claude-nomad 0.44.0 → 0.45.0

package/.gitleaks.toml

@@ -39,6 +39,27 @@ paths = [
 ]
 condition = "AND"
 
+# Path-scoped: SSH public-key fingerprints in git signature-verification
+# output (`git log --show-signature`, `git verify-commit`) land in session
+# transcripts as `Good "git" signature for <signer> with ED25519 key
+# SHA256:<43-char base64>`. The fingerprint is a hash of a PUBLIC key, not a
+# credential, but its 43-char base64 body trips generic-api-key. Anchoring on
+# the surrounding `with <keytype> key SHA256:` structure (via
+# regexTarget = "line") keeps this from whitelisting a bare token: a real
+# secret is never preceded by an SSH key-type label and the SHA256: scheme
+# prefix. `condition = "AND"` plus the session-jsonl path scope double-locks
+# it to synced transcripts.
+[[allowlists]]
+description = "claude-nomad: SSH public-key fingerprints (with <keytype> key SHA256:<b64>) in git signature output in synced session transcripts"
+regexTarget = "line"
+regexes = [
+    '''with (?:ED25519|ED25519-SK|ECDSA|ECDSA-SK|RSA|DSA) key SHA256:[A-Za-z0-9+/]{43}''',
+]
+paths = [
+    '''^shared/projects/[^/]+/.*\.jsonl$''',
+]
+condition = "AND"
+
 # Path-scoped: SonarCloud issue-listing tool output (`gh`/sonar API dumps of
 # the form `key: <20-char id>` immediately followed by `rule: <lang>:S<n>`)
 # lands in session transcripts during PR reviews. The issue key is an opaque

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## [0.45.0](https://github.com/funkadelic/claude-nomad/compare/v0.44.1...v0.45.0) (2026-06-07)
+
+
+### Added
+
+* **doctor:** warn when settings.json drifts from the base+host merge ([#259](https://github.com/funkadelic/claude-nomad/issues/259)) ([6401732](https://github.com/funkadelic/claude-nomad/commit/6401732199aa9f883de78b15b323ec4dfecf8d3f))
+
+
+### Changed
+
+* **gitleaks:** allowlist SSH key fingerprints in signature output ([#257](https://github.com/funkadelic/claude-nomad/issues/257)) ([ca310aa](https://github.com/funkadelic/claude-nomad/commit/ca310aa7f3a23b152ed149224400d60332ada037))
+
+
+### Testing
+
+* kill mutation survivors from the full Stryker sweep ([#260](https://github.com/funkadelic/claude-nomad/issues/260)) ([314e315](https://github.com/funkadelic/claude-nomad/commit/314e31587cb97e0fdf5b410587bb0ca64a2e46d5))
+
+## [0.44.1](https://github.com/funkadelic/claude-nomad/compare/v0.44.0...v0.44.1) (2026-06-06)
+
+
+### Fixed
+
+* **config:** read HOME from process.env before os.homedir() ([#255](https://github.com/funkadelic/claude-nomad/issues/255)) ([2d5d679](https://github.com/funkadelic/claude-nomad/commit/2d5d67930196bd33f68de608385d4254f203f758))
+* **output:** list per-item lines without info glyph ([#251](https://github.com/funkadelic/claude-nomad/issues/251)) ([bdbebee](https://github.com/funkadelic/claude-nomad/commit/bdbebee506d69eeffc91d609c44110f5d4f38e25))
+
+
+### Changed
+
+* **config:** resolve HOME-derived paths at call time ([#254](https://github.com/funkadelic/claude-nomad/issues/254)) ([db007fc](https://github.com/funkadelic/claude-nomad/commit/db007fceb92c435ad8c0149119691fdbdb6d9aaa))
+
+
+### Documentation
+
+* mark the HOME-isolation mutation-testing limitation resolved ([#256](https://github.com/funkadelic/claude-nomad/issues/256)) ([83f462d](https://github.com/funkadelic/claude-nomad/commit/83f462d51b991f3ecc7ce853c4694163fbb0b859))
+
+
+### Testing
+
+* add Stryker mutation-testing toolchain and prune zero-kill test ([#253](https://github.com/funkadelic/claude-nomad/issues/253)) ([c7339f1](https://github.com/funkadelic/claude-nomad/commit/c7339f11dd1dc28fa8fa73f744805dc0ca005855))
+
 ## [0.44.0](https://github.com/funkadelic/claude-nomad/compare/v0.43.0...v0.44.0) (2026-06-05)
 
 

package/README.md

@@ -37,7 +37,9 @@ survives different file paths and your secrets never ride along.
   `--dry-run` on pull and push prints the plan without writing anything.
 - **One command tells you what is wrong.** `nomad doctor` is a read-only health check: wedged sync
   repo, broken hook references, hooks that would crash on session start because of a missing
-  `--preserve-symlinks-main` flag, version drift, oversized backup cache, each with a fix hint.
+  `--preserve-symlinks-main` flag, version drift, oversized backup cache, and settings drift (warns
+  when `~/.claude/settings.json` no longer matches the base+host merge nomad would write, the
+  silent-clobber case, with `nomad pull` as the fix), each with a fix hint.
 - **Self-healing sync.** Every overwrite is backed up first, and `nomad pull --force-remote`
   recovers a sync repo stuck mid-rebase while parking your stranded work on a branch, refusing
   entirely if shared config is at risk.