claude-nomad 0.40.0 → 0.42.0

package/dist/nomad.mjs

@@ -170,13 +170,12 @@ function gitOrFatal(args, context, cwd) {
     throw new NomadFatal(`${context} failed`);
   }
 }
-var log, ok, warn, fail, NomadFatal, die, gitStatusPorcelainZ;
+var log, warn, fail, NomadFatal, die, gitStatusPorcelainZ;
 var init_utils = __esm({
   "src/utils.ts"() {
     "use strict";
     init_color();
     log = (msg) => console.log(`${dim(infoGlyph)} ${msg}`);
-    ok = (msg) => console.log(`${green(okGlyph)} ${msg}`);
     warn = (msg) => {
       console.error(`${yellow(warnGlyph)} ${msg}`);
     };
@@ -450,6 +449,17 @@ function deepMerge(target, source) {
   }
   return out;
 }
+function sortKeysDeep(value) {
+  if (Array.isArray(value)) return value.map(sortKeysDeep);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const key of Object.keys(value).sort((a, b) => a.localeCompare(b, "en"))) {
+      out[key] = sortKeysDeep(value[key]);
+    }
+    return out;
+  }
+  return value;
+}
 var encodePath;
 var init_utils_json = __esm({
   "src/utils.json.ts"() {
@@ -551,31 +561,31 @@ var init_utils_fs = __esm({
 });
 
 // src/push-gitleaks.config.ts
-import { existsSync as existsSync9, mkdtempSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync10, mkdtempSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveTomlPath() {
-  const repoToml = join10(REPO_HOME, ".gitleaks.toml");
-  if (existsSync9(repoToml)) return repoToml;
+  const repoToml = join11(REPO_HOME, ".gitleaks.toml");
+  if (existsSync10(repoToml)) return repoToml;
   const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync9(bundled) ? bundled : null;
+  return existsSync10(bundled) ? bundled : null;
 }
 function buildOverlayTempConfig(overlayBody, bundled) {
   const tempBody = `[extend]
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join10(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join10(tempPath, "config.toml");
+  const tempPath = mkdtempSync(join11(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join11(tempPath, "config.toml");
   writeFileSync2(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
-  const overlayPath = join10(REPO_HOME, ".gitleaks.overlay.toml");
-  const repoToml = join10(REPO_HOME, ".gitleaks.toml");
+  const overlayPath = join11(REPO_HOME, ".gitleaks.overlay.toml");
+  const repoToml = join11(REPO_HOME, ".gitleaks.toml");
   const bundled = resolveTomlPath();
-  if (!existsSync9(overlayPath)) {
+  if (!existsSync10(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -618,7 +628,7 @@ var init_push_gitleaks_config = __esm({
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { readdirSync as readdirSync3, rmSync as rmSync3 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -661,7 +671,7 @@ function findGitlinks(dir) {
       return;
     }
     for (const e of entries) {
-      const p = join11(current, e.name);
+      const p = join12(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
@@ -713,7 +723,7 @@ var init_push_checks = __esm({
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync4 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 function readGitleaksReport(reportPath) {
   try {
     const raw = readFileSync4(reportPath, "utf8");
@@ -725,9 +735,9 @@ function readGitleaksReport(reportPath) {
   }
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join15(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join16(homedir3(), ".cache", "claude-nomad");
   mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join15(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join16(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -759,9 +769,9 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   }
 }
 function scanFile(filePath, forwardStreams = false) {
-  const cacheDir = join15(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join16(homedir3(), ".cache", "claude-nomad");
   mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join15(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join16(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "detect",
@@ -1210,8 +1220,8 @@ function cmdClean(opts, backupBase = BACKUP_BASE) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join23 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
@@ -1225,8 +1235,8 @@ init_color();
 // src/output-tree.ts
 init_color();
 var FAIL_GLYPH_BARE = "\u2717";
-function section(header) {
-  return { header, items: [] };
+function section(header, raw = false) {
+  return { header, items: [], raw };
 }
 function addItem(s, text) {
   s.items.push(text);
@@ -1234,7 +1244,17 @@ function addItem(s, text) {
 function sectionFailed(s) {
   return s.items.some((line) => line.includes(failGlyph));
 }
+function renderRawItems(items) {
+  for (const item of items) {
+    console.log(item === "" ? "" : `  ${item}`);
+  }
+}
 function renderSection(s) {
+  if (s.raw) {
+    console.log(s.header);
+    renderRawItems(s.items);
+    return;
+  }
   const header = sectionFailed(s) ? `${red(FAIL_GLYPH_BARE)} ${s.header}` : s.header;
   console.log(header);
   const lastContent = s.items.reduce((acc, item, j) => item === "" ? acc : j, -1);
@@ -1542,8 +1562,20 @@ function reportNeverSync(section2) {
 init_color();
 init_config();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join12, relative as relative2 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join13, relative as relative2 } from "node:path";
+
+// src/commands.pull.wedge.ts
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join10 } from "node:path";
+function detectWedge(repo) {
+  const g = join10(repo, ".git");
+  if (existsSync9(join10(g, "rebase-merge")) || existsSync9(join10(g, "rebase-apply"))) return "rebase";
+  if (existsSync9(join10(g, "MERGE_HEAD"))) return "merge";
+  return null;
+}
+
+// src/commands.doctor.checks.repository.ts
 init_push_checks();
 init_utils();
 function reportGitleaksProbe(section2) {
@@ -1562,8 +1594,8 @@ function reportGitleaksProbe(section2) {
   }
 }
 function reportGitlinks(section2) {
-  const sharedDir = join12(REPO_HOME, "shared");
-  if (existsSync10(sharedDir)) {
+  const sharedDir = join13(REPO_HOME, "shared");
+  if (existsSync11(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
       const rel = relative2(REPO_HOME, p);
@@ -1602,11 +1634,25 @@ function reportRebaseClean(section2) {
   } catch {
   }
 }
+function reportRebaseState(section2) {
+  try {
+    const wedge = detectWedge(REPO_HOME);
+    if (wedge !== null) {
+      const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
+      addItem(
+        section2,
+        `${red(failGlyph)} repo is ${state}: run 'nomad pull --force-remote' to auto-recover`
+      );
+      process.exitCode = 1;
+    }
+  } catch {
+  }
+}
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync11, lstatSync as lstatSync5, readdirSync as readdirSync4 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync12, lstatSync as lstatSync5, readdirSync as readdirSync4 } from "node:fs";
+import { join as join14 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
 function safeReaddir(dir) {
@@ -1622,7 +1668,7 @@ var BYTES_PER_MB = 1024 * 1024;
 function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
-    const full = join13(dir, entry);
+    const full = join14(dir, entry);
     const st = lstatSync5(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
@@ -1633,11 +1679,11 @@ function dirSizeBytes(dir) {
 }
 function totalSizeMb(backupBase, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join13(backupBase, name));
+  for (const name of dirs) bytes += dirSizeBytes(join14(backupBase, name));
   return bytes / BYTES_PER_MB;
 }
 function reportBackupsCheck(section2, backupBase = BACKUP_BASE) {
-  if (!existsSync11(backupBase)) return;
+  if (!existsSync12(backupBase)) return;
   const dirs = safeReaddir(backupBase).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
   const sizeMb = totalSizeMb(backupBase, dirs);
@@ -1651,8 +1697,8 @@ function reportBackupsCheck(section2, backupBase = BACKUP_BASE) {
 
 // src/commands.doctor.check-schema.ts
 init_color();
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join15 } from "node:path";
 init_config();
 
 // src/http-fetch.ts
@@ -1689,8 +1735,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join14(CLAUDE_HOME, "settings.json");
-  if (!existsSync12(settingsPath)) {
+  const settingsPath = join15(CLAUDE_HOME, "settings.json");
+  if (!existsSync13(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -1720,18 +1766,18 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, readdirSync as readdirSync6, rmSync as rmSync6 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readdirSync as readdirSync6, rmSync as rmSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 init_config();
 init_push_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join16(CLAUDE_HOME, "projects", encoded, `${sid}.jsonl`);
+  return join17(CLAUDE_HOME, "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -1823,8 +1869,8 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { cpSync as cpSync3, existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync5, rmSync as rmSync5, statSync as statSync4 } from "node:fs";
-import { join as join17, relative as relative3, sep } from "node:path";
+import { cpSync as cpSync3, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync5, rmSync as rmSync5, statSync as statSync4 } from "node:fs";
+import { join as join18, relative as relative3, sep } from "node:path";
 function copyDir(src, dst) {
   rmSync5(dst, { recursive: true, force: true });
   cpSync3(src, dst, { recursive: true, force: true });
@@ -1845,19 +1891,24 @@ function copyDirJsonlOnly(src, dst) {
     }
   });
 }
+function emitPreview(onPreview, event, fallback) {
+  if (onPreview) onPreview(event);
+  else log(fallback);
+}
 function remapPull(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
   let unmapped = 0;
   const pulled = [];
   const wouldPull = [];
-  const mapPath = join17(REPO_HOME, "path-map.json");
-  const repoProjects = join17(REPO_HOME, "shared", "projects");
-  if (!existsSync13(mapPath) || !existsSync13(repoProjects)) {
-    log("no path-map or repo projects dir; skipping session remap");
+  const mapPath = join18(REPO_HOME, "path-map.json");
+  const repoProjects = join18(REPO_HOME, "shared", "projects");
+  if (!existsSync14(mapPath) || !existsSync14(repoProjects)) {
+    const text = "no path-map or repo projects dir; skipping session remap";
+    emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readJson(mapPath);
-  const localProjects = join17(CLAUDE_HOME, "projects");
+  const localProjects = join18(CLAUDE_HOME, "projects");
   if (!dryRun) mkdirSync3(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -1866,12 +1917,16 @@ function remapPull(ts, opts = {}) {
       unmapped++;
       continue;
     }
-    const src = join17(repoProjects, logical);
-    if (!existsSync13(src)) continue;
-    const dst = join17(localProjects, encodePath(localPath));
+    const src = join18(repoProjects, logical);
+    if (!existsSync14(src)) continue;
+    const dst = join18(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
-      log(`would overwrite: ${dst} (from ${src})`);
+      emitPreview(
+        opts.onPreview,
+        { kind: "overwrite", dst, src },
+        `would overwrite: ${dst} (from ${src})`
+      );
       continue;
     }
     backupBeforeWrite(dst, ts);
@@ -1909,16 +1964,16 @@ function remapPush(ts, opts = {}) {
   let unmapped = 0;
   const pushed = [];
   const wouldPush = [];
-  const mapPath = join17(REPO_HOME, "path-map.json");
-  if (!existsSync13(mapPath)) {
+  const mapPath = join18(REPO_HOME, "path-map.json");
+  if (!existsSync14(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readJson(mapPath);
-  const localProjects = join17(CLAUDE_HOME, "projects");
-  const repoProjects = join17(REPO_HOME, "shared", "projects");
+  const localProjects = join18(CLAUDE_HOME, "projects");
+  const repoProjects = join18(REPO_HOME, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync13(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync14(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync3(repoProjects, { recursive: true });
   for (const dir of readdirSync5(localProjects)) {
     const logical = reverse.get(dir);
@@ -1926,13 +1981,13 @@ function remapPush(ts, opts = {}) {
       unmapped++;
       continue;
     }
-    const repoDst = join17(repoProjects, logical);
+    const repoDst = join18(repoProjects, logical);
     if (dryRun) {
       wouldPush.push(logical);
       continue;
     }
     backupRepoWrite(repoDst, ts, REPO_HOME);
-    copyDirJsonlOnly(join17(localProjects, dir), repoDst);
+    copyDirJsonlOnly(join18(localProjects, dir), repoDst);
     pushed.push(logical);
   }
   return { unmapped, collisions: 0, pushed, wouldPush };
@@ -1944,8 +1999,8 @@ init_utils_json();
 function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
-  const mapPath = join18(REPO_HOME, "path-map.json");
-  if (!existsSync14(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join19(REPO_HOME, "path-map.json");
+  if (!existsSync15(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -1962,12 +2017,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join18(CLAUDE_HOME, "projects");
-  if (!existsSync14(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  const localProjects = join19(CLAUDE_HOME, "projects");
+  if (!existsSync15(localProjects)) return { logicalToEncoded, staged, malformed: false };
   for (const dir of readdirSync6(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join18(localProjects, dir), join18(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join19(localProjects, dir), join19(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -1998,11 +2053,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
 }
 function reportCheckShared(section2, gitleaksReady) {
   if (!ensureGitleaksReady(section2, gitleaksReady)) return;
-  const cacheDir = join18(homedir4(), ".cache", "claude-nomad");
+  const cacheDir = join19(homedir4(), ".cache", "claude-nomad");
   mkdirSync4(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const reportPath = join18(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join18(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join19(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join19(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -2023,8 +2078,8 @@ function reportCheckShared(section2, gitleaksReady) {
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync15, readFileSync as readFileSync5, readdirSync as readdirSync7, realpathSync } from "node:fs";
-import { dirname as dirname2, extname, join as join19 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync5, readdirSync as readdirSync7, realpathSync } from "node:fs";
+import { dirname as dirname2, extname, join as join20 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
@@ -2046,8 +2101,8 @@ function effectiveType(hookPath) {
   }
   let dir = dirname2(real);
   for (; ; ) {
-    const pkg = join19(dir, "package.json");
-    if (existsSync15(pkg)) return typeFromPackageJson(pkg);
+    const pkg = join20(dir, "package.json");
+    if (existsSync16(pkg)) return typeFromPackageJson(pkg);
     const parent = dirname2(dir);
     if (parent === dir) return "cjs";
     dir = parent;
@@ -2089,15 +2144,15 @@ function safeRead(path) {
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join19(CLAUDE_HOME, "hooks");
-  if (!existsSync15(hooksDir)) {
+  const hooksDir = join20(CLAUDE_HOME, "hooks");
+  if (!existsSync16(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join19(hooksDir, name);
+    const abs = join20(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -2117,8 +2172,8 @@ function reportHookScopeCheck(section2) {
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync16 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join21 } from "node:path";
 init_config();
 function expandHome(token) {
   return token.replace(/^\$\{HOME\}/, HOME).replace(/^\$HOME/, HOME).replace(/^~/, HOME);
@@ -2156,7 +2211,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync16(resolved)) continue;
+        if (existsSync17(resolved)) continue;
         addItem(section2, `${red(failGlyph)} hooks/${event}: command target missing: ${resolved}`);
         process.exitCode = 1;
         anyFail = true;
@@ -2166,8 +2221,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join20(CLAUDE_HOME, "settings.json");
-  if (!existsSync16(settingsPath)) {
+  const settingsPath = join21(CLAUDE_HOME, "settings.json");
+  if (!existsSync17(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -2297,8 +2352,8 @@ function reportNodeEngineCheck(section2) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join22 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -2307,7 +2362,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join21(REPO_HOME, ".gitleaks.toml");
+  const tomlPath = join22(REPO_HOME, ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -2319,7 +2374,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync17) {
+function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync18) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -2492,8 +2547,8 @@ function cmdDoctor(opts = {}) {
   reportHostAndPaths(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join22(REPO_HOME, "path-map.json");
-  const rawMap = existsSync18(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join23(REPO_HOME, "path-map.json");
+  const rawMap = existsSync19(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   const hooksScan = section("Hook targets");
@@ -2512,6 +2567,7 @@ function cmdDoctor(opts = {}) {
   reportGitlinks(repository);
   reportRemote(repository);
   reportRebaseClean(repository);
+  reportRebaseState(repository);
   reportActionsDrift(repository);
   const nomadVersion = section("Nomad Version");
   reportVersionCheck(nomadVersion);
@@ -2542,8 +2598,8 @@ function cmdDoctor(opts = {}) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { existsSync as existsSync20, readdirSync as readdirSync8, statSync as statSync5 } from "node:fs";
-import { join as join25, relative as relative4 } from "node:path";
+import { existsSync as existsSync21, readdirSync as readdirSync8, statSync as statSync5 } from "node:fs";
+import { join as join26, relative as relative4 } from "node:path";
 
 // src/commands.drop-session.git.ts
 init_config();
@@ -2586,8 +2642,8 @@ function isInIndex(rel) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync19 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { join as join24 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript(id, matches);
@@ -2603,16 +2659,16 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript(id, matches) {
   try {
-    const mapPath = join23(REPO_HOME, "path-map.json");
-    if (!existsSync19(mapPath)) return null;
+    const mapPath = join24(REPO_HOME, "path-map.json");
+    if (!existsSync20(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     for (const rel of matches) {
       const logical = SHARED_PROJECT_LOGICAL.exec(rel)?.[1];
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join23(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync19(live)) return live;
+      const live = join24(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync20(live)) return live;
     }
     return null;
   } catch {
@@ -2627,8 +2683,8 @@ init_utils();
 init_config();
 init_utils();
 import { closeSync as closeSync2, mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join24 } from "node:path";
-var LOCK_PATH = join24(HOME, ".cache", "claude-nomad", "nomad.lock");
+import { dirname as dirname3, join as join25 } from "node:path";
+var LOCK_PATH = join25(HOME, ".cache", "claude-nomad", "nomad.lock");
 function acquireLock(verb) {
   mkdirSync5(dirname3(LOCK_PATH), { recursive: true });
   try {
@@ -2738,12 +2794,12 @@ function cmdDropSession(id) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync20(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync21(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join25(REPO_HOME, "shared", "projects");
-    if (!existsSync20(repoProjects)) {
+    const repoProjects = join26(REPO_HOME, "shared", "projects");
+    if (!existsSync21(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id);
@@ -2765,12 +2821,12 @@ function cmdDropSession(id) {
 function collectMatches(repoProjects, id) {
   const matches = [];
   for (const logical of readdirSync8(repoProjects)) {
-    const candidate = join25(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync20(candidate)) {
+    const candidate = join26(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync21(candidate)) {
       matches.push(relative4(REPO_HOME, candidate));
     }
-    const dir = join25(repoProjects, logical, id);
-    if (existsSync20(dir) && statSync5(dir).isDirectory()) {
+    const dir = join26(repoProjects, logical, id);
+    if (existsSync21(dir) && statSync5(dir).isDirectory()) {
       const dirRel = relative4(REPO_HOME, dir);
       const staged = expandStagedDir(dirRel);
       if (staged.length > 0) matches.push(...staged);
@@ -2806,19 +2862,19 @@ function unstageOne(rel) {
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync22, statSync as statSync7 } from "node:fs";
-import { dirname as dirname4, join as join27 } from "node:path";
+import { existsSync as existsSync23, statSync as statSync7 } from "node:fs";
+import { dirname as dirname4, join as join28 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync21, lstatSync as lstatSync6, readFileSync as readFileSync9, readdirSync as readdirSync9, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync22, lstatSync as lstatSync6, readFileSync as readFileSync9, readdirSync as readdirSync9, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join27 } from "node:path";
 init_utils_fs();
 function collectFiles(dir, out) {
-  if (!existsSync21(dir)) return;
+  if (!existsSync22(dir)) return;
   const st = lstatSync6(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync9(dir)) {
-    const abs = join26(dir, entry);
+    const abs = join27(dir, entry);
     const lst = lstatSync6(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
@@ -2868,14 +2924,14 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript2(id) {
   try {
-    const mapPath = join27(REPO_HOME, "path-map.json");
-    if (!existsSync22(mapPath)) return null;
+    const mapPath = join28(REPO_HOME, "path-map.json");
+    if (!existsSync23(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join27(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync22(live)) return live;
+      const live = join28(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync23(live)) return live;
     }
     return null;
   } catch {
@@ -2893,17 +2949,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync22(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync23(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript2(id);
-    if (localPath === null || !existsSync22(localPath)) {
+    if (localPath === null || !existsSync23(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join27(dirname4(localPath), id);
+    const sessionDir = join28(dirname4(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -2956,8 +3012,8 @@ ${lines}`);
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync8 } from "node:fs";
+import { join as join37 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -2986,14 +3042,6 @@ function summaryRow(verb, unmapped, collisions = 0, extrasSkipped = 0) {
   const { text, clean } = summaryText(verb, unmapped, collisions, extrasSkipped);
   return clean ? `${green(okGlyph)} ${text}` : `${yellow(warnGlyph)} ${text}`;
 }
-function emitSummary(verb, unmapped, collisions = 0, extrasSkipped = 0) {
-  const { text, clean } = summaryText(verb, unmapped, collisions, extrasSkipped);
-  if (clean) {
-    ok(text);
-    return;
-  }
-  warn(text);
-}
 
 // src/commands.push.sections.ts
 function collapsedSkipRow(n, noun) {
@@ -3053,22 +3101,34 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync25 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync26 } from "node:fs";
+import { join as join31 } from "node:path";
 
 // src/extras-sync.diff.ts
 init_utils();
 import { execFileSync as execFileSync13 } from "node:child_process";
+function labelDiffLine(line) {
+  const tab = line.indexOf("	");
+  if (tab === -1) return line;
+  const status = line.slice(0, tab);
+  const path = line.slice(tab + 1);
+  if (status === "D") return `${path} (local only)`;
+  if (status === "A") return `${path} (repo only)`;
+  return path;
+}
+function parseDiffOutput(stdout) {
+  return stdout.split("\n").filter((line) => line.length > 0).map(labelDiffLine);
+}
 function listDivergingFiles(a, b) {
   try {
-    const stdout = execFileSync13("git", ["diff", "--no-index", "--name-only", a, b], {
+    const stdout = execFileSync13("git", ["diff", "--no-index", "--name-status", a, b], {
       stdio: ["ignore", "pipe", "pipe"]
     }).toString();
-    return stdout.split("\n").filter((line) => line.length > 0);
+    return parseDiffOutput(stdout);
   } catch (err) {
     const e = err;
     if (e.status === 1 && e.stdout !== void 0) {
-      return e.stdout.toString().split("\n").filter((line) => line.length > 0);
+      return parseDiffOutput(e.stdout.toString());
     }
     if (e.code === "ENOENT") {
       warn(`git not on PATH; divergence check skipped for ${a}`);
@@ -3081,8 +3141,8 @@ function listDivergingFiles(a, b) {
 
 // src/extras-sync.core.ts
 init_config();
-import { cpSync as cpSync4, existsSync as existsSync23, rmSync as rmSync7 } from "node:fs";
-import { join as join28 } from "node:path";
+import { cpSync as cpSync4, existsSync as existsSync24, rmSync as rmSync7 } from "node:fs";
+import { join as join29 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -3105,9 +3165,9 @@ function assertSafeLocalRoot(localRoot, logical) {
 init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
-  const mapPath = join28(REPO_HOME, "path-map.json");
-  const repoExtras = join28(REPO_HOME, "shared", "extras");
-  if (!existsSync23(mapPath) || opts.requireRepoExtras === true && !existsSync23(repoExtras)) {
+  const mapPath = join29(REPO_HOME, "path-map.json");
+  const repoExtras = join29(REPO_HOME, "shared", "extras");
+  if (!existsSync24(mapPath) || opts.requireRepoExtras === true && !existsSync24(repoExtras)) {
     if (opts.missingMsg !== void 0) log(opts.missingMsg);
     return null;
   }
@@ -3149,8 +3209,8 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync24, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join30 } from "node:path";
 init_utils_fs();
 function runExtrasOp(v, dryRun, paths, backup) {
   const counts = { unmapped: 0, skipped: 0 };
@@ -3158,7 +3218,7 @@ function runExtrasOp(v, dryRun, paths, backup) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync24(src)) continue;
+    if (!existsSync25(src)) continue;
     const item = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item);
@@ -3174,14 +3234,14 @@ function remapExtrasPush(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
-  const repoExtras = join29(REPO_HOME, "shared", "extras");
+  const repoExtras = join30(REPO_HOME, "shared", "extras");
   if (!dryRun) mkdirSync6(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname6 }) => ({
-      src: join29(localRoot, dirname6),
-      dst: join29(repoExtras, logical, dirname6)
+      src: join30(localRoot, dirname6),
+      dst: join30(repoExtras, logical, dirname6)
     }),
     (dst) => backupRepoWrite(dst, ts, REPO_HOME)
   );
@@ -3194,13 +3254,13 @@ function remapExtrasPull(ts, opts = {}) {
     missingMsg: "no path-map or repo extras dir; skipping extras remap"
   });
   if (v === null) return { unmapped: 0, skipped: 0, pulled: [], wouldPull: [] };
-  const repoExtras = join29(REPO_HOME, "shared", "extras");
+  const repoExtras = join30(REPO_HOME, "shared", "extras");
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname6 }) => ({
-      src: join29(repoExtras, logical, dirname6),
-      dst: join29(localRoot, dirname6)
+      src: join30(repoExtras, logical, dirname6),
+      dst: join30(localRoot, dirname6)
     }),
     // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -3214,14 +3274,14 @@ function divergenceCheckExtras(ts) {
   const v = loadValidatedExtras({});
   if (v === null) return;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join30(BACKUP_BASE, ts, "extras");
+  const backupRoot = join31(BACKUP_BASE, ts, "extras");
   for (const { logical, localRoot, dirname: dirname6 } of eachExtrasTarget(v, counts)) {
-    const local = join30(localRoot, dirname6);
-    const repo = join30(REPO_HOME, "shared", "extras", logical, dirname6);
-    if (!existsSync25(local) || !existsSync25(repo)) continue;
+    const local = join31(localRoot, dirname6);
+    const repo = join31(REPO_HOME, "shared", "extras", logical, dirname6);
+    if (!existsSync26(local) || !existsSync26(repo)) continue;
     const diff = listDivergingFiles(local, repo);
     if (diff.length === 0) continue;
-    const projectBackupRoot = join30(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join31(backupRoot, encodePath(localRoot));
     warn(
       `local ${dirname6} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will overwrite them (backups at ${projectBackupRoot}/)`
     );
@@ -3234,47 +3294,61 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { existsSync as existsSync26, lstatSync as lstatSync7, rmSync as rmSync8 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync27, lstatSync as lstatSync7, rmSync as rmSync8 } from "node:fs";
+import { join as join32 } from "node:path";
+function emitAutoMove(onPreview, linkPath, ts, name) {
+  if (onPreview) {
+    onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
+  } else {
+    log(`would auto-move non-symlink: ${linkPath} -> backup/${ts}/${name}`);
+  }
+}
+function emitCreate(onPreview, from, to) {
+  if (onPreview) {
+    onPreview({ kind: "create", from, to });
+  } else {
+    log(`would create symlink: ${from} -> ${to}`);
+  }
+}
 function applySharedLinks(ts, map, opts = {}) {
   const dryRun = opts.dryRun === true;
   const linkNames = allSharedLinks(map);
   for (const name of linkNames) {
-    const linkPath = join31(CLAUDE_HOME, name);
-    const target = join31(REPO_HOME, "shared", name);
-    if (!existsSync26(linkPath)) continue;
+    const linkPath = join32(CLAUDE_HOME, name);
+    const target = join32(REPO_HOME, "shared", name);
+    if (!existsSync27(linkPath)) continue;
     if (lstatSync7(linkPath).isSymbolicLink()) continue;
-    if (!existsSync26(target)) continue;
+    if (!existsSync27(target)) continue;
     if (dryRun) {
-      log(`would auto-move non-symlink: ${linkPath} -> backup/${ts}/${name}`);
+      emitAutoMove(opts.onPreview, linkPath, ts, name);
       continue;
     }
     backupBeforeWrite(linkPath, ts);
     rmSync8(linkPath, { recursive: true, force: true });
   }
   for (const name of linkNames) {
-    const target = join31(REPO_HOME, "shared", name);
-    if (!existsSync26(target)) continue;
+    const target = join32(REPO_HOME, "shared", name);
+    if (!existsSync27(target)) continue;
     if (dryRun) {
-      log(`would create symlink: ${join31(CLAUDE_HOME, name)} -> ${target}`);
+      emitCreate(opts.onPreview, join32(CLAUDE_HOME, name), target);
       continue;
     }
-    ensureSymlink(join31(CLAUDE_HOME, name), target);
+    ensureSymlink(join32(CLAUDE_HOME, name), target);
   }
 }
 function regenerateSettings(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
-  const basePath = join31(REPO_HOME, "shared", "settings.base.json");
-  const hostPath = join31(REPO_HOME, "hosts", `${HOST}.json`);
-  if (!existsSync26(basePath)) {
+  const basePath = join32(REPO_HOME, "shared", "settings.base.json");
+  const hostPath = join32(REPO_HOME, "hosts", `${HOST}.json`);
+  if (!existsSync27(basePath)) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const base = readJson(basePath);
-  const hasOverrides = existsSync26(hostPath);
+  const hasOverrides = existsSync27(hostPath);
   const overrides = hasOverrides ? readJson(hostPath) : {};
   const merged = deepMerge(base, overrides);
-  const settingsPath = join31(CLAUDE_HOME, "settings.json");
-  if (!hasOverrides && existsSync26(settingsPath)) {
+  const settingsPath = join32(CLAUDE_HOME, "settings.json");
+  if (!hasOverrides && existsSync27(settingsPath)) {
     try {
       const existing = readJson(settingsPath);
       const baseKeys = new Set(Object.keys(base));
@@ -3300,8 +3374,8 @@ function regenerateSettings(ts, opts = {}) {
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync27 } from "node:fs";
-import { join as join32 } from "node:path";
+import { existsSync as existsSync28 } from "node:fs";
+import { join as join33 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -3575,8 +3649,8 @@ function diffLinesToUnified(oldStr, newStr) {
 }
 
 // src/preview.ts
-init_utils();
 init_utils_json();
+var CANONICAL_ORDER_NOTE = "settings.json will be rewritten in canonical key order; no value changes";
 function diffJsonStrings(currentJsonText, newJsonText) {
   if (currentJsonText === newJsonText) return "";
   const lines = [
@@ -3587,7 +3661,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync27(path)) return null;
+  if (!existsSync28(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -3597,59 +3671,86 @@ function readJsonOrNull(path) {
 function previewSettings(basePath, hostPath, settingsPath) {
   const base = readJsonOrNull(basePath);
   if (base === null) {
-    log("settings.json: section skipped (base or current missing)");
-    return;
+    return { diff: "", notes: ["section skipped (base or current missing)"] };
   }
+  const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync27(hostPath)) {
-    log(`settings.json: malformed hosts/${HOST}.json; ignoring overrides`);
+  if (hostOverrides === null && existsSync28(hostPath)) {
+    notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = deepMerge(base, hostOverrides ?? {});
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync27(settingsPath)) {
-    log("settings.json: malformed; skipping diff");
-    return;
+  if (current === null && existsSync28(settingsPath)) {
+    return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
+  const rawEqual = JSON.stringify(current ?? {}, null, 2) === JSON.stringify(merged, null, 2);
   const diff = diffJsonStrings(
-    JSON.stringify(current ?? {}, null, 2),
-    JSON.stringify(merged, null, 2)
+    JSON.stringify(sortKeysDeep(current ?? {}), null, 2),
+    JSON.stringify(sortKeysDeep(merged), null, 2)
   );
-  if (diff === "") {
-    log("settings.json: no changes");
-  } else {
-    log("settings.json:");
-    for (const line of diff.split("\n")) log(line);
+  if (diff === "" && !rawEqual) notes.push(CANONICAL_ORDER_NOTE);
+  return { diff, notes };
+}
+function formatLinkRow(e) {
+  return `${e.kind}  ${e.from} -> ${e.to}`;
+}
+function formatSessionRow(e) {
+  return e.kind === "overwrite" ? `overwrite  ${e.dst} (from ${e.src})` : e.text;
+}
+function buildSettingsSectionForPreview(result) {
+  const s = section("settings.json", true);
+  if (result.diff !== "") {
+    for (const line of result.diff.split("\n")) {
+      addItem(s, line);
+    }
   }
+  for (const note of result.notes) {
+    addItem(s, `note: ${note}`);
+  }
+  return s;
 }
-function computePreview(ts, map) {
-  log(`would pull on host=${HOST} (dry-run; no mutation)`);
-  applySharedLinks(ts, map, { dryRun: true });
-  previewSettings(
-    join32(REPO_HOME, "shared", "settings.base.json"),
-    join32(REPO_HOME, "hosts", `${HOST}.json`),
-    join32(CLAUDE_HOME, "settings.json")
+function computePreview(ts, map, verb = "pull") {
+  console.log(`would pull on host=${HOST} (dry-run; no mutation)`);
+  console.log("");
+  const links = section("Symlinks");
+  applySharedLinks(ts, map, {
+    dryRun: true,
+    onPreview: (e) => addItem(links, formatLinkRow(e))
+  });
+  const settingsResult = previewSettings(
+    join33(REPO_HOME, "shared", "settings.base.json"),
+    join33(REPO_HOME, "hosts", `${HOST}.json`),
+    join33(CLAUDE_HOME, "settings.json")
   );
-  const remapResult = remapPull(ts, { dryRun: true });
+  const settingsSection = buildSettingsSectionForPreview(settingsResult);
+  const sessions = section("Sessions");
+  const remapResult = remapPull(ts, {
+    dryRun: true,
+    onPreview: (e) => addItem(sessions, formatSessionRow(e))
+  });
+  const summary = section("Summary");
+  addItem(summary, summaryRow(verb, remapResult.unmapped));
+  renderTree([links, settingsSection, sessions, summary]);
   return { unmapped: remapResult.unmapped, collisions: 0 };
 }
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync29 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
 import { readFileSync as readFileSync10, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync5, existsSync as existsSync28, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
-import { dirname as dirname5, join as join33, sep as sep2 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync29, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
+import { dirname as dirname5, join as join34, sep as sep2 } from "node:path";
 init_push_gitleaks_scan();
 init_utils_json();
 init_utils();
@@ -3680,8 +3781,8 @@ function resolveStagedDir(localPath, map) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join33(CLAUDE_HOME, "projects", encodePath(abs)) + sep2)) {
-      return join33(REPO_HOME, "shared", "projects", logical);
+    if (localPath.startsWith(join34(CLAUDE_HOME, "projects", encodePath(abs)) + sep2)) {
+      return join34(REPO_HOME, "shared", "projects", logical);
     }
   }
   return null;
@@ -3703,7 +3804,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join33(dirname5(localPath), sid);
+  const sessionDir = join34(dirname5(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -3737,9 +3838,9 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync7(stagedProjectDir, { recursive: true });
-  cpSync5(localPath, join33(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync28(sessionDir)) {
-    cpSync5(sessionDir, join33(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync5(localPath, join34(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync29(sessionDir)) {
+    cpSync5(sessionDir, join34(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
@@ -3747,13 +3848,13 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
 // src/commands.push.recovery.drop.ts
 init_config();
 import { rmSync as rmSync9 } from "node:fs";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   for (const logical of logicals) {
-    const jsonl = join34(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join34(REPO_HOME, "shared", "projects", logical, sid);
+    const jsonl = join35(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join35(REPO_HOME, "shared", "projects", logical, sid);
     rmSync9(jsonl, { force: true });
     rmSync9(dir, { recursive: true, force: true });
   }
@@ -3871,7 +3972,7 @@ function applyThenRescan(scanVerdict, repoHome) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome) {
-  const ignPath = join35(repoHome, ".gitleaksignore");
+  const ignPath = join36(repoHome, ".gitleaksignore");
   let before;
   try {
     before = readFileSync10(ignPath, "utf8");
@@ -3969,7 +4070,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync29;
+  const check = deps.existsSyncFn ?? existsSync30;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -4009,10 +4110,10 @@ function startSpinner(label, deps = {}) {
     const elapsed = now() - startMs;
     if (animate && !degraded && worker !== null) {
       worker.postMessage({ type: "pause" });
-      if (success) writeAnimatedDone(out, dl, elapsed, ttyCheck());
-      else out.write("\r\x1B[K");
       worker.terminate();
       worker = null;
+      if (success) writeAnimatedDone(out, dl, elapsed, ttyCheck());
+      else out.write("\r\x1B[K");
     } else if (success) {
       writePlainDone(out, dl, elapsed);
     }
@@ -4022,6 +4123,122 @@ function startSpinner(label, deps = {}) {
     stop: () => finalize(false)
   };
 }
+function withSpinner(label, fn, deps) {
+  const sp = startSpinner(label, deps);
+  try {
+    const result = fn();
+    sp.succeed();
+    return result;
+  } finally {
+    sp.stop();
+  }
+}
+
+// src/commands.pull.recovery.ts
+init_config();
+import { execFileSync as execFileSync14 } from "node:child_process";
+init_utils();
+init_utils_fs();
+function gitCapture(args, cwd) {
+  return execFileSync14("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
+}
+function isSyncedConfig(path) {
+  return PUSH_ALLOWED_STATIC.some(
+    (entry) => entry.endsWith("/") ? path.startsWith(entry) : path === entry
+  );
+}
+function classifyTouched(touched) {
+  const synced = [];
+  const toolSource = [];
+  for (const p of touched) {
+    if (isSyncedConfig(p)) {
+      synced.push(p);
+    } else {
+      toolSource.push(p);
+    }
+  }
+  return { synced, toolSource };
+}
+function parsePorcelainZ(raw) {
+  const tracked = [];
+  const untracked = [];
+  if (!raw) return { tracked, untracked };
+  const records = raw.split("\0");
+  for (let i = 0; i < records.length; i++) {
+    const record = records[i];
+    if (record.length < 3) continue;
+    const xy = record.slice(0, 2);
+    const filePath = record.slice(3);
+    if (xy === "??") {
+      untracked.push(filePath);
+      continue;
+    }
+    tracked.push(filePath);
+    if (xy.startsWith("R") || xy.startsWith("C")) {
+      const src = records[i + 1];
+      if (src) {
+        tracked.push(src);
+        i++;
+      }
+    }
+  }
+  return { tracked, untracked };
+}
+function parseDirtyPaths(repo) {
+  return parsePorcelainZ(gitStatusPorcelainZ(repo));
+}
+function buildRecoverySummary(branchName, strandedLog, untracked) {
+  const strandedLines = strandedLog.split("\n").filter(Boolean).map((l) => `  ${l}`).join("\n");
+  const parts = [`parked stranded commits on ${branchName}`];
+  if (strandedLines) parts.push(`stranded:
+${strandedLines}`);
+  if (untracked.length > 0) parts.push(`untracked files preserved: ${untracked.join(", ")}`);
+  parts.push("continuing with normal pull");
+  return parts.join("; ");
+}
+function freshStrandedBranch(repo) {
+  const base = `nomad/stranded-${nowTimestamp()}`;
+  const exists = (name) => {
+    try {
+      gitCapture(["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], repo);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  if (!exists(base)) return base;
+  let n = 1;
+  while (exists(`${base}-${n}`)) n++;
+  return `${base}-${n}`;
+}
+function recoverForceRemote(mode, repo) {
+  if (mode === "merge") {
+    gitOrFatal(["merge", "--abort"], "git merge --abort", repo);
+  } else {
+    gitOrFatal(["rebase", "--abort"], "git rebase --abort", repo);
+  }
+  gitOrFatal(["fetch", "origin", "main"], "git fetch origin main", repo);
+  try {
+    gitCapture(["rev-parse", "--verify", "origin/main"], repo);
+  } catch {
+    die("origin/main not found after fetch; check your remote configuration");
+  }
+  const committedRaw = gitCapture(["diff", "--name-only", "-z", "origin/main", "HEAD"], repo);
+  const committedTouched = committedRaw.split("\0").filter(Boolean);
+  const { tracked: dirtyTracked, untracked } = parseDirtyPaths(repo);
+  const allTouched = [...committedTouched, ...dirtyTracked];
+  const { synced } = classifyTouched(allTouched);
+  if (synced.length > 0) {
+    die(
+      "force-remote refused: stranded or dirty tracked changes touch synced config.\nAt-risk paths:\n" + synced.map((p) => `  ${p}`).join("\n") + "\nCopy or cherry-pick those changes out before retrying."
+    );
+  }
+  const branchName = freshStrandedBranch(repo);
+  gitOrFatal(["branch", branchName, "HEAD"], "park stranded commits", repo);
+  gitOrFatal(["reset", "--hard", "origin/main"], "reset to origin/main", repo);
+  const strandedLog = gitCapture(["log", "--oneline", `origin/main..${branchName}`], repo);
+  log(buildRecoverySummary(branchName, strandedLog, untracked));
+}
 
 // src/commands.pull.ts
 init_utils();
@@ -4030,14 +4247,7 @@ init_utils_json();
 function applyWetPull(ts, map) {
   applySharedLinks(ts, map);
   const { label } = regenerateSettings(ts);
-  const syncSp = startSpinner("Syncing sessions");
-  let remapResult;
-  try {
-    remapResult = remapPull(ts);
-    syncSp.succeed();
-  } finally {
-    syncSp.stop();
-  }
+  const remapResult = withSpinner("Syncing sessions", () => remapPull(ts));
   const extrasResult = remapExtrasPull(ts);
   const summary = section("Summary");
   addItem(
@@ -4051,18 +4261,32 @@ function applyWetPull(ts, map) {
     summary
   ]);
 }
+function handleWedge(repo, forceRemote) {
+  const wedge = detectWedge(repo);
+  if (wedge === null) return;
+  if (forceRemote) {
+    recoverForceRemote(wedge, repo);
+    return;
+  }
+  const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
+  die(
+    `repo is ${state} from a previous failed pull; run 'nomad pull --force-remote' to auto-recover, or resolve manually (see FAQ: "Every pull fails with unmerged files")`
+  );
+}
 function cmdPull(opts = {}) {
   const dryRun = opts.dryRun === true;
-  if (!existsSync30(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
-  if (!existsSync30(join36(REPO_HOME, "shared", "settings.base.json"))) {
+  const forceRemote = opts.forceRemote === true;
+  if (!existsSync31(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync31(join37(REPO_HOME, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
   if (handle === null) process.exit(0);
   try {
     const ts = freshBackupTs(BACKUP_BASE);
+    handleWedge(REPO_HOME, forceRemote);
     if (!dryRun) {
-      const backupRoot = join36(BACKUP_BASE, ts);
+      const backupRoot = join37(BACKUP_BASE, ts);
       try {
         mkdirSync8(backupRoot, { recursive: true });
       } catch (err) {
@@ -4073,13 +4297,12 @@ function cmdPull(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
     gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", REPO_HOME);
-    const mapPath = join36(REPO_HOME, "path-map.json");
-    const map = existsSync30(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join37(REPO_HOME, "path-map.json");
+    const map = existsSync31(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     if (dryRun) {
-      const previewResult = computePreview(ts, map);
+      computePreview(ts, map, "pull");
       log("dry-run complete; no mutation");
-      emitSummary("pull", previewResult.unmapped);
     } else {
       applyWetPull(ts, map);
     }
@@ -4097,8 +4320,8 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync32 } from "node:fs";
-import { join as join38, relative as relative5 } from "node:path";
+import { existsSync as existsSync33 } from "node:fs";
+import { join as join39, relative as relative5 } from "node:path";
 
 // src/commands.push.allowlist.ts
 init_config();
@@ -4122,7 +4345,7 @@ function isNeverSync(path) {
   }
   return false;
 }
-function parsePorcelainZ(statusPorcelain) {
+function parsePorcelainZ2(statusPorcelain) {
   const records = statusPorcelain.split("\0");
   const paths = [];
   for (let i = 0; i < records.length; i++) {
@@ -4152,7 +4375,7 @@ function enforceAllowList(statusPorcelain, map) {
   ];
   const neverSyncHits = [];
   const violations = [];
-  for (const path of parsePorcelainZ(statusPorcelain)) {
+  for (const path of parsePorcelainZ2(statusPorcelain)) {
     if (isNeverSync(path)) {
       neverSyncHits.push(path);
     } else if (!isAllowed(path, allowed)) {
@@ -4178,9 +4401,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync31, mkdirSync as mkdirSync9, readdirSync as readdirSync10, rmSync as rmSync11 } from "node:fs";
+import { copyFileSync, existsSync as existsSync32, mkdirSync as mkdirSync9, readdirSync as readdirSync10, rmSync as rmSync11 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -4195,13 +4418,13 @@ function stageSessions(tmpRoot, map) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join37(CLAUDE_HOME, "projects");
-  if (!existsSync31(localProjects)) return 0;
+  const localProjects = join38(CLAUDE_HOME, "projects");
+  if (!existsSync32(localProjects)) return 0;
   let staged = 0;
   for (const dir of readdirSync10(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join37(localProjects, dir), join37(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join38(localProjects, dir), join38(tmpRoot, "shared", "projects", logical));
     staged++;
   }
   return staged;
@@ -4217,9 +4440,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname6 of dirnames) {
       if (!whitelist.includes(dirname6)) continue;
-      const src = join37(localRoot, dirname6);
-      if (!existsSync31(src)) continue;
-      const dst = join37(tmpRoot, "shared", "extras", logical, dirname6);
+      const src = join38(localRoot, dirname6);
+      if (!existsSync32(src)) continue;
+      const dst = join38(tmpRoot, "shared", "extras", logical, dirname6);
       copyExtras(src, dst);
       staged++;
     }
@@ -4227,19 +4450,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map) {
-  const cacheDir = join37(homedir5(), ".cache", "claude-nomad");
+  const cacheDir = join38(homedir5(), ".cache", "claude-nomad");
   mkdirSync9(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join37(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join38(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join37(REPO_HOME, ".gitleaksignore");
-    if (existsSync31(ignoreFile)) {
-      copyFileSync(ignoreFile, join37(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join38(REPO_HOME, ".gitleaksignore");
+    if (existsSync32(ignoreFile)) {
+      copyFileSync(ignoreFile, join38(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -4261,7 +4484,7 @@ init_utils();
 init_utils_fs();
 init_utils_json();
 function guardGitlinks() {
-  const gitlinks = findGitlinks(join38(REPO_HOME, "shared"));
+  const gitlinks = findGitlinks(join39(REPO_HOME, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative5(REPO_HOME, p);
@@ -4272,34 +4495,15 @@ function guardGitlinks() {
     `gitlink trap: ${gitlinks.length} nested .git ${noun} in shared/; remove before retry`
   );
 }
-function runScan() {
-  const sp = startSpinner("Scanning for secrets");
-  try {
-    const verdict = scanPushVerdict();
-    sp.succeed();
-    return verdict;
-  } finally {
-    sp.stop();
-  }
-}
-function runPush() {
-  const sp = startSpinner("Pushing");
-  try {
-    gitOrFatal(["push"], "git push", REPO_HOME);
-    sp.succeed();
-  } finally {
-    sp.stop();
-  }
-}
 async function commitAndPush(st, ts, map, redactAll, allowAll, allowRule) {
   gitOrFatal(["add", "-A"], "git add", REPO_HOME);
-  let verdict = runScan();
+  let verdict = withSpinner("Scanning for secrets", scanPushVerdict);
   if (verdict.leak) {
     renderPushTree(st, verdict);
     verdict = await resolveLeakFindings(verdict, ts, map, { redactAll, allowAll, allowRule });
   }
   gitOrFatal(["commit", "-m", `chore: sync from ${HOST}`], "git commit", REPO_HOME);
-  runPush();
+  withSpinner("Pushing", () => gitOrFatal(["push"], "git push", REPO_HOME));
   renderPushTree(st, verdict);
 }
 function runDryRunPreview(st, map) {
@@ -4332,22 +4536,16 @@ async function cmdPush(opts = {}) {
   const allowAll = opts.allowAll === true;
   const allowRule = opts.allowRule;
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
-  if (!existsSync32(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync33(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
     console.log(dryRun ? `push on host=${HOST} (dry-run)` : `push on host=${HOST}`);
     probeGitleaks();
-    const rebaseSp = startSpinner("Rebasing onto origin");
-    try {
-      rebaseBeforePush();
-      rebaseSp.succeed();
-    } finally {
-      rebaseSp.stop();
-    }
+    withSpinner("Rebasing onto origin", rebaseBeforePush);
     const ts = freshBackupTs(BACKUP_BASE);
-    const remap = remapPush(ts, { dryRun });
-    const extras = remapExtrasPush(ts, { dryRun });
+    const remap = withSpinner("Syncing sessions", () => remapPush(ts, { dryRun }));
+    const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
     const st = { dryRun, remap, extras };
     guardGitlinks();
     const status = gitStatusPorcelainZ(REPO_HOME, { untrackedAll: true });
@@ -4356,8 +4554,8 @@ async function cmdPush(opts = {}) {
       renderNoScanTree(st);
       return;
     }
-    const mapPath = join38(REPO_HOME, "path-map.json");
-    if (!existsSync32(mapPath)) {
+    const mapPath = join39(REPO_HOME, "path-map.json");
+    if (!existsSync33(mapPath)) {
       if (dryRun) return runDryRunPreview(st, null);
       die("path-map.json missing, cannot enforce push allow-list");
     }
@@ -4378,9 +4576,9 @@ async function cmdPush(opts = {}) {
 }
 
 // src/commands.update.ts
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 init_utils();
-function cmdUpdate(run = execFileSync14) {
+function cmdUpdate(run = execFileSync15) {
   try {
     run("npm", ["update", "-g", "claude-nomad"], { stdio: "inherit" });
   } catch (err) {
@@ -4397,19 +4595,18 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync33 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync34 } from "node:fs";
+import { join as join40 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
-    if (!existsSync33(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+    if (!existsSync34(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
     const ts = freshBackupTs(BACKUP_BASE);
-    const mapPath = join39(REPO_HOME, "path-map.json");
-    const map = existsSync33(mapPath) ? readPathMap(mapPath) : { projects: {} };
-    const result = computePreview(ts, map);
-    emitSummary("diff", result.unmapped);
+    const mapPath = join40(REPO_HOME, "path-map.json");
+    const map = existsSync34(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    computePreview(ts, map, "diff");
   } catch (err) {
     if (err instanceof NomadFatal) {
       fail(err.message);
@@ -4422,19 +4619,19 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync35, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join42 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 init_utils();
 var DEFAULT_REPO_NAME = "claude-nomad-config";
 function isValidRepoName(name) {
   return /^[A-Za-z0-9._-]{1,100}$/.test(name);
 }
 var GH_NETWORK_TIMEOUT_MS = 3e4;
-function ensureOriginRepo(repoName, run = execFileSync15) {
+function ensureOriginRepo(repoName, run = execFileSync16) {
   if (!isValidRepoName(repoName)) {
     die(
       `invalid repo name: ${JSON.stringify(repoName)}. Use only letters, digits, hyphens, underscores, and dots (1-100 chars).`
@@ -4504,31 +4701,31 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync6, existsSync as existsSync34, rmSync as rmSync12, statSync as statSync9 } from "node:fs";
-import { join as join40 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync6, existsSync as existsSync35, rmSync as rmSync12, statSync as statSync9 } from "node:fs";
+import { join as join41 } from "node:path";
 function snapshotIntoShared(map) {
   for (const name of allSharedLinks(map)) {
-    const src = join40(CLAUDE_HOME, name);
-    if (!existsSync34(src)) continue;
-    const dst = join40(REPO_HOME, "shared", name);
+    const src = join41(CLAUDE_HOME, name);
+    if (!existsSync35(src)) continue;
+    const dst = join41(REPO_HOME, "shared", name);
     if (statSync9(src).isDirectory()) {
-      const gk = join40(dst, ".gitkeep");
-      if (existsSync34(gk)) rmSync12(gk);
+      const gk = join41(dst, ".gitkeep");
+      if (existsSync35(gk)) rmSync12(gk);
       cpSync6(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join40(CLAUDE_HOME, "settings.json");
-  if (existsSync34(userSettings)) {
+  const userSettings = join41(CLAUDE_HOME, "settings.json");
+  if (existsSync35(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join40(REPO_HOME, "hosts", `${HOST}.json`);
+    const hostFile = join41(REPO_HOME, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -4541,14 +4738,14 @@ var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.cl
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome) {
   const candidates = [
-    join41(repoHome, "shared", "settings.base.json"),
-    join41(repoHome, "shared", "CLAUDE.md"),
-    join41(repoHome, "path-map.json"),
-    join41(repoHome, "hosts"),
-    join41(repoHome, "shared")
+    join42(repoHome, "shared", "settings.base.json"),
+    join42(repoHome, "shared", "CLAUDE.md"),
+    join42(repoHome, "path-map.json"),
+    join42(repoHome, "hosts"),
+    join42(repoHome, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync35(c)) return c;
+    if (existsSync36(c)) return c;
   }
   return null;
 }
@@ -4561,25 +4758,25 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync10(join41(REPO_HOME, "shared"), { recursive: true });
-  mkdirSync10(join41(REPO_HOME, "hosts"), { recursive: true });
+  mkdirSync10(join42(REPO_HOME, "shared"), { recursive: true });
+  mkdirSync10(join42(REPO_HOME, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync10(join41(REPO_HOME, "shared", name), { recursive: true });
+    mkdirSync10(join42(REPO_HOME, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join41(CLAUDE_HOME, "CLAUDE.md");
-  if (!snapshot || !existsSync35(userClaudeMd)) {
-    writeFileSync6(join41(REPO_HOME, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join42(CLAUDE_HOME, "CLAUDE.md");
+  if (!snapshot || !existsSync36(userClaudeMd)) {
+    writeFileSync6(join42(REPO_HOME, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     log("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join41(REPO_HOME, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join42(REPO_HOME, "shared", name, ".gitkeep"), "");
     log(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync6(join41(REPO_HOME, "hosts", ".gitkeep"), "");
+  writeFileSync6(join42(REPO_HOME, "hosts", ".gitkeep"), "");
   log("created hosts/.gitkeep");
-  writeJsonAtomic(join41(REPO_HOME, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join42(REPO_HOME, "shared", "settings.base.json"), {});
   log("created shared/settings.base.json");
-  writeJsonAtomic(join41(REPO_HOME, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join42(REPO_HOME, "path-map.json"), { projects: {} });
   log("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -4783,6 +4980,28 @@ function parseAllowArgs(argv) {
   return positionals;
 }
 
+// src/nomad.dispatch.pull.ts
+function parsePullArgs(argv) {
+  let dryRun = false;
+  let forceRemote = false;
+  let i = 3;
+  while (i < argv.length) {
+    const token = argv[i];
+    if (token === "--dry-run") {
+      if (dryRun) return null;
+      dryRun = true;
+    } else if (token === "--force-remote") {
+      if (forceRemote) return null;
+      forceRemote = true;
+    } else {
+      return null;
+    }
+    i++;
+  }
+  if (dryRun && forceRemote) return null;
+  return { dryRun, forceRemote };
+}
+
 // src/nomad.dispatch.push.ts
 var REJECT2 = { ok: false, advance: 0 };
 function applyBool2(seen, set) {
@@ -4841,7 +5060,7 @@ function parsePushArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.40.0",
+  version: "0.42.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -4854,7 +5073,7 @@ var package_default = {
     type: "git",
     url: "git+https://github.com/funkadelic/claude-nomad.git"
   },
-  homepage: "https://github.com/funkadelic/claude-nomad#readme",
+  homepage: "https://funkadelic.github.io/claude-nomad/",
   bugs: {
     url: "https://github.com/funkadelic/claude-nomad/issues"
   },
@@ -4939,6 +5158,11 @@ var DEFAULT_HELP = [
   "Commands:",
   row("  pull", "Sync ~/.claude/ from the shared repo (settings, symlinks, sessions)."),
   row("       --dry-run", "Run lock + git pull, then preview every mutation without writing."),
+  row("       --force-remote", "Recover from a wedged repo (stuck mid-rebase or mid-merge):"),
+  cont("abort the in-progress rebase/merge, park stranded commits on"),
+  cont("nomad/stranded-<ts>, reset to origin/main, and re-pull. Refuses"),
+  cont("if stranded or dirty tracked changes touch synced config (shared/,"),
+  cont("hosts/, path-map.json). Cannot combine with --dry-run."),
   "",
   row("  push", "Rebase, run safety checks (gitleaks, gitlinks, allow-list), commit, push."),
   row("       --dry-run", "Run pre-checks (rebase, gitleaks probe, gitlink scan) and preview"),
@@ -5031,15 +5255,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync36, readFileSync as readFileSync11, readdirSync as readdirSync11 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync37, readFileSync as readFileSync11, readdirSync as readdirSync11 } from "node:fs";
+import { join as join43 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join42(CLAUDE_HOME, "projects");
-  if (!existsSync36(projectsRoot)) {
+  const projectsRoot = join43(CLAUDE_HOME, "projects");
+  if (!existsSync37(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -5053,8 +5277,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join42(REPO_HOME, "path-map.json");
-  if (!existsSync36(mapPath)) {
+  const mapPath = join43(REPO_HOME, "path-map.json");
+  if (!existsSync37(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -5077,8 +5301,8 @@ function resumeCmd(sessionId) {
 }
 function findTranscriptPath(projectsRoot, sessionId) {
   for (const dir of readdirSync11(projectsRoot)) {
-    const candidate = join42(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync36(candidate)) return candidate;
+    const candidate = join43(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync37(candidate)) return candidate;
   }
   return null;
 }
@@ -5150,15 +5374,12 @@ try {
       console.log(package_default.version);
       break;
     case "pull": {
-      const sub = process.argv[3];
-      if (sub === void 0) {
-        cmdPull();
-      } else if (sub === "--dry-run" && process.argv.length === 4) {
-        cmdPull({ dryRun: true });
-      } else {
-        console.error("usage: nomad pull [--dry-run]");
+      const pullArgs = parsePullArgs(process.argv);
+      if (pullArgs === null) {
+        console.error("usage: nomad pull [--dry-run] [--force-remote]");
         process.exit(1);
       }
+      cmdPull({ dryRun: pullArgs.dryRun, forceRemote: pullArgs.forceRemote });
       break;
     }
     case "push": {