@kodrunhq/claudefy 1.1.2 → 1.2.0

package/README.md

@@ -7,11 +7,36 @@ Sync your Claude Code environment across machines.
 claudefy syncs your `~/.claude` directory (commands, skills, agents, hooks, rules, plans, plugins, settings, and project configs) across multiple machines using a private git repository as the backend. It handles:
 
 - **Selective sync** — three-tier filter (allow/deny/unknown) controls what syncs
-- **Encryption** — sensitive and unknown files encrypted with age before push
+- **Encryption** — sensitive and unknown files encrypted with AES-256-SIV before push
 - **Path remapping** — machine-specific paths normalized to canonical IDs
 - **Deep merge** — settings.json merged at the key level; other files use last-write-wins
 - **Override** — wipe remote and push local as source of truth when needed
 
+## Architecture
+
+claudefy uses a private git repository as the sync backend, with per-machine branches to avoid conflicts.
+
+**Branch model:**
+- Each machine syncs to its own branch: `machines/<machineId>`
+- `main` holds the merged state from all machines
+
+**Push (SessionEnd):**
+Commits local `~/.claude` changes to the machine branch, merges into `main`, and pushes both.
+
+**Pull (SessionStart):**
+Fetches `main`, merges into the machine branch, decrypts, remaps paths, and applies to `~/.claude`.
+
+**Override:**
+Wipes `main` and force-updates it to match your machine's current state. Useful when one machine should become the canonical source of truth.
+
+## What Gets Synced
+
+| Category | Items | Notes |
+|----------|-------|-------|
+| **Synced** | commands, agents, skills, hooks, rules, plans, plugins, agent-memory, projects, settings.json, history.jsonl, package.json | Core config that should travel with you |
+| **Never synced** | cache, backups, file-history, shell-snapshots, paste-cache, session-env, tasks, .credentials.json | Machine-local or sensitive data |
+| **Unknown** | Anything not in either list | Encrypted by default before commit |
+
 ## Install
 
 ```bash
@@ -95,7 +120,14 @@ Pass `--hooks` to `init` or `join` to install auto-sync hooks automatically.
 
 ## Encryption
 
-claudefy encrypts files using [age](https://age-encryption.org/) (WASM-based, no native binary needed).
+claudefy encrypts files using AES-256-SIV deterministic encryption via `@noble/ciphers`.
+
+**Why deterministic?** Same plaintext always produces the same ciphertext. This means unchanged files produce no git diff, and git's merge machinery can work with encrypted content.
+
+**How different file types are handled:**
+- **Session transcripts (.jsonl):** encrypted per-line, so git can diff and merge individual lines
+- **Other files:** encrypted as a whole file; deterministic output avoids spurious diffs
+- **Size overhead:** ~38% from base64 encoding
 
 **Passphrase resolution order:**
 1. `--passphrase` CLI flag (highest priority; avoid — visible in process list)
@@ -135,13 +167,23 @@ claudefy config set encryption.enabled false
 claudefy config set encryption.useKeychain true
 ```
 
-## Security
+## Security Model
 
+- `.credentials.json` is never synced (hardcoded in the deny list)
+- All hooks from remote are stripped on pull to prevent code injection
+- Secret scanner detects common patterns (API keys, tokens, high-entropy strings) before push — not exhaustive, but catches the obvious ones
+- Files with detected secrets are encrypted before commit rather than blocking the push
 - Passphrases never stored in plain text on disk
-- Secret scanner detects API keys, tokens, and high-entropy strings before push
 - Unknown files always encrypted — never pushed in cleartext
 - `--passphrase` CLI flag warns about process list exposure
 
+## Multi-Machine Workflow
+
+1. **First machine:** `claudefy init --backend <url> --hooks` — creates the store and installs auto-sync hooks
+2. **Other machines:** `claudefy join --backend <url> --hooks` — clones the store, registers the machine, pulls config, installs hooks
+3. **Automatic sync:** with hooks installed, `pull` runs on SessionStart and `push` runs on SessionEnd — no manual steps needed
+4. **Canonical override:** if one machine has the "right" config, run `claudefy override --confirm` to wipe main and push that machine's state as the source of truth
+
 ## License
 
 MIT

package/dist/commands/init.js

@@ -60,6 +60,7 @@ export class InitCommand {
         // 2. Initialize git store
         const gitAdapter = new GitAdapter(join(this.homeDir, ".claudefy"));
         await gitAdapter.initStore(backend);
+        await gitAdapter.ensureMachineBranch(config.machineId);
         // 3. Write .gitattributes for LFS tracking of large session files
         await writeFile(join(gitAdapter.getStorePath(), ".gitattributes"), LFS_GITATTRIBUTES);
         // 4. Run initial push

package/dist/commands/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,iBAAiB,GAAG;IACxB,yDAAyD;IACzD,6DAA6D;IAC7D,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAYb,MAAM,OAAO,WAAW;IACd,OAAO,CAAS;IAExB,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAE9B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC/B,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,oEAAoE;QACpE,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACpC,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;gBAC9B,WAAW,GAAG,KAAK,CAAC,gBAAgB,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAExE,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,yCAAyC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,0BAA0B;QAC1B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEpC,kEAAkE;QAClE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEtF,sBAAsB;QACtB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc;YACd,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU;SACX,CAAC,CAAC;QAEH,gCAAgC;QAChC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;YACpF,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,iBAAiB,GAAG;IACxB,yDAAyD;IACzD,6DAA6D;IAC7D,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAYb,MAAM,OAAO,WAAW;IACd,OAAO,CAAS;IAExB,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAE9B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC/B,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,oEAAoE;QACpE,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACpC,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;gBAC9B,WAAW,GAAG,KAAK,CAAC,gBAAgB,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAExE,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,yCAAyC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,0BAA0B;QAC1B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvD,kEAAkE;QAClE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEtF,sBAAsB;QACtB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc;YACd,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU;SACX,CAAC,CAAC;QAEH,gCAAgC;QAChC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;YACpF,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF"}

package/dist/commands/join.js

@@ -24,17 +24,21 @@ export class JoinCommand {
         // 2. Initialize git store and pull
         const gitAdapter = new GitAdapter(join(this.homeDir, ".claudefy"));
         await gitAdapter.initStore(options.backend);
-        // 3. Register this machine and commit
-        const registry = new MachineRegistry(join(gitAdapter.getStorePath(), "manifest.json"));
-        await registry.register(config.machineId, hostname(), platform());
-        await gitAdapter.commitAndPush(`sync: ${config.machineId} joined`);
-        // 4. Run pull to get remote config
+        await gitAdapter.ensureMachineBranch(config.machineId);
+        // 3. Run pull to get remote config
         const pullCommand = new PullCommand(this.homeDir);
         await pullCommand.execute({
             quiet: options.quiet,
             skipEncryption: options.skipEncryption,
             passphrase: options.passphrase,
         });
+        // 4. Register this machine and commit
+        const registry = new MachineRegistry(join(gitAdapter.getStorePath(), "manifest.json"));
+        await registry.register(config.machineId, hostname(), platform());
+        const commitResult = await gitAdapter.commitAndPush(`sync: ${config.machineId} joined`, config.machineId);
+        if (!commitResult.pushed && !options.quiet) {
+            output.warn("Machine registry update could not be pushed to the remote. Check your connection and try 'claudefy push'.");
+        }
         // 5. Install hooks if requested
         if (options.installHooks) {
             const hookManager = new HookManager(join(this.homeDir, ".claude", "settings.json"));

package/dist/commands/join.js.map

@@ -1 +1 @@
-{"version":3,"file":"join.js","sourceRoot":"","sources":["../../src/commands/join.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAUtC,MAAM,OAAO,WAAW;IACd,OAAO,CAAS;IAExB,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE/D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,mCAAmC;QACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5C,sCAAsC;QACtC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACvF,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,CAAC,aAAa,CAAC,SAAS,MAAM,CAAC,SAAS,SAAS,CAAC,CAAC;QAEnE,mCAAmC;QACnC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,gCAAgC;QAChC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;YACpF,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"join.js","sourceRoot":"","sources":["../../src/commands/join.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAUtC,MAAM,OAAO,WAAW;IACd,OAAO,CAAS;IAExB,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE/D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,mCAAmC;QACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvD,mCAAmC;QACnC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,sCAAsC;QACtC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACvF,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,aAAa,CACjD,SAAS,MAAM,CAAC,SAAS,SAAS,EAClC,MAAM,CAAC,SAAS,CACjB,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACT,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;YACpF,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF"}

package/dist/commands/override.js

@@ -21,6 +21,7 @@ export class OverrideCommand {
         // 1. Initialize git adapter
         const gitAdapter = new GitAdapter(join(this.homeDir, ".claudefy"));
         await gitAdapter.initStore(config.backend.url);
+        await gitAdapter.ensureMachineBranch(config.machineId);
         try {
             await gitAdapter.pull();
         }

package/dist/commands/override.js.map

@@ -1 +1 @@
-{"version":3,"file":"override.js","sourceRoot":"","sources":["../../src/commands/override.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAStC,MAAM,OAAO,eAAe;IAClB,OAAO,CAAS;IAChB,aAAa,CAAgB;IAErC,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAE/C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,2CAA2C;QAC3C,MAAM,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE/C,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CACZ,8EAA8E,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"override.js","sourceRoot":"","sources":["../../src/commands/override.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAStC,MAAM,OAAO,eAAe;IAClB,OAAO,CAAS;IAChB,aAAa,CAAgB;IAErC,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAE/C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,2CAA2C;QAC3C,MAAM,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE/C,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CACZ,8EAA8E,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/commands/pull.d.ts

@@ -14,4 +14,12 @@ export declare class PullCommand {
     private configManager;
     constructor(homeDir: string);
     execute(options: PullOptions): Promise<PullResult>;
+    /**
+     * Check for an override marker. First checks current branch, then checks
+     * the main branch (override markers may not survive merge into machine branch
+     * due to conflicts from wipeAndPush).
+     */
+    private checkOverrideOnMain;
+    private collectAgeFiles;
+    private walkAgeFiles;
 }

package/dist/commands/pull.js

@@ -1,10 +1,9 @@
 import { cp, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { join, relative, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { ConfigManager } from "../config/config-manager.js";
 import { GitAdapter } from "../git-adapter/git-adapter.js";
 import { PathMapper } from "../path-mapper/path-mapper.js";
-import { MachineRegistry } from "../machine-registry/machine-registry.js";
 import { Encryptor } from "../encryptor/encryptor.js";
 import { Merger } from "../merger/merger.js";
 import { BackupManager } from "../backup-manager/backup-manager.js";
@@ -21,22 +20,21 @@ export class PullCommand {
     async execute(options) {
         const config = await this.configManager.load();
         const result = { overrideDetected: false, filesUpdated: 0 };
-        // 1. Initialize git adapter and pull
+        // 1. Initialize git adapter, switch to machine branch, pull & merge main
         const claudefyDir = join(this.homeDir, ".claudefy");
         const gitAdapter = new GitAdapter(claudefyDir);
         await gitAdapter.initStore(config.backend.url);
+        await gitAdapter.ensureMachineBranch(config.machineId);
         try {
-            await gitAdapter.pull();
+            await gitAdapter.pullAndMergeMain();
         }
         catch {
             // Fresh store with no remote history yet
         }
         const storePath = gitAdapter.getStorePath();
-        const configDir = join(storePath, "config");
-        const unknownDir = join(storePath, "unknown");
         const resolvedClaudeDir = resolve(this.claudeDir);
-        // 2. Check for override marker
-        const override = await gitAdapter.checkOverrideMarker();
+        // 2. Check for override marker (check on main branch where overrides are written)
+        const override = await this.checkOverrideOnMain(gitAdapter);
         if (override) {
             result.overrideDetected = true;
             if (!options.quiet) {
@@ -50,171 +48,227 @@ export class PullCommand {
             if (!options.quiet && result.backupPath) {
                 output.info(`Backup created at: ${result.backupPath}`);
             }
-            // Remove override marker
+            // Reset machine branch to main so we apply the override content
+            const { simpleGit: sg } = await import("simple-git");
+            const git = sg(storePath);
+            await git.reset(["--hard", "main"]);
+            // Remove override marker and commit the acknowledgement locally.
+            // The commit will be pushed on the next normal push.
             await gitAdapter.removeOverrideMarker();
-            await gitAdapter.commitAndPush("pull: acknowledge override");
-        }
-        // 3. Decrypt .age files if encryption is enabled
-        if (config.encryption.enabled && !options.skipEncryption) {
-            if (!options.passphrase) {
-                throw new Error("Encryption is enabled but no passphrase found. Set CLAUDEFY_PASSPHRASE or store it in your OS keychain via 'claudefy init'.");
+            const { simpleGit: sgCommit } = await import("simple-git");
+            const gitCommit = sgCommit(storePath);
+            await gitCommit.add(["."]);
+            const status = await gitCommit.status();
+            if (!status.isClean()) {
+                await gitCommit.commit("acknowledge override marker removal");
             }
-            const encryptor = new Encryptor(options.passphrase);
-            // Decrypt sensitive config files
-            const filesToDecrypt = ["settings.json.age", "history.jsonl.age"];
-            for (const fileName of filesToDecrypt) {
-                const filePath = join(configDir, fileName);
-                if (existsSync(filePath)) {
-                    const outputPath = filePath.replace(/\.age$/, "");
-                    await encryptor.decryptFile(filePath, outputPath);
-                    await rm(filePath);
+        }
+        // 3. Create temp working directory
+        const tmpDir = join(claudefyDir, ".pull-tmp");
+        if (existsSync(tmpDir))
+            await rm(tmpDir, { recursive: true });
+        await mkdir(tmpDir, { recursive: true });
+        try {
+            // 4. Copy store to temp dir
+            const storeConfigDir = join(storePath, "config");
+            const storeUnknownDir = join(storePath, "unknown");
+            const tmpConfigDir = join(tmpDir, "config");
+            const tmpUnknownDir = join(tmpDir, "unknown");
+            if (existsSync(storeConfigDir))
+                await cp(storeConfigDir, tmpConfigDir, { recursive: true });
+            if (existsSync(storeUnknownDir))
+                await cp(storeUnknownDir, tmpUnknownDir, { recursive: true });
+            // 5. Decrypt any .age files in temp dir
+            const encryptedFiles = await this.collectAgeFiles(tmpConfigDir, tmpUnknownDir);
+            if (encryptedFiles.length > 0 && !options.skipEncryption) {
+                if (!options.passphrase) {
+                    throw new Error("Encrypted files found but no passphrase available. Set CLAUDEFY_PASSPHRASE or store it in your OS keychain via 'claudefy init'.");
+                }
+                const encryptor = new Encryptor(options.passphrase);
+                if (existsSync(tmpConfigDir)) {
+                    await encryptor.decryptDirectory(tmpConfigDir);
+                }
+                if (existsSync(tmpUnknownDir)) {
+                    await encryptor.decryptDirectory(tmpUnknownDir);
                 }
             }
-            // Decrypt all .age files in unknown/
-            if (existsSync(unknownDir)) {
-                await encryptor.decryptDirectory(unknownDir);
+            // 6. Remap paths (canonical -> local) in temp dir
+            const links = await this.configManager.getLinks();
+            const pathMapper = new PathMapper(links);
+            // settings.json
+            const remoteSettingsPath = join(tmpConfigDir, "settings.json");
+            if (existsSync(remoteSettingsPath)) {
+                const settings = JSON.parse(await readFile(remoteSettingsPath, "utf-8"));
+                const remapped = pathMapper.remapSettingsPaths(settings, this.claudeDir);
+                await writeFile(remoteSettingsPath, JSON.stringify(remapped, null, 2));
             }
-        }
-        // 4. Remap paths (canonical → local)
-        const links = await this.configManager.getLinks();
-        const pathMapper = new PathMapper(links);
-        // settings.json
-        const remoteSettingsPath = join(configDir, "settings.json");
-        if (existsSync(remoteSettingsPath)) {
-            const settings = JSON.parse(await readFile(remoteSettingsPath, "utf-8"));
-            const remapped = pathMapper.remapSettingsPaths(settings, this.claudeDir);
-            await writeFile(remoteSettingsPath, JSON.stringify(remapped, null, 2));
-        }
-        // installed_plugins.json
-        const pluginsJsonPath = join(configDir, "plugins", "installed_plugins.json");
-        if (existsSync(pluginsJsonPath)) {
-            const plugins = JSON.parse(await readFile(pluginsJsonPath, "utf-8"));
-            const remapped = pathMapper.remapPluginPaths(plugins, this.claudeDir);
-            await writeFile(pluginsJsonPath, JSON.stringify(remapped, null, 2));
-        }
-        // known_marketplaces.json
-        const marketplacesPath = join(configDir, "plugins", "known_marketplaces.json");
-        if (existsSync(marketplacesPath)) {
-            const mp = JSON.parse(await readFile(marketplacesPath, "utf-8"));
-            const remapped = pathMapper.remapPluginPaths(mp, this.claudeDir);
-            await writeFile(marketplacesPath, JSON.stringify(remapped, null, 2));
-        }
-        // history.jsonl
-        const historyPath = join(configDir, "history.jsonl");
-        if (existsSync(historyPath)) {
-            const content = await readFile(historyPath, "utf-8");
-            const remapped = content
-                .split("\n")
-                .filter(Boolean)
-                .map((line) => pathMapper.remapJsonlLine(line))
-                .join("\n") + "\n";
-            await writeFile(historyPath, remapped);
-        }
-        // projects/ directory renaming (canonical → local)
-        const projectsDir = join(configDir, "projects");
-        if (existsSync(projectsDir)) {
-            const projectDirs = await readdir(projectsDir);
-            for (const dirName of projectDirs) {
-                const localName = pathMapper.remapDirName(dirName);
-                if (localName) {
-                    const destPath = resolve(join(projectsDir, localName));
-                    // Path containment: ensure renamed dir stays within projects/
-                    if (!destPath.startsWith(resolve(projectsDir) + "/")) {
-                        console.warn(`Skipping directory rename "${dirName}" → "${localName}": path escapes projects directory`);
-                        continue;
-                    }
-                    await rename(join(projectsDir, dirName), destPath);
-                }
+            // installed_plugins.json
+            const pluginsJsonPath = join(tmpConfigDir, "plugins", "installed_plugins.json");
+            if (existsSync(pluginsJsonPath)) {
+                const plugins = JSON.parse(await readFile(pluginsJsonPath, "utf-8"));
+                const remapped = pathMapper.remapPluginPaths(plugins, this.claudeDir);
+                await writeFile(pluginsJsonPath, JSON.stringify(remapped, null, 2));
             }
-        }
-        // 5. Merge and copy to ~/.claude
-        const merger = new Merger();
-        await mkdir(this.claudeDir, { recursive: true });
-        // 5a. Deep merge settings.json
-        if (existsSync(remoteSettingsPath)) {
-            const localSettingsPath = join(this.claudeDir, "settings.json");
-            const remoteSettings = JSON.parse(await readFile(remoteSettingsPath, "utf-8"));
-            // Security: strip hooks from remote settings to prevent remote hook injection.
-            // Local hooks should never be overwritten by remote data, as an attacker with
-            // store access could inject arbitrary shell commands via SessionStart/SessionEnd hooks.
-            delete remoteSettings.hooks;
-            if (existsSync(localSettingsPath) && !result.overrideDetected) {
-                const localSettings = JSON.parse(await readFile(localSettingsPath, "utf-8"));
-                const merged = merger.deepMergeJson(localSettings, remoteSettings);
-                await writeFile(localSettingsPath, JSON.stringify(merged, null, 2));
+            // known_marketplaces.json
+            const marketplacesPath = join(tmpConfigDir, "plugins", "known_marketplaces.json");
+            if (existsSync(marketplacesPath)) {
+                const mp = JSON.parse(await readFile(marketplacesPath, "utf-8"));
+                const remapped = pathMapper.remapPluginPaths(mp, this.claudeDir);
+                await writeFile(marketplacesPath, JSON.stringify(remapped, null, 2));
             }
-            else {
-                await writeFile(localSettingsPath, JSON.stringify(remoteSettings, null, 2));
+            // history.jsonl
+            const historyPath = join(tmpConfigDir, "history.jsonl");
+            if (existsSync(historyPath)) {
+                const content = await readFile(historyPath, "utf-8");
+                const remapped = content
+                    .split("\n")
+                    .filter(Boolean)
+                    .map((line) => pathMapper.remapJsonlLine(line))
+                    .join("\n") + "\n";
+                await writeFile(historyPath, remapped);
             }
-            result.filesUpdated++;
-        }
-        // 5b. Copy remaining config items (remote overwrites local)
-        if (existsSync(configDir)) {
-            const entries = await readdir(configDir, { withFileTypes: true });
-            for (const entry of entries) {
-                if (entry.name === "settings.json")
-                    continue; // Already handled
-                // Security: skip symlinks to prevent path traversal attacks
-                if (entry.isSymbolicLink()) {
-                    console.warn(`Skipping symlink in config store: ${entry.name}`);
-                    continue;
-                }
-                const src = join(configDir, entry.name);
-                const dest = resolve(join(this.claudeDir, entry.name));
-                // Path containment: ensure destination stays within ~/.claude/
-                if (!dest.startsWith(resolvedClaudeDir + "/") && dest !== resolvedClaudeDir) {
-                    console.warn(`Skipping "${entry.name}": resolved path escapes ~/.claude/`);
-                    continue;
+            // projects/ directory renaming (canonical -> local)
+            const projectsDir = join(tmpConfigDir, "projects");
+            if (existsSync(projectsDir)) {
+                const projectDirs = await readdir(projectsDir);
+                for (const dirName of projectDirs) {
+                    const localName = pathMapper.remapDirName(dirName);
+                    if (localName) {
+                        const destPath = resolve(join(projectsDir, localName));
+                        // Path containment: ensure renamed dir stays within projects/
+                        const rel = relative(resolve(projectsDir), destPath);
+                        if (rel.startsWith("..") || resolve(destPath) === resolve(projectsDir)) {
+                            output.warn(`Skipping directory rename "${dirName}" -> "${localName}": path escapes projects directory`);
+                            continue;
+                        }
+                        await rename(join(projectsDir, dirName), destPath);
+                    }
                 }
-                await cp(src, dest, { recursive: true, force: true });
-                result.filesUpdated++;
             }
-        }
-        // 5c. Copy unknown items back
-        if (existsSync(unknownDir)) {
-            const entries = await readdir(unknownDir, { withFileTypes: true });
-            for (const entry of entries) {
-                // Security: skip symlinks to prevent path traversal attacks
-                if (entry.isSymbolicLink()) {
-                    console.warn(`Skipping symlink in unknown store: ${entry.name}`);
-                    continue;
+            // 7. Merge and copy to ~/.claude
+            const merger = new Merger();
+            await mkdir(this.claudeDir, { recursive: true });
+            // 7a. Deep merge settings.json with hook filtering
+            if (existsSync(remoteSettingsPath)) {
+                const localSettingsPath = join(this.claudeDir, "settings.json");
+                const remoteSettings = JSON.parse(await readFile(remoteSettingsPath, "utf-8"));
+                // Security: strip all hooks from remote to prevent code injection
+                if (remoteSettings && typeof remoteSettings === "object" && "hooks" in remoteSettings) {
+                    delete remoteSettings.hooks;
+                }
+                if (existsSync(localSettingsPath) && !result.overrideDetected) {
+                    const localSettings = JSON.parse(await readFile(localSettingsPath, "utf-8"));
+                    const merged = merger.deepMergeJson(localSettings, remoteSettings);
+                    await writeFile(localSettingsPath, JSON.stringify(merged, null, 2));
                 }
-                const src = join(unknownDir, entry.name);
-                const dest = resolve(join(this.claudeDir, entry.name));
-                // Path containment: ensure destination stays within ~/.claude/
-                if (!dest.startsWith(resolvedClaudeDir + "/") && dest !== resolvedClaudeDir) {
-                    console.warn(`Skipping "${entry.name}": resolved path escapes ~/.claude/`);
-                    continue;
+                else {
+                    await writeFile(localSettingsPath, JSON.stringify(remoteSettings, null, 2));
                 }
-                await cp(src, dest, { recursive: true, force: true });
                 result.filesUpdated++;
             }
-        }
-        // 6. Re-encrypt decrypted files in the store before committing,
-        //    so plaintext is never committed to git history.
-        if (config.encryption.enabled && !options.skipEncryption) {
-            const encryptor = new Encryptor(options.passphrase);
-            const filesToReencrypt = ["settings.json", "history.jsonl"];
-            for (const fileName of filesToReencrypt) {
-                const filePath = join(configDir, fileName);
-                if (existsSync(filePath)) {
-                    await encryptor.encryptFile(filePath, filePath + ".age");
-                    await rm(filePath);
+            // 7b. Copy remaining config items (remote overwrites local)
+            if (existsSync(tmpConfigDir)) {
+                const entries = await readdir(tmpConfigDir, { withFileTypes: true });
+                for (const entry of entries) {
+                    if (entry.name === "settings.json")
+                        continue; // Already handled
+                    // Security: skip symlinks to prevent path traversal attacks
+                    if (entry.isSymbolicLink()) {
+                        output.warn(`Skipping symlink in config store: ${entry.name}`);
+                        continue;
+                    }
+                    const src = join(tmpConfigDir, entry.name);
+                    const dest = resolve(join(this.claudeDir, entry.name));
+                    // Path containment: ensure destination stays within ~/.claude/
+                    const relPath = relative(resolvedClaudeDir, dest);
+                    if (relPath.startsWith("..") || resolve(dest) === resolvedClaudeDir) {
+                        output.warn(`Skipping "${entry.name}": resolved path escapes ~/.claude/`);
+                        continue;
+                    }
+                    await cp(src, dest, { recursive: true, force: true });
+                    result.filesUpdated++;
                 }
             }
-            // Re-encrypt all plaintext files in unknown/
-            if (existsSync(unknownDir)) {
-                await encryptor.encryptDirectory(unknownDir);
+            // 7c. Copy unknown items back
+            if (existsSync(tmpUnknownDir)) {
+                const entries = await readdir(tmpUnknownDir, { withFileTypes: true });
+                for (const entry of entries) {
+                    // Security: skip symlinks to prevent path traversal attacks
+                    if (entry.isSymbolicLink()) {
+                        output.warn(`Skipping symlink in unknown store: ${entry.name}`);
+                        continue;
+                    }
+                    const src = join(tmpUnknownDir, entry.name);
+                    const dest = resolve(join(this.claudeDir, entry.name));
+                    // Path containment: ensure destination stays within ~/.claude/
+                    const relPath = relative(resolvedClaudeDir, dest);
+                    if (relPath.startsWith("..") || resolve(dest) === resolvedClaudeDir) {
+                        output.warn(`Skipping "${entry.name}": resolved path escapes ~/.claude/`);
+                        continue;
+                    }
+                    await cp(src, dest, { recursive: true, force: true });
+                    result.filesUpdated++;
+                }
             }
         }
-        // 7. Update machine registry last sync time and commit
-        const registry = new MachineRegistry(join(storePath, "manifest.json"));
-        await registry.updateLastSync(config.machineId);
-        await gitAdapter.commitAndPush(`sync: pull on ${config.machineId}`);
+        finally {
+            if (existsSync(tmpDir))
+                await rm(tmpDir, { recursive: true });
+        }
+        // NO re-encryption step (store is never modified)
+        // NO commitAndPush (pull should not create commits)
         if (!options.quiet) {
             output.success(`Pull complete. ${result.filesUpdated} items updated.`);
         }
         return result;
     }
+    /**
+     * Check for an override marker. First checks current branch, then checks
+     * the main branch (override markers may not survive merge into machine branch
+     * due to conflicts from wipeAndPush).
+     */
+    async checkOverrideOnMain(gitAdapter) {
+        // First check on current branch (works when merge succeeded)
+        const override = await gitAdapter.checkOverrideMarker();
+        if (override)
+            return override;
+        // If not found, check on main branch by temporarily switching
+        const currentBranch = await gitAdapter.getCurrentBranch();
+        if (currentBranch === "main")
+            return null;
+        const storePath = gitAdapter.getStorePath();
+        try {
+            const { simpleGit } = await import("simple-git");
+            const git = simpleGit(storePath);
+            // Use git show to read .override from main without switching branches
+            const content = await git.show(["main:.override"]);
+            const marker = JSON.parse(content);
+            return { machine: marker.machine, timestamp: marker.timestamp };
+        }
+        catch {
+            return null;
+        }
+    }
+    async collectAgeFiles(...dirs) {
+        const results = [];
+        for (const dir of dirs) {
+            if (!existsSync(dir))
+                continue;
+            await this.walkAgeFiles(dir, results);
+        }
+        return results;
+    }
+    async walkAgeFiles(dirPath, results) {
+        const entries = await readdir(dirPath, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(dirPath, entry.name);
+            if (entry.isDirectory()) {
+                await this.walkAgeFiles(fullPath, results);
+            }
+            else if (entry.name.endsWith(".age")) {
+                results.push(fullPath);
+            }
+        }
+    }
 }
 //# sourceMappingURL=pull.js.map