disk): its chunks are
+   * reused, so only chunks that changed are downloaded.
+   */
   async fetchBlobs(cache, items) {
-    if (!items.length) return [];
-    const { downloads } = await this.call("POST", "/blobs/download", { items });
+    const need = [...new Map(items.filter((i) => !i.sha || !cache.has(i.sha)).map((i) => [`${i.artifactId}@${i.version}`, i])).values()];
+    if (!need.length) return;
+    let manifests;
+    try {
+      ({ manifests } = await this.call("POST", "/chunks/manifest", { items: need.map(({ artifactId, version }) => ({ artifactId, version })) }));
+    } catch (e) {
+      if (!(e instanceof ApiError && e.status === 404)) throw e;
+      return this.fetchWhole(cache, need);
+    }
+    for (const [k, m] of manifests.entries()) {
+      if (cache.has(m.blob)) continue;
+      const local = /* @__PURE__ */ new Map();
+      const base = need[k].base;
+      if (base && cache.has(base)) for (const c of chunkContent(cache.get(base))) local.set(c.h, c.bytes);
+      const size = new Map(m.chunks.map((c) => [c.h, c.s]));
+      const want = [...size.keys()].filter((h) => !local.has(h));
+      let bytesIn = 0;
+      const batches = [];
+      for (let i = 0; i < want.length; ) {
+        const batch = [];
+        let total = 0;
+        while (i < want.length && (!batch.length || total + size.get(want[i]) <= FETCH_BATCH_BYTES)) {
+          batch.push(want[i]);
+          total += size.get(want[i++]);
+        }
+        batches.push(batch);
+        bytesIn += total;
+      }
+      let next = 0;
+      await Promise.all(Array.from({ length: Math.min(FETCH_PARALLEL, batches.length) }, async () => {
+        while (next < batches.length) {
+          const batch = batches[next++];
+          const buf = await this.binary("/chunks/fetch", { json: { artifactId: m.artifactId, version: m.version, hashes: batch } });
+          let off = 0;
+          for (const h of batch) {
+            const bytes = buf.subarray(off, off + size.get(h));
+            off += size.get(h);
+            if (sha256(bytes) !== h) throw new Error("downloaded chunk does not match its hash");
+            local.set(h, Buffer.from(bytes));
+          }
+        }
+      }));
+      const content = Buffer.concat(m.chunks.map((c) => local.get(c.h)));
+      if (sha256(content) !== m.blob) throw new Error("downloaded content does not match its hash");
+      cache.put(m.blob, content);
+      this.transfers.set(m.blob, { moved: want.length, total: size.size, bytes: bytesIn });
+    }
+  }
+  /** Whole-file downloads through signed URLs, for servers without delta sync. */
+  async fetchWhole(cache, items) {
+    const { downloads } = await this.call("POST", "/blobs/download", { items: items.map(({ artifactId, version }) => ({ artifactId, version })) });
     for (const d of downloads) {
       if (cache.has(d.sha256)) continue;
       const res = await fetch(d.url);
@@ -753,13 +989,19 @@ var UserError = class extends Error {
 var ACTIVE = (i) => i.mode !== "orphaned";
 var Engine = class {
   constructor({ db, api, cache, tracker, config, log = () => {
-  } }) {
+  }, notify = () => {
+  }, home = null, cliPath = null }) {
     this.db = db;
     this.api = api;
     this.cache = cache;
     this.tracker = tracker;
     this.config = config;
     this.log = log;
+    this.notify = notify;
+    this.home = home;
+    this.cliPath = cliPath;
+    this.gitState = /* @__PURE__ */ new Map();
+    this.busyCache = null;
     this.offline = null;
     this.lastTick = null;
     this.graceDue = null;
@@ -793,22 +1035,330 @@ var Engine = class {
     if (!this.cache.has(sha)) throw new Error(`content ${sha.slice(0, 12)} is not in the local cache`);
     return this.cache.get(sha);
   }
+  /** Downloads content not yet cached; `base` (content already here) lets only changed chunks travel. */
   async ensureBlobs(pairs) {
     const missing = pairs.filter((p) => p.sha && !this.cache.has(p.sha));
-    if (missing.length) await this.api.fetchBlobs(this.cache, missing.map(({ artifactId, version }) => ({ artifactId, version })));
+    if (missing.length) await this.api.fetchBlobs(this.cache, missing);
+  }
+  /** Uploads content (only chunks the server lacks) and returns the commit fields for it. */
+  async uploadContent(local, artifactId) {
+    await this.api.uploadBlobs([{ sha256: local.hash, bytes: local.canonical }], { artifactId });
+    this.cache.put(local.hash, local.canonical);
+    return { blob: local.hash, size: local.canonical.length, chunks: this.api.manifestFor(local.hash) };
+  }
+  /** ", sent 2 of 540 chunks, 17 KB" for log lines (empty when nothing is known). */
+  sentNote(sha) {
+    const t = describeTransfer(this.api.transfers.get(sha), "sent");
+    return t ? `; ${t}` : "";
   }
   /** Writes content for an instance at `p`; records the result for the quick change check. */
   writeInstance(inst, p, sha, eolMode = inst.eolMode, exec = inst.exec) {
     const style = inst.eolStyle ? { eol: inst.eolStyle, bom: !!inst.hasBom } : null;
-    return writeLocal(p, this.blobFor(sha), eolMode, { exec, style });
+    const st = writeLocal(p, this.blobFor(sha), eolMode, { exec, style });
+    if (inst.gitMode === "keep" && inst.gitRoot) {
+      restage(inst.gitRoot, p);
+      const after = statOrNull(p);
+      if (after) Object.assign(st, { size: after.size, mtimeMs: after.mtimeMs });
+    }
+    return st;
   }
   // ---------- tick ----------
   async tick({ remote = true } = {}) {
+    this.busyCache = /* @__PURE__ */ new Map();
     await this.locateAll();
-    if (remote) await this.checkRemote();
+    await this.gitPass();
+    if (remote) {
+      await this.checkRemote();
+      await this.syncRealtime();
+    }
     await this.enforceLocal();
     this.lastTick = Date.now();
   }
+  // ---------- git integration ----------
+  isGitBusy(inst) {
+    if (!inst.gitDir) return false;
+    this.busyCache ??= /* @__PURE__ */ new Map();
+    if (!this.busyCache.has(inst.gitDir)) this.busyCache.set(inst.gitDir, gitBusy(inst.gitDir));
+    return !!this.busyCache.get(inst.gitDir);
+  }
+  gitInstances() {
+    return this.db.all().filter((i) => i.gitMode && i.gitRoot && i.mode !== "orphaned");
+  }
+  /** Sets the git mode on an instance (and a folder's files). Throws if follow is not allowed. */
+  applyGitMode(root, mode) {
+    if (!root) return;
+    if (!GIT_MODES.includes(mode)) throw new UserError(`git mode must be one of ${GIT_MODES.join(", ")}`);
+    if (mode === "follow" && root.role === "viewer") throw new UserError("git follow mode needs editor access");
+    if (mode === "follow" && !gitBinary()) throw new UserError("git follow mode needs git to be installed");
+    const repo = findRepo(root.path);
+    if (!repo) throw new UserError(`${root.path} is not inside a git repository`);
+    const fields = { gitMode: mode, gitRoot: repo.root, gitDir: repo.gitDir, gitWaiting: false };
+    for (const i of [root, ...root.kind === "folder" ? this.db.childrenOf(root.instanceId) : []]) {
+      this.db.update(i.instanceId, fields);
+      if (i.kind === "file") setKeep(repo.root, i.path, mode === "keep");
+    }
+  }
+  /** Lets git see the file normally again (after unmanage, orphaning, or leaving keep mode). */
+  releaseGit(inst) {
+    if (inst.gitMode === "keep" && inst.kind === "file" && inst.gitRoot) setKeep(inst.gitRoot, inst.path, false);
+  }
+  /** `tether git <path> [--mode]`: show or change the git mode of managed files. */
+  gitMode({ path: p, mode }) {
+    const ts = this.targets(p);
+    const folders = new Set(ts.filter((i) => i.kind === "folder").map((i) => i.instanceId));
+    if (mode) for (const i of ts.filter((x) => !x.folderInstanceId || !folders.has(x.folderInstanceId))) this.applyGitMode(i.folderInstanceId ? this.db.get(i.folderInstanceId) : i, mode);
+    return this.targets(p).map((i) => ({ path: i.path, kind: i.kind, role: i.role, gitMode: this.db.get(i.instanceId)?.gitMode ?? null, gitRoot: this.db.get(i.instanceId)?.gitRoot ?? findRepo(i.path)?.root ?? null }));
+  }
+  /** Tether 0.2.0 used git hooks; they are no longer needed. */
+  cleanupLegacyHooks() {
+    const dirs = this.db.getMeta("gitHooks") ?? [];
+    for (const dir of dirs) if (this.home) removeHooks(dir, this.home);
+    if (dirs.length) this.db.setMeta("gitHooks", null);
+  }
+  /** Managed files that ended up inside a git repository later (git init, moved into one) get keep mode. */
+  detectNewRepos() {
+    for (const i of this.db.all().filter((x) => !x.gitMode && !x.folderInstanceId && x.mode !== "orphaned" && !x.detached)) {
+      const repo = findRepo(i.path);
+      if (!repo) continue;
+      this.applyGitMode(i, "keep");
+      this.log(`${i.path}: now inside the git repository ${repo.root}; using keep mode`);
+      this.notify({ kind: "git-new", level: "info", short: path4.basename(i.path), title: "Managed file is now in a git repository", body: `${path4.basename(i.path)} is inside ${repo.root}. Tether keeps it as the shared version and git ignores Tether's copy. Run "tether git ${path4.basename(i.path)} --mode follow" to publish git's changes instead.` });
+    }
+  }
+  /**
+   * Runs after git may have changed files (watcher on the git directory, and every tick):
+   * follows renames git made, brings back files git restored, keeps keep-mode files hidden from
+   * git, and publishes follow-mode files whose content now matches git's committed or staged state.
+   */
+  async gitPass({ only } = {}) {
+    const repos = /* @__PURE__ */ new Map();
+    for (const i of this.gitInstances()) if (!only || samePath(i.gitRoot, only)) repos.set(i.gitDir, i.gitRoot);
+    if (!repos.size) return;
+    const heads = this.db.getMeta("gitHeads") ?? {};
+    const publish = [];
+    for (const [gitDir, root] of repos) {
+      if (gitBusy(gitDir)) continue;
+      const h = gitBinary() ? head(root) : null;
+      const prev = heads[gitDir];
+      const headMoved = !!h && h !== prev;
+      if (h && prev && h !== prev) await this.followGitHistory(root, prev, h);
+      if (h) heads[gitDir] = h;
+      for (const i of this.gitInstances().filter((x) => x.gitDir === gitDir)) {
+        if (i.kind !== "file") continue;
+        if (i.detached) {
+          if (statOrNull(i.path)?.isFile()) {
+            this.db.update(i.instanceId, { ...this.identity(i.path), detached: false, missingSince: null, size: null, mtimeMs: null });
+            if (i.gitMode === "keep") setKeep(root, i.path, true);
+            this.log(`${i.path}: back (restored by git)`);
+          }
+          continue;
+        }
+        if (i.mode !== "normal") continue;
+        if (i.gitMode === "keep") {
+          if ((headMoved || !prev) && gitBinary() && !isKept(root, i.path)) setKeep(root, i.path, true);
+          continue;
+        }
+        if (!gitBinary()) continue;
+        let local;
+        try {
+          local = readLocal(i.path, i.eolMode);
+        } catch {
+          continue;
+        }
+        if (i.gitOverlay) {
+          if (fileBlob(root, i.path) !== blobAt(root, "HEAD", i.path)) continue;
+          setKeep(root, i.path, false);
+          this.db.update(i.instanceId, { gitOverlay: false });
+          i.gitOverlay = false;
+        }
+        const folder = i.folderInstanceId ? this.folderOf(i) : null;
+        const rel = folder ? this.localRel(i, folder) : null;
+        const moved = folder && rel && rel !== i.relPath;
+        const changed = local && local.hash !== i.baseHash;
+        if (!changed && !moved) continue;
+        const { fromGit, commit } = changed ? changeFromGit(root, i.path) : { fromGit: true, commit: null };
+        if (fromGit) publish.push({ inst: i, local: changed ? local : null, commit, relPath: moved ? rel : void 0 });
+      }
+    }
+    this.db.setMeta("gitHeads", heads);
+    if (publish.length) await this.publishGitChanges(publish);
+  }
+  /** Renames and new files git brought in between two commits. */
+  async followGitHistory(root, from, to) {
+    for (const c of changesBetween(root, from, to)) {
+      if (c.status === "R") {
+        const inst = this.gitInstances().find((i) => i.kind === "file" && samePath(i.path, c.from));
+        if (inst && !statOrNull(c.from) && statOrNull(c.to)?.isFile()) {
+          this.db.update(inst.instanceId, { path: canonicalPath(c.to), ...this.identity(c.to), detached: false, missingSince: null, size: null, mtimeMs: null });
+          if (inst.gitMode === "keep") {
+            setKeep(root, c.from, false);
+            setKeep(root, c.to, true);
+          }
+          this.log(`${c.from} -> ${c.to}: followed a rename made in git`);
+        }
+      } else if (c.status === "A" && !this.instanceAt(c.to) && statOrNull(c.to)?.isFile()) {
+        const folder = this.gitInstances().find((i) => i.kind === "folder" && i.gitMode === "follow" && isUnder(c.to, i.path) && !samePath(c.to, i.path));
+        if (!folder) continue;
+        const name = path4.basename(c.to);
+        if (folder.role === "owner") {
+          try {
+            const r = await this.add({ path: c.to, gitCommit: to });
+            this.log(`${c.to}: added to ${folder.path} (new in git)`);
+            this.notify({ kind: "git-published", level: "info", short: name, title: "Published git's changes", body: `${r.relPath} is new in git and was added to ${path4.basename(folder.path)} for everyone.` });
+          } catch (e) {
+            this.log(`${c.to}: could not add (${e.message})`);
+          }
+        } else {
+          this.notify({ kind: "git-new-file", level: "info", short: name, title: "New file in a managed folder", body: `git added ${name} inside ${path4.basename(folder.path)}. Only the owner can add files to it, so it is not shared through Tether.` });
+        }
+      }
+    }
+  }
+  /**
+   * Publishes git's version of follow-mode files. If Tether already has exactly that content it is
+   * adopted; if Tether moved on to something else, the file stays in editing mode for `tether done`.
+   */
+  async publishGitChanges(list) {
+    let results;
+    try {
+      ({ results } = await this.api.call("POST", "/sync/check", { items: list.map(({ inst }) => ({ artifactId: inst.artifactId, version: inst.baseVersion })) }));
+    } catch (e) {
+      if (!(e instanceof OfflineError)) throw e;
+      for (const { inst } of list) this.db.update(inst.instanceId, { mode: "editing", lastError: "git changed this file while offline; run `tether done` to publish it" });
+      return;
+    }
+    for (const [k, { inst, local, commit, relPath }] of list.entries()) {
+      const r = results[k];
+      const name = path4.basename(inst.path);
+      const hash = local?.hash ?? inst.baseHash;
+      if (r.status === "gone" || r.state?.deleted || r.folderDeleted) {
+        this.orphan(inst, r.reason ?? "deleted");
+        continue;
+      }
+      if (r.role === "viewer") {
+        this.db.update(inst.instanceId, { gitMode: "keep", role: "viewer" });
+        setKeep(inst.gitRoot, inst.path, true);
+        continue;
+      }
+      const conflict = () => {
+        this.db.update(inst.instanceId, { mode: "editing", lastError: "conflict: git changed this file and Tether has a newer version; run `tether done` to resolve" });
+        this.log(`${inst.path}: git changed it but Tether also has a newer version; left in editing mode`);
+        this.notify({ kind: "conflict", level: "warn", title: "Merge conflict (git and Tether)", body: `${name}: git changed it, but someone also pushed a newer version to Tether. Git's version is kept and the file is in editing mode; run "tether done" to choose.`, short: name, artifactId: inst.artifactId });
+      };
+      const adopt = (state) => {
+        this.db.update(inst.instanceId, { baseVersion: state.version, remoteVersion: state.version, baseHash: state.blob, relPath: state.relPath ?? inst.relPath, gitWaiting: false, lastError: null, ...local ? { size: local.size, mtimeMs: local.mtimeMs, ...styleOf(local) } : {} });
+        this.log(`${inst.path}: git's version is already on Tether (v${state.version})`);
+      };
+      if (r.status === "changed") {
+        if (r.state.blob === hash && (relPath === void 0 || r.state.relPath === relPath)) adopt(r.state);
+        else conflict();
+        continue;
+      }
+      try {
+        const change = { gitCommit: commit ?? null };
+        if (local) Object.assign(change, await this.uploadContent(local, inst.artifactId));
+        if (relPath !== void 0) change.relPath = relPath;
+        const c = await this.api.call("POST", `/artifacts/${inst.artifactId}/commit`, { baseVersion: inst.baseVersion, change });
+        this.db.update(inst.instanceId, {
+          baseVersion: c.version,
+          remoteVersion: c.version,
+          baseHash: hash,
+          relPath: relPath ?? inst.relPath,
+          gitWaiting: false,
+          lastError: null,
+          ...local ? { size: local.size, mtimeMs: local.mtimeMs, ...styleOf(local) } : {}
+        });
+        const sent = local ? describeTransfer(this.api.transfers.get(local.hash), "sent") : "";
+        this.log(`${inst.path}: published git's version as v${c.version}${sent ? ` (${sent})` : ""}`);
+        this.notify({ kind: "git-published", level: "info", title: "Published git's changes", body: `${name} is now v${c.version} for everyone who has it.`, short: name, artifactId: inst.artifactId });
+      } catch (e) {
+        if (e instanceof ApiError && e.status === 409) conflict();
+        else if (e instanceof ApiError) {
+          this.db.update(inst.instanceId, { mode: "editing", lastError: `could not publish git's version: ${e.message}` });
+          this.notify({ kind: "push-failed", level: "error", title: "Push failed", body: `${name}: ${e.message}. Git's version is kept in editing mode.`, short: name, artifactId: inst.artifactId });
+        } else throw e;
+      }
+    }
+  }
+  /** Hook calls from Tether 0.2.0 installs, and explicit syncs. */
+  async gitReconcile(root) {
+    await this.locateAll();
+    await this.gitPass({ only: root });
+  }
+  // ---------- realtime editing ----------
+  /** Files this client is editing live (every save is pushed). */
+  realtimeInstances() {
+    return this.db.all().filter((i) => i.realtime && i.mode === "editing" && i.kind === "file");
+  }
+  /** True while anything held here is being edited live, so the daemon checks more often. */
+  get realtimeActive() {
+    return this.db.all().some((i) => i.realtime && i.mode === "editing" || i.remoteRealtime && i.mode !== "orphaned");
+  }
+  async releaseRealtime(inst) {
+    this.db.update(inst.instanceId, { realtime: false });
+    await this.api.call("POST", `/artifacts/${inst.artifactId}/realtime`, { action: "stop" }).catch(() => {
+    });
+  }
+  /**
+   * Pushes live edits: renews the session, applies incoming versions when there is no local
+   * change, pushes local changes when the server has not moved, and pauses on a conflict.
+   */
+  async syncRealtime() {
+    const rts = this.realtimeInstances().filter((i) => !i.detached);
+    if (!rts.length) return;
+    let results;
+    try {
+      ({ results } = await this.api.call("POST", "/sync/check", { items: rts.map((i) => ({ artifactId: i.artifactId, version: i.baseVersion, realtime: true })) }));
+    } catch (e) {
+      if (e instanceof OfflineError) return this.offline = e.message;
+      throw e;
+    }
+    for (const [k, inst] of rts.entries()) {
+      const r = results[k];
+      const cur = this.db.get(inst.instanceId);
+      if (!cur || cur.mode !== "editing" || !cur.realtime) continue;
+      if (r.status === "gone" || r.state?.deleted || r.folderDeleted) {
+        this.orphan(cur, r.reason ?? "deleted");
+        continue;
+      }
+      if (!r.realtime?.mine) {
+        const why = r.role === "viewer" ? "you are no longer an editor" : r.realtime ? `taken over by ${r.realtime.email}` : "it ended";
+        this.db.update(cur.instanceId, { realtime: false, lastError: r.role === "viewer" ? null : `realtime session lost (${why}); still editing, run \`tether done\` to push` });
+        this.log(`${cur.path}: realtime session lost (${why})`);
+        this.notify({ kind: "realtime-lost", level: "warn", title: "Live editing stopped", body: `${path4.basename(cur.path)}: your realtime session ${why}. Your changes are kept; run "tether done" to push them.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
+        continue;
+      }
+      try {
+        const local = readLocal(cur.path, cur.eolMode);
+        if (r.status === "changed") {
+          if (!local || local.hash === cur.baseHash) {
+            await this.ensureBlobs([{ artifactId: cur.artifactId, version: r.state.version, sha: r.state.blob, base: cur.baseHash }]);
+            this.applyIncoming(cur, r.state);
+          } else {
+            if (!cur.lastError?.startsWith("conflict")) {
+              this.log(`${cur.path}: someone else pushed while you were editing live; live pushing paused, run \`tether done\` to resolve`);
+              this.notify({ kind: "conflict", level: "warn", title: "Merge conflict", body: `${path4.basename(cur.path)}: someone else pushed while you were editing live. Live pushing is paused; run "tether done" to choose what to keep.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
+            }
+            this.db.update(cur.instanceId, { lastError: "conflict: the server changed; run `tether done` to resolve" });
+          }
+          continue;
+        }
+        if (!local || local.hash === cur.baseHash) continue;
+        const content = await this.uploadContent(local, cur.artifactId);
+        try {
+          const c = await this.api.call("POST", `/artifacts/${cur.artifactId}/commit`, { baseVersion: cur.baseVersion, change: content });
+          this.db.update(cur.instanceId, { baseVersion: c.version, remoteVersion: c.version, baseHash: local.hash, size: local.size, mtimeMs: local.mtimeMs, ...styleOf(local), lastError: null });
+          this.log(`${cur.path}: pushed v${c.version} (realtime${this.sentNote(local.hash)})`);
+        } catch (e) {
+          if (!(e instanceof ApiError && e.status === 409)) throw e;
+          this.db.update(cur.instanceId, { lastError: "conflict: the server changed; run `tether done` to resolve" });
+        }
+      } catch (e) {
+        if (!(e instanceof LockedError)) throw e;
+        this.db.update(cur.instanceId, { lastError: e.message });
+      }
+    }
+  }
   /** Refresh path and file ID of every tracked instance (DESIGN §5). */
   async locateAll() {
     const graceMs = this.config.get("graceMs");
@@ -871,7 +1421,10 @@ var Engine = class {
       this.log(`${inst.path}: folder deleted locally; no longer managed here`);
       return;
     }
-    if (inst.mode === "editing") {
+    if (inst.gitMode && inst.mode === "normal") {
+      this.db.update(inst.instanceId, { detached: true, missingSince: null });
+      this.log(`${inst.path}: removed (by git?); waiting for git to bring it back`);
+    } else if (inst.mode === "editing") {
       this.db.update(inst.instanceId, { detached: true, missingSince: null });
       this.log(`${inst.path}: deleted while editing; resolve with \`tether done\``);
     } else if (inst.folderInstanceId) {
@@ -884,8 +1437,13 @@ var Engine = class {
   }
   orphan(inst, reason) {
     const targets = inst.kind === "folder" ? [inst, ...this.db.childrenOf(inst.instanceId)] : [inst];
-    for (const t of targets) this.db.update(t.instanceId, { mode: "orphaned", orphanReason: reason });
-    this.log(`${inst.path}: ${reason === "revoked" ? "access revoked" : reason === "deleted" ? "deleted on the server" : "removed from the server"}; file kept, no longer tracked`);
+    for (const t of targets) {
+      this.releaseGit(t);
+      this.db.update(t.instanceId, { mode: "orphaned", orphanReason: reason });
+    }
+    const what = reason === "revoked" ? "access revoked" : reason === "deleted" ? "deleted on the server" : "removed from the server";
+    this.log(`${inst.path}: ${what}; file kept, no longer tracked`);
+    this.notify({ kind: "orphaned", level: "warn", title: "No longer synced", body: `${path4.basename(inst.path)}: ${what}. Your copy stays on disk but Tether no longer keeps it up to date.`, short: path4.basename(inst.path) });
   }
   /** One batched call for all instances (DESIGN §6.1 step 2). */
   async checkRemote() {
@@ -901,6 +1459,7 @@ var Engine = class {
     } catch (e) {
       if (e instanceof OfflineError || e instanceof ApiError && e.status === 401) {
         this.offline = e.message;
+        if (e instanceof ApiError) this.notify({ kind: "auth", level: "error", key: "auth", cooldownMs: 6 * 3600 * 1e3, title: "Tether needs you to sign in", body: `${e.message}. Until then nothing syncs.` });
         return;
       }
       throw e;
@@ -913,10 +1472,21 @@ var Engine = class {
       if (!cur || cur.mode === "orphaned") return;
       if (r.status === "gone") return this.orphan(cur, r.reason);
       if (r.folderDeleted || r.state?.deleted) return this.orphan(cur, "deleted");
-      const patch = { role: r.role, canDelete: r.canDelete, remoteVersion: r.version };
+      const patch = {
+        role: r.role,
+        canDelete: r.canDelete,
+        remoteVersion: r.version,
+        remoteRealtime: r.realtime && !r.realtime.mine ? JSON.stringify({ email: r.realtime.email, since: r.realtime.since }) : null
+      };
       if (cur.role && cur.role !== "viewer" && r.role === "viewer" && cur.mode === "editing") {
         patch.mode = "normal";
+        patch.realtime = false;
         this.log(`${cur.path}: you are now a viewer; editing ended and local changes will be reverted`);
+        this.notify({ kind: "demoted", level: "warn", title: "You are now a viewer", body: `${path4.basename(cur.path)}: your editor access was removed, so your unpushed changes are being reverted.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
+      }
+      if (cur.gitMode === "follow" && r.role === "viewer") {
+        patch.gitMode = "keep";
+        this.notify({ kind: "demoted", level: "warn", title: "Git follow mode turned off", body: `${path4.basename(cur.path)}: you are no longer an editor, so git's changes to it will be reverted.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
       }
       const now = this.db.update(cur.instanceId, patch);
       if (r.status !== "changed") return;
@@ -925,20 +1495,36 @@ var Engine = class {
       else if (!now.detached) incoming.push({ inst: now, state: r.state });
     });
     const newChildren = [];
+    const waiting = /* @__PURE__ */ new Set();
     for (const f of folders) {
       const have = new Set(this.db.childrenOf(f.inst.instanceId).map((c) => c.artifactId));
-      for (const c of f.children) if (!c.deleted && !have.has(c.artifactId)) newChildren.push({ folder: f.inst, child: c });
+      for (const c of f.children) {
+        if (c.deleted || have.has(c.artifactId)) continue;
+        if (f.inst.gitMode === "follow" && c.gitCommit && !isAncestor(f.inst.gitRoot, c.gitCommit)) {
+          waiting.add(f.inst.instanceId);
+          continue;
+        }
+        newChildren.push({ folder: f.inst, child: c });
+      }
     }
     try {
       await this.ensureBlobs([
-        ...incoming.map(({ state }) => ({ artifactId: state.artifactId, version: state.version, sha: state.blob })),
+        ...incoming.map(({ inst, state }) => ({ artifactId: state.artifactId, version: state.version, sha: state.blob, base: inst.baseHash })),
         ...newChildren.map(({ child }) => ({ artifactId: child.artifactId, version: child.version, sha: child.blob }))
       ]);
     } catch (e) {
       if (e instanceof OfflineError) return this.offline = e.message;
       throw e;
     }
-    for (const { inst, state } of incoming) this.applyIncoming(inst, state);
+    for (const { inst, state } of incoming) {
+      if (this.isGitBusy(inst)) continue;
+      if (inst.gitMode === "follow" && state.gitCommit && !isAncestor(inst.gitRoot, state.gitCommit)) {
+        if (!inst.gitWaiting) this.log(`${inst.path}: v${state.version} came from git commit ${state.gitCommit.slice(0, 8)}; it will arrive with your next git pull`);
+        this.db.update(inst.instanceId, { gitWaiting: true });
+        continue;
+      }
+      this.applyIncoming(inst, state);
+    }
     for (const { folder, child } of newChildren) {
       this.db.insert({
         instanceId: newInstanceId(),
@@ -960,10 +1546,11 @@ var Engine = class {
       });
       this.log(`${folder.path}: new file ${child.relPath}`);
     }
-    for (const f of folders) this.db.update(f.inst.instanceId, { baseVersion: f.state.version });
+    for (const f of folders) if (!waiting.has(f.inst.instanceId)) this.db.update(f.inst.instanceId, { baseVersion: f.state.version });
   }
   /** Normal mode: write an incoming version (content and/or layout). */
   applyIncoming(inst, state) {
+    if (!statOrNull(inst.path)) return;
     try {
       let p = inst.path;
       if (inst.folderInstanceId && state.relPath !== inst.relPath) {
@@ -975,17 +1562,40 @@ var Engine = class {
         p = to;
         this.log(`${inst.path} -> ${to}: moved by the server`);
       }
-      const patch = { path: p, relPath: state.relPath, baseVersion: state.version, baseHash: state.blob, eolMode: state.eol, exec: state.exec, lastError: null };
-      if (state.blob !== inst.baseHash || !this.matchesBase(inst, p)) {
+      const patch = { path: p, relPath: state.relPath, baseVersion: state.version, baseHash: state.blob, eolMode: state.eol, exec: state.exec, lastError: null, gitWaiting: false };
+      const localEdit = !this.matchesBase(inst, p) && readLocal(p, inst.eolMode)?.hash !== state.blob;
+      if (state.blob !== inst.baseHash || localEdit) {
         Object.assign(patch, this.writeInstance(inst, p, state.blob, state.eol, state.exec));
-        this.log(`${p}: updated to version ${state.version}`);
+        const got = describeTransfer(this.api.transfers.get(state.blob), "received");
+        this.api.transfers.delete(state.blob);
+        this.log(`${p}: updated to version ${state.version}${localEdit ? " (local change replaced)" : ""}${got ? ` (${got})` : ""}`);
+        if (inst.gitMode === "follow" && inst.gitRoot && !state.gitCommit && blobAt(inst.gitRoot, "HEAD", p) !== fileBlob(inst.gitRoot, p)) {
+          setKeep(inst.gitRoot, p, true);
+          patch.gitOverlay = true;
+          this.notify({ kind: "git-overlay", level: "info", short: path4.basename(p), artifactId: inst.artifactId, title: "Changed through Tether", body: `${path4.basename(p)} now has Tether's v${state.version}, which is not in git. Git does not see this change; the next change to the file in git replaces it.` });
+        }
+        if (localEdit) {
+          const name = path4.basename(p);
+          this.notify({
+            kind: "revert",
+            level: "info",
+            short: name,
+            artifactId: inst.artifactId,
+            title: inst.gitMode === "keep" ? "Tether undid a git change" : "Tether undid your change",
+            body: `${name} is managed by Tether, so your local change was replaced with the shared version (v${state.version}). Run "tether edit ${name}" to change it.`
+          });
+        }
       }
       this.db.update(inst.instanceId, patch);
     } catch (e) {
       if (!(e instanceof LockedError)) throw e;
-      this.db.update(inst.instanceId, { lastError: e.message });
+      this.lockedNotice(inst, e);
     }
   }
+  lockedNotice(inst, e) {
+    if (!inst.lastError) this.notify({ kind: "locked", level: "warn", key: `locked:${inst.instanceId}`, cooldownMs: 3600 * 1e3, title: "File in use", body: `${path4.basename(inst.path)} is open in another program, so Tether cannot update it yet. It will retry automatically.`, short: path4.basename(inst.path) });
+    this.db.update(inst.instanceId, { lastError: e.message });
+  }
   /** If `to` is occupied by something that isn't this instance, move it aside (keep both). */
   makeRoom(to, inst) {
     const st = statOrNull(to);
@@ -1014,6 +1624,7 @@ var Engine = class {
     }
     for (const inst of this.db.all()) {
       if (inst.mode !== "normal" || inst.kind !== "file" || inst.detached) continue;
+      if (this.isGitBusy(inst)) continue;
       try {
         if (inst.needsRestore) {
           if (this.cache.has(inst.baseHash)) this.restore(inst);
@@ -1034,9 +1645,18 @@ var Engine = class {
         if (!this.cache.has(cur.baseHash)) continue;
         this.db.update(cur.instanceId, { ...this.writeInstance(cur, cur.path, cur.baseHash), lastError: null });
         this.log(`${cur.path}: local change reverted (use \`tether edit\` to change it)`);
+        const byGit = cur.gitMode === "keep";
+        this.notify({
+          kind: "revert",
+          level: "info",
+          short: path4.basename(cur.path),
+          artifactId: cur.artifactId,
+          title: byGit ? "Tether undid a git change" : "Tether undid your change",
+          body: `${path4.basename(cur.path)} is managed by Tether, so it was put back to the shared version. Run "tether edit ${path4.basename(cur.path)}" to change it${byGit ? ', or "tether git <path> --mode follow" to accept git updates' : ""}.`
+        });
       } catch (e) {
         if (!(e instanceof LockedError)) throw e;
-        this.db.update(inst.instanceId, { lastError: e.message });
+        this.lockedNotice(inst, e);
       }
     }
   }
@@ -1094,7 +1714,13 @@ var Engine = class {
     return { abs, bytes: canonical, sha256: sha256(canonical), size: canonical.length, eol: eolMode, exec: process.platform !== "win32" && !!(st.mode & 73), stat: st };
   }
   /** `tether manage <path> --repo <repo>`: upload; the caller becomes the owner. */
-  async manage({ path: target, repo: repoRef, eol }) {
+  /** `tether manage`, then apply the git mode chosen for a path inside a git repository. */
+  async manage({ gitMode, ...opts }) {
+    const r = await this.manageCore(opts);
+    if (gitMode) this.applyGitMode(this.instanceAt(r.path), gitMode);
+    return r;
+  }
+  async manageCore({ path: target, repo: repoRef, eol }) {
     const abs = canonicalPath(path4.resolve(target));
     const st = statOrNull(abs);
     if (!st) throw new UserError(`${abs} does not exist`);
@@ -1107,7 +1733,7 @@ var Engine = class {
     if (st.isFile()) {
       const f = this.prepareFile(abs, name, rules, eol);
       await this.api.uploadBlobs([f]);
-      const r2 = await this.api.call("POST", "/artifacts", { repoId: repo.repoId, kind: "file", name, blob: f.sha256, size: f.size, eol: f.eol, exec: f.exec });
+      const r2 = await this.api.call("POST", "/artifacts", { repoId: repo.repoId, kind: "file", name, blob: f.sha256, size: f.size, chunks: this.api.manifestFor(f.sha256), eol: f.eol, exec: f.exec });
       this.cache.put(f.sha256, f.bytes);
       const local = readLocal(abs, f.eol);
       this.db.insert({
@@ -1146,7 +1772,7 @@ var Engine = class {
       repoId: repo.repoId,
       kind: "folder",
       name,
-      files: prepared.map((f) => ({ relPath: f.rel, blob: f.sha256, size: f.size, eol: f.eol, exec: f.exec }))
+      files: prepared.map((f) => ({ relPath: f.rel, blob: f.sha256, size: f.size, chunks: this.api.manifestFor(f.sha256), eol: f.eol, exec: f.exec }))
     });
     const folderInst = this.db.insert({
       instanceId: newInstanceId(),
@@ -1193,7 +1819,7 @@ var Engine = class {
     return { artifactId: r.artifact.artifactId, shareId: r.artifact.shareId, kind: "folder", path: abs, files: files2.length, skippedSymlinks: symlinks };
   }
   /** `tether add <path>`: owner adds a new file inside a managed folder. */
-  async add({ path: target }) {
+  async add({ path: target, gitCommit }) {
     const abs = canonicalPath(path4.resolve(target));
     if (!statOrNull(abs)?.isFile()) throw new UserError(`${abs} is not a file`);
     if (this.instanceAt(abs)) throw new UserError(`${abs} is already managed`);
@@ -1206,7 +1832,7 @@ var Engine = class {
     const repo = (await this.api.call("GET", "/repos")).find((r) => r.repoId === folder.repoId);
     const f = this.prepareFile(abs, rel, repo?.eolDefaults ?? {});
     await this.api.uploadBlobs([f]);
-    const child = await this.api.call("POST", `/artifacts/${folder.artifactId}/children`, { relPath: rel, blob: f.sha256, size: f.size, eol: f.eol, exec: f.exec });
+    const child = await this.api.call("POST", `/artifacts/${folder.artifactId}/children`, { relPath: rel, blob: f.sha256, size: f.size, chunks: this.api.manifestFor(f.sha256), eol: f.eol, exec: f.exec, gitCommit });
     this.cache.put(f.sha256, f.bytes);
     const local = readLocal(abs, f.eol);
     this.db.insert({
@@ -1234,17 +1860,44 @@ var Engine = class {
     return { artifactId: child.artifactId, relPath: rel, folder: folder.path };
   }
   /** `tether pull <shareId> [dest]`. Never overwrites existing user files. */
-  async pull({ shareId, dest, cwd }) {
+  /** `tether pull`; with peek, only report where it would go and the caller's role. */
+  async pull({ gitMode, peek, ...opts }) {
+    if (peek) {
+      const r2 = await this.api.call("POST", "/pull", { shareId: opts.shareId, peek: true });
+      return { role: r2.role, kind: r2.artifact.kind, path: this.pullTarget(r2.artifact, opts) };
+    }
+    const r = await this.pullCore(opts, gitMode);
+    if (gitMode) this.applyGitMode(this.instanceAt(r.path), gitMode);
+    return r;
+  }
+  pullTarget(a, { dest, cwd }) {
+    const target = path4.resolve(cwd, dest ?? a.name);
+    return dest && statOrNull(target)?.isDirectory() && a.kind === "file" ? path4.join(target, a.name) : target;
+  }
+  async pullCore({ shareId, dest, cwd }, gitMode) {
     const r = await this.api.call("POST", "/pull", { shareId });
     const a = r.artifact;
-    let target = path4.resolve(cwd, dest ?? a.name);
-    if (dest && statOrNull(target)?.isDirectory() && a.kind === "file") target = path4.join(target, a.name);
+    if (gitMode === "follow" && r.role === "viewer") throw new UserError("git follow mode needs editor access; you are a viewer (use --git keep)");
+    const target = this.pullTarget(a, { dest, cwd });
     if (this.instanceAt(target)) throw new UserError(`${target} is already a managed copy`);
     const base = { repoId: a.repoId, role: r.role, canDelete: r.canDelete };
     if (a.kind === "file") {
       await this.ensureBlobs([{ artifactId: a.artifactId, version: a.version, sha: a.blob }]);
-      const existing = readLocal(target, a.eol);
-      if (existing && existing.hash !== a.blob) throw new UserError(`${target} already exists with different content; choose another destination`);
+      let existing = readLocal(target, a.eol);
+      let mode = "normal";
+      let lastError = null;
+      let note;
+      if (existing && existing.hash !== a.blob) {
+        const clash = this.gitClash(target, gitMode, a.relPath ?? a.name);
+        if (clash === "replace") {
+          existing = null;
+          note = "replaced git's version with Tether's (git still has it)";
+        } else {
+          mode = "editing";
+          lastError = "git's version differs from Tether's; run `tether done` to publish it or accept Tether's";
+          note = "kept git's version; run `tether done` to publish it or accept Tether's";
+        }
+      }
       const st2 = existing ? { size: existing.size, mtimeMs: existing.mtimeMs, ...styleOf(existing) } : writeLocal(target, this.blobFor(a.blob), a.eol, { exec: a.exec });
       this.db.insert({
         ...base,
@@ -1254,7 +1907,8 @@ var Engine = class {
         name: a.name,
         path: canonicalPath(target),
         ...this.identity(target),
-        mode: "normal",
+        mode,
+        lastError,
         baseVersion: a.version,
         baseHash: a.blob,
         ...st2,
@@ -1262,18 +1916,17 @@ var Engine = class {
         exec: a.exec,
         remoteVersion: a.version
       });
-      return { kind: "file", path: canonicalPath(target), role: r.role, version: a.version };
+      return { kind: "file", path: canonicalPath(target), role: r.role, version: a.version, note };
     }
     const st = statOrNull(target);
     if (st && !st.isDirectory()) throw new UserError(`${target} exists and is not a folder`);
     await this.ensureBlobs(r.children.map((c) => ({ artifactId: c.artifactId, version: c.version, sha: c.blob })));
-    const clashes = [];
+    const clashes = /* @__PURE__ */ new Map();
     for (const c of r.children) {
       const p = path4.join(target, ...c.relPath.split("/"));
       const ex = readLocal(p, c.eol);
-      if (ex && ex.hash !== c.blob) clashes.push(c.relPath);
+      if (ex && ex.hash !== c.blob) clashes.set(c.relPath, this.gitClash(p, gitMode, c.relPath));
     }
-    if (clashes.length) throw new UserError(`${target} already has different files: ${clashes.join(", ")}; choose another destination`);
     fs6.mkdirSync(target, { recursive: true });
     const folderInst = this.db.insert({
       ...base,
@@ -1289,7 +1942,8 @@ var Engine = class {
     });
     for (const c of r.children) {
       const p = path4.join(folderInst.path, ...c.relPath.split("/"));
-      const ex = readLocal(p, c.eol);
+      const clash = clashes.get(c.relPath);
+      const ex = clash === "replace" ? null : readLocal(p, c.eol);
       const cst = ex ? { size: ex.size, mtimeMs: ex.mtimeMs, ...styleOf(ex) } : writeLocal(p, this.blobFor(c.blob), c.eol, { exec: c.exec });
       this.db.insert({
         ...base,
@@ -1301,10 +1955,11 @@ var Engine = class {
         relPath: c.relPath,
         path: canonicalPath(p),
         ...this.identity(p),
-        mode: "normal",
         baseVersion: c.version,
         baseHash: c.blob,
         ...cst,
+        mode: clash === "keep-git" ? "editing" : "normal",
+        lastError: clash === "keep-git" ? "git's version differs from Tether's; run `tether done`" : null,
         eolMode: c.eol,
         exec: c.exec,
         remoteVersion: c.version
@@ -1312,6 +1967,21 @@ var Engine = class {
     }
     return { kind: "folder", path: folderInst.path, role: r.role, files: r.children.length, version: a.version };
   }
+  /**
+   * A pulled file already exists with different content. Only allowed when git holds that
+   * content safely (tracked, no uncommitted changes): keep mode replaces it with Tether's version,
+   * follow mode keeps git's version in editing mode. Otherwise the pull is refused.
+   */
+  gitClash(p, gitMode, label) {
+    const repo = gitMode && findRepo(p);
+    if (repo && gitBinary() && isTracked(repo.root, p)) {
+      const blob = fileBlob(repo.root, p);
+      const clean = blob && (blob === blobAt(repo.root, "HEAD", p) || blob === indexBlob(repo.root, p));
+      if (clean) return gitMode === "keep" ? "replace" : "keep-git";
+      throw new UserError(`${label} differs from Tether's version and has uncommitted git changes; commit or stash them first`);
+    }
+    throw new UserError(`${p} already exists with different content; choose another destination`);
+  }
   /** Instances addressed by a path: a file, a managed folder (with its files), or any directory. */
   targets(p) {
     const abs = canonicalPath(path4.resolve(p));
@@ -1331,13 +2001,55 @@ var Engine = class {
     }
     return changed;
   }
-  edit({ path: p }) {
+  /**
+   * `tether edit [--realtime]`. Realtime claims a live session per file (editors only, one
+   * holder per file). A plain edit warns about files someone else is editing live.
+   */
+  async edit({ path: p, realtime = false }) {
     const ts = this.targets(p);
     const unmanaged = ts.filter((i) => i.mode === "unmanaged" && !i.detached);
     if (unmanaged.length === ts.length) throw new UserError("these files are unmanaged; use `tether track` first");
-    return { changed: this.setMode(p, "editing", ["normal"]) };
+    const files2 = ts.filter((i) => i.kind === "file" && ["normal", "editing"].includes(i.mode) && !i.detached);
+    if (realtime) {
+      if (!files2.length) throw new UserError("nothing here to edit");
+      const viewerOf = files2.find((i) => i.role === "viewer");
+      if (viewerOf) throw new UserError(`realtime editing needs editor access; you are a viewer of ${viewerOf.path}`);
+      const claimed = [];
+      for (const f of files2) {
+        try {
+          await this.api.call("POST", `/artifacts/${f.artifactId}/realtime`, { action: "start" });
+          claimed.push(f);
+        } catch (e) {
+          for (const c of claimed) await this.releaseRealtime(c);
+          if (e instanceof ApiError && e.status === 409 && e.body?.realtime) {
+            const s = e.body.realtime;
+            throw new UserError(`${f.path} is already being edited in realtime by ${s.email} (since ${new Date(s.since).toLocaleTimeString()}).
+You can still run \`tether edit\` without --realtime, but expect merge conflicts.`);
+          }
+          throw e;
+        }
+      }
+      this.setMode(p, "editing", ["normal", "editing"]);
+      for (const f of files2) this.db.update(f.instanceId, { mode: "editing", realtime: true, lastError: null });
+      return { changed: files2.map((f) => f.path), realtime: true };
+    }
+    const changed = this.setMode(p, "editing", ["normal"]);
+    const warnings = [];
+    if (files2.length) {
+      try {
+        const { results } = await this.api.call("POST", "/sync/check", { items: files2.map((i) => ({ artifactId: i.artifactId, version: i.baseVersion })) });
+        results.forEach((r, k) => {
+          if (r.realtime && !r.realtime.mine) warnings.push({ path: files2[k].path, email: r.realtime.email, since: r.realtime.since });
+        });
+      } catch (e) {
+        if (!(e instanceof OfflineError)) throw e;
+      }
+    }
+    return { changed, warnings };
   }
-  unmanage({ path: p }) {
+  async unmanage({ path: p }) {
+    for (const i of this.targets(p).filter((x) => x.realtime)) await this.releaseRealtime(i);
+    for (const i of this.targets(p)) this.releaseGit(i);
     return { changed: this.setMode(p, "unmanaged", ["normal", "editing"]) };
   }
   /**
@@ -1420,6 +2132,7 @@ var Engine = class {
     for (const f of this.targets(p).filter((i) => i.kind === "folder" && i.mode === from)) {
       if (!this.db.childrenOf(f.instanceId).some((c) => c.mode === from && !c.detached)) this.db.update(f.instanceId, { mode: "normal" });
     }
+    for (const i of this.db.all().filter((x) => x.realtime && x.mode !== "editing")) await this.releaseRealtime(i);
     await this.tick();
     return { results: out };
   }
@@ -1464,16 +2177,16 @@ var Engine = class {
       case "push": {
         const local = readLocal(inst.path, inst.eolMode);
         const change = {};
-        if (local && local.hash !== inst.baseHash) {
-          await this.api.uploadBlobs([{ sha256: local.hash, bytes: local.canonical }]);
-          this.cache.put(local.hash, local.canonical);
-          Object.assign(change, { blob: local.hash, size: local.canonical.length });
-        }
+        if (local && local.hash !== inst.baseHash) Object.assign(change, await this.uploadContent(local, inst.artifactId));
         if (folder) {
           const rel = this.localRel(inst, folder);
           if (rel && rel !== inst.relPath) change.relPath = rel;
         }
         const baseVersion = item.incoming ? item.serverVersion : inst.baseVersion;
+        if (inst.gitMode === "follow" && inst.gitRoot && change.blob) {
+          const g = changeFromGit(inst.gitRoot, inst.path);
+          if (g.fromGit && g.commit) change.gitCommit = g.commit;
+        }
         const r = await this.api.call("POST", `/artifacts/${inst.artifactId}/commit`, { baseVersion, change });
         const state = r.state;
         this.db.update(inst.instanceId, {
@@ -1486,7 +2199,7 @@ var Engine = class {
           mtimeMs: local?.mtimeMs ?? null,
           ...local ? styleOf(local) : {}
         });
-        return { version: r.version };
+        return { version: r.version, sent: change.blob ? describeTransfer(this.api.transfers.get(change.blob), "sent") : "" };
       }
       case "delete": {
         await this.api.call("POST", `/artifacts/${inst.artifactId}/commit`, { baseVersion: item.serverVersion, change: { deleted: true } });
@@ -1512,7 +2225,7 @@ var Engine = class {
     if (!inst || inst.kind !== "file") throw new UserError("diff needs a managed file");
     const { artifact } = await this.api.call("GET", `/artifacts/${inst.artifactId}`);
     if (artifact.deleted) throw new UserError("the artifact has been deleted on the server");
-    await this.ensureBlobs([{ artifactId: inst.artifactId, version: artifact.version, sha: artifact.blob }]);
+    await this.ensureBlobs([{ artifactId: inst.artifactId, version: artifact.version, sha: artifact.blob, base: inst.baseHash }]);
     const server = this.cache.get(artifact.blob);
     const local = inst.detached ? null : readLocal(inst.path, inst.eolMode);
     const label = path4.basename(inst.path);
@@ -1544,6 +2257,11 @@ var Engine = class {
         }
       }
       if (i.orphanReason) flags.push(i.orphanReason);
+      if (i.realtime && i.mode === "editing") flags.push("realtime: your saves are pushed live");
+      if (i.gitMode) flags.push(`git: ${i.gitMode}`);
+      if (i.gitWaiting) flags.push("newer version arrives with your next git pull");
+      if (i.gitOverlay) flags.push("Tether-only version (hidden from git)");
+      if (i.remoteRealtime && i.mode !== "orphaned") flags.push(`realtime edits by ${JSON.parse(i.remoteRealtime).email}`);
       return {
         instanceId: i.instanceId,
         artifactId: i.artifactId,
@@ -1592,15 +2310,161 @@ var Engine = class {
   }
 };
 
+// packages/client/src/notifier.js
+import fs7 from "node:fs";
+import { spawn } from "node:child_process";
+var AUMID = "Tether.Sync";
+var FLUSH_MS = 3e3;
+var LEVELS = { info: 0, warn: 1, error: 2 };
+var SHORTCUT_SCRIPT = String.raw`Add-Type -TypeDefinition @'
+using System;
+using System.Text;
+using System.Runtime.InteropServices;
+using System.Runtime.InteropServices.ComTypes;
+
+namespace TetherShortcut {
+  [ComImport, Guid("00021401-0000-0000-C000-000000000046")] class CShellLink {}
+
+  [ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("000214F9-0000-0000-C000-000000000046")]
+  interface IShellLinkW {
+    void GetPath([Out, MarshalAs(UnmanagedType.LPWStr)] StringBuilder f, int cch, IntPtr fd, uint flags);
+    void GetIDList(out IntPtr pidl);
+    void SetIDList(IntPtr pidl);
+    void GetDescription([Out, MarshalAs(UnmanagedType.LPWStr)] StringBuilder s, int cch);
+    void SetDescription([MarshalAs(UnmanagedType.LPWStr)] string s);
+    void GetWorkingDirectory([Out, MarshalAs(UnmanagedType.LPWStr)] StringBuilder s, int cch);
+    void SetWorkingDirectory([MarshalAs(UnmanagedType.LPWStr)] string s);
+    void GetArguments([Out, MarshalAs(UnmanagedType.LPWStr)] StringBuilder s, int cch);
+    void SetArguments([MarshalAs(UnmanagedType.LPWStr)] string s);
+    void GetHotkey(out short k);
+    void SetHotkey(short k);
+    void GetShowCmd(out int c);
+    void SetShowCmd(int c);
+    void GetIconLocation([Out, MarshalAs(UnmanagedType.LPWStr)] StringBuilder s, int cch, out int i);
+    void SetIconLocation([MarshalAs(UnmanagedType.LPWStr)] string s, int i);
+    void SetRelativePath([MarshalAs(UnmanagedType.LPWStr)] string s, uint r);
+    void Resolve(IntPtr hwnd, uint flags);
+    void SetPath([MarshalAs(UnmanagedType.LPWStr)] string s);
+  }
+
+  [StructLayout(LayoutKind.Sequential, Pack = 4)] public struct PropertyKey { public Guid fmtid; public uint pid; }
+  [StructLayout(LayoutKind.Explicit)] public struct PropVariant { [FieldOffset(0)] public ushort vt; [FieldOffset(8)] public IntPtr p; }
+
+  [ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99")]
+  interface IPropertyStore {
+    void GetCount(out uint c);
+    void GetAt(uint i, out PropertyKey k);
+    void GetValue(ref PropertyKey k, out PropVariant v);
+    void SetValue(ref PropertyKey k, ref PropVariant v);
+    void Commit();
+  }
+
+  public static class Maker {
+    public static void Create(string lnk, string aumid, string url) {
+      var link = (IShellLinkW)new CShellLink();
+      link.SetPath(Environment.ExpandEnvironmentVariables("%SystemRoot%\\explorer.exe"));
+      link.SetArguments(url);
+      link.SetDescription("Tether");
+      link.SetIconLocation(Environment.ExpandEnvironmentVariables("%SystemRoot%\\System32\\imageres.dll"), 228);
+      var store = (IPropertyStore)link;
+      var key = new PropertyKey { fmtid = new Guid("9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3"), pid = 5 };
+      var v = new PropVariant { vt = 31, p = Marshal.StringToCoTaskMemUni(aumid) };
+      store.SetValue(ref key, ref v);
+      store.Commit();
+      ((IPersistFile)link).Save(lnk, true);
+      Marshal.FreeCoTaskMem(v.p);
+    }
+  }
+}
+'@
+`;
+var Notifier = class {
+  /** setting: 'all' | 'errors' | 'off' (config key `notifications`). */
+  constructor({ setting = () => "all", consoleUrl = () => "", log = () => {
+  } } = {}) {
+    this.setting = setting;
+    this.consoleUrl = consoleUrl;
+    this.log = log;
+    this.pending = /* @__PURE__ */ new Map();
+    this.cooldown = /* @__PURE__ */ new Map();
+    this.timer = null;
+    this.registered = false;
+  }
+  /**
+   * event: { kind, level: 'info'|'warn'|'error', title, body, path?, artifactId?, key?, cooldownMs? }
+   * Events sharing `key` are suppressed for cooldownMs (default: no cooldown).
+   */
+  notify(event) {
+    const s = this.setting();
+    if (s === "off" || s === "errors" && LEVELS[event.level] < LEVELS.warn) return;
+    if (event.key) {
+      if ((this.cooldown.get(event.key) ?? 0) > Date.now()) return;
+      if (event.cooldownMs) this.cooldown.set(event.key, Date.now() + event.cooldownMs);
+    }
+    if (!this.pending.has(event.kind)) this.pending.set(event.kind, []);
+    this.pending.get(event.kind).push(event);
+    this.timer ??= setTimeout(() => this.flush(), FLUSH_MS);
+  }
+  flush() {
+    this.timer = null;
+    for (const events of this.pending.values()) {
+      const first = events[0];
+      const more = events.length - 1;
+      const title = more ? `${first.title} (+${more} more)` : first.title;
+      const body = more ? `${first.body}
+Also: ${events.slice(1, 4).map((e) => e.short ?? e.title).join("; ")}${more > 3 ? "\u2026" : ""}` : first.body;
+      const base = this.consoleUrl().replace(/\/$/, "");
+      const url = base ? first.artifactId && !more ? `${base}/artifacts/${first.artifactId}` : base : "";
+      this.show({ title, body, url, level: first.level });
+    }
+    this.pending.clear();
+  }
+  show(n) {
+    this.log(`notify [${n.level}] ${n.title}: ${n.body.replace(/\n/g, " ")}`);
+    if (process.env.TETHER_NOTIFY_LOG) {
+      fs7.appendFileSync(process.env.TETHER_NOTIFY_LOG, JSON.stringify(n) + "\n");
+      return;
+    }
+    try {
+      if (isWindows) this.toast(n);
+      else spawn("notify-send", ["--app-name=Tether", n.level === "info" ? "--urgency=low" : "--urgency=normal", n.title, n.body], { stdio: "ignore" }).on("error", () => {
+      });
+    } catch (e) {
+      this.log(`notification failed: ${e.message}`);
+    }
+  }
+  toast({ title, body, url }) {
+    const esc = (s) => s.replace(/[<>&"']/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", '"': "&quot;", "'": "&apos;" })[c]);
+    const launch = url ? ` activationType="protocol" launch="${esc(url)}"` : "";
+    const xml = `<toast${launch}><visual><binding template="ToastGeneric"><text>${esc(title)}</text><text>${esc(body)}</text></binding></visual></toast>`;
+    const consoleUrl = (this.consoleUrl() || "https://tether-b10cf.web.app").replace(/'/g, "''");
+    const register = this.registered ? "" : `$k='HKCU:\\Software\\Classes\\AppUserModelId\\${AUMID}'; if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null }; Set-ItemProperty -Path $k -Name DisplayName -Value 'Tether';
+$lnk = Join-Path $env:APPDATA 'Microsoft\\Windows\\Start Menu\\Programs\\Tether.lnk'
+if (-not (Test-Path $lnk)) { try {
+${SHORTCUT_SCRIPT}
+[TetherShortcut.Maker]::Create($lnk, '${AUMID}', '${consoleUrl}') } catch {} }`;
+    this.registered = true;
+    const script = `${register}
+[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
+[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null
+$x = New-Object Windows.Data.Xml.Dom.XmlDocument; $x.LoadXml('${xml.replace(/'/g, "''")}')
+[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('${AUMID}').Show((New-Object Windows.UI.Notifications.ToastNotification $x))`;
+    const child = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { stdio: "ignore", windowsHide: true });
+    child.on("error", (e) => this.log(`notification failed: ${e.message}`));
+  }
+};
+
 // packages/client/src/daemon.js
-var VERSION = "0.1.0";
+import { fileURLToPath } from "node:url";
+var REALTIME_TICK_SECONDS = 3;
+var UPDATE_CHECK_MS = 24 * 60 * 60 * 1e3;
 async function runDaemon() {
   const home = tetherHome();
-  fs7.mkdirSync(home, { recursive: true });
+  fs8.mkdirSync(home, { recursive: true });
   process.chdir(home);
   const f = files(home);
   const recent = [];
-  const logStream = fs7.createWriteStream(f.log, { flags: "a" });
+  const logStream = fs8.createWriteStream(f.log, { flags: "a" });
   const log = (msg) => {
     const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}`;
     recent.push(line);
@@ -1613,26 +2477,62 @@ async function runDaemon() {
   const api = new Api({ config, credentials });
   const cache = new BlobCache(f.blobs);
   const tracker = await createTracker(config);
-  const engine = new Engine({ db, api, cache, tracker, config, log });
+  const notifier = new Notifier({ setting: () => config.get("notifications"), consoleUrl: () => config.consoleUrl, log });
+  const engine = new Engine({
+    db,
+    api,
+    cache,
+    tracker,
+    config,
+    log,
+    home,
+    notify: (e) => notifier.notify(e),
+    cliPath: fileURLToPath(new URL("../bin/tether.js", import.meta.url))
+  });
   let timer = null;
   let quickTimer = null;
+  let realtimeTimer = null;
   let stopping = false;
+  let latest = null;
   async function runTick(opts) {
     try {
       await engine.locked(() => engine.tick(opts));
     } catch (e) {
       log(`tick failed: ${e.stack || e.message}`);
+      notifier.notify({ kind: "error", level: "error", key: "tick-failed", cooldownMs: 3600 * 1e3, title: "Tether hit an error", body: `${e.message}. Run "tether log" for details.` });
     }
     refreshWatchers();
     scheduleGrace();
+    schedule();
   }
   function schedule() {
     clearTimeout(timer);
     if (stopping) return;
-    timer = setTimeout(async () => {
-      await runTick();
-      schedule();
-    }, config.get("tickSeconds") * 1e3);
+    const seconds = engine.realtimeActive ? Math.min(config.get("tickSeconds"), REALTIME_TICK_SECONDS) : config.get("tickSeconds");
+    timer = setTimeout(() => runTick(), seconds * 1e3);
+  }
+  function realtimePass(delay = 1e3) {
+    if (stopping || !engine.realtimeInstances().length) return;
+    clearTimeout(realtimeTimer);
+    realtimeTimer = setTimeout(async () => {
+      realtimeTimer = null;
+      try {
+        await engine.locked(async () => {
+          await engine.locateAll();
+          await engine.syncRealtime();
+        });
+      } catch (e) {
+        log(`realtime push failed: ${e.message}`);
+      }
+    }, delay);
+  }
+  let notifiedVersion = null;
+  async function checkForUpdate() {
+    latest = await latestVersion() ?? latest;
+    if (isNewer(latest, VERSION) && notifiedVersion !== latest) {
+      notifiedVersion = latest;
+      notifier.notify({ kind: "update", level: "info", title: "Tether update available", body: `Version ${latest} is available (you have ${VERSION}). Run "tether update".` });
+    }
   }
   function quickPass(delay) {
     if (quickTimer || stopping) return;
@@ -1651,10 +2551,29 @@ async function runDaemon() {
     if (engine.graceDue) quickPass(Math.max(50, engine.graceDue - Date.now() + 50));
   }
   const watchers = /* @__PURE__ */ new Map();
+  let gitTimer = null;
+  function gitPassSoon() {
+    clearTimeout(gitTimer);
+    gitTimer = setTimeout(async () => {
+      gitTimer = null;
+      try {
+        await engine.locked(async () => {
+          engine.busyCache = /* @__PURE__ */ new Map();
+          await engine.locateAll();
+          await engine.gitPass();
+          await engine.enforceLocal();
+        });
+      } catch (e) {
+        log(`git pass failed: ${e.message}`);
+      }
+    }, 600);
+  }
   function refreshWatchers() {
     const want = /* @__PURE__ */ new Map();
     for (const i of db.all()) {
-      if (i.mode === "orphaned" || i.detached) continue;
+      if (i.mode === "orphaned") continue;
+      if (i.gitDir && !want.has(i.gitDir)) want.set(i.gitDir, "git");
+      if (i.detached) continue;
       if (i.kind === "folder") want.set(i.path, true);
       else if (!i.folderInstanceId) want.set(path5.dirname(i.path), false);
     }
@@ -1664,10 +2583,13 @@ async function runDaemon() {
         watchers.delete(dir);
       }
     }
-    for (const [dir, recursive] of want) {
+    for (const [dir, kind] of want) {
       if (watchers.has(dir)) continue;
       try {
-        const w = fs7.watch(dir, { recursive, persistent: false }, () => quickPass(250));
+        const w = kind === "git" ? fs8.watch(dir, { persistent: false }, () => gitPassSoon()) : fs8.watch(dir, { recursive: kind, persistent: false }, () => {
+          quickPass(250);
+          realtimePass();
+        });
         w.on("error", () => {
           w.close();
           watchers.delete(dir);
@@ -1714,7 +2636,15 @@ async function runDaemon() {
     ping: () => ({ pid: process.pid, version: VERSION, home, tracker: tracker.name, server: config.get("server") }),
     async status(p) {
       const creds = await credentials.load();
-      return { user: creds?.user ?? null, server: config.get("server"), offline: engine.offline, lastTick: engine.lastTick, instances: await L((x) => engine.status(x))(p) };
+      return {
+        user: creds?.user ?? null,
+        server: config.get("server"),
+        offline: engine.offline,
+        lastTick: engine.lastTick,
+        version: VERSION,
+        latest,
+        instances: await L((x) => engine.status(x))(p)
+      };
     },
     sync: async () => {
       await runTick();
@@ -1742,8 +2672,18 @@ async function runDaemon() {
     manage: L((p) => engine.manage(p)),
     add: L((p) => engine.add(p)),
     pull: L((p) => engine.pull(p)),
-    edit: L((p) => engine.edit(p)),
+    edit: async (p) => {
+      const r = await L((x) => engine.edit(x))(p);
+      schedule();
+      return r;
+    },
     unmanage: L((p) => engine.unmanage(p)),
+    "git.mode": L((p) => engine.gitMode(p)),
+    // Called by git hooks: answer at once so git is not held up; reconcile in the background.
+    "git.sync": ({ repo }) => {
+      engine.locked(() => engine.gitReconcile(path5.resolve(repo))).catch((e) => log(`git sync failed: ${e.message}`));
+      return { queued: true };
+    },
     plan: L((p) => engine.plan(p)),
     resolve: L((p) => engine.resolve(p)),
     diff: L((p) => engine.diff(p)),
@@ -1796,11 +2736,14 @@ async function runDaemon() {
       return { stopping: true };
     }
   };
+  const CHANGES_WATCHED = /* @__PURE__ */ new Set(["manage", "add", "pull", "edit", "unmanage", "git.mode", "resolve", "locate"]);
   async function handle(method, params) {
     const h = handlers[method];
     if (!h) throw new UserError(`unknown command ${method}`);
     try {
-      return await h(params);
+      const result = await h(params);
+      if (CHANGES_WATCHED.has(method)) refreshWatchers();
+      return result;
     } catch (e) {
       if (e instanceof ApiError || e instanceof UserError) throw e;
       if (e.name === "OfflineError") throw e;
@@ -1809,25 +2752,36 @@ async function runDaemon() {
     }
   }
   const server = await listen(ipcEndpoint(home), handle);
-  fs7.writeFileSync(f.pid, String(process.pid));
+  fs8.writeFileSync(f.pid, String(process.pid));
   log(`tetherd ${VERSION} started (pid ${process.pid}, tracker ${tracker.name}, server ${config.get("server")})`);
   function shutdown(code) {
     if (stopping) return;
     stopping = true;
     clearTimeout(timer);
     clearTimeout(quickTimer);
+    clearTimeout(realtimeTimer);
+    clearInterval(updateTimer);
+    clearInterval(repoTimer);
+    clearTimeout(gitTimer);
     for (const w of watchers.values()) w.close();
     server.close();
     engine.locked(() => db.close()).finally(() => {
-      fs7.rmSync(f.pid, { force: true });
+      fs8.rmSync(f.pid, { force: true });
       log("tetherd stopped");
       logStream.end(() => process.exit(code));
     });
   }
   process.on("SIGINT", () => shutdown(0));
   process.on("SIGTERM", () => shutdown(0));
+  await engine.locked(() => {
+    engine.cleanupLegacyHooks();
+    engine.detectNewRepos();
+  }).catch((e) => log(`git setup: ${e.message}`));
+  const repoTimer = setInterval(() => engine.locked(() => engine.detectNewRepos()).catch(() => {
+  }), 60 * 60 * 1e3);
+  const updateTimer = setInterval(checkForUpdate, UPDATE_CHECK_MS);
+  setTimeout(checkForUpdate, 5e3);
   await runTick();
-  schedule();
 }
 export {
   VERSION,