claude-nomad 0.34.1 → 0.35.0

package/dist/nomad.mjs

@@ -327,7 +327,7 @@ var init_settings_keys = __esm({
 
 // src/config.ts
 import { homedir, hostname } from "node:os";
-import { resolve } from "node:path";
+import { join, resolve } from "node:path";
 function allSharedLinks(map) {
   const extras = [];
   for (const entry of map.sharedDirs ?? []) {
@@ -341,7 +341,7 @@ function allSharedLinks(map) {
   }
   return [...SHARED_LINKS, ...extras];
 }
-var HOME, CLAUDE_HOME, REPO_HOME, SETTINGS_SCHEMA_URL, GITLEAKS_PINNED_VERSION, HOST, SHARED_LINKS, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, NEVER_SYNC, PUSH_ALLOWED_STATIC;
+var HOME, CLAUDE_HOME, BACKUP_BASE, REPO_HOME, SETTINGS_SCHEMA_URL, GITLEAKS_PINNED_VERSION, HOST, SHARED_LINKS, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, NEVER_SYNC, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -350,6 +350,7 @@ var init_config = __esm({
     init_settings_keys();
     HOME = homedir();
     CLAUDE_HOME = resolve(HOME, ".claude");
+    BACKUP_BASE = join(HOME, ".cache", "claude-nomad", "backup");
     REPO_HOME = process.env.NOMAD_REPO || resolve(HOME, "claude-nomad");
     SETTINGS_SCHEMA_URL = "https://json.schemastore.org/claude-code-settings.json";
     GITLEAKS_PINNED_VERSION = "8.30.1";
@@ -463,7 +464,7 @@ import {
   symlinkSync,
   writeFileSync
 } from "node:fs";
-import { dirname, join, relative } from "node:path";
+import { dirname, join as join2, relative } from "node:path";
 function writeJsonAtomic(path, data) {
   const mode = existsSync(path) ? statSync(path).mode & 511 : 384;
   const tmp = `${path}.tmp.${process.pid}`;
@@ -489,9 +490,9 @@ function nowTimestamp() {
 }
 function freshBackupTs(backupRoot) {
   const base = nowTimestamp();
-  if (!existsSync(join(backupRoot, base))) return base;
+  if (!existsSync(join2(backupRoot, base))) return base;
   let n = 1;
-  while (existsSync(join(backupRoot, `${base}-${n}`))) n++;
+  while (existsSync(join2(backupRoot, `${base}-${n}`))) n++;
   return `${base}-${n}`;
 }
 function ensureSymlink(linkPath, target) {
@@ -507,8 +508,8 @@ function backupBeforeWrite(absPath, ts) {
   if (!existsSync(absPath)) return;
   const rel = relative(CLAUDE_HOME, absPath);
   if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join(HOME, ".cache", "claude-nomad", "backup", ts);
-  const dst = join(backupRoot, rel);
+  const backupRoot = join2(HOME, ".cache", "claude-nomad", "backup", ts);
+  const dst = join2(backupRoot, rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
 }
@@ -516,8 +517,8 @@ function backupRepoWrite(absPath, ts, repoHome) {
   if (!existsSync(absPath)) return;
   const rel = relative(repoHome, absPath);
   if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join(HOME, ".cache", "claude-nomad", "backup", ts, "repo");
-  const dst = join(backupRoot, rel);
+  const backupRoot = join2(HOME, ".cache", "claude-nomad", "backup", ts, "repo");
+  const dst = join2(backupRoot, rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
 }
@@ -525,8 +526,8 @@ function backupExtrasWrite(absPath, ts, projectRoot) {
   if (!existsSync(absPath)) return;
   const rel = relative(projectRoot, absPath);
   if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join(HOME, ".cache", "claude-nomad", "backup", ts, "extras");
-  const dst = join(backupRoot, encodePath(projectRoot), rel);
+  const backupRoot = join2(HOME, ".cache", "claude-nomad", "backup", ts, "extras");
+  const dst = join2(backupRoot, encodePath(projectRoot), rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
 }
@@ -541,15 +542,15 @@ var init_utils_fs = __esm({
 
 // src/push-gitleaks.scan.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join9 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveTomlPath() {
-  const repoToml = join7(REPO_HOME, ".gitleaks.toml");
-  if (existsSync7(repoToml)) return repoToml;
+  const repoToml = join9(REPO_HOME, ".gitleaks.toml");
+  if (existsSync8(repoToml)) return repoToml;
   const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync7(bundled) ? bundled : null;
+  return existsSync8(bundled) ? bundled : null;
 }
 function readGitleaksReport(reportPath) {
   try {
@@ -562,9 +563,9 @@ function readGitleaksReport(reportPath) {
   }
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join7(homedir2(), ".cache", "claude-nomad");
+  const cacheDir = join9(homedir2(), ".cache", "claude-nomad");
   mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join7(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join9(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -591,14 +592,14 @@ function scanStagedTree(repoDir, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync2(tempPath, { recursive: true, force: true });
-    rmSync2(reportPath, { force: true });
+    if (tempPath !== null) rmSync3(tempPath, { recursive: true, force: true });
+    rmSync3(reportPath, { force: true });
   }
 }
 function scanFile(filePath, forwardStreams = false) {
-  const cacheDir = join7(homedir2(), ".cache", "claude-nomad");
+  const cacheDir = join9(homedir2(), ".cache", "claude-nomad");
   mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join7(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join9(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "detect",
@@ -623,8 +624,8 @@ function scanFile(filePath, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync2(tempPath, { recursive: true, force: true });
-    rmSync2(reportPath, { force: true });
+    if (tempPath !== null) rmSync3(tempPath, { recursive: true, force: true });
+    rmSync3(reportPath, { force: true });
   }
 }
 var init_push_gitleaks_scan = __esm({
@@ -637,24 +638,24 @@ var init_push_gitleaks_scan = __esm({
 });
 
 // src/push-gitleaks.config.ts
-import { existsSync as existsSync8, mkdtempSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync9, mkdtempSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 function buildOverlayTempConfig(overlayBody, bundled) {
   const tempBody = `[extend]
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join8(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join8(tempPath, "config.toml");
+  const tempPath = mkdtempSync(join10(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join10(tempPath, "config.toml");
   writeFileSync2(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
-  const overlayPath = join8(REPO_HOME, ".gitleaks.overlay.toml");
-  const repoToml = join8(REPO_HOME, ".gitleaks.toml");
+  const overlayPath = join10(REPO_HOME, ".gitleaks.overlay.toml");
+  const repoToml = join10(REPO_HOME, ".gitleaks.toml");
   const bundled = resolveTomlPath();
-  if (!existsSync8(overlayPath)) {
+  if (!existsSync9(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -696,9 +697,9 @@ var init_push_gitleaks_config = __esm({
 
 // src/push-checks.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
+import { readdirSync as readdirSync3, rmSync as rmSync4 } from "node:fs";
 import { homedir as homedir3, platform } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join11 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -736,12 +737,12 @@ function findGitlinks(dir) {
   function walk(current) {
     let entries;
     try {
-      entries = readdirSync2(current, { withFileTypes: true });
+      entries = readdirSync3(current, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = join9(current, e.name);
+      const p = join11(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
@@ -763,7 +764,7 @@ function probeGitleaks() {
     if (e.code === "ENOENT") throw new NomadFatal(gitleaksInstallHint());
     throw new NomadFatal(`gitleaks --version failed: ${e.message}`);
   } finally {
-    if (tempPath !== null) rmSync3(tempPath, { recursive: true, force: true });
+    if (tempPath !== null) rmSync4(tempPath, { recursive: true, force: true });
   }
 }
 function rebaseBeforePush() {
@@ -949,7 +950,7 @@ init_utils();
 init_utils_fs();
 init_utils_json();
 import { cpSync as cpSync2, existsSync as existsSync2, lstatSync as lstatSync2, rmSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
 function lexists(p) {
   try {
@@ -960,7 +961,7 @@ function lexists(p) {
   }
 }
 function readMapIfPresent(repoHome) {
-  const mapPath = join2(repoHome, "path-map.json");
+  const mapPath = join3(repoHome, "path-map.json");
   return existsSync2(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function isConfiguredTarget(name, map) {
@@ -971,13 +972,13 @@ function isValidAdoptName(name) {
   return isValidSharedDir(name);
 }
 function performAdoptMove(name, linkPath, sharedTarget) {
-  const backupBase = join2(HOME, ".cache", "claude-nomad", "backup");
+  const backupBase = join3(HOME, ".cache", "claude-nomad", "backup");
   const ts = freshBackupTs(backupBase);
   backupBeforeWrite(linkPath, ts);
   cpSync2(linkPath, sharedTarget, { recursive: true, force: true, preserveTimestamps: true });
   rmSync(linkPath, { recursive: true, force: true });
   ensureSymlink(linkPath, sharedTarget);
-  const rel = join2("shared", name);
+  const rel = join3("shared", name);
   gitOrFatal(["add", "--", rel], `git add shared/${name}`, REPO_HOME);
   log(`adopted ${name}; ${ADOPT_PUSH_HINT}`);
 }
@@ -994,8 +995,8 @@ function cmdAdopt(name, opts = {}) {
     );
     process.exit(1);
   }
-  const linkPath = join2(CLAUDE_HOME, name);
-  const sharedTarget = join2(REPO_HOME, "shared", name);
+  const linkPath = join3(CLAUDE_HOME, name);
+  const sharedTarget = join3(REPO_HOME, "shared", name);
   if (!existsSync2(linkPath)) {
     log(`${name}: nothing to adopt (not present in ~/.claude/)`);
     return;
@@ -1009,7 +1010,7 @@ function cmdAdopt(name, opts = {}) {
     process.exit(1);
   }
   if (dryRun) {
-    const backupBase = join2(HOME, ".cache", "claude-nomad", "backup");
+    const backupBase = join3(HOME, ".cache", "claude-nomad", "backup");
     const ts = freshBackupTs(backupBase);
     log(`would backup: ${linkPath} -> backup/${ts}/${name}`);
     log(`would move: ${linkPath} -> shared/${name}`);
@@ -1025,15 +1026,79 @@ function cmdAdopt(name, opts = {}) {
   }
 }
 
+// src/commands.clean.ts
+init_config();
+init_utils();
+import { existsSync as existsSync3, lstatSync as lstatSync3, readdirSync, rmSync as rmSync2, statSync as statSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+var TS_SHAPE = /^\d{8}-\d{6}(-\d+)?$/;
+var DURATION_RE = /^(\d+)([dhm])$/;
+var UNIT_MS = { d: 864e5, h: 36e5, m: 6e4 };
+var CLEAN_DEFAULT_OLDER_THAN_MS = 14 * 24 * 60 * 60 * 1e3;
+function isTsDir(name) {
+  return TS_SHAPE.test(name);
+}
+function parseDuration(s) {
+  const m = DURATION_RE.exec(s);
+  if (!m) return null;
+  return Number(m[1]) * UNIT_MS[m[2]];
+}
+function listBackupDirs(backupBase) {
+  if (!existsSync3(backupBase)) return [];
+  return readdirSync(backupBase).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join4(backupBase, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+function prunableByAge(dirs, olderThanMs, nowMs) {
+  return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
+}
+function prunableByCount(dirs, keep) {
+  return dirs.slice(keep).map((d) => d.name);
+}
+function safeDelete(backupBase, name) {
+  if (!isTsDir(name)) return;
+  const full = join4(backupBase, name);
+  const st = lstatSync3(full, { throwIfNoEntry: false });
+  if (!st || st.isSymbolicLink() || !st.isDirectory()) return;
+  rmSync2(full, { recursive: true, force: true });
+}
+function resolveTargets(dirs, olderThanMs, keep) {
+  if (keep !== void 0) return prunableByCount(dirs, keep);
+  return prunableByAge(dirs, olderThanMs, Date.now());
+}
+function cmdClean(opts, backupBase = BACKUP_BASE) {
+  const { dryRun, olderThan, keep } = opts;
+  if (olderThan !== void 0 && keep !== void 0) {
+    fail("--older-than and --keep are mutually exclusive");
+    process.exit(1);
+  }
+  let olderThanMs = CLEAN_DEFAULT_OLDER_THAN_MS;
+  if (olderThan !== void 0) {
+    const parsed = parseDuration(olderThan);
+    if (parsed === null) {
+      fail(`invalid --older-than duration: ${olderThan} (expected e.g. 14d, 24h, 30m)`);
+      process.exit(1);
+    }
+    olderThanMs = parsed;
+  }
+  const dirs = listBackupDirs(backupBase);
+  const targets = resolveTargets(dirs, olderThanMs, keep);
+  if (dryRun) {
+    for (const name of targets) log(`would remove ${name}`);
+    log(`dry-run: ${targets.length} backup(s) would be removed`);
+    return;
+  }
+  for (const name of targets) safeDelete(backupBase, name);
+  log(`removed ${targets.length} backup(s)`);
+}
+
 // src/commands.doctor.ts
-import { existsSync as existsSync16 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join21 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
 init_config();
-import { existsSync as existsSync4, lstatSync as lstatSync3, statSync as statSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync5, lstatSync as lstatSync4, statSync as statSync3 } from "node:fs";
+import { join as join6 } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -1083,15 +1148,15 @@ function readJsonSafe(path, label, section2) {
 // src/init.classify.ts
 init_config();
 init_utils_json();
-import { existsSync as existsSync3 } from "node:fs";
-import { join as join3 } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+import { join as join5 } from "node:path";
 function classifyRepoState(repoHome, host) {
-  const basePath = join3(repoHome, "shared", "settings.base.json");
-  const mapPath = join3(repoHome, "path-map.json");
-  const hostPath = join3(repoHome, "hosts", `${host}.json`);
-  const hasBase = existsSync3(basePath);
-  const hasMap = existsSync3(mapPath);
-  const hasHost = existsSync3(hostPath);
+  const basePath = join5(repoHome, "shared", "settings.base.json");
+  const mapPath = join5(repoHome, "path-map.json");
+  const hostPath = join5(repoHome, "hosts", `${host}.json`);
+  const hasBase = existsSync4(basePath);
+  const hasMap = existsSync4(mapPath);
+  const hasHost = existsSync4(hostPath);
   let mapEntryCount = 0;
   if (hasMap) {
     try {
@@ -1106,11 +1171,11 @@ function classifyRepoState(repoHome, host) {
   return "partial";
 }
 function reasonForPartial(repoHome, host) {
-  const basePath = join3(repoHome, "shared", "settings.base.json");
-  const mapPath = join3(repoHome, "path-map.json");
-  const hostPath = join3(repoHome, "hosts", `${host}.json`);
-  if (!existsSync3(basePath)) return "- shared/settings.base.json missing";
-  if (!existsSync3(mapPath)) return "- path-map.json missing";
+  const basePath = join5(repoHome, "shared", "settings.base.json");
+  const mapPath = join5(repoHome, "path-map.json");
+  const hostPath = join5(repoHome, "hosts", `${host}.json`);
+  if (!existsSync4(basePath)) return "- shared/settings.base.json missing";
+  if (!existsSync4(mapPath)) return "- path-map.json missing";
   let mapEntryCount;
   try {
     const map = readJson(mapPath);
@@ -1119,7 +1184,7 @@ function reasonForPartial(repoHome, host) {
     mapEntryCount = 0;
   }
   if (mapEntryCount === 0) return "- path-map.json.projects has no entries";
-  if (!existsSync3(hostPath)) return `- hosts/${host}.json missing`;
+  if (!existsSync4(hostPath)) return `- hosts/${host}.json missing`;
   return "- partial state (unknown gap)";
 }
 
@@ -1131,11 +1196,11 @@ function reportHostAndPaths(section2) {
   addItem(section2, `${dim(infoGlyph)} host: ${cyan(HOST)}`);
   addItem(
     section2,
-    `${existsSync4(REPO_HOME) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(REPO_HOME)}`
+    `${existsSync5(REPO_HOME) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(REPO_HOME)}`
   );
   addItem(
     section2,
-    `${existsSync4(CLAUDE_HOME) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(CLAUDE_HOME)}`
+    `${existsSync5(CLAUDE_HOME) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(CLAUDE_HOME)}`
   );
 }
 function reportRepoState(section2) {
@@ -1157,12 +1222,12 @@ function reportRepoState(section2) {
   }
 }
 function repoHasSharedSource(name) {
-  return existsSync4(join4(REPO_HOME, "shared", name));
+  return existsSync5(join6(REPO_HOME, "shared", name));
 }
 function classifySharedLink(name, p) {
   let stat;
   try {
-    stat = lstatSync3(p);
+    stat = lstatSync4(p);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -1183,7 +1248,7 @@ function classifySharedLink(name, p) {
 }
 function classifySymlinkTarget(name, p) {
   try {
-    statSync2(p);
+    statSync3(p);
     return { line: `${green(okGlyph)} ${name}: symlink`, fail: false };
   } catch (err) {
     const code = err.code;
@@ -1204,7 +1269,7 @@ function classifySymlinkTarget(name, p) {
 }
 function reportSharedLinks(section2, map) {
   for (const name of allSharedLinks(map)) {
-    const p = join4(CLAUDE_HOME, name);
+    const p = join6(CLAUDE_HOME, name);
     const { line, fail: fail2 } = classifySharedLink(name, p);
     addItem(section2, line);
     if (fail2) process.exitCode = 1;
@@ -1214,11 +1279,11 @@ function reportSharedLinks(section2, map) {
 // src/commands.doctor.checks.settings.ts
 init_color();
 init_config();
-import { existsSync as existsSync5, readdirSync } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
+import { join as join7 } from "node:path";
 function loadBaseSettings(section2) {
-  const basePath = join5(REPO_HOME, "shared", "settings.base.json");
-  if (!existsSync5(basePath)) {
+  const basePath = join7(REPO_HOME, "shared", "settings.base.json");
+  if (!existsSync6(basePath)) {
     addItem(section2, `${red(failGlyph)} shared/settings.base.json missing at ${blue(basePath)}`);
     process.exitCode = 1;
     return null;
@@ -1226,8 +1291,8 @@ function loadBaseSettings(section2) {
   return readJsonSafe(basePath, basePath, section2);
 }
 function loadAndReportSettings(section2) {
-  const settingsPath = join5(CLAUDE_HOME, "settings.json");
-  if (!existsSync5(settingsPath)) return null;
+  const settingsPath = join7(CLAUDE_HOME, "settings.json");
+  if (!existsSync6(settingsPath)) return null;
   const settings = readJsonSafe(settingsPath, settingsPath, section2);
   if (settings === null) return null;
   const unknownKeys = Object.keys(settings).filter((k) => !KNOWN_SETTINGS_KEYS.has(k));
@@ -1242,13 +1307,13 @@ function loadAndReportSettings(section2) {
   return settings;
 }
 function reportHostOverrides(section2, base, settings) {
-  const hostFile = join5(REPO_HOME, "hosts", `${HOST}.json`);
+  const hostFile = join7(REPO_HOME, "hosts", `${HOST}.json`);
   let drift = [];
   if (base !== null && settings !== null) {
     const baseKeys = new Set(Object.keys(base));
     drift = Object.keys(settings).filter((k) => !baseKeys.has(k));
   }
-  if (existsSync5(hostFile)) {
+  if (existsSync6(hostFile)) {
     if (readJsonSafe(hostFile, hostFile, section2) !== null) {
       addItem(section2, `${green(okGlyph)} host overrides: ${blue(hostFile)}`);
     }
@@ -1257,9 +1322,9 @@ function reportHostOverrides(section2, base, settings) {
       section2,
       `${red(failGlyph)} no hosts/${HOST}.json AND settings.json has unbased keys ${JSON.stringify(drift)}`
     );
-    const hostsDir = join5(REPO_HOME, "hosts");
-    if (existsSync5(hostsDir)) {
-      const cands = readdirSync(hostsDir).filter((f) => f.endsWith(".json"));
+    const hostsDir = join7(REPO_HOME, "hosts");
+    if (existsSync6(hostsDir)) {
+      const cands = readdirSync2(hostsDir).filter((f) => f.endsWith(".json"));
       if (cands.length > 0) addItem(section2, `${dim(infoGlyph)} candidates: ${cands.join(", ")}`);
     }
     process.exitCode = 1;
@@ -1274,8 +1339,8 @@ function reportHostOverrides(section2, base, settings) {
 // src/commands.doctor.checks.pathmap.ts
 init_color();
 init_config();
-import { existsSync as existsSync6 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join8 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
@@ -1310,8 +1375,8 @@ function reportPathCollisions(section2, map) {
   else addItem(section2, `${green(okGlyph)} path-encoding: no collisions`);
 }
 function reportPathMap(section2) {
-  const mapPath = join6(REPO_HOME, "path-map.json");
-  if (!existsSync6(mapPath)) {
+  const mapPath = join8(REPO_HOME, "path-map.json");
+  if (!existsSync7(mapPath)) {
     addItem(section2, `${red(failGlyph)} path-map.json missing at ${blue(mapPath)}`);
     process.exitCode = 1;
     return;
@@ -1358,8 +1423,8 @@ function reportNeverSync(section2) {
 init_color();
 init_config();
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join10, relative as relative2 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join12, relative as relative2 } from "node:path";
 init_push_checks();
 init_utils();
 function reportGitleaksProbe(section2) {
@@ -1378,8 +1443,8 @@ function reportGitleaksProbe(section2) {
   }
 }
 function reportGitlinks(section2) {
-  const sharedDir = join10(REPO_HOME, "shared");
-  if (existsSync9(sharedDir)) {
+  const sharedDir = join12(REPO_HOME, "shared");
+  if (existsSync10(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
       const rel = relative2(REPO_HOME, p);
@@ -1419,11 +1484,57 @@ function reportRebaseClean(section2) {
   }
 }
 
+// src/commands.doctor.checks.backups.ts
+init_color();
+import { existsSync as existsSync11, lstatSync as lstatSync5, readdirSync as readdirSync4 } from "node:fs";
+import { join as join13 } from "node:path";
+init_config();
+var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
+function safeReaddir(dir) {
+  try {
+    return readdirSync4(dir);
+  } catch {
+    return [];
+  }
+}
+var DOCTOR_BACKUP_COUNT_WARN = 20;
+var DOCTOR_BACKUP_SIZE_WARN_MB = 200;
+var BYTES_PER_MB = 1024 * 1024;
+function dirSizeBytes(dir) {
+  let bytes = 0;
+  for (const entry of safeReaddir(dir)) {
+    const full = join13(dir, entry);
+    const st = lstatSync5(full, { throwIfNoEntry: false });
+    if (!st) continue;
+    if (st.isSymbolicLink()) continue;
+    if (st.isDirectory()) bytes += dirSizeBytes(full);
+    else bytes += st.size;
+  }
+  return bytes;
+}
+function totalSizeMb(backupBase, dirs) {
+  let bytes = 0;
+  for (const name of dirs) bytes += dirSizeBytes(join13(backupBase, name));
+  return bytes / BYTES_PER_MB;
+}
+function reportBackupsCheck(section2, backupBase = BACKUP_BASE) {
+  if (!existsSync11(backupBase)) return;
+  const dirs = safeReaddir(backupBase).filter((n) => TS_SHAPE2.test(n));
+  const count = dirs.length;
+  const sizeMb = totalSizeMb(backupBase, dirs);
+  if (count > DOCTOR_BACKUP_COUNT_WARN || sizeMb > DOCTOR_BACKUP_SIZE_WARN_MB) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} backups: ${count} dirs / ${sizeMb.toFixed(1)} MB (run 'nomad clean --backups')`
+    );
+  }
+}
+
 // src/commands.doctor.check-schema.ts
 init_color();
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join14 } from "node:path";
 init_config();
 function fetchSchemaKeys() {
   try {
@@ -1438,8 +1549,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join11(CLAUDE_HOME, "settings.json");
-  if (!existsSync10(settingsPath)) {
+  const settingsPath = join14(CLAUDE_HOME, "settings.json");
+  if (!existsSync12(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -1469,18 +1580,18 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync4, readdirSync as readdirSync4, rmSync as rmSync5 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readdirSync as readdirSync6, rmSync as rmSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join17 } from "node:path";
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
-import { join as join12 } from "node:path";
+import { join as join15 } from "node:path";
 init_config();
 init_push_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join12(CLAUDE_HOME, "projects", encoded, `${sid}.jsonl`);
+  return join15(CLAUDE_HOME, "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -1572,14 +1683,14 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { cpSync as cpSync3, existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync3 } from "node:fs";
-import { join as join13, relative as relative3, sep } from "node:path";
+import { cpSync as cpSync3, existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync5, rmSync as rmSync5, statSync as statSync4 } from "node:fs";
+import { join as join16, relative as relative3, sep } from "node:path";
 function copyDir(src, dst) {
-  rmSync4(dst, { recursive: true, force: true });
+  rmSync5(dst, { recursive: true, force: true });
   cpSync3(src, dst, { recursive: true, force: true });
 }
 function copyDirJsonlOnly(src, dst) {
-  rmSync4(dst, { recursive: true, force: true });
+  rmSync5(dst, { recursive: true, force: true });
   cpSync3(src, dst, {
     recursive: true,
     force: true,
@@ -1587,7 +1698,7 @@ function copyDirJsonlOnly(src, dst) {
       const rel = relative3(src, srcPath);
       if (rel === "") return true;
       if (rel.split(sep).length > 1) return true;
-      if (statSync3(srcPath).isDirectory()) return true;
+      if (statSync4(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       log(`skip ${rel}: extension not in allowlist`);
       return false;
@@ -1599,14 +1710,14 @@ function remapPull(ts, opts = {}) {
   let unmapped = 0;
   const pulled = [];
   const wouldPull = [];
-  const mapPath = join13(REPO_HOME, "path-map.json");
-  const repoProjects = join13(REPO_HOME, "shared", "projects");
-  if (!existsSync11(mapPath) || !existsSync11(repoProjects)) {
+  const mapPath = join16(REPO_HOME, "path-map.json");
+  const repoProjects = join16(REPO_HOME, "shared", "projects");
+  if (!existsSync13(mapPath) || !existsSync13(repoProjects)) {
     log("no path-map or repo projects dir; skipping session remap");
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readJson(mapPath);
-  const localProjects = join13(CLAUDE_HOME, "projects");
+  const localProjects = join16(CLAUDE_HOME, "projects");
   if (!dryRun) mkdirSync3(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -1615,9 +1726,9 @@ function remapPull(ts, opts = {}) {
       unmapped++;
       continue;
     }
-    const src = join13(repoProjects, logical);
-    if (!existsSync11(src)) continue;
-    const dst = join13(localProjects, encodePath(localPath));
+    const src = join16(repoProjects, logical);
+    if (!existsSync13(src)) continue;
+    const dst = join16(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       log(`would overwrite: ${dst} (from ${src})`);
@@ -1658,30 +1769,30 @@ function remapPush(ts, opts = {}) {
   let unmapped = 0;
   const pushed = [];
   const wouldPush = [];
-  const mapPath = join13(REPO_HOME, "path-map.json");
-  if (!existsSync11(mapPath)) {
+  const mapPath = join16(REPO_HOME, "path-map.json");
+  if (!existsSync13(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readJson(mapPath);
-  const localProjects = join13(CLAUDE_HOME, "projects");
-  const repoProjects = join13(REPO_HOME, "shared", "projects");
+  const localProjects = join16(CLAUDE_HOME, "projects");
+  const repoProjects = join16(REPO_HOME, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync11(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync13(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync3(repoProjects, { recursive: true });
-  for (const dir of readdirSync3(localProjects)) {
+  for (const dir of readdirSync5(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) {
       unmapped++;
       continue;
     }
-    const repoDst = join13(repoProjects, logical);
+    const repoDst = join16(repoProjects, logical);
     if (dryRun) {
       wouldPush.push(logical);
       continue;
     }
     backupRepoWrite(repoDst, ts, REPO_HOME);
-    copyDirJsonlOnly(join13(localProjects, dir), repoDst);
+    copyDirJsonlOnly(join16(localProjects, dir), repoDst);
     pushed.push(logical);
   }
   return { unmapped, collisions: 0, pushed, wouldPush };
@@ -1693,8 +1804,8 @@ init_utils_json();
 function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
-  const mapPath = join14(REPO_HOME, "path-map.json");
-  if (!existsSync12(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join17(REPO_HOME, "path-map.json");
+  if (!existsSync14(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -1711,12 +1822,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join14(CLAUDE_HOME, "projects");
-  if (!existsSync12(localProjects)) return { logicalToEncoded, staged, malformed: false };
-  for (const dir of readdirSync4(localProjects)) {
+  const localProjects = join17(CLAUDE_HOME, "projects");
+  if (!existsSync14(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  for (const dir of readdirSync6(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join14(localProjects, dir), join14(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join17(localProjects, dir), join17(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -1747,11 +1858,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
 }
 function reportCheckShared(section2, gitleaksReady) {
   if (!ensureGitleaksReady(section2, gitleaksReady)) return;
-  const cacheDir = join14(homedir4(), ".cache", "claude-nomad");
+  const cacheDir = join17(homedir4(), ".cache", "claude-nomad");
   mkdirSync4(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const reportPath = join14(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join14(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join17(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join17(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -1765,15 +1876,109 @@ function reportCheckShared(section2, gitleaksReady) {
     }
     scanAndReport(section2, tmpRoot, staged, logicalToEncoded);
   } finally {
-    rmSync5(reportPath, { force: true });
-    rmSync5(tmpRoot, { recursive: true, force: true });
+    rmSync6(reportPath, { force: true });
+    rmSync6(tmpRoot, { recursive: true, force: true });
+  }
+}
+
+// src/commands.doctor.checks.hooks.scope.ts
+init_color();
+import { existsSync as existsSync15, readFileSync as readFileSync4, readdirSync as readdirSync7, realpathSync } from "node:fs";
+import { dirname as dirname2, extname, join as join18 } from "node:path";
+init_config();
+function typeFromPackageJson(pkgPath) {
+  try {
+    const parsed = JSON.parse(readFileSync4(pkgPath, "utf8"));
+    return parsed.type === "module" ? "esm" : "cjs";
+  } catch {
+    return "cjs";
+  }
+}
+function effectiveType(hookPath) {
+  const ext = extname(hookPath);
+  if (ext === ".mjs") return "esm";
+  if (ext === ".cjs") return "cjs";
+  let real;
+  try {
+    real = realpathSync(hookPath);
+  } catch {
+    return null;
+  }
+  let dir = dirname2(real);
+  for (; ; ) {
+    const pkg = join18(dir, "package.json");
+    if (existsSync15(pkg)) return typeFromPackageJson(pkg);
+    const parent = dirname2(dir);
+    if (parent === dir) return "cjs";
+    dir = parent;
+  }
+}
+function stripCommentsAndStrings(src) {
+  return src.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g, (match) => {
+    const open = match[0];
+    if (open === "'") return "''";
+    if (open === '"') return '""';
+    if (open === "`") return "``";
+    return " ";
+  });
+}
+function classifySource(src) {
+  const code = stripCommentsAndStrings(src);
+  const cjs = /\brequire\s*\(/.test(code) || /\bmodule\.exports\b/.test(code) || /\bexports\.\w/.test(code);
+  const esm = /^[^\S\r\n]*import\s/m.test(code) || /^[^\S\r\n]*export\s/m.test(code) || /\bimport\.meta\b/.test(code);
+  if (cjs && !esm) return "cjs";
+  if (esm && !cjs) return "esm";
+  if (cjs && esm) return "cjs";
+  return "unknown";
+}
+function remedy(family) {
+  return family === "cjs" ? 'rename to .cjs, or add { "type": "commonjs" } to the hooks dir' : "rename to .mjs (a synced hooks/ dir treats .js as CommonJS)";
+}
+function safeReaddir2(dir) {
+  try {
+    return readdirSync7(dir);
+  } catch {
+    return [];
+  }
+}
+function safeRead(path) {
+  try {
+    return readFileSync4(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function reportHookScopeCheck(section2) {
+  const hooksDir = join18(CLAUDE_HOME, "hooks");
+  if (!existsSync15(hooksDir)) {
+    addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
+    return;
+  }
+  let anyWarn = false;
+  for (const name of safeReaddir2(hooksDir)) {
+    if (extname(name) !== ".js") continue;
+    const abs = join18(hooksDir, name);
+    const eff = effectiveType(abs);
+    if (eff === null) continue;
+    const src = safeRead(abs);
+    if (src === null) continue;
+    const fam = classifySource(src);
+    if (fam === "unknown" || fam === eff) continue;
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} hooks/${name}: ${fam} source loads as ${eff} (${remedy(fam)})`
+    );
+    anyWarn = true;
+  }
+  if (!anyWarn) {
+    addItem(section2, `${green(okGlyph)} hooks: module type consistent`);
   }
 }
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { join as join19 } from "node:path";
 init_config();
 function expandHome(token) {
   return token.replace(/^\$\{HOME\}/, HOME).replace(/^\$HOME/, HOME).replace(/^~/, HOME);
@@ -1811,7 +2016,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync13(resolved)) continue;
+        if (existsSync16(resolved)) continue;
         addItem(section2, `${red(failGlyph)} hooks/${event}: command target missing: ${resolved}`);
         process.exitCode = 1;
         anyFail = true;
@@ -1821,8 +2026,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join15(CLAUDE_HOME, "settings.json");
-  if (!existsSync13(settingsPath)) {
+  const settingsPath = join19(CLAUDE_HOME, "settings.json");
+  if (!existsSync16(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -1848,18 +2053,14 @@ init_config();
 
 // src/commands.doctor.engine.ts
 init_color();
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/commands.doctor.version.ts
 init_color();
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname2, join as join16 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-init_config();
-var CACHE_PATH = join16(HOME, ".cache", "claude-nomad", "version-check.json");
-var CACHE_TTL_MS = 60 * 60 * 1e3;
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
 var STRICT_SEMVER_PREFIX = /^(\d+\.\d+\.\d+)(?:[-+]|$)/;
 function compareSemver(a, b) {
@@ -1874,7 +2075,7 @@ function compareSemver(a, b) {
 function readLocalVersion() {
   try {
     const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync4(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync5(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
     }
@@ -1883,28 +2084,6 @@ function readLocalVersion() {
     return null;
   }
 }
-function loadCache() {
-  try {
-    if (!existsSync14(CACHE_PATH)) return null;
-    const parsed = JSON.parse(readFileSync4(CACHE_PATH, "utf8"));
-    if (typeof parsed.checked_at !== "number" || !Number.isFinite(parsed.checked_at)) {
-      return null;
-    }
-    if (typeof parsed.latest !== "string" || !STRICT_SEMVER.test(parsed.latest)) {
-      return null;
-    }
-    return { checked_at: parsed.checked_at, latest: parsed.latest };
-  } catch {
-    return null;
-  }
-}
-function saveCache(latest) {
-  try {
-    mkdirSync5(dirname2(CACHE_PATH), { recursive: true });
-    writeFileSync3(CACHE_PATH, JSON.stringify({ checked_at: Date.now(), latest }));
-  } catch {
-  }
-}
 function fetchLatestVersion() {
   try {
     const url = "https://registry.npmjs.org/claude-nomad/latest";
@@ -1924,16 +2103,8 @@ function reportVersionCheck(section2) {
   if (local === null) return;
   const localPure = STRICT_SEMVER_PREFIX.exec(local)?.[1] ?? null;
   if (localPure === null) return;
-  let latest = null;
-  const cached = loadCache();
-  if (cached !== null && Date.now() - cached.checked_at < CACHE_TTL_MS) {
-    latest = cached.latest;
-  }
-  if (latest === null) {
-    latest = fetchLatestVersion();
-    if (latest === null) return;
-    saveCache(latest);
-  }
+  const latest = fetchLatestVersion();
+  if (latest === null) return;
   const cmp = compareSemver(localPure, latest);
   if (cmp === 0) {
     addItem(section2, `${green(okGlyph)} claude-nomad: ${local} (latest)`);
@@ -1959,7 +2130,7 @@ function parseMinVersion(spec) {
 function readEnginesNode() {
   try {
     const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync5(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
     return null;
@@ -1988,8 +2159,8 @@ function reportNodeEngineCheck(section2) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync8 } from "node:child_process";
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join20 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -1998,7 +2169,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join17(REPO_HOME, ".gitleaks.toml");
+  const tomlPath = join20(REPO_HOME, ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -2010,7 +2181,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync8, tomlExists = existsSync15) {
+function reportGitleaksVersionCheck(section2, run = execFileSync8, tomlExists = existsSync17) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -2172,12 +2343,13 @@ function cmdDoctor(opts = {}) {
   reportHostAndPaths(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join18(REPO_HOME, "path-map.json");
-  const rawMap = existsSync16(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join21(REPO_HOME, "path-map.json");
+  const rawMap = existsSync18(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   const hooksScan = section("Hook targets");
   reportHooksTargetCheck(hooksScan);
+  reportHookScopeCheck(hooksScan);
   const settings = section("Settings");
   const base = loadBaseSettings(settings);
   const parsedSettings = loadAndReportSettings(settings);
@@ -2197,6 +2369,7 @@ function cmdDoctor(opts = {}) {
   reportNodeEngineCheck(version);
   reportGitleaksVersionCheck(version);
   reportOptionalDeps(version);
+  reportBackupsCheck(version);
   const sharedScan = section("Shared scan");
   if (opts.checkShared === true) reportCheckShared(sharedScan, gitleaksReady);
   const schemaScan = section("Schema scan");
@@ -2218,8 +2391,8 @@ function cmdDoctor(opts = {}) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync18, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
-import { join as join21, relative as relative4 } from "node:path";
+import { existsSync as existsSync20, readdirSync as readdirSync8, statSync as statSync5 } from "node:fs";
+import { join as join24, relative as relative4 } from "node:path";
 
 // src/commands.drop-session.git.ts
 init_config();
@@ -2262,8 +2435,8 @@ function isInIndex(rel) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join22 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript(id, matches);
@@ -2279,16 +2452,16 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript(id, matches) {
   try {
-    const mapPath = join19(REPO_HOME, "path-map.json");
-    if (!existsSync17(mapPath)) return null;
+    const mapPath = join22(REPO_HOME, "path-map.json");
+    if (!existsSync19(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     for (const rel of matches) {
       const logical = SHARED_PROJECT_LOGICAL.exec(rel)?.[1];
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join19(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync17(live)) return live;
+      const live = join22(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync19(live)) return live;
     }
     return null;
   } catch {
@@ -2302,15 +2475,15 @@ init_utils();
 // src/utils.lockfile.ts
 init_config();
 init_utils();
-import { closeSync as closeSync2, mkdirSync as mkdirSync6, openSync as openSync2, readFileSync as readFileSync6, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname3, join as join20 } from "node:path";
-var LOCK_PATH = join20(HOME, ".cache", "claude-nomad", "nomad.lock");
+import { closeSync as closeSync2, mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync7, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join23 } from "node:path";
+var LOCK_PATH = join23(HOME, ".cache", "claude-nomad", "nomad.lock");
 function acquireLock(verb) {
-  mkdirSync6(dirname3(LOCK_PATH), { recursive: true });
+  mkdirSync5(dirname3(LOCK_PATH), { recursive: true });
   try {
     const fd = openSync2(LOCK_PATH, "wx");
     try {
-      writeFileSync4(fd, String(process.pid));
+      writeFileSync3(fd, String(process.pid));
     } catch (writeErr) {
       try {
         closeSync2(fd);
@@ -2344,7 +2517,7 @@ function releaseLock(handle) {
 function unlinkIfSamePid(expectedPidStr) {
   let current;
   try {
-    current = readFileSync6(LOCK_PATH, "utf8").trim();
+    current = readFileSync7(LOCK_PATH, "utf8").trim();
   } catch {
     return false;
   }
@@ -2359,7 +2532,7 @@ function unlinkIfSamePid(expectedPidStr) {
 function checkStaleAndRetry(verb) {
   let pidStr;
   try {
-    pidStr = readFileSync6(LOCK_PATH, "utf8").trim();
+    pidStr = readFileSync7(LOCK_PATH, "utf8").trim();
   } catch {
     pidStr = "";
   }
@@ -2388,7 +2561,7 @@ function retryOnce(verb) {
   try {
     const fd = openSync2(LOCK_PATH, "wx");
     try {
-      writeFileSync4(fd, String(process.pid));
+      writeFileSync3(fd, String(process.pid));
     } catch {
       try {
         closeSync2(fd);
@@ -2414,12 +2587,12 @@ function cmdDropSession(id) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync18(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync20(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join21(REPO_HOME, "shared", "projects");
-    if (!existsSync18(repoProjects)) {
+    const repoProjects = join24(REPO_HOME, "shared", "projects");
+    if (!existsSync20(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id);
@@ -2440,13 +2613,13 @@ function cmdDropSession(id) {
 }
 function collectMatches(repoProjects, id) {
   const matches = [];
-  for (const logical of readdirSync5(repoProjects)) {
-    const candidate = join21(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync18(candidate)) {
+  for (const logical of readdirSync8(repoProjects)) {
+    const candidate = join24(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync20(candidate)) {
       matches.push(relative4(REPO_HOME, candidate));
     }
-    const dir = join21(repoProjects, logical, id);
-    if (existsSync18(dir) && statSync4(dir).isDirectory()) {
+    const dir = join24(repoProjects, logical, id);
+    if (existsSync20(dir) && statSync5(dir).isDirectory()) {
       const dirRel = relative4(REPO_HOME, dir);
       const staged = expandStagedDir(dirRel);
       if (staged.length > 0) matches.push(...staged);
@@ -2482,13 +2655,13 @@ function unstageOne(rel) {
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync19, readFileSync as readFileSync7, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync8, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // src/commands.redact.core.ts
 init_config();
 import { appendFileSync } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join25 } from "node:path";
 function collectMatchIntervals(content, findings) {
   const intervals = [];
   for (const f of findings) {
@@ -2538,7 +2711,7 @@ function isRecentlyModified(mtimeMs, nowMs, thresholdMs = 5 * 60 * 1e3) {
   return nowMs - mtimeMs < thresholdMs;
 }
 function appendGitleaksIgnore(fingerprint) {
-  appendFileSync(join22(REPO_HOME, ".gitleaksignore"), formatFingerprint(fingerprint), "utf8");
+  appendFileSync(join25(REPO_HOME, ".gitleaksignore"), formatFingerprint(fingerprint), "utf8");
 }
 
 // src/commands.redact.ts
@@ -2548,14 +2721,14 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript2(id) {
   try {
-    const mapPath = join23(REPO_HOME, "path-map.json");
-    if (!existsSync19(mapPath)) return null;
+    const mapPath = join26(REPO_HOME, "path-map.json");
+    if (!existsSync21(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join23(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync19(live)) return live;
+      const live = join26(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync21(live)) return live;
     }
     return null;
   } catch {
@@ -2573,17 +2746,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync19(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync21(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript2(id);
-    if (localPath === null || !existsSync19(localPath)) {
+    if (localPath === null || !existsSync21(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const mtimeMs = statSync5(localPath).mtimeMs;
+    const mtimeMs = statSync6(localPath).mtimeMs;
     if (isRecentlyModified(mtimeMs, nowMs())) {
       log(
         `session ${id} was modified recently and may be active.
@@ -2612,12 +2785,12 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
       );
       return;
     }
-    const backupBase = join23(HOME, ".cache", "claude-nomad", "backup");
+    const backupBase = join26(HOME, ".cache", "claude-nomad", "backup");
     const ts = freshBackupTs(backupBase);
     backupBeforeWrite(localPath, ts);
-    const original = readFileSync7(localPath, "utf8");
+    const original = readFileSync8(localPath, "utf8");
     const redacted = applyRedactions(original, findings);
-    writeFileSync5(localPath, redacted, "utf8");
+    writeFileSync4(localPath, redacted, "utf8");
     log(`redacted ${findings.length} finding(s) in ${localPath} (backup: ${ts})`);
   } catch (err) {
     if (!(err instanceof NomadFatal)) {
@@ -2631,8 +2804,8 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join32 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -2728,8 +2901,8 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync22 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { join as join29 } from "node:path";
 
 // src/extras-sync.diff.ts
 init_utils();
@@ -2756,8 +2929,8 @@ function listDivergingFiles(a, b) {
 
 // src/extras-sync.core.ts
 init_config();
-import { cpSync as cpSync4, existsSync as existsSync20, rmSync as rmSync6 } from "node:fs";
-import { join as join24 } from "node:path";
+import { cpSync as cpSync4, existsSync as existsSync22, rmSync as rmSync7 } from "node:fs";
+import { join as join27 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -2780,9 +2953,9 @@ function assertSafeLocalRoot(localRoot, logical) {
 init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
-  const mapPath = join24(REPO_HOME, "path-map.json");
-  const repoExtras = join24(REPO_HOME, "shared", "extras");
-  if (!existsSync20(mapPath) || opts.requireRepoExtras === true && !existsSync20(repoExtras)) {
+  const mapPath = join27(REPO_HOME, "path-map.json");
+  const repoExtras = join27(REPO_HOME, "shared", "extras");
+  if (!existsSync22(mapPath) || opts.requireRepoExtras === true && !existsSync22(repoExtras)) {
     if (opts.missingMsg !== void 0) log(opts.missingMsg);
     return null;
   }
@@ -2814,7 +2987,7 @@ function* eachExtrasTarget(v, counts) {
   }
 }
 function copyExtras(src, dst) {
-  rmSync6(dst, { recursive: true, force: true });
+  rmSync7(dst, { recursive: true, force: true });
   cpSync4(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
 }
 
@@ -2824,8 +2997,8 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync21, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join28 } from "node:path";
 init_utils_fs();
 function runExtrasOp(v, dryRun, paths, backup) {
   const counts = { unmapped: 0, skipped: 0 };
@@ -2833,7 +3006,7 @@ function runExtrasOp(v, dryRun, paths, backup) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync21(src)) continue;
+    if (!existsSync23(src)) continue;
     const item = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item);
@@ -2849,14 +3022,14 @@ function remapExtrasPush(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
-  const repoExtras = join25(REPO_HOME, "shared", "extras");
-  if (!dryRun) mkdirSync7(repoExtras, { recursive: true });
+  const repoExtras = join28(REPO_HOME, "shared", "extras");
+  if (!dryRun) mkdirSync6(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname4 }) => ({
-      src: join25(localRoot, dirname4),
-      dst: join25(repoExtras, logical, dirname4)
+      src: join28(localRoot, dirname4),
+      dst: join28(repoExtras, logical, dirname4)
     }),
     (dst) => backupRepoWrite(dst, ts, REPO_HOME)
   );
@@ -2869,13 +3042,13 @@ function remapExtrasPull(ts, opts = {}) {
     missingMsg: "no path-map or repo extras dir; skipping extras remap"
   });
   if (v === null) return { unmapped: 0, skipped: 0, pulled: [], wouldPull: [] };
-  const repoExtras = join25(REPO_HOME, "shared", "extras");
+  const repoExtras = join28(REPO_HOME, "shared", "extras");
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname4 }) => ({
-      src: join25(repoExtras, logical, dirname4),
-      dst: join25(localRoot, dirname4)
+      src: join28(repoExtras, logical, dirname4),
+      dst: join28(localRoot, dirname4)
     }),
     // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -2889,14 +3062,14 @@ function divergenceCheckExtras(ts) {
   const v = loadValidatedExtras({});
   if (v === null) return;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join26(HOME, ".cache", "claude-nomad", "backup", ts, "extras");
+  const backupRoot = join29(HOME, ".cache", "claude-nomad", "backup", ts, "extras");
   for (const { logical, localRoot, dirname: dirname4 } of eachExtrasTarget(v, counts)) {
-    const local = join26(localRoot, dirname4);
-    const repo = join26(REPO_HOME, "shared", "extras", logical, dirname4);
-    if (!existsSync22(local) || !existsSync22(repo)) continue;
+    const local = join29(localRoot, dirname4);
+    const repo = join29(REPO_HOME, "shared", "extras", logical, dirname4);
+    if (!existsSync24(local) || !existsSync24(repo)) continue;
     const diff = listDivergingFiles(local, repo);
     if (diff.length === 0) continue;
-    const projectBackupRoot = join26(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join29(backupRoot, encodePath(localRoot));
     warn(
       `local ${dirname4} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will overwrite them (backups at ${projectBackupRoot}/)`
     );
@@ -2909,47 +3082,47 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { existsSync as existsSync23, lstatSync as lstatSync4, rmSync as rmSync7 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync25, lstatSync as lstatSync6, rmSync as rmSync8 } from "node:fs";
+import { join as join30 } from "node:path";
 function applySharedLinks(ts, map, opts = {}) {
   const dryRun = opts.dryRun === true;
   const linkNames = allSharedLinks(map);
   for (const name of linkNames) {
-    const linkPath = join27(CLAUDE_HOME, name);
-    const target = join27(REPO_HOME, "shared", name);
-    if (!existsSync23(linkPath)) continue;
-    if (lstatSync4(linkPath).isSymbolicLink()) continue;
-    if (!existsSync23(target)) continue;
+    const linkPath = join30(CLAUDE_HOME, name);
+    const target = join30(REPO_HOME, "shared", name);
+    if (!existsSync25(linkPath)) continue;
+    if (lstatSync6(linkPath).isSymbolicLink()) continue;
+    if (!existsSync25(target)) continue;
     if (dryRun) {
       log(`would auto-move non-symlink: ${linkPath} -> backup/${ts}/${name}`);
       continue;
     }
     backupBeforeWrite(linkPath, ts);
-    rmSync7(linkPath, { recursive: true, force: true });
+    rmSync8(linkPath, { recursive: true, force: true });
   }
   for (const name of linkNames) {
-    const target = join27(REPO_HOME, "shared", name);
-    if (!existsSync23(target)) continue;
+    const target = join30(REPO_HOME, "shared", name);
+    if (!existsSync25(target)) continue;
     if (dryRun) {
-      log(`would create symlink: ${join27(CLAUDE_HOME, name)} -> ${target}`);
+      log(`would create symlink: ${join30(CLAUDE_HOME, name)} -> ${target}`);
       continue;
     }
-    ensureSymlink(join27(CLAUDE_HOME, name), target);
+    ensureSymlink(join30(CLAUDE_HOME, name), target);
   }
 }
 function regenerateSettings(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
-  const basePath = join27(REPO_HOME, "shared", "settings.base.json");
-  const hostPath = join27(REPO_HOME, "hosts", `${HOST}.json`);
-  if (!existsSync23(basePath)) {
+  const basePath = join30(REPO_HOME, "shared", "settings.base.json");
+  const hostPath = join30(REPO_HOME, "hosts", `${HOST}.json`);
+  if (!existsSync25(basePath)) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const base = readJson(basePath);
-  const hasOverrides = existsSync23(hostPath);
+  const hasOverrides = existsSync25(hostPath);
   const overrides = hasOverrides ? readJson(hostPath) : {};
   const merged = deepMerge(base, overrides);
-  const settingsPath = join27(CLAUDE_HOME, "settings.json");
-  if (!hasOverrides && existsSync23(settingsPath)) {
+  const settingsPath = join30(CLAUDE_HOME, "settings.json");
+  if (!hasOverrides && existsSync25(settingsPath)) {
     try {
       const existing = readJson(settingsPath);
       const baseKeys = new Set(Object.keys(base));
@@ -2975,8 +3148,8 @@ function regenerateSettings(ts, opts = {}) {
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync24 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync26 } from "node:fs";
+import { join as join31 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -3262,7 +3435,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync24(path)) return null;
+  if (!existsSync26(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -3276,12 +3449,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
     return;
   }
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync24(hostPath)) {
+  if (hostOverrides === null && existsSync26(hostPath)) {
     log(`settings.json: malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = deepMerge(base, hostOverrides ?? {});
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync24(settingsPath)) {
+  if (current === null && existsSync26(settingsPath)) {
     log("settings.json: malformed; skipping diff");
     return;
   }
@@ -3300,9 +3473,9 @@ function computePreview(ts, map) {
   log(`would pull on host=${HOST} (dry-run; no mutation)`);
   applySharedLinks(ts, map, { dryRun: true });
   previewSettings(
-    join28(REPO_HOME, "shared", "settings.base.json"),
-    join28(REPO_HOME, "hosts", `${HOST}.json`),
-    join28(CLAUDE_HOME, "settings.json")
+    join31(REPO_HOME, "shared", "settings.base.json"),
+    join31(REPO_HOME, "hosts", `${HOST}.json`),
+    join31(CLAUDE_HOME, "settings.json")
   );
   const remapResult = remapPull(ts, { dryRun: true });
   return { unmapped: remapResult.unmapped, collisions: 0 };
@@ -3331,19 +3504,18 @@ function applyWetPull(ts, map) {
 }
 function cmdPull(opts = {}) {
   const dryRun = opts.dryRun === true;
-  if (!existsSync25(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
-  if (!existsSync25(join29(REPO_HOME, "shared", "settings.base.json"))) {
+  if (!existsSync27(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync27(join32(REPO_HOME, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
   if (handle === null) process.exit(0);
   try {
-    const backupBase = join29(HOME, ".cache", "claude-nomad", "backup");
-    const ts = freshBackupTs(backupBase);
+    const ts = freshBackupTs(BACKUP_BASE);
     if (!dryRun) {
-      const backupRoot = join29(backupBase, ts);
+      const backupRoot = join32(BACKUP_BASE, ts);
       try {
-        mkdirSync8(backupRoot, { recursive: true });
+        mkdirSync7(backupRoot, { recursive: true });
       } catch (err) {
         die(`could not create backup dir: ${err.message}`);
       }
@@ -3352,8 +3524,8 @@ function cmdPull(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
     gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", REPO_HOME);
-    const mapPath = join29(REPO_HOME, "path-map.json");
-    const map = existsSync25(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join32(REPO_HOME, "path-map.json");
+    const map = existsSync27(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     if (dryRun) {
       const previewResult = computePreview(ts, map);
@@ -3376,8 +3548,8 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync27 } from "node:fs";
-import { join as join33, relative as relative5 } from "node:path";
+import { existsSync as existsSync29 } from "node:fs";
+import { join as join36, relative as relative5 } from "node:path";
 
 // src/commands.push.allowlist.ts
 init_config();
@@ -3454,8 +3626,8 @@ import { createInterface } from "node:readline/promises";
 
 // src/commands.push.recovery.redact.ts
 init_config();
-import { cpSync as cpSync5, readFileSync as readFileSync8, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join30, sep as sep2 } from "node:path";
+import { cpSync as cpSync5, readFileSync as readFileSync9, statSync as statSync7, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join33, sep as sep2 } from "node:path";
 init_push_gitleaks_scan();
 init_utils_fs();
 init_utils_json();
@@ -3499,7 +3671,7 @@ function applyRedact(f, allFindings, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  if (isRecentlyModified(statSync6(localPath).mtimeMs, nowMs())) {
+  if (isRecentlyModified(statSync7(localPath).mtimeMs, nowMs())) {
     return refuse(
       `session ${sid} looks active (modified within the last 5 minutes); refusing to redact, no changes made.
   End the session and choose Redact again, or choose Drop session (holds this session back from the push, local copy kept) or Skip.`
@@ -3515,13 +3687,13 @@ function applyRedact(f, allFindings, ts, map, nowMs, scan = scanFile) {
     );
   }
   backupBeforeWrite(localPath, ts);
-  writeFileSync6(localPath, applyRedactions(readFileSync8(localPath, "utf8"), realFindings), "utf8");
+  writeFileSync5(localPath, applyRedactions(readFileSync9(localPath, "utf8"), realFindings), "utf8");
   let copied = false;
   for (const [logical, hostMap] of Object.entries(map.projects)) {
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join30(CLAUDE_HOME, "projects", encodePath(abs)) + sep2)) {
-      cpSync5(localPath, join30(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`), {
+    if (localPath.startsWith(join33(CLAUDE_HOME, "projects", encodePath(abs)) + sep2)) {
+      cpSync5(localPath, join33(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`), {
         force: true
       });
       copied = true;
@@ -3538,16 +3710,16 @@ function applyRedact(f, allFindings, ts, map, nowMs, scan = scanFile) {
 
 // src/commands.push.recovery.drop.ts
 init_config();
-import { rmSync as rmSync8 } from "node:fs";
-import { join as join31 } from "node:path";
+import { rmSync as rmSync9 } from "node:fs";
+import { join as join34 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   for (const logical of logicals) {
-    const jsonl = join31(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join31(REPO_HOME, "shared", "projects", logical, sid);
-    rmSync8(jsonl, { force: true });
-    rmSync8(dir, { recursive: true, force: true });
+    const jsonl = join34(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join34(REPO_HOME, "shared", "projects", logical, sid);
+    rmSync9(jsonl, { force: true });
+    rmSync9(dir, { recursive: true, force: true });
   }
   return true;
 }
@@ -3702,9 +3874,9 @@ init_push_checks();
 init_color();
 init_config();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync9, readdirSync as readdirSync6, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync8, readdirSync as readdirSync9, rmSync as rmSync10 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join35 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -3719,13 +3891,13 @@ function stageSessions(tmpRoot, map) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join32(CLAUDE_HOME, "projects");
-  if (!existsSync26(localProjects)) return 0;
+  const localProjects = join35(CLAUDE_HOME, "projects");
+  if (!existsSync28(localProjects)) return 0;
   let staged = 0;
-  for (const dir of readdirSync6(localProjects)) {
+  for (const dir of readdirSync9(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join32(localProjects, dir), join32(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join35(localProjects, dir), join35(tmpRoot, "shared", "projects", logical));
     staged++;
   }
   return staged;
@@ -3741,9 +3913,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname4 of dirnames) {
       if (!whitelist.includes(dirname4)) continue;
-      const src = join32(localRoot, dirname4);
-      if (!existsSync26(src)) continue;
-      const dst = join32(tmpRoot, "shared", "extras", logical, dirname4);
+      const src = join35(localRoot, dirname4);
+      if (!existsSync28(src)) continue;
+      const dst = join35(tmpRoot, "shared", "extras", logical, dirname4);
       copyExtras(src, dst);
       staged++;
     }
@@ -3751,10 +3923,10 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map) {
-  const cacheDir = join32(homedir5(), ".cache", "claude-nomad");
-  mkdirSync9(cacheDir, { recursive: true });
+  const cacheDir = join35(homedir5(), ".cache", "claude-nomad");
+  mkdirSync8(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join32(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join35(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map);
     const extrasCount = stageExtras(tmpRoot, map);
@@ -3772,7 +3944,7 @@ function previewPushLeaks(map) {
     }
     return verdictFromFindings(findings);
   } finally {
-    rmSync9(tmpRoot, { recursive: true, force: true });
+    rmSync10(tmpRoot, { recursive: true, force: true });
   }
 }
 
@@ -3781,7 +3953,7 @@ init_utils();
 init_utils_fs();
 init_utils_json();
 function guardGitlinks() {
-  const gitlinks = findGitlinks(join33(REPO_HOME, "shared"));
+  const gitlinks = findGitlinks(join36(REPO_HOME, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative5(REPO_HOME, p);
@@ -3815,15 +3987,14 @@ function runDryRunPreview(st, map) {
 async function cmdPush(opts = {}) {
   const dryRun = opts.dryRun === true;
   const redactAll = opts.redactAll === true;
-  if (!existsSync27(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync29(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
     console.log(dryRun ? `push on host=${HOST} (dry-run)` : `push on host=${HOST}`);
     probeGitleaks();
     rebaseBeforePush();
-    const backupBase = join33(HOME, ".cache", "claude-nomad", "backup");
-    const ts = freshBackupTs(backupBase);
+    const ts = freshBackupTs(BACKUP_BASE);
     const remap = remapPush(ts, { dryRun });
     const extras = remapExtrasPush(ts, { dryRun });
     const st = { dryRun, remap, extras };
@@ -3834,8 +4005,8 @@ async function cmdPush(opts = {}) {
       renderNoScanTree(st);
       return;
     }
-    const mapPath = join33(REPO_HOME, "path-map.json");
-    if (!existsSync27(mapPath)) {
+    const mapPath = join36(REPO_HOME, "path-map.json");
+    if (!existsSync29(mapPath)) {
       if (dryRun) return runDryRunPreview(st, null);
       die("path-map.json missing, cannot enforce push allow-list");
     }
@@ -3875,18 +4046,17 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync28 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+import { join as join37 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
-    if (!existsSync28(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
-    const backupBase = join34(HOME, ".cache", "claude-nomad", "backup");
-    const ts = freshBackupTs(backupBase);
-    const mapPath = join34(REPO_HOME, "path-map.json");
-    const map = existsSync28(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    if (!existsSync30(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+    const ts = freshBackupTs(BACKUP_BASE);
+    const mapPath = join37(REPO_HOME, "path-map.json");
+    const map = existsSync30(mapPath) ? readPathMap(mapPath) : { projects: {} };
     const result = computePreview(ts, map);
     emitSummary("diff", result.unmapped);
   } catch (err) {
@@ -3901,8 +4071,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync30, mkdirSync as mkdirSync10, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join39 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -3983,31 +4153,31 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync, cpSync as cpSync6, existsSync as existsSync29, rmSync as rmSync10, statSync as statSync7 } from "node:fs";
-import { join as join35 } from "node:path";
+import { copyFileSync, cpSync as cpSync6, existsSync as existsSync31, rmSync as rmSync11, statSync as statSync8 } from "node:fs";
+import { join as join38 } from "node:path";
 function snapshotIntoShared(map) {
   for (const name of allSharedLinks(map)) {
-    const src = join35(CLAUDE_HOME, name);
-    if (!existsSync29(src)) continue;
-    const dst = join35(REPO_HOME, "shared", name);
-    if (statSync7(src).isDirectory()) {
-      const gk = join35(dst, ".gitkeep");
-      if (existsSync29(gk)) rmSync10(gk);
+    const src = join38(CLAUDE_HOME, name);
+    if (!existsSync31(src)) continue;
+    const dst = join38(REPO_HOME, "shared", name);
+    if (statSync8(src).isDirectory()) {
+      const gk = join38(dst, ".gitkeep");
+      if (existsSync31(gk)) rmSync11(gk);
       cpSync6(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join35(CLAUDE_HOME, "settings.json");
-  if (existsSync29(userSettings)) {
+  const userSettings = join38(CLAUDE_HOME, "settings.json");
+  if (existsSync31(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join35(REPO_HOME, "hosts", `${HOST}.json`);
+    const hostFile = join38(REPO_HOME, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -4020,45 +4190,45 @@ var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.cl
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome) {
   const candidates = [
-    join36(repoHome, "shared", "settings.base.json"),
-    join36(repoHome, "shared", "CLAUDE.md"),
-    join36(repoHome, "path-map.json"),
-    join36(repoHome, "hosts"),
-    join36(repoHome, "shared")
+    join39(repoHome, "shared", "settings.base.json"),
+    join39(repoHome, "shared", "CLAUDE.md"),
+    join39(repoHome, "path-map.json"),
+    join39(repoHome, "hosts"),
+    join39(repoHome, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync30(c)) return c;
+    if (existsSync32(c)) return c;
   }
   return null;
 }
 function cmdInit(opts = {}) {
   const snapshot = opts.snapshot === true;
   const keepActions = opts.keepActions === true;
-  mkdirSync10(REPO_HOME, { recursive: true });
+  mkdirSync9(REPO_HOME, { recursive: true });
   const conflict = preflightConflict(REPO_HOME);
   if (conflict !== null) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync10(join36(REPO_HOME, "shared"), { recursive: true });
-  mkdirSync10(join36(REPO_HOME, "hosts"), { recursive: true });
+  mkdirSync9(join39(REPO_HOME, "shared"), { recursive: true });
+  mkdirSync9(join39(REPO_HOME, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync10(join36(REPO_HOME, "shared", name), { recursive: true });
+    mkdirSync9(join39(REPO_HOME, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join36(CLAUDE_HOME, "CLAUDE.md");
-  if (!snapshot || !existsSync30(userClaudeMd)) {
-    writeFileSync7(join36(REPO_HOME, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join39(CLAUDE_HOME, "CLAUDE.md");
+  if (!snapshot || !existsSync32(userClaudeMd)) {
+    writeFileSync6(join39(REPO_HOME, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     log("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync7(join36(REPO_HOME, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join39(REPO_HOME, "shared", name, ".gitkeep"), "");
     log(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync7(join36(REPO_HOME, "hosts", ".gitkeep"), "");
+  writeFileSync6(join39(REPO_HOME, "hosts", ".gitkeep"), "");
   log("created hosts/.gitkeep");
-  writeJsonAtomic(join36(REPO_HOME, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join39(REPO_HOME, "shared", "settings.base.json"), {});
   log("created shared/settings.base.json");
-  writeJsonAtomic(join36(REPO_HOME, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join39(REPO_HOME, "path-map.json"), { projects: {} });
   log("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -4210,10 +4380,63 @@ function parseRedactArgs(argv) {
   return { id, rule, dryRun };
 }
 
+// src/nomad.dispatch.clean.ts
+var REJECT = { ok: false, advance: 0 };
+function applyOlderThan(argv, i, st) {
+  if (st.olderThan !== void 0) return REJECT;
+  const val = extractFlagValue(argv, i);
+  if (val === null) return REJECT;
+  st.olderThan = val;
+  return { ok: true, advance: 2 };
+}
+function applyKeep(argv, i, st) {
+  if (st.keep !== void 0) return REJECT;
+  const val = extractFlagValue(argv, i);
+  if (val === null || !/^\d+$/.test(val)) return REJECT;
+  st.keep = Number(val);
+  return { ok: true, advance: 2 };
+}
+function applyBool(seen, set) {
+  if (seen) return REJECT;
+  set();
+  return { ok: true, advance: 1 };
+}
+function applyCleanToken(argv, i, st) {
+  switch (argv[i]) {
+    case "--backups":
+      return applyBool(st.backups, () => st.backups = true);
+    case "--dry-run":
+      return applyBool(st.dryRun, () => st.dryRun = true);
+    case "--older-than":
+      return applyOlderThan(argv, i, st);
+    case "--keep":
+      return applyKeep(argv, i, st);
+    default:
+      return REJECT;
+  }
+}
+function parseCleanArgs(argv) {
+  const st = {
+    backups: false,
+    dryRun: false,
+    olderThan: void 0,
+    keep: void 0
+  };
+  let i = 3;
+  while (i < argv.length) {
+    const { ok: ok2, advance } = applyCleanToken(argv, i, st);
+    if (!ok2) return null;
+    i += advance;
+  }
+  if (!st.backups) return null;
+  if (st.olderThan !== void 0 && st.keep !== void 0) return null;
+  return { dryRun: st.dryRun, olderThan: st.olderThan, keep: st.keep };
+}
+
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.34.1",
+  version: "0.35.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -4363,6 +4586,14 @@ var DEFAULT_HELP = [
   "",
   row("  update", "Update the claude-nomad CLI to the latest npm release."),
   "",
+  row("  clean", "Prune old backup snapshots under ~/.cache/claude-nomad/backup/."),
+  row("       --backups", "Required: confirm backup pruning is the intended target."),
+  row("       --dry-run", "List the snapshots that would be removed without deleting."),
+  row("       --older-than <dur>", "Delete snapshots older than a duration (e.g. 14d, 24h, 30m)."),
+  cont("Default when no retention flag is given: 14d."),
+  row("       --keep <N>", "Keep the N most-recent snapshots, delete the rest. Mutually"),
+  cont("exclusive with --older-than."),
+  "",
   row("  --version", "Print the installed CLI version as bare semver to stdout; exits 0."),
   "",
   "Run `nomad doctor` to validate your setup. Edit shared/ or hosts/<HOST>.json",
@@ -4374,15 +4605,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync31, readFileSync as readFileSync9, readdirSync as readdirSync7 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync33, readFileSync as readFileSync10, readdirSync as readdirSync10 } from "node:fs";
+import { join as join40 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join37(CLAUDE_HOME, "projects");
-  if (!existsSync31(projectsRoot)) {
+  const projectsRoot = join40(CLAUDE_HOME, "projects");
+  if (!existsSync33(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -4396,8 +4627,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join37(REPO_HOME, "path-map.json");
-  if (!existsSync31(mapPath)) {
+  const mapPath = join40(REPO_HOME, "path-map.json");
+  if (!existsSync33(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -4419,14 +4650,14 @@ function resumeCmd(sessionId) {
   console.log(`cd ${shQuote(hit.localPath)} && claude --resume ${shQuote(sessionId)}`);
 }
 function findTranscriptPath(projectsRoot, sessionId) {
-  for (const dir of readdirSync7(projectsRoot)) {
-    const candidate = join37(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync31(candidate)) return candidate;
+  for (const dir of readdirSync10(projectsRoot)) {
+    const candidate = join40(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync33(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync9(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync10(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);
@@ -4590,6 +4821,15 @@ try {
       cmdRedact(redactArgs);
       break;
     }
+    case "clean": {
+      const cleanArgs = parseCleanArgs(process.argv);
+      if (cleanArgs === null) {
+        console.error("usage: nomad clean --backups [--dry-run] [--older-than <dur> | --keep <N>]");
+        process.exit(1);
+      }
+      cmdClean(cleanArgs);
+      break;
+    }
     default:
       console.error(DEFAULT_HELP);
       process.exit(1);