claude-nomad 0.42.0 → 0.44.0

package/dist/nomad.mjs

@@ -561,31 +561,31 @@ var init_utils_fs = __esm({
 });
 
 // src/push-gitleaks.config.ts
-import { existsSync as existsSync10, mkdtempSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync11, mkdtempSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveTomlPath() {
-  const repoToml = join11(REPO_HOME, ".gitleaks.toml");
-  if (existsSync10(repoToml)) return repoToml;
+  const repoToml = join12(REPO_HOME, ".gitleaks.toml");
+  if (existsSync11(repoToml)) return repoToml;
   const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync10(bundled) ? bundled : null;
+  return existsSync11(bundled) ? bundled : null;
 }
 function buildOverlayTempConfig(overlayBody, bundled) {
   const tempBody = `[extend]
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join11(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join11(tempPath, "config.toml");
+  const tempPath = mkdtempSync(join12(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join12(tempPath, "config.toml");
   writeFileSync2(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
-  const overlayPath = join11(REPO_HOME, ".gitleaks.overlay.toml");
-  const repoToml = join11(REPO_HOME, ".gitleaks.toml");
+  const overlayPath = join12(REPO_HOME, ".gitleaks.overlay.toml");
+  const repoToml = join12(REPO_HOME, ".gitleaks.toml");
   const bundled = resolveTomlPath();
-  if (!existsSync10(overlayPath)) {
+  if (!existsSync11(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -626,9 +626,9 @@ var init_push_gitleaks_config = __esm({
 
 // src/push-checks.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readdirSync as readdirSync3, rmSync as rmSync3 } from "node:fs";
+import { readdirSync as readdirSync4, rmSync as rmSync4 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -666,12 +666,12 @@ function findGitlinks(dir) {
   function walk(current) {
     let entries;
     try {
-      entries = readdirSync3(current, { withFileTypes: true });
+      entries = readdirSync4(current, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = join12(current, e.name);
+      const p = join13(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
@@ -693,7 +693,7 @@ function probeGitleaks() {
     if (e.code === "ENOENT") throw new NomadFatal(gitleaksInstallHint());
     throw new NomadFatal(`gitleaks --version failed: ${e.message}`);
   } finally {
-    if (tempPath !== null) rmSync3(tempPath, { recursive: true, force: true });
+    if (tempPath !== null) rmSync4(tempPath, { recursive: true, force: true });
   }
 }
 function rebaseBeforePush() {
@@ -721,9 +721,9 @@ var init_push_checks = __esm({
 
 // src/push-gitleaks.scan.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync4 } from "node:fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync5 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function readGitleaksReport(reportPath) {
   try {
     const raw = readFileSync4(reportPath, "utf8");
@@ -735,9 +735,9 @@ function readGitleaksReport(reportPath) {
   }
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join16(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join17(homedir3(), ".cache", "claude-nomad");
   mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join16(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join17(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -764,14 +764,14 @@ function scanStagedTree(repoDir, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync4(tempPath, { recursive: true, force: true });
-    rmSync4(reportPath, { force: true });
+    if (tempPath !== null) rmSync5(tempPath, { recursive: true, force: true });
+    rmSync5(reportPath, { force: true });
   }
 }
 function scanFile(filePath, forwardStreams = false) {
-  const cacheDir = join16(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join17(homedir3(), ".cache", "claude-nomad");
   mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join16(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join17(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "detect",
@@ -796,8 +796,8 @@ function scanFile(filePath, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync4(tempPath, { recursive: true, force: true });
-    rmSync4(reportPath, { force: true });
+    if (tempPath !== null) rmSync5(tempPath, { recursive: true, force: true });
+    rmSync5(reportPath, { force: true });
   }
 }
 var init_push_gitleaks_scan = __esm({
@@ -1219,15 +1219,178 @@ function cmdClean(opts, backupBase = BACKUP_BASE) {
   log(`removed ${targets.length} backup(s)`);
 }
 
+// src/commands.eject.ts
+init_config();
+init_utils();
+init_utils_json();
+import { cpSync as cpSync3, existsSync as existsSync5, lstatSync as lstatSync4, realpathSync, renameSync as renameSync2, rmSync as rmSync3 } from "node:fs";
+import { join as join6, sep } from "node:path";
+var EJECT_CHECKLIST = [
+  "Manual steps remaining to finish leaving claude-nomad on this host:",
+  `  1. Uninstall the CLI: npm uninstall -g claude-nomad`,
+  `  2. Remove NOMAD_HOST and NOMAD_REPO from your shell rc (~/.zshrc or ~/.bashrc)`,
+  `  3. Optionally delete the local sync checkout: rm -rf ${REPO_HOME}`,
+  `  4. Optionally delete the private sync repo on GitHub`,
+  `  5. Optionally delete the backup cache: rm -rf ${BACKUP_BASE}`
+].join("\n");
+var DEFAULT_ROOTS = { claudeHome: CLAUDE_HOME, repoHome: REPO_HOME };
+function errMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function lexists2(p) {
+  try {
+    lstatSync4(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readMapIfPresent2(repoHome) {
+  const mapPath = join6(repoHome, "path-map.json");
+  return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
+}
+function classifyName(linkPath) {
+  if (!lexists2(linkPath)) return "absent";
+  if (!lstatSync4(linkPath).isSymbolicLink()) return "skip-real";
+  if (!existsSync5(linkPath)) return "dangling";
+  return "materialize";
+}
+function resolveSharedRoot(repoHome) {
+  try {
+    return realpathSync(join6(repoHome, "shared"));
+  } catch {
+    return die(
+      `cannot resolve ${join6(repoHome, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
+    );
+  }
+}
+function isManagedTarget(target, sharedRoot) {
+  return target.startsWith(sharedRoot + sep);
+}
+function materializeOne(name, linkPath, sharedRoot) {
+  const target = realpathSync(linkPath);
+  if (!isManagedTarget(target, sharedRoot)) {
+    log(`skipped (not a nomad-managed target): ${name} -> ${target}`);
+    return false;
+  }
+  const tmp = `${linkPath}.eject.tmp.${process.pid}.${Date.now()}`;
+  try {
+    rmSync3(tmp, { recursive: true, force: true });
+    cpSync3(target, tmp, {
+      recursive: true,
+      force: true,
+      dereference: true,
+      preserveTimestamps: true
+    });
+    rmSync3(linkPath, { force: true });
+    renameSync2(tmp, linkPath);
+    log(`ejected: ${name}`);
+    return true;
+  } catch (err) {
+    try {
+      rmSync3(tmp, { recursive: true, force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+function previewDryRun(names, classifications, claudeHome, sharedRoot) {
+  for (const name of names) {
+    const cls = classifications.get(name);
+    const linkPath = join6(claudeHome, name);
+    if (cls === "absent") {
+      log(`skipped (absent): ${name}`);
+    } else if (cls === "skip-real") {
+      log(`skipped (not a symlink): ${name}`);
+    } else {
+      previewMaterialize(name, linkPath, sharedRoot);
+    }
+  }
+  log(EJECT_CHECKLIST);
+}
+function previewMaterialize(name, linkPath, sharedRoot) {
+  let target;
+  try {
+    target = realpathSync(linkPath);
+  } catch {
+    log(`would materialize: ${name} (target now unresolvable; re-run to re-classify)`);
+    return;
+  }
+  if (!isManagedTarget(target, sharedRoot)) {
+    log(`skipped (not a nomad-managed target): ${name} -> ${target}`);
+    return;
+  }
+  log(`would materialize: ${name} (copy ${target} -> ${linkPath})`);
+}
+function runLiveEject(names, classifications, claudeHome, sharedRoot) {
+  const done = [];
+  let skipped = 0;
+  for (const name of names) {
+    const cls = classifications.get(name);
+    const linkPath = join6(claudeHome, name);
+    if (cls === "absent") {
+      log(`skipped (absent): ${name}`);
+      skipped++;
+    } else if (cls === "skip-real") {
+      log(`skipped (not a symlink): ${name}`);
+      skipped++;
+    } else if (materializeOneOrDie(name, linkPath, sharedRoot, done)) {
+      done.push(name);
+    } else {
+      skipped++;
+    }
+  }
+  log(`materialized ${done.length}, skipped ${skipped}`);
+  log(EJECT_CHECKLIST);
+}
+function materializeOneOrDie(name, linkPath, sharedRoot, done) {
+  try {
+    return materializeOne(name, linkPath, sharedRoot);
+  } catch (err) {
+    const msg = errMessage(err);
+    return die(
+      `failed to materialize ${name}: ${msg}. already materialized: ${done.join(", ") || "(none)"}. the remaining names are still symlinks; do NOT delete ${REPO_HOME} yet, fix the cause and re-run \`nomad eject\` (it is idempotent on already-real names)`
+    );
+  }
+}
+function cmdEject(opts = {}, roots = DEFAULT_ROOTS) {
+  const dryRun = opts.dryRun === true;
+  const { claudeHome, repoHome } = roots;
+  const map = readMapIfPresent2(repoHome);
+  const names = allSharedLinks(map);
+  const classifications = /* @__PURE__ */ new Map();
+  for (const name of names) {
+    classifications.set(name, classifyName(join6(claudeHome, name)));
+  }
+  const dangling = names.filter((n) => classifications.get(n) === "dangling");
+  if (dangling.length > 0) {
+    fail(
+      `dangling symlink(s): ${dangling.join(", ")}. run \`nomad pull\` first to restore the missing target, then re-run \`nomad eject\``
+    );
+    process.exit(1);
+  }
+  const sharedRoot = resolveSharedRoot(repoHome);
+  if (dryRun) {
+    previewDryRun(names, classifications, claudeHome, sharedRoot);
+    return;
+  }
+  try {
+    runLiveEject(names, classifications, claudeHome, sharedRoot);
+  } catch (err) {
+    fail(errMessage(err));
+    process.exit(1);
+  }
+}
+
 // src/commands.doctor.ts
-import { existsSync as existsSync19 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
 init_config();
-import { existsSync as existsSync6, lstatSync as lstatSync4, statSync as statSync3 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync5, statSync as statSync3 } from "node:fs";
+import { join as join8 } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -1241,6 +1404,9 @@ function section(header, raw = false) {
 function addItem(s, text) {
   s.items.push(text);
 }
+function addChildItem(s, text) {
+  s.items.push(`	${text}`);
+}
 function sectionFailed(s) {
   return s.items.some((line) => line.includes(failGlyph));
 }
@@ -1257,12 +1423,27 @@ function renderSection(s) {
   }
   const header = sectionFailed(s) ? `${red(FAIL_GLYPH_BARE)} ${s.header}` : s.header;
   console.log(header);
-  const lastContent = s.items.reduce((acc, item, j) => item === "" ? acc : j, -1);
+  const lastContent = s.items.reduce(
+    (acc, item, j) => item === "" || isChild(item) ? acc : j,
+    -1
+  );
   for (let j = 0; j < s.items.length; j++) {
-    if (s.items[j] === "") console.log("");
-    else console.log(`${j === lastContent ? "  \u2514 " : "  \u251C "}${s.items[j]}`);
+    const item = s.items[j];
+    if (item === "") console.log("");
+    else if (isChild(item)) console.log(renderChildLine(s.items, j));
+    else console.log(`${j === lastContent ? "  \u2514 " : "  \u251C "}${item}`);
   }
 }
+function isChild(item) {
+  return item.startsWith("	");
+}
+function renderChildLine(items, j) {
+  const parentContinues = items.some((it, k) => k > j && it !== "" && !isChild(it));
+  const gutter = parentContinues ? "  \u2502 " : "    ";
+  const next = items[j + 1];
+  const elbow = next === void 0 || !isChild(next) ? "\u2514 " : "\u251C ";
+  return `${gutter}  ${elbow}${items[j].slice(1)}`;
+}
 function renderTree(sections) {
   const visible = sections.filter((s) => s.items.length > 0);
   for (let i = 0; i < visible.length; i++) {
@@ -1287,15 +1468,15 @@ function readJsonSafe(path, label, section2) {
 // src/init.classify.ts
 init_config();
 init_utils_json();
-import { existsSync as existsSync5 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join7 } from "node:path";
 function classifyRepoState(repoHome, host) {
-  const basePath = join6(repoHome, "shared", "settings.base.json");
-  const mapPath = join6(repoHome, "path-map.json");
-  const hostPath = join6(repoHome, "hosts", `${host}.json`);
-  const hasBase = existsSync5(basePath);
-  const hasMap = existsSync5(mapPath);
-  const hasHost = existsSync5(hostPath);
+  const basePath = join7(repoHome, "shared", "settings.base.json");
+  const mapPath = join7(repoHome, "path-map.json");
+  const hostPath = join7(repoHome, "hosts", `${host}.json`);
+  const hasBase = existsSync6(basePath);
+  const hasMap = existsSync6(mapPath);
+  const hasHost = existsSync6(hostPath);
   let mapEntryCount = 0;
   if (hasMap) {
     try {
@@ -1310,11 +1491,11 @@ function classifyRepoState(repoHome, host) {
   return "partial";
 }
 function reasonForPartial(repoHome, host) {
-  const basePath = join6(repoHome, "shared", "settings.base.json");
-  const mapPath = join6(repoHome, "path-map.json");
-  const hostPath = join6(repoHome, "hosts", `${host}.json`);
-  if (!existsSync5(basePath)) return "- shared/settings.base.json missing";
-  if (!existsSync5(mapPath)) return "- path-map.json missing";
+  const basePath = join7(repoHome, "shared", "settings.base.json");
+  const mapPath = join7(repoHome, "path-map.json");
+  const hostPath = join7(repoHome, "hosts", `${host}.json`);
+  if (!existsSync6(basePath)) return "- shared/settings.base.json missing";
+  if (!existsSync6(mapPath)) return "- path-map.json missing";
   let mapEntryCount;
   try {
     const map = readJson(mapPath);
@@ -1323,7 +1504,7 @@ function reasonForPartial(repoHome, host) {
     mapEntryCount = 0;
   }
   if (mapEntryCount === 0) return "- path-map.json.projects has no entries";
-  if (!existsSync5(hostPath)) return `- hosts/${host}.json missing`;
+  if (!existsSync6(hostPath)) return `- hosts/${host}.json missing`;
   return "- partial state (unknown gap)";
 }
 
@@ -1332,14 +1513,18 @@ function isOverrideActive() {
   return Boolean(process.env.NOMAD_REPO);
 }
 function reportHostAndPaths(section2) {
-  addItem(section2, `${dim(infoGlyph)} host: ${cyan(HOST)}`);
+  const unsetHint = process.env.NOMAD_HOST ? "" : dim(" (env unset, using hostname)");
+  addItem(section2, `${dim(infoGlyph)} NOMAD_HOST: ${cyan(HOST)}${unsetHint}`);
+  if (isOverrideActive()) {
+    addItem(section2, `${dim(infoGlyph)} NOMAD_REPO: ${blue(REPO_HOME)}`);
+  }
   addItem(
     section2,
-    `${existsSync6(REPO_HOME) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(REPO_HOME)}`
+    `${existsSync7(REPO_HOME) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(REPO_HOME)}`
   );
   addItem(
     section2,
-    `${existsSync6(CLAUDE_HOME) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(CLAUDE_HOME)}`
+    `${existsSync7(CLAUDE_HOME) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(CLAUDE_HOME)}`
   );
 }
 function reportRepoState(section2) {
@@ -1361,12 +1546,12 @@ function reportRepoState(section2) {
   }
 }
 function repoHasSharedSource(name) {
-  return existsSync6(join7(REPO_HOME, "shared", name));
+  return existsSync7(join8(REPO_HOME, "shared", name));
 }
 function classifySharedLink(name, p) {
   let stat;
   try {
-    stat = lstatSync4(p);
+    stat = lstatSync5(p);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -1408,7 +1593,7 @@ function classifySymlinkTarget(name, p) {
 }
 function reportSharedLinks(section2, map) {
   for (const name of allSharedLinks(map)) {
-    const p = join7(CLAUDE_HOME, name);
+    const p = join8(CLAUDE_HOME, name);
     const { line, fail: fail2 } = classifySharedLink(name, p);
     addItem(section2, line);
     if (fail2) process.exitCode = 1;
@@ -1418,11 +1603,11 @@ function reportSharedLinks(section2, map) {
 // src/commands.doctor.checks.settings.ts
 init_color();
 init_config();
-import { existsSync as existsSync7, readdirSync as readdirSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
+import { join as join9 } from "node:path";
 function loadBaseSettings(section2) {
-  const basePath = join8(REPO_HOME, "shared", "settings.base.json");
-  if (!existsSync7(basePath)) {
+  const basePath = join9(REPO_HOME, "shared", "settings.base.json");
+  if (!existsSync8(basePath)) {
     addItem(section2, `${red(failGlyph)} shared/settings.base.json missing at ${blue(basePath)}`);
     process.exitCode = 1;
     return null;
@@ -1430,15 +1615,15 @@ function loadBaseSettings(section2) {
   return readJsonSafe(basePath, basePath, section2);
 }
 function loadAndReportSettings(section2) {
-  const settingsPath = join8(CLAUDE_HOME, "settings.json");
-  if (!existsSync7(settingsPath)) return null;
+  const settingsPath = join9(CLAUDE_HOME, "settings.json");
+  if (!existsSync8(settingsPath)) return null;
   const settings = readJsonSafe(settingsPath, settingsPath, section2);
   if (settings === null) return null;
   const unknownKeys = Object.keys(settings).filter((k) => !KNOWN_SETTINGS_KEYS.has(k));
   if (unknownKeys.length > 0) {
     addItem(
       section2,
-      `${yellow(warnGlyph)} settings.json has unknown keys (schema drift?): ${unknownKeys.join(", ")}`
+      `${yellow(warnGlyph)} settings.json has unknown keys (schema drift?): ${unknownKeys.join(", ")} (verify: nomad doctor --check-schema)`
     );
   } else {
     addItem(section2, `${green(okGlyph)} settings.json schema: known keys only`);
@@ -1446,13 +1631,13 @@ function loadAndReportSettings(section2) {
   return settings;
 }
 function reportHostOverrides(section2, base, settings) {
-  const hostFile = join8(REPO_HOME, "hosts", `${HOST}.json`);
+  const hostFile = join9(REPO_HOME, "hosts", `${HOST}.json`);
   let drift = [];
   if (base !== null && settings !== null) {
     const baseKeys = new Set(Object.keys(base));
     drift = Object.keys(settings).filter((k) => !baseKeys.has(k));
   }
-  if (existsSync7(hostFile)) {
+  if (existsSync8(hostFile)) {
     if (readJsonSafe(hostFile, hostFile, section2) !== null) {
       addItem(section2, `${green(okGlyph)} host overrides: ${blue(hostFile)}`);
     }
@@ -1461,8 +1646,8 @@ function reportHostOverrides(section2, base, settings) {
       section2,
       `${red(failGlyph)} no hosts/${HOST}.json AND settings.json has unbased keys ${JSON.stringify(drift)}`
     );
-    const hostsDir = join8(REPO_HOME, "hosts");
-    if (existsSync7(hostsDir)) {
+    const hostsDir = join9(REPO_HOME, "hosts");
+    if (existsSync8(hostsDir)) {
       const cands = readdirSync2(hostsDir).filter((f) => f.endsWith(".json"));
       if (cands.length > 0) addItem(section2, `${dim(infoGlyph)} candidates: ${cands.join(", ")}`);
     }
@@ -1478,17 +1663,33 @@ function reportHostOverrides(section2, base, settings) {
 // src/commands.doctor.checks.pathmap.ts
 init_color();
 init_config();
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync3 } from "node:fs";
+import { join as join10 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
-  addItem(
-    section2,
-    `${dim(infoGlyph)} mapped projects for ${cyan(HOST)}: ${dim(String(mapped.length))}`
-  );
+  addItem(section2, `Mapped projects for ${cyan(HOST)}: ${dim(String(mapped.length))}`);
   for (const [name, hosts] of mapped) {
-    addItem(section2, `      ${name} -> ${blue(hosts[HOST])}`);
+    addChildItem(section2, `${name} -> ${blue(hosts[HOST])}`);
+  }
+}
+function reportUnmappedProjects(section2, map) {
+  const localProjects = join10(CLAUDE_HOME, "projects");
+  if (!existsSync9(localProjects)) return;
+  let localDirs;
+  try {
+    localDirs = readdirSync3(localProjects);
+  } catch {
+    return;
+  }
+  const mappedEncodings = new Set(
+    Object.values(map.projects).map((hosts) => hosts[HOST]).filter(Boolean).map((abspath) => encodePath(abspath))
+  );
+  const unmapped = localDirs.filter((dir) => !mappedEncodings.has(dir));
+  if (unmapped.length === 0) return;
+  addItem(section2, `Unmapped local projects (not synced): ${dim(String(unmapped.length))}`);
+  for (const dir of unmapped) {
+    addChildItem(section2, dim(dir));
   }
 }
 function reportPathCollisions(section2, map) {
@@ -1514,8 +1715,8 @@ function reportPathCollisions(section2, map) {
   else addItem(section2, `${green(okGlyph)} path-encoding: no collisions`);
 }
 function reportPathMap(section2) {
-  const mapPath = join9(REPO_HOME, "path-map.json");
-  if (!existsSync8(mapPath)) {
+  const mapPath = join10(REPO_HOME, "path-map.json");
+  if (!existsSync9(mapPath)) {
     addItem(section2, `${red(failGlyph)} path-map.json missing at ${blue(mapPath)}`);
     process.exitCode = 1;
     return;
@@ -1552,26 +1753,32 @@ function reportPathMap(section2) {
     }
   }
   reportMappedProjects(section2, map);
+  reportUnmappedProjects(section2, map);
   reportPathCollisions(section2, map);
 }
 function reportNeverSync(section2) {
-  addItem(section2, `${dim(infoGlyph)} never-sync items: ${[...NEVER_SYNC].join(", ")}`);
+  addItem(
+    section2,
+    `${dim(infoGlyph)} never-sync items: ${NEVER_SYNC.size} protected ${dim(
+      "(https://funkadelic.github.io/claude-nomad/how-it-works/)"
+    )}`
+  );
 }
 
 // src/commands.doctor.checks.repository.ts
 init_color();
 init_config();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync11 } from "node:fs";
-import { join as join13, relative as relative2 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join14, relative as relative2 } from "node:path";
 
 // src/commands.pull.wedge.ts
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join11 } from "node:path";
 function detectWedge(repo) {
-  const g = join10(repo, ".git");
-  if (existsSync9(join10(g, "rebase-merge")) || existsSync9(join10(g, "rebase-apply"))) return "rebase";
-  if (existsSync9(join10(g, "MERGE_HEAD"))) return "merge";
+  const g = join11(repo, ".git");
+  if (existsSync10(join11(g, "rebase-merge")) || existsSync10(join11(g, "rebase-apply"))) return "rebase";
+  if (existsSync10(join11(g, "MERGE_HEAD"))) return "merge";
   return null;
 }
 
@@ -1580,12 +1787,14 @@ init_push_checks();
 init_utils();
 function reportGitleaksProbe(section2) {
   try {
-    const v = execFileSync3("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
-    addItem(section2, `${green(okGlyph)} gitleaks: ${dim(v)}`);
+    execFileSync3("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch (err) {
     if (err.code === "ENOENT") {
-      addItem(section2, `${yellow(warnGlyph)} gitleaks: not on PATH (required for nomad push)`);
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} gitleaks: not on PATH (required for nomad push; install: https://github.com/gitleaks/gitleaks)`
+      );
     } else {
       addItem(section2, `${red(failGlyph)} gitleaks: probe failed: ${err.message}`);
       process.exitCode = 1;
@@ -1594,8 +1803,8 @@ function reportGitleaksProbe(section2) {
   }
 }
 function reportGitlinks(section2) {
-  const sharedDir = join13(REPO_HOME, "shared");
-  if (existsSync11(sharedDir)) {
+  const sharedDir = join14(REPO_HOME, "shared");
+  if (existsSync12(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
       const rel = relative2(REPO_HOME, p);
@@ -1651,13 +1860,13 @@ function reportRebaseState(section2) {
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync12, lstatSync as lstatSync5, readdirSync as readdirSync4 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync13, lstatSync as lstatSync6, readdirSync as readdirSync5 } from "node:fs";
+import { join as join15 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
 function safeReaddir(dir) {
   try {
-    return readdirSync4(dir);
+    return readdirSync5(dir);
   } catch {
     return [];
   }
@@ -1668,8 +1877,8 @@ var BYTES_PER_MB = 1024 * 1024;
 function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
-    const full = join14(dir, entry);
-    const st = lstatSync5(full, { throwIfNoEntry: false });
+    const full = join15(dir, entry);
+    const st = lstatSync6(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) bytes += dirSizeBytes(full);
@@ -1679,11 +1888,11 @@ function dirSizeBytes(dir) {
 }
 function totalSizeMb(backupBase, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join14(backupBase, name));
+  for (const name of dirs) bytes += dirSizeBytes(join15(backupBase, name));
   return bytes / BYTES_PER_MB;
 }
 function reportBackupsCheck(section2, backupBase = BACKUP_BASE) {
-  if (!existsSync12(backupBase)) return;
+  if (!existsSync13(backupBase)) return;
   const dirs = safeReaddir(backupBase).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
   const sizeMb = totalSizeMb(backupBase, dirs);
@@ -1697,8 +1906,8 @@ function reportBackupsCheck(section2, backupBase = BACKUP_BASE) {
 
 // src/commands.doctor.check-schema.ts
 init_color();
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { join as join16 } from "node:path";
 init_config();
 
 // src/http-fetch.ts
@@ -1735,8 +1944,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join15(CLAUDE_HOME, "settings.json");
-  if (!existsSync13(settingsPath)) {
+  const settingsPath = join16(CLAUDE_HOME, "settings.json");
+  if (!existsSync14(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -1766,18 +1975,18 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync4, readdirSync as readdirSync6, rmSync as rmSync6 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync4, readdirSync as readdirSync7, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 init_config();
 init_push_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join17(CLAUDE_HOME, "projects", encoded, `${sid}.jsonl`);
+  return join18(CLAUDE_HOME, "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -1869,21 +2078,21 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { cpSync as cpSync3, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync5, rmSync as rmSync5, statSync as statSync4 } from "node:fs";
-import { join as join18, relative as relative3, sep } from "node:path";
+import { cpSync as cpSync4, existsSync as existsSync15, mkdirSync as mkdirSync3, readdirSync as readdirSync6, rmSync as rmSync6, statSync as statSync4 } from "node:fs";
+import { join as join19, relative as relative3, sep as sep2 } from "node:path";
 function copyDir(src, dst) {
-  rmSync5(dst, { recursive: true, force: true });
-  cpSync3(src, dst, { recursive: true, force: true });
+  rmSync6(dst, { recursive: true, force: true });
+  cpSync4(src, dst, { recursive: true, force: true });
 }
 function copyDirJsonlOnly(src, dst) {
-  rmSync5(dst, { recursive: true, force: true });
-  cpSync3(src, dst, {
+  rmSync6(dst, { recursive: true, force: true });
+  cpSync4(src, dst, {
     recursive: true,
     force: true,
     filter: (srcPath) => {
       const rel = relative3(src, srcPath);
       if (rel === "") return true;
-      if (rel.split(sep).length > 1) return true;
+      if (rel.split(sep2).length > 1) return true;
       if (statSync4(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       log(`skip ${rel}: extension not in allowlist`);
@@ -1900,15 +2109,15 @@ function remapPull(ts, opts = {}) {
   let unmapped = 0;
   const pulled = [];
   const wouldPull = [];
-  const mapPath = join18(REPO_HOME, "path-map.json");
-  const repoProjects = join18(REPO_HOME, "shared", "projects");
-  if (!existsSync14(mapPath) || !existsSync14(repoProjects)) {
+  const mapPath = join19(REPO_HOME, "path-map.json");
+  const repoProjects = join19(REPO_HOME, "shared", "projects");
+  if (!existsSync15(mapPath) || !existsSync15(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readJson(mapPath);
-  const localProjects = join18(CLAUDE_HOME, "projects");
+  const localProjects = join19(CLAUDE_HOME, "projects");
   if (!dryRun) mkdirSync3(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -1917,9 +2126,9 @@ function remapPull(ts, opts = {}) {
       unmapped++;
       continue;
     }
-    const src = join18(repoProjects, logical);
-    if (!existsSync14(src)) continue;
-    const dst = join18(localProjects, encodePath(localPath));
+    const src = join19(repoProjects, logical);
+    if (!existsSync15(src)) continue;
+    const dst = join19(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -1964,30 +2173,30 @@ function remapPush(ts, opts = {}) {
   let unmapped = 0;
   const pushed = [];
   const wouldPush = [];
-  const mapPath = join18(REPO_HOME, "path-map.json");
-  if (!existsSync14(mapPath)) {
+  const mapPath = join19(REPO_HOME, "path-map.json");
+  if (!existsSync15(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readJson(mapPath);
-  const localProjects = join18(CLAUDE_HOME, "projects");
-  const repoProjects = join18(REPO_HOME, "shared", "projects");
+  const localProjects = join19(CLAUDE_HOME, "projects");
+  const repoProjects = join19(REPO_HOME, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync14(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync15(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync3(repoProjects, { recursive: true });
-  for (const dir of readdirSync5(localProjects)) {
+  for (const dir of readdirSync6(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) {
       unmapped++;
       continue;
     }
-    const repoDst = join18(repoProjects, logical);
+    const repoDst = join19(repoProjects, logical);
     if (dryRun) {
       wouldPush.push(logical);
       continue;
     }
     backupRepoWrite(repoDst, ts, REPO_HOME);
-    copyDirJsonlOnly(join18(localProjects, dir), repoDst);
+    copyDirJsonlOnly(join19(localProjects, dir), repoDst);
     pushed.push(logical);
   }
   return { unmapped, collisions: 0, pushed, wouldPush };
@@ -1999,8 +2208,8 @@ init_utils_json();
 function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
-  const mapPath = join19(REPO_HOME, "path-map.json");
-  if (!existsSync15(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join20(REPO_HOME, "path-map.json");
+  if (!existsSync16(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -2017,12 +2226,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join19(CLAUDE_HOME, "projects");
-  if (!existsSync15(localProjects)) return { logicalToEncoded, staged, malformed: false };
-  for (const dir of readdirSync6(localProjects)) {
+  const localProjects = join20(CLAUDE_HOME, "projects");
+  if (!existsSync16(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  for (const dir of readdirSync7(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join19(localProjects, dir), join19(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join20(localProjects, dir), join20(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -2053,11 +2262,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
 }
 function reportCheckShared(section2, gitleaksReady) {
   if (!ensureGitleaksReady(section2, gitleaksReady)) return;
-  const cacheDir = join19(homedir4(), ".cache", "claude-nomad");
+  const cacheDir = join20(homedir4(), ".cache", "claude-nomad");
   mkdirSync4(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const reportPath = join19(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join19(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join20(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join20(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -2071,15 +2280,15 @@ function reportCheckShared(section2, gitleaksReady) {
     }
     scanAndReport(section2, tmpRoot, staged, logicalToEncoded);
   } finally {
-    rmSync6(reportPath, { force: true });
-    rmSync6(tmpRoot, { recursive: true, force: true });
+    rmSync7(reportPath, { force: true });
+    rmSync7(tmpRoot, { recursive: true, force: true });
   }
 }
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync16, readFileSync as readFileSync5, readdirSync as readdirSync7, realpathSync } from "node:fs";
-import { dirname as dirname2, extname, join as join20 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync5, readdirSync as readdirSync8, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname2, extname, join as join21 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
@@ -2095,14 +2304,14 @@ function effectiveType(hookPath) {
   if (ext === ".cjs") return "cjs";
   let real;
   try {
-    real = realpathSync(hookPath);
+    real = realpathSync2(hookPath);
   } catch {
     return null;
   }
   let dir = dirname2(real);
   for (; ; ) {
-    const pkg = join20(dir, "package.json");
-    if (existsSync16(pkg)) return typeFromPackageJson(pkg);
+    const pkg = join21(dir, "package.json");
+    if (existsSync17(pkg)) return typeFromPackageJson(pkg);
     const parent = dirname2(dir);
     if (parent === dir) return "cjs";
     dir = parent;
@@ -2131,7 +2340,7 @@ function remedy(family) {
 }
 function safeReaddir2(dir) {
   try {
-    return readdirSync7(dir);
+    return readdirSync8(dir);
   } catch {
     return [];
   }
@@ -2144,15 +2353,15 @@ function safeRead(path) {
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join20(CLAUDE_HOME, "hooks");
-  if (!existsSync16(hooksDir)) {
+  const hooksDir = join21(CLAUDE_HOME, "hooks");
+  if (!existsSync17(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join20(hooksDir, name);
+    const abs = join21(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -2172,8 +2381,8 @@ function reportHookScopeCheck(section2) {
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join22 } from "node:path";
 init_config();
 function expandHome(token) {
   return token.replace(/^\$\{HOME\}/, HOME).replace(/^\$HOME/, HOME).replace(/^~/, HOME);
@@ -2211,8 +2420,11 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync17(resolved)) continue;
-        addItem(section2, `${red(failGlyph)} hooks/${event}: command target missing: ${resolved}`);
+        if (existsSync18(resolved)) continue;
+        addItem(
+          section2,
+          `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
+        );
         process.exitCode = 1;
         anyFail = true;
       }
@@ -2221,8 +2433,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join21(CLAUDE_HOME, "settings.json");
-  if (!existsSync17(settingsPath)) {
+  const settingsPath = join22(CLAUDE_HOME, "settings.json");
+  if (!existsSync18(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -2243,17 +2455,221 @@ function reportHooksTargetCheck(section2) {
   }
 }
 
+// src/commands.doctor.checks.hooks.preserve-symlinks.ts
+init_color();
+import { existsSync as existsSync20, readFileSync as readFileSync6 } from "node:fs";
+import { join as join24 } from "node:path";
+
+// src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
+import { closeSync as closeSync2, existsSync as existsSync19, openSync as openSync2, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname3, join as join23, resolve as resolve2 } from "node:path";
+function suppressedRanges(src) {
+  const ranges = [];
+  const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
+  let m;
+  while ((m = re.exec(src)) !== null) {
+    ranges.push([m.index, m.index + m[0].length]);
+  }
+  return ranges;
+}
+function inSuppressedRange(pos, ranges) {
+  for (const [start, end] of ranges) {
+    if (pos >= start && pos < end) return true;
+  }
+  return false;
+}
+function topRelativeSpecifiers(src) {
+  const ranges = suppressedRanges(src);
+  const specifiers = [];
+  const reqRe = /\brequire\s*\(\s*(['"])(\.\.?\/[^'"]*)\1\s*\)/g;
+  let m;
+  while ((m = reqRe.exec(src)) !== null) {
+    if (!inSuppressedRange(m.index, ranges)) specifiers.push(m[2]);
+  }
+  const impRe = /\bfrom\s+(['"])(\.\.?\/[^'"]*)\1/g;
+  while ((m = impRe.exec(src)) !== null) {
+    if (!inSuppressedRange(m.index, ranges)) specifiers.push(m[2]);
+  }
+  return specifiers;
+}
+function specifierIsMissing(specifier, baseDir) {
+  const base = resolve2(baseDir, specifier);
+  if (existsSync19(base)) return false;
+  for (const ext of [".js", ".cjs", ".mjs"]) {
+    if (existsSync19(base + ext)) return false;
+  }
+  for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
+    if (existsSync19(join23(base, idx))) return false;
+  }
+  return true;
+}
+function relativeRequireTargetsBroken(scriptPath) {
+  let realPath;
+  try {
+    realPath = realpathSync3(scriptPath);
+  } catch {
+    return false;
+  }
+  let raw;
+  try {
+    const fd = openSync2(realPath, "r");
+    try {
+      const buf = Buffer.alloc(65536);
+      const bytesRead = readSync(fd, buf, 0, 65536, 0);
+      raw = buf.toString("utf8", 0, bytesRead);
+    } finally {
+      closeSync2(fd);
+    }
+  } catch {
+    return false;
+  }
+  const specifiers = topRelativeSpecifiers(raw);
+  if (specifiers.length === 0) return false;
+  const baseDir = dirname3(realPath);
+  for (const spec of specifiers) {
+    if (specifierIsMissing(spec, baseDir)) return true;
+  }
+  return false;
+}
+
+// src/commands.doctor.checks.hooks.preserve-symlinks.ts
+init_config();
+function expandHome2(token) {
+  return token.replace(/^\$\{HOME\}/, HOME).replace(/^\$HOME/, HOME).replace(/^~/, HOME);
+}
+function stripShellPunct(token) {
+  const head = token.replace(/^['"]+/, "");
+  let end = head.length;
+  while (end > 0 && "'\"`;)|&>".includes(head[end - 1])) end--;
+  return head.slice(0, end);
+}
+function commandTokens(command) {
+  const tokens = [];
+  for (const seg of command.split(/&&|\|\||;|\|/)) {
+    for (const raw of seg.trim().split(/\s+/).filter(Boolean)) {
+      tokens.push(expandHome2(stripShellPunct(raw)));
+    }
+  }
+  return tokens;
+}
+function readPathMapSafe() {
+  const mapPath = join24(REPO_HOME, "path-map.json");
+  if (!existsSync20(mapPath)) return { projects: {} };
+  try {
+    return JSON.parse(readFileSync6(mapPath, "utf8"));
+  } catch {
+    return { projects: {} };
+  }
+}
+function resolvesUnderSymlinkedShared(scriptPath, sharedLinkNames) {
+  for (const name of sharedLinkNames) {
+    const prefix = `${CLAUDE_HOME}/${name}/`;
+    if (scriptPath.startsWith(prefix)) return true;
+  }
+  return false;
+}
+function nodeScriptArg(tokens, nodeIdx) {
+  for (let i = nodeIdx + 1; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.startsWith("-")) continue;
+    if (t.endsWith(".js") || t.endsWith(".cjs")) return t;
+    break;
+  }
+  return null;
+}
+function hasPreserveSymlinksMain(tokens, nodeIdx) {
+  for (let i = nodeIdx + 1; i < tokens.length; i++) {
+    if (tokens[i] === "--preserve-symlinks-main") return true;
+    if (!tokens[i].startsWith("-")) break;
+  }
+  return false;
+}
+function* commandsFromFlatEntries(entries) {
+  for (const entry of entries) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const e = entry;
+    if (e.type === "command" && typeof e.command === "string") yield e.command;
+  }
+}
+function* commandsFromOneGroup(group) {
+  if (typeof group !== "object" || group === null) return;
+  const g = group;
+  if (Array.isArray(g.hooks)) {
+    yield* commandsFromFlatEntries(g.hooks);
+    return;
+  }
+  if (g.type === "command" && typeof g.command === "string") yield g.command;
+}
+function flaggedScript(command, sharedLinkNames) {
+  const tokens = commandTokens(command);
+  const nodeIdx = tokens.indexOf("node");
+  if (nodeIdx < 0) return null;
+  if (hasPreserveSymlinksMain(tokens, nodeIdx)) return null;
+  const script = nodeScriptArg(tokens, nodeIdx);
+  if (script === null) return null;
+  if (!resolvesUnderSymlinkedShared(script, sharedLinkNames)) return null;
+  if (!relativeRequireTargetsBroken(script)) return null;
+  return script;
+}
+function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames) {
+  let anyWarn = false;
+  for (const group of groups) {
+    for (const cmd of commandsFromOneGroup(group)) {
+      const script = flaggedScript(cmd, sharedLinkNames);
+      if (script === null) continue;
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} hooks/${event}: node ${script} needs --preserve-symlinks-main (add it to the hook command in shared/settings.base.json)`
+      );
+      anyWarn = true;
+    }
+  }
+  return anyWarn;
+}
+function reportPreserveSymlinksCheck(section2) {
+  const settingsPath = join24(CLAUDE_HOME, "settings.json");
+  if (!existsSync20(settingsPath)) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
+    );
+    return;
+  }
+  let settings;
+  try {
+    settings = JSON.parse(readFileSync6(settingsPath, "utf8"));
+  } catch {
+    return;
+  }
+  if (settings === null) return;
+  const hooks = settings.hooks;
+  if (typeof hooks !== "object" || hooks === null || Array.isArray(hooks)) {
+    addItem(section2, `${green(okGlyph)} hooks: preserve-symlinks-main not needed`);
+    return;
+  }
+  const map = readPathMapSafe();
+  const sharedLinkNames = allSharedLinks(map);
+  let anyWarn = false;
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    if (checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)) anyWarn = true;
+  }
+  if (!anyWarn) {
+    addItem(section2, `${green(okGlyph)} hooks: preserve-symlinks-main not needed`);
+  }
+}
+
 // src/commands.doctor.ts
 init_config();
 
 // src/commands.doctor.engine.ts
 init_color();
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/commands.doctor.version.ts
 init_color();
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_config();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -2270,7 +2686,7 @@ function compareSemver(a, b) {
 function readLocalVersion() {
   try {
     const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync6(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync7(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
     }
@@ -2297,7 +2713,13 @@ function reportVersionCheck(section2) {
   const localPure = STRICT_SEMVER_PREFIX.exec(local)?.[1] ?? null;
   if (localPure === null) return;
   const latest = fetchLatestVersion();
-  if (latest === null) return;
+  if (latest === null) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} claude-nomad: ${local} (version check skipped: could not determine latest version)`
+    );
+    return;
+  }
   const cmp = compareSemver(localPure, latest);
   if (cmp === 0) {
     addItem(section2, `${green(okGlyph)} claude-nomad: ${local} (latest)`);
@@ -2323,7 +2745,7 @@ function parseMinVersion(spec) {
 function readEnginesNode() {
   try {
     const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync7(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
     return null;
@@ -2352,8 +2774,8 @@ function reportNodeEngineCheck(section2) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import { join as join25 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -2362,7 +2784,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join22(REPO_HOME, ".gitleaks.toml");
+  const tomlPath = join25(REPO_HOME, ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -2374,7 +2796,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync18) {
+function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync21) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -2541,19 +2963,47 @@ function reportActionsDrift(section2, run = execFileSync10) {
   );
 }
 
+// src/commands.doctor.verdict.ts
+init_color();
+function isFailLine(item) {
+  return item.includes(failGlyph);
+}
+function isWarnLine(item) {
+  return !isFailLine(item) && item.includes(warnGlyph);
+}
+function buildVerdictSection(sections) {
+  const summary = section("Summary");
+  const lines = sections.flatMap((s) => s.items).map((item) => item.replace(/^\t/, ""));
+  const failures = lines.filter(isFailLine);
+  const warnings = lines.filter(isWarnLine);
+  for (const line of [...failures, ...warnings]) addItem(summary, line);
+  if (failures.length > 0) {
+    addItem(
+      summary,
+      `${red(failGlyph)} ${failures.length} failure(s), ${warnings.length} warning(s)`
+    );
+  } else if (warnings.length > 0) {
+    addItem(summary, `${yellow(warnGlyph)} ${warnings.length} warning(s)`);
+  } else {
+    addItem(summary, `${green(okGlyph)} healthy`);
+  }
+  return summary;
+}
+
 // src/commands.doctor.ts
 function cmdDoctor(opts = {}) {
-  const host = section("Host");
+  const host = section("Environment");
   reportHostAndPaths(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join23(REPO_HOME, "path-map.json");
-  const rawMap = existsSync19(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join26(REPO_HOME, "path-map.json");
+  const rawMap = existsSync22(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   const hooksScan = section("Hook targets");
   reportHooksTargetCheck(hooksScan);
   reportHookScopeCheck(hooksScan);
+  reportPreserveSymlinksCheck(hooksScan);
   const settings = section("Settings");
   const base = loadBaseSettings(settings);
   const parsedSettings = loadAndReportSettings(settings);
@@ -2571,7 +3021,8 @@ function cmdDoctor(opts = {}) {
   reportActionsDrift(repository);
   const nomadVersion = section("Nomad Version");
   reportVersionCheck(nomadVersion);
-  reportBackupsCheck(nomadVersion);
+  const housekeeping = section("Housekeeping");
+  reportBackupsCheck(housekeeping);
   const depVersions = section("Dependency Versions");
   reportNodeEngineCheck(depVersions);
   reportGitleaksVersionCheck(depVersions);
@@ -2580,7 +3031,7 @@ function cmdDoctor(opts = {}) {
   if (opts.checkShared === true) reportCheckShared(sharedScan, gitleaksReady);
   const schemaScan = section("Schema scan");
   if (opts.checkSchema === true) reportCheckSchema(schemaScan);
-  renderDoctor([
+  const body = [
     nomadVersion,
     depVersions,
     host,
@@ -2590,16 +3041,18 @@ function cmdDoctor(opts = {}) {
     pathMap,
     neverSync,
     repository,
+    housekeeping,
     sharedScan,
     schemaScan
-  ]);
+  ];
+  renderDoctor([...body, buildVerdictSection(body)]);
 }
 
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { existsSync as existsSync21, readdirSync as readdirSync8, statSync as statSync5 } from "node:fs";
-import { join as join26, relative as relative4 } from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync9, statSync as statSync5 } from "node:fs";
+import { join as join29, relative as relative4 } from "node:path";
 
 // src/commands.drop-session.git.ts
 init_config();
@@ -2642,8 +3095,8 @@ function isInIndex(rel) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync20 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { join as join27 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript(id, matches);
@@ -2659,16 +3112,16 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript(id, matches) {
   try {
-    const mapPath = join24(REPO_HOME, "path-map.json");
-    if (!existsSync20(mapPath)) return null;
+    const mapPath = join27(REPO_HOME, "path-map.json");
+    if (!existsSync23(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     for (const rel of matches) {
       const logical = SHARED_PROJECT_LOGICAL.exec(rel)?.[1];
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join24(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync20(live)) return live;
+      const live = join27(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync23(live)) return live;
     }
     return null;
   } catch {
@@ -2682,18 +3135,18 @@ init_utils();
 // src/utils.lockfile.ts
 init_config();
 init_utils();
-import { closeSync as closeSync2, mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join25 } from "node:path";
-var LOCK_PATH = join25(HOME, ".cache", "claude-nomad", "nomad.lock");
+import { closeSync as closeSync3, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join28 } from "node:path";
+var LOCK_PATH = join28(HOME, ".cache", "claude-nomad", "nomad.lock");
 function acquireLock(verb) {
-  mkdirSync5(dirname3(LOCK_PATH), { recursive: true });
+  mkdirSync5(dirname4(LOCK_PATH), { recursive: true });
   try {
-    const fd = openSync2(LOCK_PATH, "wx");
+    const fd = openSync3(LOCK_PATH, "wx");
     try {
       writeFileSync3(fd, String(process.pid));
     } catch (writeErr) {
       try {
-        closeSync2(fd);
+        closeSync3(fd);
       } catch {
       }
       try {
@@ -2712,7 +3165,7 @@ function acquireLock(verb) {
 function releaseLock(handle) {
   if (handle === null) return;
   try {
-    closeSync2(handle.fd);
+    closeSync3(handle.fd);
   } catch {
   }
   try {
@@ -2724,7 +3177,7 @@ function releaseLock(handle) {
 function unlinkIfSamePid(expectedPidStr) {
   let current;
   try {
-    current = readFileSync8(LOCK_PATH, "utf8").trim();
+    current = readFileSync9(LOCK_PATH, "utf8").trim();
   } catch {
     return false;
   }
@@ -2739,7 +3192,7 @@ function unlinkIfSamePid(expectedPidStr) {
 function checkStaleAndRetry(verb) {
   let pidStr;
   try {
-    pidStr = readFileSync8(LOCK_PATH, "utf8").trim();
+    pidStr = readFileSync9(LOCK_PATH, "utf8").trim();
   } catch {
     pidStr = "";
   }
@@ -2766,12 +3219,12 @@ function checkStaleAndRetry(verb) {
 }
 function retryOnce(verb) {
   try {
-    const fd = openSync2(LOCK_PATH, "wx");
+    const fd = openSync3(LOCK_PATH, "wx");
     try {
       writeFileSync3(fd, String(process.pid));
     } catch {
       try {
-        closeSync2(fd);
+        closeSync3(fd);
       } catch {
       }
       try {
@@ -2794,12 +3247,12 @@ function cmdDropSession(id) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync21(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync24(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join26(REPO_HOME, "shared", "projects");
-    if (!existsSync21(repoProjects)) {
+    const repoProjects = join29(REPO_HOME, "shared", "projects");
+    if (!existsSync24(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id);
@@ -2820,13 +3273,13 @@ function cmdDropSession(id) {
 }
 function collectMatches(repoProjects, id) {
   const matches = [];
-  for (const logical of readdirSync8(repoProjects)) {
-    const candidate = join26(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync21(candidate)) {
+  for (const logical of readdirSync9(repoProjects)) {
+    const candidate = join29(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync24(candidate)) {
       matches.push(relative4(REPO_HOME, candidate));
     }
-    const dir = join26(repoProjects, logical, id);
-    if (existsSync21(dir) && statSync5(dir).isDirectory()) {
+    const dir = join29(repoProjects, logical, id);
+    if (existsSync24(dir) && statSync5(dir).isDirectory()) {
       const dirRel = relative4(REPO_HOME, dir);
       const staged = expandStagedDir(dirRel);
       if (staged.length > 0) matches.push(...staged);
@@ -2862,20 +3315,20 @@ function unstageOne(rel) {
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync23, statSync as statSync7 } from "node:fs";
-import { dirname as dirname4, join as join28 } from "node:path";
+import { existsSync as existsSync26, statSync as statSync7 } from "node:fs";
+import { dirname as dirname5, join as join31 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync22, lstatSync as lstatSync6, readFileSync as readFileSync9, readdirSync as readdirSync9, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync25, lstatSync as lstatSync7, readFileSync as readFileSync10, readdirSync as readdirSync10, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join30 } from "node:path";
 init_utils_fs();
 function collectFiles(dir, out) {
-  if (!existsSync22(dir)) return;
-  const st = lstatSync6(dir);
+  if (!existsSync25(dir)) return;
+  const st = lstatSync7(dir);
   if (!st.isDirectory()) return;
-  for (const entry of readdirSync9(dir)) {
-    const abs = join27(dir, entry);
-    const lst = lstatSync6(abs);
+  for (const entry of readdirSync10(dir)) {
+    const abs = join30(dir, entry);
+    const lst = lstatSync7(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -2911,7 +3364,7 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   if (!dryRun && total > 0) {
     for (const { path: filePath, findings } of dirty) {
       backupBeforeWrite(filePath, ts);
-      writeFileSync4(filePath, applyRedactions(readFileSync9(filePath, "utf8"), findings), "utf8");
+      writeFileSync4(filePath, applyRedactions(readFileSync10(filePath, "utf8"), findings), "utf8");
     }
   }
   return { total, dirty };
@@ -2924,14 +3377,14 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript2(id) {
   try {
-    const mapPath = join28(REPO_HOME, "path-map.json");
-    if (!existsSync23(mapPath)) return null;
+    const mapPath = join31(REPO_HOME, "path-map.json");
+    if (!existsSync26(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join28(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync23(live)) return live;
+      const live = join31(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync26(live)) return live;
     }
     return null;
   } catch {
@@ -2949,17 +3402,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync23(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync26(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript2(id);
-    if (localPath === null || !existsSync23(localPath)) {
+    if (localPath === null || !existsSync26(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join28(dirname4(localPath), id);
+    const sessionDir = join31(dirname5(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -3012,8 +3465,8 @@ ${lines}`);
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync8 } from "node:fs";
+import { join as join40 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -3101,8 +3554,8 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync26 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync29 } from "node:fs";
+import { join as join34 } from "node:path";
 
 // src/extras-sync.diff.ts
 init_utils();
@@ -3141,8 +3594,8 @@ function listDivergingFiles(a, b) {
 
 // src/extras-sync.core.ts
 init_config();
-import { cpSync as cpSync4, existsSync as existsSync24, rmSync as rmSync7 } from "node:fs";
-import { join as join29 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync27, rmSync as rmSync8 } from "node:fs";
+import { join as join32 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -3165,9 +3618,9 @@ function assertSafeLocalRoot(localRoot, logical) {
 init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
-  const mapPath = join29(REPO_HOME, "path-map.json");
-  const repoExtras = join29(REPO_HOME, "shared", "extras");
-  if (!existsSync24(mapPath) || opts.requireRepoExtras === true && !existsSync24(repoExtras)) {
+  const mapPath = join32(REPO_HOME, "path-map.json");
+  const repoExtras = join32(REPO_HOME, "shared", "extras");
+  if (!existsSync27(mapPath) || opts.requireRepoExtras === true && !existsSync27(repoExtras)) {
     if (opts.missingMsg !== void 0) log(opts.missingMsg);
     return null;
   }
@@ -3189,18 +3642,18 @@ function* eachExtrasTarget(v, counts) {
       counts.unmapped++;
       continue;
     }
-    for (const dirname6 of dirnames) {
-      if (!whitelist.includes(dirname6)) {
+    for (const dirname7 of dirnames) {
+      if (!whitelist.includes(dirname7)) {
         counts.skipped++;
         continue;
       }
-      yield { logical, localRoot, dirname: dirname6 };
+      yield { logical, localRoot, dirname: dirname7 };
     }
   }
 }
 function copyExtras(src, dst) {
-  rmSync7(dst, { recursive: true, force: true });
-  cpSync4(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
+  rmSync8(dst, { recursive: true, force: true });
+  cpSync5(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
 }
 
 // src/extras-sync.ts
@@ -3209,8 +3662,8 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync25, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join33 } from "node:path";
 init_utils_fs();
 function runExtrasOp(v, dryRun, paths, backup) {
   const counts = { unmapped: 0, skipped: 0 };
@@ -3218,7 +3671,7 @@ function runExtrasOp(v, dryRun, paths, backup) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync25(src)) continue;
+    if (!existsSync28(src)) continue;
     const item = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item);
@@ -3234,14 +3687,14 @@ function remapExtrasPush(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
-  const repoExtras = join30(REPO_HOME, "shared", "extras");
+  const repoExtras = join33(REPO_HOME, "shared", "extras");
   if (!dryRun) mkdirSync6(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname6 }) => ({
-      src: join30(localRoot, dirname6),
-      dst: join30(repoExtras, logical, dirname6)
+    ({ localRoot, logical, dirname: dirname7 }) => ({
+      src: join33(localRoot, dirname7),
+      dst: join33(repoExtras, logical, dirname7)
     }),
     (dst) => backupRepoWrite(dst, ts, REPO_HOME)
   );
@@ -3254,13 +3707,13 @@ function remapExtrasPull(ts, opts = {}) {
     missingMsg: "no path-map or repo extras dir; skipping extras remap"
   });
   if (v === null) return { unmapped: 0, skipped: 0, pulled: [], wouldPull: [] };
-  const repoExtras = join30(REPO_HOME, "shared", "extras");
+  const repoExtras = join33(REPO_HOME, "shared", "extras");
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname6 }) => ({
-      src: join30(repoExtras, logical, dirname6),
-      dst: join30(localRoot, dirname6)
+    ({ localRoot, logical, dirname: dirname7 }) => ({
+      src: join33(repoExtras, logical, dirname7),
+      dst: join33(localRoot, dirname7)
     }),
     // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -3274,16 +3727,16 @@ function divergenceCheckExtras(ts) {
   const v = loadValidatedExtras({});
   if (v === null) return;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join31(BACKUP_BASE, ts, "extras");
-  for (const { logical, localRoot, dirname: dirname6 } of eachExtrasTarget(v, counts)) {
-    const local = join31(localRoot, dirname6);
-    const repo = join31(REPO_HOME, "shared", "extras", logical, dirname6);
-    if (!existsSync26(local) || !existsSync26(repo)) continue;
+  const backupRoot = join34(BACKUP_BASE, ts, "extras");
+  for (const { logical, localRoot, dirname: dirname7 } of eachExtrasTarget(v, counts)) {
+    const local = join34(localRoot, dirname7);
+    const repo = join34(REPO_HOME, "shared", "extras", logical, dirname7);
+    if (!existsSync29(local) || !existsSync29(repo)) continue;
     const diff = listDivergingFiles(local, repo);
     if (diff.length === 0) continue;
-    const projectBackupRoot = join31(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join34(backupRoot, encodePath(localRoot));
     warn(
-      `local ${dirname6} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will overwrite them (backups at ${projectBackupRoot}/)`
+      `local ${dirname7} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will overwrite them (backups at ${projectBackupRoot}/)`
     );
     for (const f of diff) warn(`  ${f}`);
   }
@@ -3294,8 +3747,8 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { existsSync as existsSync27, lstatSync as lstatSync7, rmSync as rmSync8 } from "node:fs";
-import { join as join32 } from "node:path";
+import { existsSync as existsSync30, lstatSync as lstatSync8, rmSync as rmSync9 } from "node:fs";
+import { join as join35 } from "node:path";
 function emitAutoMove(onPreview, linkPath, ts, name) {
   if (onPreview) {
     onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
@@ -3314,41 +3767,41 @@ function applySharedLinks(ts, map, opts = {}) {
   const dryRun = opts.dryRun === true;
   const linkNames = allSharedLinks(map);
   for (const name of linkNames) {
-    const linkPath = join32(CLAUDE_HOME, name);
-    const target = join32(REPO_HOME, "shared", name);
-    if (!existsSync27(linkPath)) continue;
-    if (lstatSync7(linkPath).isSymbolicLink()) continue;
-    if (!existsSync27(target)) continue;
+    const linkPath = join35(CLAUDE_HOME, name);
+    const target = join35(REPO_HOME, "shared", name);
+    if (!existsSync30(linkPath)) continue;
+    if (lstatSync8(linkPath).isSymbolicLink()) continue;
+    if (!existsSync30(target)) continue;
     if (dryRun) {
       emitAutoMove(opts.onPreview, linkPath, ts, name);
       continue;
     }
     backupBeforeWrite(linkPath, ts);
-    rmSync8(linkPath, { recursive: true, force: true });
+    rmSync9(linkPath, { recursive: true, force: true });
   }
   for (const name of linkNames) {
-    const target = join32(REPO_HOME, "shared", name);
-    if (!existsSync27(target)) continue;
+    const target = join35(REPO_HOME, "shared", name);
+    if (!existsSync30(target)) continue;
     if (dryRun) {
-      emitCreate(opts.onPreview, join32(CLAUDE_HOME, name), target);
+      emitCreate(opts.onPreview, join35(CLAUDE_HOME, name), target);
       continue;
     }
-    ensureSymlink(join32(CLAUDE_HOME, name), target);
+    ensureSymlink(join35(CLAUDE_HOME, name), target);
   }
 }
 function regenerateSettings(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
-  const basePath = join32(REPO_HOME, "shared", "settings.base.json");
-  const hostPath = join32(REPO_HOME, "hosts", `${HOST}.json`);
-  if (!existsSync27(basePath)) {
+  const basePath = join35(REPO_HOME, "shared", "settings.base.json");
+  const hostPath = join35(REPO_HOME, "hosts", `${HOST}.json`);
+  if (!existsSync30(basePath)) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const base = readJson(basePath);
-  const hasOverrides = existsSync27(hostPath);
+  const hasOverrides = existsSync30(hostPath);
   const overrides = hasOverrides ? readJson(hostPath) : {};
   const merged = deepMerge(base, overrides);
-  const settingsPath = join32(CLAUDE_HOME, "settings.json");
-  if (!hasOverrides && existsSync27(settingsPath)) {
+  const settingsPath = join35(CLAUDE_HOME, "settings.json");
+  if (!hasOverrides && existsSync30(settingsPath)) {
     try {
       const existing = readJson(settingsPath);
       const baseKeys = new Set(Object.keys(base));
@@ -3374,8 +3827,8 @@ function regenerateSettings(ts, opts = {}) {
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync28 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync31 } from "node:fs";
+import { join as join36 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -3661,7 +4114,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync28(path)) return null;
+  if (!existsSync31(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -3675,12 +4128,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync28(hostPath)) {
+  if (hostOverrides === null && existsSync31(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = deepMerge(base, hostOverrides ?? {});
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync28(settingsPath)) {
+  if (current === null && existsSync31(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const rawEqual = JSON.stringify(current ?? {}, null, 2) === JSON.stringify(merged, null, 2);
@@ -3718,9 +4171,9 @@ function computePreview(ts, map, verb = "pull") {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join33(REPO_HOME, "shared", "settings.base.json"),
-    join33(REPO_HOME, "hosts", `${HOST}.json`),
-    join33(CLAUDE_HOME, "settings.json")
+    join36(REPO_HOME, "shared", "settings.base.json"),
+    join36(REPO_HOME, "hosts", `${HOST}.json`),
+    join36(CLAUDE_HOME, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -3736,21 +4189,21 @@ function computePreview(ts, map, verb = "pull") {
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync30 } from "node:fs";
+import { existsSync as existsSync33 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
-import { readFileSync as readFileSync10, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join36 } from "node:path";
+import { readFileSync as readFileSync11, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join39 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync5, existsSync as existsSync29, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
-import { dirname as dirname5, join as join34, sep as sep2 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync32, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
+import { dirname as dirname6, join as join37, sep as sep3 } from "node:path";
 init_push_gitleaks_scan();
 init_utils_json();
 init_utils();
@@ -3781,8 +4234,8 @@ function resolveStagedDir(localPath, map) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join34(CLAUDE_HOME, "projects", encodePath(abs)) + sep2)) {
-      return join34(REPO_HOME, "shared", "projects", logical);
+    if (localPath.startsWith(join37(CLAUDE_HOME, "projects", encodePath(abs)) + sep3)) {
+      return join37(REPO_HOME, "shared", "projects", logical);
     }
   }
   return null;
@@ -3804,7 +4257,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join34(dirname5(localPath), sid);
+  const sessionDir = join37(dirname6(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -3838,25 +4291,25 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync7(stagedProjectDir, { recursive: true });
-  cpSync5(localPath, join34(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync29(sessionDir)) {
-    cpSync5(sessionDir, join34(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync6(localPath, join37(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync32(sessionDir)) {
+    cpSync6(sessionDir, join37(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
 
 // src/commands.push.recovery.drop.ts
 init_config();
-import { rmSync as rmSync9 } from "node:fs";
-import { join as join35 } from "node:path";
+import { rmSync as rmSync10 } from "node:fs";
+import { join as join38 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   for (const logical of logicals) {
-    const jsonl = join35(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join35(REPO_HOME, "shared", "projects", logical, sid);
-    rmSync9(jsonl, { force: true });
-    rmSync9(dir, { recursive: true, force: true });
+    const jsonl = join38(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join38(REPO_HOME, "shared", "projects", logical, sid);
+    rmSync10(jsonl, { force: true });
+    rmSync10(dir, { recursive: true, force: true });
   }
   return true;
 }
@@ -3972,10 +4425,10 @@ function applyThenRescan(scanVerdict, repoHome) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome) {
-  const ignPath = join36(repoHome, ".gitleaksignore");
+  const ignPath = join39(repoHome, ".gitleaksignore");
   let before;
   try {
-    before = readFileSync10(ignPath, "utf8");
+    before = readFileSync11(ignPath, "utf8");
   } catch {
     before = null;
   }
@@ -3983,7 +4436,7 @@ function allowThenRescan(append, scanVerdict, repoHome) {
   try {
     return applyThenRescan(scanVerdict, repoHome);
   } catch (err) {
-    if (before === null) rmSync10(ignPath, { force: true });
+    if (before === null) rmSync11(ignPath, { force: true });
     else writeFileSync5(ignPath, before, "utf8");
     throw err;
   }
@@ -4070,7 +4523,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync30;
+  const check = deps.existsSyncFn ?? existsSync33;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -4276,8 +4729,8 @@ function handleWedge(repo, forceRemote) {
 function cmdPull(opts = {}) {
   const dryRun = opts.dryRun === true;
   const forceRemote = opts.forceRemote === true;
-  if (!existsSync31(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
-  if (!existsSync31(join37(REPO_HOME, "shared", "settings.base.json"))) {
+  if (!existsSync34(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync34(join40(REPO_HOME, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -4286,7 +4739,7 @@ function cmdPull(opts = {}) {
     const ts = freshBackupTs(BACKUP_BASE);
     handleWedge(REPO_HOME, forceRemote);
     if (!dryRun) {
-      const backupRoot = join37(BACKUP_BASE, ts);
+      const backupRoot = join40(BACKUP_BASE, ts);
       try {
         mkdirSync8(backupRoot, { recursive: true });
       } catch (err) {
@@ -4297,8 +4750,8 @@ function cmdPull(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
     gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", REPO_HOME);
-    const mapPath = join37(REPO_HOME, "path-map.json");
-    const map = existsSync31(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join40(REPO_HOME, "path-map.json");
+    const map = existsSync34(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     if (dryRun) {
       computePreview(ts, map, "pull");
@@ -4320,8 +4773,8 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync33 } from "node:fs";
-import { join as join39, relative as relative5 } from "node:path";
+import { existsSync as existsSync36 } from "node:fs";
+import { join as join42, relative as relative5 } from "node:path";
 
 // src/commands.push.allowlist.ts
 init_config();
@@ -4401,9 +4854,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync32, mkdirSync as mkdirSync9, readdirSync as readdirSync10, rmSync as rmSync11 } from "node:fs";
+import { copyFileSync, existsSync as existsSync35, mkdirSync as mkdirSync9, readdirSync as readdirSync11, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join38 } from "node:path";
+import { join as join41 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -4418,13 +4871,13 @@ function stageSessions(tmpRoot, map) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join38(CLAUDE_HOME, "projects");
-  if (!existsSync32(localProjects)) return 0;
+  const localProjects = join41(CLAUDE_HOME, "projects");
+  if (!existsSync35(localProjects)) return 0;
   let staged = 0;
-  for (const dir of readdirSync10(localProjects)) {
+  for (const dir of readdirSync11(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join38(localProjects, dir), join38(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join41(localProjects, dir), join41(tmpRoot, "shared", "projects", logical));
     staged++;
   }
   return staged;
@@ -4438,11 +4891,11 @@ function stageExtras(tmpRoot, map) {
     assertSafeLogical(logical);
     const localRoot = map.projects[logical]?.[HOST];
     if (!localRoot || localRoot === "TBD") continue;
-    for (const dirname6 of dirnames) {
-      if (!whitelist.includes(dirname6)) continue;
-      const src = join38(localRoot, dirname6);
-      if (!existsSync32(src)) continue;
-      const dst = join38(tmpRoot, "shared", "extras", logical, dirname6);
+    for (const dirname7 of dirnames) {
+      if (!whitelist.includes(dirname7)) continue;
+      const src = join41(localRoot, dirname7);
+      if (!existsSync35(src)) continue;
+      const dst = join41(tmpRoot, "shared", "extras", logical, dirname7);
       copyExtras(src, dst);
       staged++;
     }
@@ -4450,19 +4903,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map) {
-  const cacheDir = join38(homedir5(), ".cache", "claude-nomad");
+  const cacheDir = join41(homedir5(), ".cache", "claude-nomad");
   mkdirSync9(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join38(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join41(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join38(REPO_HOME, ".gitleaksignore");
-    if (existsSync32(ignoreFile)) {
-      copyFileSync(ignoreFile, join38(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join41(REPO_HOME, ".gitleaksignore");
+    if (existsSync35(ignoreFile)) {
+      copyFileSync(ignoreFile, join41(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -4475,7 +4928,7 @@ function previewPushLeaks(map) {
     }
     return verdictFromFindings(findings);
   } finally {
-    rmSync11(tmpRoot, { recursive: true, force: true });
+    rmSync12(tmpRoot, { recursive: true, force: true });
   }
 }
 
@@ -4484,7 +4937,7 @@ init_utils();
 init_utils_fs();
 init_utils_json();
 function guardGitlinks() {
-  const gitlinks = findGitlinks(join39(REPO_HOME, "shared"));
+  const gitlinks = findGitlinks(join42(REPO_HOME, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative5(REPO_HOME, p);
@@ -4536,7 +4989,7 @@ async function cmdPush(opts = {}) {
   const allowAll = opts.allowAll === true;
   const allowRule = opts.allowRule;
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
-  if (!existsSync33(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  if (!existsSync36(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -4554,8 +5007,8 @@ async function cmdPush(opts = {}) {
       renderNoScanTree(st);
       return;
     }
-    const mapPath = join39(REPO_HOME, "path-map.json");
-    if (!existsSync33(mapPath)) {
+    const mapPath = join42(REPO_HOME, "path-map.json");
+    if (!existsSync36(mapPath)) {
       if (dryRun) return runDryRunPreview(st, null);
       die("path-map.json missing, cannot enforce push allow-list");
     }
@@ -4595,17 +5048,17 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync34 } from "node:fs";
-import { join as join40 } from "node:path";
+import { existsSync as existsSync37 } from "node:fs";
+import { join as join43 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
-    if (!existsSync34(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+    if (!existsSync37(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
     const ts = freshBackupTs(BACKUP_BASE);
-    const mapPath = join40(REPO_HOME, "path-map.json");
-    const map = existsSync34(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join43(REPO_HOME, "path-map.json");
+    const map = existsSync37(mapPath) ? readPathMap(mapPath) : { projects: {} };
     computePreview(ts, map, "diff");
   } catch (err) {
     if (err instanceof NomadFatal) {
@@ -4619,8 +5072,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync36, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join45 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -4701,31 +5154,31 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync6, existsSync as existsSync35, rmSync as rmSync12, statSync as statSync9 } from "node:fs";
-import { join as join41 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync38, rmSync as rmSync13, statSync as statSync9 } from "node:fs";
+import { join as join44 } from "node:path";
 function snapshotIntoShared(map) {
   for (const name of allSharedLinks(map)) {
-    const src = join41(CLAUDE_HOME, name);
-    if (!existsSync35(src)) continue;
-    const dst = join41(REPO_HOME, "shared", name);
+    const src = join44(CLAUDE_HOME, name);
+    if (!existsSync38(src)) continue;
+    const dst = join44(REPO_HOME, "shared", name);
     if (statSync9(src).isDirectory()) {
-      const gk = join41(dst, ".gitkeep");
-      if (existsSync35(gk)) rmSync12(gk);
-      cpSync6(src, dst, { recursive: true, force: false, errorOnExist: true });
+      const gk = join44(dst, ".gitkeep");
+      if (existsSync38(gk)) rmSync13(gk);
+      cpSync7(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join41(CLAUDE_HOME, "settings.json");
-  if (existsSync35(userSettings)) {
+  const userSettings = join44(CLAUDE_HOME, "settings.json");
+  if (existsSync38(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join41(REPO_HOME, "hosts", `${HOST}.json`);
+    const hostFile = join44(REPO_HOME, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -4738,14 +5191,14 @@ var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.cl
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome) {
   const candidates = [
-    join42(repoHome, "shared", "settings.base.json"),
-    join42(repoHome, "shared", "CLAUDE.md"),
-    join42(repoHome, "path-map.json"),
-    join42(repoHome, "hosts"),
-    join42(repoHome, "shared")
+    join45(repoHome, "shared", "settings.base.json"),
+    join45(repoHome, "shared", "CLAUDE.md"),
+    join45(repoHome, "path-map.json"),
+    join45(repoHome, "hosts"),
+    join45(repoHome, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync36(c)) return c;
+    if (existsSync39(c)) return c;
   }
   return null;
 }
@@ -4758,25 +5211,25 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync10(join42(REPO_HOME, "shared"), { recursive: true });
-  mkdirSync10(join42(REPO_HOME, "hosts"), { recursive: true });
+  mkdirSync10(join45(REPO_HOME, "shared"), { recursive: true });
+  mkdirSync10(join45(REPO_HOME, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync10(join42(REPO_HOME, "shared", name), { recursive: true });
+    mkdirSync10(join45(REPO_HOME, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join42(CLAUDE_HOME, "CLAUDE.md");
-  if (!snapshot || !existsSync36(userClaudeMd)) {
-    writeFileSync6(join42(REPO_HOME, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join45(CLAUDE_HOME, "CLAUDE.md");
+  if (!snapshot || !existsSync39(userClaudeMd)) {
+    writeFileSync6(join45(REPO_HOME, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     log("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join42(REPO_HOME, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join45(REPO_HOME, "shared", name, ".gitkeep"), "");
     log(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync6(join42(REPO_HOME, "hosts", ".gitkeep"), "");
+  writeFileSync6(join45(REPO_HOME, "hosts", ".gitkeep"), "");
   log("created hosts/.gitkeep");
-  writeJsonAtomic(join42(REPO_HOME, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join45(REPO_HOME, "shared", "settings.base.json"), {});
   log("created shared/settings.base.json");
-  writeJsonAtomic(join42(REPO_HOME, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join45(REPO_HOME, "path-map.json"), { projects: {} });
   log("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -4970,6 +5423,23 @@ function parseCleanArgs(argv) {
   return { dryRun: st.dryRun, olderThan: st.olderThan, keep: st.keep };
 }
 
+// src/nomad.dispatch.eject.ts
+function parseEjectArgs(argv) {
+  let dryRun = false;
+  let i = 3;
+  while (i < argv.length) {
+    const token = argv[i];
+    if (token === "--dry-run") {
+      if (dryRun) return null;
+      dryRun = true;
+    } else {
+      return null;
+    }
+    i++;
+  }
+  return { dryRun };
+}
+
 // src/nomad.dispatch.allow.ts
 function parseAllowArgs(argv) {
   const positionals = argv.slice(3);
@@ -5060,7 +5530,7 @@ function parsePushArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.42.0",
+  version: "0.44.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -5219,6 +5689,11 @@ var DEFAULT_HELP = [
   cont("symlink, and stage for push. <name> must be in SHARED_LINKS or sharedDirs."),
   row("       --dry-run", "Preview backup, move, and git-add without writing."),
   "",
+  row("  eject", "Materialize every managed ~/.claude/ symlink into a real copy so the"),
+  cont("setup keeps working after deleting the sync repo. Prints a"),
+  cont("manual-remainder checklist (uninstall CLI, drop env vars, optional deletes)."),
+  row("       --dry-run", "List what would be materialized without writing anything."),
+  "",
   row(
     "  redact <session-id>",
     "Rewrite the secret span in the local source transcript for a session,"
@@ -5255,15 +5730,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync37, readFileSync as readFileSync11, readdirSync as readdirSync11 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync40, readFileSync as readFileSync12, readdirSync as readdirSync12 } from "node:fs";
+import { join as join46 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join43(CLAUDE_HOME, "projects");
-  if (!existsSync37(projectsRoot)) {
+  const projectsRoot = join46(CLAUDE_HOME, "projects");
+  if (!existsSync40(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -5277,8 +5752,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join43(REPO_HOME, "path-map.json");
-  if (!existsSync37(mapPath)) {
+  const mapPath = join46(REPO_HOME, "path-map.json");
+  if (!existsSync40(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -5300,14 +5775,14 @@ function resumeCmd(sessionId) {
   console.log(`cd ${shQuote(hit.localPath)} && claude --resume ${shQuote(sessionId)}`);
 }
 function findTranscriptPath(projectsRoot, sessionId) {
-  for (const dir of readdirSync11(projectsRoot)) {
-    const candidate = join43(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync37(candidate)) return candidate;
+  for (const dir of readdirSync12(projectsRoot)) {
+    const candidate = join46(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync40(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync11(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync12(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);
@@ -5436,6 +5911,15 @@ try {
       cmdAdopt(name, { dryRun: sub === "--dry-run" });
       break;
     }
+    case "eject": {
+      const ejectArgs = parseEjectArgs(process.argv);
+      if (ejectArgs === null) {
+        console.error("usage: nomad eject [--dry-run]");
+        process.exit(1);
+      }
+      cmdEject({ dryRun: ejectArgs.dryRun });
+      break;
+    }
     case "doctor":
       if (process.argv[3] === void 0) {
         cmdDoctor();