claude-nomad 0.44.0 → 0.45.0

package/dist/nomad.mjs

@@ -170,7 +170,7 @@ function gitOrFatal(args, context, cwd) {
     throw new NomadFatal(`${context} failed`);
   }
 }
-var log, warn, fail, NomadFatal, die, gitStatusPorcelainZ;
+var log, warn, fail, item, NomadFatal, die, gitStatusPorcelainZ;
 var init_utils = __esm({
   "src/utils.ts"() {
     "use strict";
@@ -182,6 +182,7 @@ var init_utils = __esm({
     fail = (msg) => {
       console.error(`${red(failGlyph)} ${msg}`);
     };
+    item = (msg) => console.log(dim(`  ${msg}`));
     NomadFatal = class extends Error {
       constructor(message) {
         super(message);
@@ -360,6 +361,18 @@ var init_settings_keys = __esm({
 // src/config.ts
 import { homedir, hostname } from "node:os";
 import { join, resolve } from "node:path";
+function home() {
+  return process.env.HOME || homedir();
+}
+function claudeHome() {
+  return resolve(home(), ".claude");
+}
+function repoHome() {
+  return process.env.NOMAD_REPO || resolve(home(), "claude-nomad");
+}
+function backupBase() {
+  return join(home(), ".cache", "claude-nomad", "backup");
+}
 function allSharedLinks(map) {
   const extras = [];
   for (const entry of map.sharedDirs ?? []) {
@@ -373,7 +386,7 @@ function allSharedLinks(map) {
   }
   return [...SHARED_LINKS, ...extras];
 }
-var HOME, CLAUDE_HOME, BACKUP_BASE, REPO_HOME, SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, HOST, SHARED_LINKS, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
+var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, HOST, SHARED_LINKS, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -381,10 +394,6 @@ var init_config = __esm({
     init_utils();
     init_config_never_sync();
     init_settings_keys();
-    HOME = homedir();
-    CLAUDE_HOME = resolve(HOME, ".claude");
-    BACKUP_BASE = join(HOME, ".cache", "claude-nomad", "backup");
-    REPO_HOME = process.env.NOMAD_REPO || resolve(HOME, "claude-nomad");
     SETTINGS_SCHEMA_URL = "https://json.schemastore.org/claude-code-settings.json";
     NPM_REGISTRY_LATEST_URL = "https://registry.npmjs.org/claude-nomad/latest";
     GITLEAKS_PINNED_VERSION = "8.30.1";
@@ -526,18 +535,19 @@ function ensureSymlink(linkPath, target) {
 }
 function backupBeforeWrite(absPath, ts) {
   if (!existsSync(absPath)) return;
-  const rel = relative(CLAUDE_HOME, absPath);
+  const claude = claudeHome();
+  const rel = relative(claude, absPath);
   if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join2(BACKUP_BASE, ts);
+  const backupRoot = join2(backupBase(), ts);
   const dst = join2(backupRoot, rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
 }
-function backupRepoWrite(absPath, ts, repoHome) {
+function backupRepoWrite(absPath, ts, repoHome2) {
   if (!existsSync(absPath)) return;
-  const rel = relative(repoHome, absPath);
+  const rel = relative(repoHome2, absPath);
   if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join2(BACKUP_BASE, ts, "repo");
+  const backupRoot = join2(backupBase(), ts, "repo");
   const dst = join2(backupRoot, rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
@@ -546,7 +556,7 @@ function backupExtrasWrite(absPath, ts, projectRoot) {
   if (!existsSync(absPath)) return;
   const rel = relative(projectRoot, absPath);
   if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join2(BACKUP_BASE, ts, "extras");
+  const backupRoot = join2(backupBase(), ts, "extras");
   const dst = join2(backupRoot, encodePath(projectRoot), rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
@@ -565,8 +575,8 @@ import { existsSync as existsSync11, mkdtempSync, readFileSync as readFileSync3,
 import { tmpdir } from "node:os";
 import { join as join12 } from "node:path";
 import { fileURLToPath } from "node:url";
-function resolveTomlPath() {
-  const repoToml = join12(REPO_HOME, ".gitleaks.toml");
+function resolveTomlPath(repo = repoHome()) {
+  const repoToml = join12(repo, ".gitleaks.toml");
   if (existsSync11(repoToml)) return repoToml;
   const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
   return existsSync11(bundled) ? bundled : null;
@@ -582,9 +592,10 @@ ${overlayBody}`;
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
-  const overlayPath = join12(REPO_HOME, ".gitleaks.overlay.toml");
-  const repoToml = join12(REPO_HOME, ".gitleaks.toml");
-  const bundled = resolveTomlPath();
+  const repo = repoHome();
+  const overlayPath = join12(repo, ".gitleaks.overlay.toml");
+  const repoToml = join12(repo, ".gitleaks.toml");
+  const bundled = resolveTomlPath(repo);
   if (!existsSync11(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
@@ -696,24 +707,23 @@ function probeGitleaks() {
     if (tempPath !== null) rmSync4(tempPath, { recursive: true, force: true });
   }
 }
-function rebaseBeforePush() {
+function rebaseBeforePush(repo) {
   try {
     execFileSync2("git", ["pull", "--rebase", "--autostash"], {
-      cwd: REPO_HOME,
+      cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
   } catch (err) {
     const e = err;
     if (e.stderr) process.stderr.write(e.stderr);
     throw new NomadFatal(
-      'rebase failed; if a conflict was reported, resolve it in ~/claude-nomad/ and run "git rebase --continue" (or "git rebase --abort" to give up). Re-run nomad push after resolution.'
+      `rebase failed; if a conflict was reported, resolve it in ${repo} and run "git rebase --continue" (or "git rebase --abort" to give up). Re-run nomad push after resolution.`
     );
   }
 }
 var init_push_checks = __esm({
   "src/push-checks.ts"() {
     "use strict";
-    init_config();
     init_push_gitleaks_config();
     init_utils();
   }
@@ -937,10 +947,10 @@ function verdictScanError(text) {
   process.exitCode = 1;
   return { leak: false, verdictRow: failRow(text), recovery: null, findings: [] };
 }
-function scanPushVerdict() {
+function scanPushVerdict(repo) {
   let findings;
   try {
-    findings = scanStagedTree(REPO_HOME, true);
+    findings = scanStagedTree(repo, true);
   } catch (err) {
     if (err.code === "ENOENT") {
       return {
@@ -970,7 +980,6 @@ var init_push_leak_verdict = __esm({
   "src/push-leak-verdict.ts"() {
     "use strict";
     init_color();
-    init_config();
     init_push_checks();
     init_push_gitleaks();
     noLeaksRow = () => `${green(okGlyph)} no leaks`;
@@ -995,8 +1004,8 @@ function lexists(p) {
     return false;
   }
 }
-function readMapIfPresent(repoHome) {
-  const mapPath = join3(repoHome, "path-map.json");
+function readMapIfPresent(repoHome2) {
+  const mapPath = join3(repoHome2, "path-map.json");
   return existsSync2(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function isConfiguredTarget(name, map) {
@@ -1006,14 +1015,14 @@ function isValidAdoptName(name) {
   if (SHARED_LINKS.includes(name)) return true;
   return isValidSharedDir(name);
 }
-function performAdoptMove(name, linkPath, sharedTarget) {
-  const ts = freshBackupTs(BACKUP_BASE);
+function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
+  const ts = freshBackupTs(backup);
   backupBeforeWrite(linkPath, ts);
   cpSync2(linkPath, sharedTarget, { recursive: true, force: true, preserveTimestamps: true });
   rmSync(linkPath, { recursive: true, force: true });
   ensureSymlink(linkPath, sharedTarget);
   const rel = join3("shared", name);
-  gitOrFatal(["add", "--", rel], `git add shared/${name}`, REPO_HOME);
+  gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
   log(`adopted ${name}; ${ADOPT_PUSH_HINT}`);
 }
 function cmdAdopt(name, opts = {}) {
@@ -1022,15 +1031,18 @@ function cmdAdopt(name, opts = {}) {
     fail(`invalid name: ${JSON.stringify(name)}`);
     process.exit(1);
   }
-  const map = readMapIfPresent(REPO_HOME);
+  const repo = repoHome();
+  const claude = claudeHome();
+  const backup = backupBase();
+  const map = readMapIfPresent(repo);
   if (!isConfiguredTarget(name, map)) {
     fail(
       `${name}: not a configured shared target. Add it to sharedDirs in path-map.json first, then re-run adopt.`
     );
     process.exit(1);
   }
-  const linkPath = join3(CLAUDE_HOME, name);
-  const sharedTarget = join3(REPO_HOME, "shared", name);
+  const linkPath = join3(claude, name);
+  const sharedTarget = join3(repo, "shared", name);
   if (!existsSync2(linkPath)) {
     log(`${name}: nothing to adopt (not present in ~/.claude/)`);
     return;
@@ -1044,14 +1056,14 @@ function cmdAdopt(name, opts = {}) {
     process.exit(1);
   }
   if (dryRun) {
-    const ts = freshBackupTs(BACKUP_BASE);
+    const ts = freshBackupTs(backup);
     log(`would backup: ${linkPath} -> backup/${ts}/${name}`);
     log(`would move: ${linkPath} -> shared/${name}`);
     log(`would stage: shared/${name}`);
     return;
   }
   try {
-    performAdoptMove(name, linkPath, sharedTarget);
+    performAdoptMove(name, linkPath, sharedTarget, repo, backup);
   } catch (err) {
     if (!(err instanceof NomadFatal)) throw err;
     fail(err.message);
@@ -1064,7 +1076,6 @@ init_config();
 import { existsSync as existsSync3 } from "node:fs";
 
 // src/commands.redact.core.ts
-init_config();
 import { appendFileSync, readFileSync as readFileSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 function collectMatchIntervals(content, findings) {
@@ -1121,10 +1132,10 @@ function isValidFingerprint(fingerprint) {
 function isAlreadyPresent(line, lines) {
   return lines.includes(line);
 }
-function appendGitleaksIgnore(fingerprint) {
+function appendGitleaksIgnore(fingerprint, repo) {
   const sanitized = fingerprint.replace(/[\r\n]/g, "").trim();
   if (sanitized.length === 0) return;
-  const ignPath = join4(REPO_HOME, ".gitleaksignore");
+  const ignPath = join4(repo, ".gitleaksignore");
   let raw;
   try {
     raw = readFileSync2(ignPath, "utf8");
@@ -1141,7 +1152,8 @@ function appendGitleaksIgnore(fingerprint) {
 // src/commands.allow.ts
 init_utils();
 function cmdAllow(fingerprints) {
-  if (!existsSync3(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  const repo = repoHome();
+  if (!existsSync3(repo)) die(`repo not cloned at ${repo}`);
   for (const fp of fingerprints) {
     if (!isValidFingerprint(fp)) {
       const shown = fp.replaceAll("\r", String.raw`\r`).replaceAll("\n", String.raw`\n`);
@@ -1150,9 +1162,10 @@ function cmdAllow(fingerprints) {
     }
   }
   for (const fp of fingerprints) {
-    appendGitleaksIgnore(fp);
-    log(`allowed: ${fp}`);
+    appendGitleaksIgnore(fp, repo);
+    item(`allowed: ${fp}`);
   }
+  log(`allowed ${fingerprints.length} fingerprint(s)`);
 }
 
 // src/commands.clean.ts
@@ -1172,9 +1185,9 @@ function parseDuration(s) {
   if (!m) return null;
   return Number(m[1]) * UNIT_MS[m[2]];
 }
-function listBackupDirs(backupBase) {
-  if (!existsSync4(backupBase)) return [];
-  return readdirSync(backupBase).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join5(backupBase, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
+function listBackupDirs(backupBase2) {
+  if (!existsSync4(backupBase2)) return [];
+  return readdirSync(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join5(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
 function prunableByAge(dirs, olderThanMs, nowMs) {
   return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
@@ -1182,9 +1195,9 @@ function prunableByAge(dirs, olderThanMs, nowMs) {
 function prunableByCount(dirs, keep) {
   return dirs.slice(keep).map((d) => d.name);
 }
-function safeDelete(backupBase, name) {
+function safeDelete(backupBase2, name) {
   if (!isTsDir(name)) return;
-  const full = join5(backupBase, name);
+  const full = join5(backupBase2, name);
   const st = lstatSync3(full, { throwIfNoEntry: false });
   if (!st || st.isSymbolicLink() || !st.isDirectory()) return;
   rmSync2(full, { recursive: true, force: true });
@@ -1193,7 +1206,7 @@ function resolveTargets(dirs, olderThanMs, keep) {
   if (keep !== void 0) return prunableByCount(dirs, keep);
   return prunableByAge(dirs, olderThanMs, Date.now());
 }
-function cmdClean(opts, backupBase = BACKUP_BASE) {
+function cmdClean(opts, backupBase2 = backupBase()) {
   const { dryRun, olderThan, keep } = opts;
   if (olderThan !== void 0 && keep !== void 0) {
     fail("--older-than and --keep are mutually exclusive");
@@ -1208,14 +1221,14 @@ function cmdClean(opts, backupBase = BACKUP_BASE) {
     }
     olderThanMs = parsed;
   }
-  const dirs = listBackupDirs(backupBase);
+  const dirs = listBackupDirs(backupBase2);
   const targets = resolveTargets(dirs, olderThanMs, keep);
   if (dryRun) {
-    for (const name of targets) log(`would remove ${name}`);
+    for (const name of targets) item(name);
     log(`dry-run: ${targets.length} backup(s) would be removed`);
     return;
   }
-  for (const name of targets) safeDelete(backupBase, name);
+  for (const name of targets) safeDelete(backupBase2, name);
   log(`removed ${targets.length} backup(s)`);
 }
 
@@ -1225,15 +1238,16 @@ init_utils();
 init_utils_json();
 import { cpSync as cpSync3, existsSync as existsSync5, lstatSync as lstatSync4, realpathSync, renameSync as renameSync2, rmSync as rmSync3 } from "node:fs";
 import { join as join6, sep } from "node:path";
-var EJECT_CHECKLIST = [
-  "Manual steps remaining to finish leaving claude-nomad on this host:",
-  `  1. Uninstall the CLI: npm uninstall -g claude-nomad`,
-  `  2. Remove NOMAD_HOST and NOMAD_REPO from your shell rc (~/.zshrc or ~/.bashrc)`,
-  `  3. Optionally delete the local sync checkout: rm -rf ${REPO_HOME}`,
-  `  4. Optionally delete the private sync repo on GitHub`,
-  `  5. Optionally delete the backup cache: rm -rf ${BACKUP_BASE}`
-].join("\n");
-var DEFAULT_ROOTS = { claudeHome: CLAUDE_HOME, repoHome: REPO_HOME };
+function ejectChecklist() {
+  return [
+    "Manual steps remaining to finish leaving claude-nomad on this host:",
+    `  1. Uninstall the CLI: npm uninstall -g claude-nomad`,
+    `  2. Remove NOMAD_HOST and NOMAD_REPO from your shell rc (~/.zshrc or ~/.bashrc)`,
+    `  3. Optionally delete the local sync checkout: rm -rf ${repoHome()}`,
+    `  4. Optionally delete the private sync repo on GitHub`,
+    `  5. Optionally delete the backup cache: rm -rf ${backupBase()}`
+  ].join("\n");
+}
 function errMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1245,8 +1259,8 @@ function lexists2(p) {
     return false;
   }
 }
-function readMapIfPresent2(repoHome) {
-  const mapPath = join6(repoHome, "path-map.json");
+function readMapIfPresent2(repoHome2) {
+  const mapPath = join6(repoHome2, "path-map.json");
   return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function classifyName(linkPath) {
@@ -1255,12 +1269,12 @@ function classifyName(linkPath) {
   if (!existsSync5(linkPath)) return "dangling";
   return "materialize";
 }
-function resolveSharedRoot(repoHome) {
+function resolveSharedRoot(repoHome2) {
   try {
-    return realpathSync(join6(repoHome, "shared"));
+    return realpathSync(join6(repoHome2, "shared"));
   } catch {
     return die(
-      `cannot resolve ${join6(repoHome, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
+      `cannot resolve ${join6(repoHome2, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
     );
   }
 }
@@ -1270,7 +1284,7 @@ function isManagedTarget(target, sharedRoot) {
 function materializeOne(name, linkPath, sharedRoot) {
   const target = realpathSync(linkPath);
   if (!isManagedTarget(target, sharedRoot)) {
-    log(`skipped (not a nomad-managed target): ${name} -> ${target}`);
+    item(`skipped (not a nomad-managed target): ${name} -> ${target}`);
     return false;
   }
   const tmp = `${linkPath}.eject.tmp.${process.pid}.${Date.now()}`;
@@ -1284,7 +1298,7 @@ function materializeOne(name, linkPath, sharedRoot) {
     });
     rmSync3(linkPath, { force: true });
     renameSync2(tmp, linkPath);
-    log(`ejected: ${name}`);
+    item(`ejected: ${name}`);
     return true;
   } catch (err) {
     try {
@@ -1294,45 +1308,45 @@ function materializeOne(name, linkPath, sharedRoot) {
     throw err;
   }
 }
-function previewDryRun(names, classifications, claudeHome, sharedRoot) {
+function previewDryRun(names, classifications, claudeHome2, sharedRoot) {
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join6(claudeHome, name);
+    const linkPath = join6(claudeHome2, name);
     if (cls === "absent") {
-      log(`skipped (absent): ${name}`);
+      item(`skipped (absent): ${name}`);
     } else if (cls === "skip-real") {
-      log(`skipped (not a symlink): ${name}`);
+      item(`skipped (not a symlink): ${name}`);
     } else {
       previewMaterialize(name, linkPath, sharedRoot);
     }
   }
-  log(EJECT_CHECKLIST);
+  log(ejectChecklist());
 }
 function previewMaterialize(name, linkPath, sharedRoot) {
   let target;
   try {
     target = realpathSync(linkPath);
   } catch {
-    log(`would materialize: ${name} (target now unresolvable; re-run to re-classify)`);
+    item(`would materialize: ${name} (target now unresolvable; re-run to re-classify)`);
     return;
   }
   if (!isManagedTarget(target, sharedRoot)) {
-    log(`skipped (not a nomad-managed target): ${name} -> ${target}`);
+    item(`skipped (not a nomad-managed target): ${name} -> ${target}`);
     return;
   }
-  log(`would materialize: ${name} (copy ${target} -> ${linkPath})`);
+  item(`would materialize: ${name} (copy ${target} -> ${linkPath})`);
 }
-function runLiveEject(names, classifications, claudeHome, sharedRoot) {
+function runLiveEject(names, classifications, claudeHome2, sharedRoot) {
   const done = [];
   let skipped = 0;
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join6(claudeHome, name);
+    const linkPath = join6(claudeHome2, name);
     if (cls === "absent") {
-      log(`skipped (absent): ${name}`);
+      item(`skipped (absent): ${name}`);
       skipped++;
     } else if (cls === "skip-real") {
-      log(`skipped (not a symlink): ${name}`);
+      item(`skipped (not a symlink): ${name}`);
       skipped++;
     } else if (materializeOneOrDie(name, linkPath, sharedRoot, done)) {
       done.push(name);
@@ -1341,7 +1355,7 @@ function runLiveEject(names, classifications, claudeHome, sharedRoot) {
     }
   }
   log(`materialized ${done.length}, skipped ${skipped}`);
-  log(EJECT_CHECKLIST);
+  log(ejectChecklist());
 }
 function materializeOneOrDie(name, linkPath, sharedRoot, done) {
   try {
@@ -1349,18 +1363,21 @@ function materializeOneOrDie(name, linkPath, sharedRoot, done) {
   } catch (err) {
     const msg = errMessage(err);
     return die(
-      `failed to materialize ${name}: ${msg}. already materialized: ${done.join(", ") || "(none)"}. the remaining names are still symlinks; do NOT delete ${REPO_HOME} yet, fix the cause and re-run \`nomad eject\` (it is idempotent on already-real names)`
+      `failed to materialize ${name}: ${msg}. already materialized: ${done.join(", ") || "(none)"}. the remaining names are still symlinks; do NOT delete ${repoHome()} yet, fix the cause and re-run \`nomad eject\` (it is idempotent on already-real names)`
     );
   }
 }
-function cmdEject(opts = {}, roots = DEFAULT_ROOTS) {
+function defaultEjectRoots() {
+  return { claudeHome: claudeHome(), repoHome: repoHome() };
+}
+function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   const dryRun = opts.dryRun === true;
-  const { claudeHome, repoHome } = roots;
-  const map = readMapIfPresent2(repoHome);
+  const { claudeHome: claudeHome2, repoHome: repoHome2 } = roots;
+  const map = readMapIfPresent2(repoHome2);
   const names = allSharedLinks(map);
   const classifications = /* @__PURE__ */ new Map();
   for (const name of names) {
-    classifications.set(name, classifyName(join6(claudeHome, name)));
+    classifications.set(name, classifyName(join6(claudeHome2, name)));
   }
   const dangling = names.filter((n) => classifications.get(n) === "dangling");
   if (dangling.length > 0) {
@@ -1369,13 +1386,13 @@ function cmdEject(opts = {}, roots = DEFAULT_ROOTS) {
     );
     process.exit(1);
   }
-  const sharedRoot = resolveSharedRoot(repoHome);
+  const sharedRoot = resolveSharedRoot(repoHome2);
   if (dryRun) {
-    previewDryRun(names, classifications, claudeHome, sharedRoot);
+    previewDryRun(names, classifications, claudeHome2, sharedRoot);
     return;
   }
   try {
-    runLiveEject(names, classifications, claudeHome, sharedRoot);
+    runLiveEject(names, classifications, claudeHome2, sharedRoot);
   } catch (err) {
     fail(errMessage(err));
     process.exit(1);
@@ -1383,8 +1400,8 @@ function cmdEject(opts = {}, roots = DEFAULT_ROOTS) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync22 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { join as join27 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
@@ -1411,8 +1428,8 @@ function sectionFailed(s) {
   return s.items.some((line) => line.includes(failGlyph));
 }
 function renderRawItems(items) {
-  for (const item of items) {
-    console.log(item === "" ? "" : `  ${item}`);
+  for (const item2 of items) {
+    console.log(item2 === "" ? "" : `  ${item2}`);
   }
 }
 function renderSection(s) {
@@ -1424,18 +1441,18 @@ function renderSection(s) {
   const header = sectionFailed(s) ? `${red(FAIL_GLYPH_BARE)} ${s.header}` : s.header;
   console.log(header);
   const lastContent = s.items.reduce(
-    (acc, item, j) => item === "" || isChild(item) ? acc : j,
+    (acc, item2, j) => item2 === "" || isChild(item2) ? acc : j,
     -1
   );
   for (let j = 0; j < s.items.length; j++) {
-    const item = s.items[j];
-    if (item === "") console.log("");
-    else if (isChild(item)) console.log(renderChildLine(s.items, j));
-    else console.log(`${j === lastContent ? "  \u2514 " : "  \u251C "}${item}`);
+    const item2 = s.items[j];
+    if (item2 === "") console.log("");
+    else if (isChild(item2)) console.log(renderChildLine(s.items, j));
+    else console.log(`${j === lastContent ? "  \u2514 " : "  \u251C "}${item2}`);
   }
 }
-function isChild(item) {
-  return item.startsWith("	");
+function isChild(item2) {
+  return item2.startsWith("	");
 }
 function renderChildLine(items, j) {
   const parentContinues = items.some((it, k) => k > j && it !== "" && !isChild(it));
@@ -1470,10 +1487,10 @@ init_config();
 init_utils_json();
 import { existsSync as existsSync6 } from "node:fs";
 import { join as join7 } from "node:path";
-function classifyRepoState(repoHome, host) {
-  const basePath = join7(repoHome, "shared", "settings.base.json");
-  const mapPath = join7(repoHome, "path-map.json");
-  const hostPath = join7(repoHome, "hosts", `${host}.json`);
+function classifyRepoState(repoHome2, host) {
+  const basePath = join7(repoHome2, "shared", "settings.base.json");
+  const mapPath = join7(repoHome2, "path-map.json");
+  const hostPath = join7(repoHome2, "hosts", `${host}.json`);
   const hasBase = existsSync6(basePath);
   const hasMap = existsSync6(mapPath);
   const hasHost = existsSync6(hostPath);
@@ -1490,10 +1507,10 @@ function classifyRepoState(repoHome, host) {
   if (hasBase && mapEntryCount > 0 && hasHost) return "populated";
   return "partial";
 }
-function reasonForPartial(repoHome, host) {
-  const basePath = join7(repoHome, "shared", "settings.base.json");
-  const mapPath = join7(repoHome, "path-map.json");
-  const hostPath = join7(repoHome, "hosts", `${host}.json`);
+function reasonForPartial(repoHome2, host) {
+  const basePath = join7(repoHome2, "shared", "settings.base.json");
+  const mapPath = join7(repoHome2, "path-map.json");
+  const hostPath = join7(repoHome2, "hosts", `${host}.json`);
   if (!existsSync6(basePath)) return "- shared/settings.base.json missing";
   if (!existsSync6(mapPath)) return "- path-map.json missing";
   let mapEntryCount;
@@ -1514,28 +1531,28 @@ function isOverrideActive() {
 }
 function reportHostAndPaths(section2) {
   const unsetHint = process.env.NOMAD_HOST ? "" : dim(" (env unset, using hostname)");
+  const repo = repoHome();
+  const claude = claudeHome();
   addItem(section2, `${dim(infoGlyph)} NOMAD_HOST: ${cyan(HOST)}${unsetHint}`);
   if (isOverrideActive()) {
-    addItem(section2, `${dim(infoGlyph)} NOMAD_REPO: ${blue(REPO_HOME)}`);
+    addItem(section2, `${dim(infoGlyph)} NOMAD_REPO: ${blue(repo)}`);
   }
+  addItem(section2, `${existsSync7(repo) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(repo)}`);
   addItem(
     section2,
-    `${existsSync7(REPO_HOME) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(REPO_HOME)}`
-  );
-  addItem(
-    section2,
-    `${existsSync7(CLAUDE_HOME) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(CLAUDE_HOME)}`
+    `${existsSync7(claude) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(claude)}`
   );
 }
 function reportRepoState(section2) {
-  const state = classifyRepoState(REPO_HOME, HOST);
+  const repo = repoHome();
+  const state = classifyRepoState(repo, HOST);
   const overrideLabel = isOverrideActive() ? " (NOMAD_REPO)" : "";
   if (state === "populated") {
     addItem(section2, `${green(okGlyph)} repo state: populated${overrideLabel}`);
   } else if (state === "partial") {
     addItem(
       section2,
-      `${yellow(warnGlyph)} repo state: partial ${reasonForPartial(REPO_HOME, HOST)}${overrideLabel}`
+      `${yellow(warnGlyph)} repo state: partial ${reasonForPartial(repo, HOST)}${overrideLabel}`
     );
   } else {
     addItem(
@@ -1546,7 +1563,7 @@ function reportRepoState(section2) {
   }
 }
 function repoHasSharedSource(name) {
-  return existsSync7(join8(REPO_HOME, "shared", name));
+  return existsSync7(join8(repoHome(), "shared", name));
 }
 function classifySharedLink(name, p) {
   let stat;
@@ -1592,8 +1609,9 @@ function classifySymlinkTarget(name, p) {
   }
 }
 function reportSharedLinks(section2, map) {
+  const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const p = join8(CLAUDE_HOME, name);
+    const p = join8(claude, name);
     const { line, fail: fail2 } = classifySharedLink(name, p);
     addItem(section2, line);
     if (fail2) process.exitCode = 1;
@@ -1606,7 +1624,7 @@ init_config();
 import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
 import { join as join9 } from "node:path";
 function loadBaseSettings(section2) {
-  const basePath = join9(REPO_HOME, "shared", "settings.base.json");
+  const basePath = join9(repoHome(), "shared", "settings.base.json");
   if (!existsSync8(basePath)) {
     addItem(section2, `${red(failGlyph)} shared/settings.base.json missing at ${blue(basePath)}`);
     process.exitCode = 1;
@@ -1615,7 +1633,7 @@ function loadBaseSettings(section2) {
   return readJsonSafe(basePath, basePath, section2);
 }
 function loadAndReportSettings(section2) {
-  const settingsPath = join9(CLAUDE_HOME, "settings.json");
+  const settingsPath = join9(claudeHome(), "settings.json");
   if (!existsSync8(settingsPath)) return null;
   const settings = readJsonSafe(settingsPath, settingsPath, section2);
   if (settings === null) return null;
@@ -1631,7 +1649,8 @@ function loadAndReportSettings(section2) {
   return settings;
 }
 function reportHostOverrides(section2, base, settings) {
-  const hostFile = join9(REPO_HOME, "hosts", `${HOST}.json`);
+  const repo = repoHome();
+  const hostFile = join9(repo, "hosts", `${HOST}.json`);
   let drift = [];
   if (base !== null && settings !== null) {
     const baseKeys = new Set(Object.keys(base));
@@ -1646,7 +1665,7 @@ function reportHostOverrides(section2, base, settings) {
       section2,
       `${red(failGlyph)} no hosts/${HOST}.json AND settings.json has unbased keys ${JSON.stringify(drift)}`
     );
-    const hostsDir = join9(REPO_HOME, "hosts");
+    const hostsDir = join9(repo, "hosts");
     if (existsSync8(hostsDir)) {
       const cands = readdirSync2(hostsDir).filter((f) => f.endsWith(".json"));
       if (cands.length > 0) addItem(section2, `${dim(infoGlyph)} candidates: ${cands.join(", ")}`);
@@ -1674,7 +1693,7 @@ function reportMappedProjects(section2, map) {
   }
 }
 function reportUnmappedProjects(section2, map) {
-  const localProjects = join10(CLAUDE_HOME, "projects");
+  const localProjects = join10(claudeHome(), "projects");
   if (!existsSync9(localProjects)) return;
   let localDirs;
   try {
@@ -1715,7 +1734,7 @@ function reportPathCollisions(section2, map) {
   else addItem(section2, `${green(okGlyph)} path-encoding: no collisions`);
 }
 function reportPathMap(section2) {
-  const mapPath = join10(REPO_HOME, "path-map.json");
+  const mapPath = join10(repoHome(), "path-map.json");
   if (!existsSync9(mapPath)) {
     addItem(section2, `${red(failGlyph)} path-map.json missing at ${blue(mapPath)}`);
     process.exitCode = 1;
@@ -1803,11 +1822,12 @@ function reportGitleaksProbe(section2) {
   }
 }
 function reportGitlinks(section2) {
-  const sharedDir = join14(REPO_HOME, "shared");
+  const repo = repoHome();
+  const sharedDir = join14(repo, "shared");
   if (existsSync12(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
-      const rel = relative2(REPO_HOME, p);
+      const rel = relative2(repo, p);
       addItem(
         section2,
         `${red(failGlyph)} gitlink: ${blue(rel)} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`
@@ -1823,7 +1843,7 @@ function reportGitlinks(section2) {
 function reportRemote(section2) {
   try {
     const url = execFileSync3("git", ["remote", "get-url", "origin"], {
-      cwd: REPO_HOME,
+      cwd: repoHome(),
       stdio: ["ignore", "pipe", "pipe"]
     }).toString().trim();
     addItem(section2, `${dim(infoGlyph)} remote origin: ${cyan(url)}`);
@@ -1833,7 +1853,7 @@ function reportRemote(section2) {
 }
 function reportRebaseClean(section2) {
   try {
-    const status = gitStatusPorcelainZ(REPO_HOME);
+    const status = gitStatusPorcelainZ(repoHome());
     if (status.length > 0) {
       addItem(
         section2,
@@ -1845,7 +1865,7 @@ function reportRebaseClean(section2) {
 }
 function reportRebaseState(section2) {
   try {
-    const wedge = detectWedge(REPO_HOME);
+    const wedge = detectWedge(repoHome());
     if (wedge !== null) {
       const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
       addItem(
@@ -1886,16 +1906,16 @@ function dirSizeBytes(dir) {
   }
   return bytes;
 }
-function totalSizeMb(backupBase, dirs) {
+function totalSizeMb(backupBase2, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join15(backupBase, name));
+  for (const name of dirs) bytes += dirSizeBytes(join15(backupBase2, name));
   return bytes / BYTES_PER_MB;
 }
-function reportBackupsCheck(section2, backupBase = BACKUP_BASE) {
-  if (!existsSync13(backupBase)) return;
-  const dirs = safeReaddir(backupBase).filter((n) => TS_SHAPE2.test(n));
+function reportBackupsCheck(section2, backupBase2 = backupBase()) {
+  if (!existsSync13(backupBase2)) return;
+  const dirs = safeReaddir(backupBase2).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
-  const sizeMb = totalSizeMb(backupBase, dirs);
+  const sizeMb = totalSizeMb(backupBase2, dirs);
   if (count > DOCTOR_BACKUP_COUNT_WARN || sizeMb > DOCTOR_BACKUP_SIZE_WARN_MB) {
     addItem(
       section2,
@@ -1944,7 +1964,7 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join16(CLAUDE_HOME, "settings.json");
+  const settingsPath = join16(claudeHome(), "settings.json");
   if (!existsSync14(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
@@ -1986,7 +2006,7 @@ init_config();
 init_push_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join18(CLAUDE_HOME, "projects", encoded, `${sid}.jsonl`);
+  return join18(claudeHome(), "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -2095,7 +2115,7 @@ function copyDirJsonlOnly(src, dst) {
       if (rel.split(sep2).length > 1) return true;
       if (statSync4(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
-      log(`skip ${rel}: extension not in allowlist`);
+      item(`skip ${rel}: extension not in allowlist`);
       return false;
     }
   });
@@ -2109,15 +2129,17 @@ function remapPull(ts, opts = {}) {
   let unmapped = 0;
   const pulled = [];
   const wouldPull = [];
-  const mapPath = join19(REPO_HOME, "path-map.json");
-  const repoProjects = join19(REPO_HOME, "shared", "projects");
+  const repo = repoHome();
+  const claude = claudeHome();
+  const mapPath = join19(repo, "path-map.json");
+  const repoProjects = join19(repo, "shared", "projects");
   if (!existsSync15(mapPath) || !existsSync15(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readJson(mapPath);
-  const localProjects = join19(CLAUDE_HOME, "projects");
+  const localProjects = join19(claude, "projects");
   if (!dryRun) mkdirSync3(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -2173,14 +2195,16 @@ function remapPush(ts, opts = {}) {
   let unmapped = 0;
   const pushed = [];
   const wouldPush = [];
-  const mapPath = join19(REPO_HOME, "path-map.json");
+  const repo = repoHome();
+  const claude = claudeHome();
+  const mapPath = join19(repo, "path-map.json");
   if (!existsSync15(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readJson(mapPath);
-  const localProjects = join19(CLAUDE_HOME, "projects");
-  const repoProjects = join19(REPO_HOME, "shared", "projects");
+  const localProjects = join19(claude, "projects");
+  const repoProjects = join19(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
   if (!existsSync15(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync3(repoProjects, { recursive: true });
@@ -2195,7 +2219,7 @@ function remapPush(ts, opts = {}) {
       wouldPush.push(logical);
       continue;
     }
-    backupRepoWrite(repoDst, ts, REPO_HOME);
+    backupRepoWrite(repoDst, ts, repo);
     copyDirJsonlOnly(join19(localProjects, dir), repoDst);
     pushed.push(logical);
   }
@@ -2208,7 +2232,8 @@ init_utils_json();
 function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
-  const mapPath = join20(REPO_HOME, "path-map.json");
+  const repo = repoHome();
+  const mapPath = join20(repo, "path-map.json");
   if (!existsSync16(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
@@ -2226,7 +2251,7 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join20(CLAUDE_HOME, "projects");
+  const localProjects = join20(claudeHome(), "projects");
   if (!existsSync16(localProjects)) return { logicalToEncoded, staged, malformed: false };
   for (const dir of readdirSync7(localProjects)) {
     const logical = reverse.get(dir);
@@ -2353,7 +2378,7 @@ function safeRead(path) {
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join21(CLAUDE_HOME, "hooks");
+  const hooksDir = join21(claudeHome(), "hooks");
   if (!existsSync17(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
@@ -2385,13 +2410,14 @@ import { existsSync as existsSync18 } from "node:fs";
 import { join as join22 } from "node:path";
 init_config();
 function expandHome(token) {
-  return token.replace(/^\$\{HOME\}/, HOME).replace(/^\$HOME/, HOME).replace(/^~/, HOME);
+  const h2 = home();
+  return token.replace(/^\$\{HOME\}/, h2).replace(/^\$HOME/, h2).replace(/^~/, h2);
 }
 function stripShellPunctuation(token) {
   return token.replace(/^['"]+/, "").replace(/['"`;)|&>]+$/, "");
 }
 function* claudePathsIn(command) {
-  const claudePrefix = `${CLAUDE_HOME}/`;
+  const claudePrefix = `${claudeHome()}/`;
   for (const segment of command.split(/&&|\|\||;|\|/)) {
     for (const raw of segment.trim().split(/\s+/).filter(Boolean)) {
       const expanded = expandHome(stripShellPunctuation(raw));
@@ -2433,7 +2459,7 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join22(CLAUDE_HOME, "settings.json");
+  const settingsPath = join22(claudeHome(), "settings.json");
   if (!existsSync18(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
@@ -2535,7 +2561,8 @@ function relativeRequireTargetsBroken(scriptPath) {
 // src/commands.doctor.checks.hooks.preserve-symlinks.ts
 init_config();
 function expandHome2(token) {
-  return token.replace(/^\$\{HOME\}/, HOME).replace(/^\$HOME/, HOME).replace(/^~/, HOME);
+  const h2 = home();
+  return token.replace(/^\$\{HOME\}/, h2).replace(/^\$HOME/, h2).replace(/^~/, h2);
 }
 function stripShellPunct(token) {
   const head = token.replace(/^['"]+/, "");
@@ -2553,7 +2580,7 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join24(REPO_HOME, "path-map.json");
+  const mapPath = join24(repoHome(), "path-map.json");
   if (!existsSync20(mapPath)) return { projects: {} };
   try {
     return JSON.parse(readFileSync6(mapPath, "utf8"));
@@ -2563,7 +2590,7 @@ function readPathMapSafe() {
 }
 function resolvesUnderSymlinkedShared(scriptPath, sharedLinkNames) {
   for (const name of sharedLinkNames) {
-    const prefix = `${CLAUDE_HOME}/${name}/`;
+    const prefix = `${claudeHome()}/${name}/`;
     if (scriptPath.startsWith(prefix)) return true;
   }
   return false;
@@ -2627,7 +2654,7 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join24(CLAUDE_HOME, "settings.json");
+  const settingsPath = join24(claudeHome(), "settings.json");
   if (!existsSync20(settingsPath)) {
     addItem(
       section2,
@@ -2659,17 +2686,150 @@ function reportPreserveSymlinksCheck(section2) {
   }
 }
 
+// src/commands.doctor.checks.settings-drift.ts
+init_color();
+import { existsSync as existsSync21, readFileSync as readFileSync7 } from "node:fs";
+import { join as join25 } from "node:path";
+init_config();
+init_utils_json();
+function arraysEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (!deepEqual(a[i], b[i])) return false;
+  }
+  return true;
+}
+function objectsEqual(a, b) {
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (!Object.hasOwn(b, k)) return false;
+    if (!deepEqual(a[k], b[k])) return false;
+  }
+  return true;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return false;
+  if (Array.isArray(a) && Array.isArray(b)) return arraysEqual(a, b);
+  if (Array.isArray(a) || Array.isArray(b)) return false;
+  if (typeof a === "object" && typeof b === "object") {
+    return objectsEqual(a, b);
+  }
+  return false;
+}
+function diffMergedSettings(merged, settings) {
+  const missing = [];
+  const changed = [];
+  const extra = [];
+  const settingsKeys = new Set(Object.keys(settings));
+  for (const key of Object.keys(merged)) {
+    if (!settingsKeys.has(key)) {
+      missing.push(key);
+    } else if (!deepEqual(merged[key], settings[key])) {
+      changed.push(key);
+    }
+  }
+  const mergedKeys = new Set(Object.keys(merged));
+  for (const key of Object.keys(settings)) {
+    if (!mergedKeys.has(key)) extra.push(key);
+  }
+  const collator = (a, b) => a.localeCompare(b, "en");
+  return {
+    missing: missing.toSorted(collator),
+    changed: changed.toSorted(collator),
+    extra: extra.toSorted(collator)
+  };
+}
+function tryReadJson(filePath) {
+  try {
+    const raw = readFileSync7(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function reportSettingsDriftCheck(section2) {
+  const claude = claudeHome();
+  const repo = repoHome();
+  const host = HOST;
+  const settingsPath = join25(claude, "settings.json");
+  const basePath = join25(repo, "shared", "settings.base.json");
+  const hostPath = join25(repo, "hosts", `${host}.json`);
+  if (!existsSync21(settingsPath)) {
+    addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
+    return;
+  }
+  if (!existsSync21(basePath)) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
+    );
+    return;
+  }
+  const base = tryReadJson(basePath);
+  if (base === null) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} shared/settings.base.json unparseable; skipping merge-drift check`
+    );
+    return;
+  }
+  const settings = tryReadJson(settingsPath);
+  if (settings === null) {
+    return;
+  }
+  const hostExists = existsSync21(hostPath);
+  const hostObj = hostExists ? tryReadJson(hostPath) : null;
+  if (hostExists && hostObj === null) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} hosts/${host}.json unparseable; 'nomad pull' will fail (fix the host file)`
+    );
+    return;
+  }
+  const merged = deepMerge(base, hostObj ?? {});
+  const { missing, changed, extra } = diffMergedSettings(merged, settings);
+  emitDriftRows(section2, missing, changed, extra, host, hostExists);
+}
+function emitDriftRows(section2, missing, changed, extra, host, hostFileExists) {
+  if (missing.length > 0) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} settings.json drift: merged keys missing locally: ${missing.join(", ")} (external writer clobbered settings.json; run 'nomad pull')`
+    );
+  }
+  if (changed.length > 0) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} settings.json drift: merged keys with changed values: ${changed.join(", ")} (run 'nomad pull')`
+    );
+  }
+  if (extra.length > 0 && hostFileExists) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} settings.json has ${extra.length} local-only key(s) not in base+host merge: ${extra.join(", ")} (promotion candidates for shared/settings.base.json or hosts/${host}.json)`
+    );
+  }
+  if (missing.length === 0 && changed.length === 0 && extra.length === 0) {
+    addItem(section2, `${green(okGlyph)} settings.json matches base+host merge`);
+  }
+}
+
 // src/commands.doctor.ts
 init_config();
 
 // src/commands.doctor.engine.ts
 init_color();
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/commands.doctor.version.ts
 init_color();
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_config();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -2686,7 +2846,7 @@ function compareSemver(a, b) {
 function readLocalVersion() {
   try {
     const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync7(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
     }
@@ -2745,7 +2905,7 @@ function parseMinVersion(spec) {
 function readEnginesNode() {
   try {
     const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync8(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync9(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
     return null;
@@ -2774,8 +2934,8 @@ function reportNodeEngineCheck(section2) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { join as join26 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -2784,7 +2944,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join25(REPO_HOME, ".gitleaks.toml");
+  const tomlPath = join26(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -2796,7 +2956,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync21) {
+function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync22) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -2935,7 +3095,7 @@ function readOriginRemote(cwd, run = execFileSync9) {
 function reportActionsDrift(section2, run = execFileSync10) {
   let remote;
   try {
-    remote = readOriginRemote(REPO_HOME, run);
+    remote = readOriginRemote(repoHome(), run);
   } catch {
     return;
   }
@@ -2965,15 +3125,15 @@ function reportActionsDrift(section2, run = execFileSync10) {
 
 // src/commands.doctor.verdict.ts
 init_color();
-function isFailLine(item) {
-  return item.includes(failGlyph);
+function isFailLine(item2) {
+  return item2.includes(failGlyph);
 }
-function isWarnLine(item) {
-  return !isFailLine(item) && item.includes(warnGlyph);
+function isWarnLine(item2) {
+  return !isFailLine(item2) && item2.includes(warnGlyph);
 }
 function buildVerdictSection(sections) {
   const summary = section("Summary");
-  const lines = sections.flatMap((s) => s.items).map((item) => item.replace(/^\t/, ""));
+  const lines = sections.flatMap((s) => s.items).map((item2) => item2.replace(/^\t/, ""));
   const failures = lines.filter(isFailLine);
   const warnings = lines.filter(isWarnLine);
   for (const line of [...failures, ...warnings]) addItem(summary, line);
@@ -2996,8 +3156,8 @@ function cmdDoctor(opts = {}) {
   reportHostAndPaths(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join26(REPO_HOME, "path-map.json");
-  const rawMap = existsSync22(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join27(repoHome(), "path-map.json");
+  const rawMap = existsSync23(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   const hooksScan = section("Hook targets");
@@ -3008,6 +3168,7 @@ function cmdDoctor(opts = {}) {
   const base = loadBaseSettings(settings);
   const parsedSettings = loadAndReportSettings(settings);
   reportHostOverrides(settings, base, parsedSettings);
+  reportSettingsDriftCheck(settings);
   const pathMap = section("Path map");
   reportPathMap(pathMap);
   const neverSync = section("Never-sync");
@@ -3051,16 +3212,15 @@ function cmdDoctor(opts = {}) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync9, statSync as statSync5 } from "node:fs";
-import { join as join29, relative as relative4 } from "node:path";
+import { existsSync as existsSync25, readdirSync as readdirSync9, statSync as statSync5 } from "node:fs";
+import { join as join30, relative as relative4 } from "node:path";
 
 // src/commands.drop-session.git.ts
-init_config();
 import { execFileSync as execFileSync11 } from "node:child_process";
-function expandStagedDir(dirRel) {
+function expandStagedDir(dirRel, repo) {
   try {
     const out = execFileSync11("git", ["ls-files", "-z", "--", dirRel], {
-      cwd: REPO_HOME,
+      cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
     return out.toString().split("\0").filter((p) => p !== "");
@@ -3068,10 +3228,10 @@ function expandStagedDir(dirRel) {
     return [];
   }
 }
-function isTrackedInHead(rel) {
+function isTrackedInHead(rel, repo) {
   try {
     execFileSync11("git", ["cat-file", "-e", `HEAD:${rel}`], {
-      cwd: REPO_HOME,
+      cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
     return true;
@@ -3079,10 +3239,10 @@ function isTrackedInHead(rel) {
     return false;
   }
 }
-function isInIndex(rel) {
+function isInIndex(rel, repo) {
   try {
     const out = execFileSync11("git", ["ls-files", "--", rel], {
-      cwd: REPO_HOME,
+      cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
     return out.toString().trim() !== "";
@@ -3095,8 +3255,8 @@ function isInIndex(rel) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync23 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { join as join28 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript(id, matches);
@@ -3112,16 +3272,17 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript(id, matches) {
   try {
-    const mapPath = join27(REPO_HOME, "path-map.json");
-    if (!existsSync23(mapPath)) return null;
+    const mapPath = join28(repoHome(), "path-map.json");
+    if (!existsSync24(mapPath)) return null;
     const projects = readJson(mapPath).projects;
+    const claude = claudeHome();
     for (const rel of matches) {
       const logical = SHARED_PROJECT_LOGICAL.exec(rel)?.[1];
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join27(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync23(live)) return live;
+      const live = join28(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync24(live)) return live;
     }
     return null;
   } catch {
@@ -3135,13 +3296,16 @@ init_utils();
 // src/utils.lockfile.ts
 init_config();
 init_utils();
-import { closeSync as closeSync3, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname4, join as join28 } from "node:path";
-var LOCK_PATH = join28(HOME, ".cache", "claude-nomad", "nomad.lock");
+import { closeSync as closeSync3, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync10, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join29 } from "node:path";
+function lockFilePath() {
+  return join29(home(), ".cache", "claude-nomad", "nomad.lock");
+}
 function acquireLock(verb) {
-  mkdirSync5(dirname4(LOCK_PATH), { recursive: true });
+  const lp = lockFilePath();
+  mkdirSync5(dirname4(lp), { recursive: true });
   try {
-    const fd = openSync3(LOCK_PATH, "wx");
+    const fd = openSync3(lp, "wx");
     try {
       writeFileSync3(fd, String(process.pid));
     } catch (writeErr) {
@@ -3150,55 +3314,56 @@ function acquireLock(verb) {
       } catch {
       }
       try {
-        unlinkSync(LOCK_PATH);
+        unlinkSync(lp);
       } catch {
       }
       throw writeErr;
     }
-    return { fd };
+    return { fd, path: lp };
   } catch (err) {
     const code = err.code;
     if (code !== "EEXIST") throw err;
-    return checkStaleAndRetry(verb);
+    return checkStaleAndRetry(verb, lp);
   }
 }
 function releaseLock(handle) {
   if (handle === null) return;
+  const lp = handle.path;
   try {
     closeSync3(handle.fd);
   } catch {
   }
   try {
-    unlinkSync(LOCK_PATH);
+    unlinkSync(lp);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
 }
-function unlinkIfSamePid(expectedPidStr) {
+function unlinkIfSamePid(expectedPidStr, lp) {
   let current;
   try {
-    current = readFileSync9(LOCK_PATH, "utf8").trim();
+    current = readFileSync10(lp, "utf8").trim();
   } catch {
     return false;
   }
   if (current !== expectedPidStr) return false;
   try {
-    unlinkSync(LOCK_PATH);
+    unlinkSync(lp);
     return true;
   } catch {
     return false;
   }
 }
-function checkStaleAndRetry(verb) {
+function checkStaleAndRetry(verb, lp) {
   let pidStr;
   try {
-    pidStr = readFileSync9(LOCK_PATH, "utf8").trim();
+    pidStr = readFileSync10(lp, "utf8").trim();
   } catch {
     pidStr = "";
   }
   const pid = Number.parseInt(pidStr, 10);
   if (!Number.isFinite(pid) || pid <= 0) {
-    if (unlinkIfSamePid(pidStr)) return retryOnce(verb);
+    if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
     warn(`another nomad ${verb} running, skipping`);
     return null;
   }
@@ -3209,7 +3374,7 @@ function checkStaleAndRetry(verb) {
   } catch (err) {
     const code = err.code;
     if (code === "ESRCH") {
-      if (unlinkIfSamePid(pidStr)) return retryOnce(verb);
+      if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
       warn(`another nomad ${verb} running, skipping`);
       return null;
     }
@@ -3217,9 +3382,9 @@ function checkStaleAndRetry(verb) {
     return null;
   }
 }
-function retryOnce(verb) {
+function retryOnce(verb, lp) {
   try {
-    const fd = openSync3(LOCK_PATH, "wx");
+    const fd = openSync3(lp, "wx");
     try {
       writeFileSync3(fd, String(process.pid));
     } catch {
@@ -3228,13 +3393,13 @@ function retryOnce(verb) {
       } catch {
       }
       try {
-        unlinkSync(LOCK_PATH);
+        unlinkSync(lp);
       } catch {
       }
       warn(`another nomad ${verb} running, skipping`);
       return null;
     }
-    return { fd };
+    return { fd, path: lp };
   } catch {
     warn(`another nomad ${verb} running, skipping`);
     return null;
@@ -3247,19 +3412,20 @@ function cmdDropSession(id) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync24(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  const repo = repoHome();
+  if (!existsSync25(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join29(REPO_HOME, "shared", "projects");
-    if (!existsSync24(repoProjects)) {
+    const repoProjects = join30(repo, "shared", "projects");
+    if (!existsSync25(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
-    const matches = collectMatches(repoProjects, id);
+    const matches = collectMatches(repoProjects, id, repo);
     if (matches.length === 0) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
-    for (const rel of matches) unstageOne(rel);
+    for (const rel of matches) unstageOne(rel, repo);
     reportScrubHint(id, matches);
   } catch (err) {
     if (!(err instanceof NomadFatal)) {
@@ -3271,37 +3437,37 @@ function cmdDropSession(id) {
     releaseLock(handle);
   }
 }
-function collectMatches(repoProjects, id) {
+function collectMatches(repoProjects, id, repo) {
   const matches = [];
   for (const logical of readdirSync9(repoProjects)) {
-    const candidate = join29(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync24(candidate)) {
-      matches.push(relative4(REPO_HOME, candidate));
-    }
-    const dir = join29(repoProjects, logical, id);
-    if (existsSync24(dir) && statSync5(dir).isDirectory()) {
-      const dirRel = relative4(REPO_HOME, dir);
-      const staged = expandStagedDir(dirRel);
+    const candidate = join30(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync25(candidate)) {
+      matches.push(relative4(repo, candidate));
+    }
+    const dir = join30(repoProjects, logical, id);
+    if (existsSync25(dir) && statSync5(dir).isDirectory()) {
+      const dirRel = relative4(repo, dir);
+      const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
       else matches.push(dirRel);
     }
   }
   return matches;
 }
-function unstageOne(rel) {
-  if (!isInIndex(rel)) {
-    log(`dropped ${rel} (already absent from index)`);
+function unstageOne(rel, repo) {
+  if (!isInIndex(rel, repo)) {
+    item(`dropped ${rel} (already absent from index)`);
     return;
   }
   try {
-    if (isTrackedInHead(rel)) {
+    if (isTrackedInHead(rel, repo)) {
       execFileSync12("git", ["restore", "--staged", "--worktree", "--", rel], {
-        cwd: REPO_HOME,
+        cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
     } else {
       execFileSync12("git", ["rm", "--cached", "-f", "--", rel], {
-        cwd: REPO_HOME,
+        cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
     }
@@ -3310,24 +3476,24 @@ function unstageOne(rel) {
     const detail = e.stderr?.toString().trim() ?? e.message;
     throw new NomadFatal(`git failed to unstage ${rel}: ${detail}`);
   }
-  log(`dropped ${rel}`);
+  item(`dropped ${rel}`);
 }
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync26, statSync as statSync7 } from "node:fs";
-import { dirname as dirname5, join as join31 } from "node:path";
+import { existsSync as existsSync27, statSync as statSync7 } from "node:fs";
+import { dirname as dirname5, join as join32 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync25, lstatSync as lstatSync7, readFileSync as readFileSync10, readdirSync as readdirSync10, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync26, lstatSync as lstatSync7, readFileSync as readFileSync11, readdirSync as readdirSync10, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join31 } from "node:path";
 init_utils_fs();
 function collectFiles(dir, out) {
-  if (!existsSync25(dir)) return;
+  if (!existsSync26(dir)) return;
   const st = lstatSync7(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync10(dir)) {
-    const abs = join30(dir, entry);
+    const abs = join31(dir, entry);
     const lst = lstatSync7(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
@@ -3364,7 +3530,7 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   if (!dryRun && total > 0) {
     for (const { path: filePath, findings } of dirty) {
       backupBeforeWrite(filePath, ts);
-      writeFileSync4(filePath, applyRedactions(readFileSync10(filePath, "utf8"), findings), "utf8");
+      writeFileSync4(filePath, applyRedactions(readFileSync11(filePath, "utf8"), findings), "utf8");
     }
   }
   return { total, dirty };
@@ -3377,14 +3543,15 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript2(id) {
   try {
-    const mapPath = join31(REPO_HOME, "path-map.json");
-    if (!existsSync26(mapPath)) return null;
+    const mapPath = join32(repoHome(), "path-map.json");
+    if (!existsSync27(mapPath)) return null;
     const projects = readJson(mapPath).projects;
+    const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join31(CLAUDE_HOME, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync26(live)) return live;
+      const live = join32(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync27(live)) return live;
     }
     return null;
   } catch {
@@ -3402,17 +3569,19 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
     fail(`invalid session id: ${id}`);
     process.exit(1);
   }
-  if (!existsSync26(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  const repo = repoHome();
+  const backup = backupBase();
+  if (!existsSync27(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript2(id);
-    if (localPath === null || !existsSync26(localPath)) {
+    if (localPath === null || !existsSync27(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join31(dirname5(localPath), id);
+    const sessionDir = join32(dirname5(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -3431,7 +3600,7 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
       process.exitCode = 1;
       return;
     }
-    const ts = freshBackupTs(BACKUP_BASE);
+    const ts = freshBackupTs(backup);
     const { total: totalCount, dirty } = applySubtreeRedactions(
       localPath,
       mainFindings,
@@ -3465,8 +3634,8 @@ ${lines}`);
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join40 } from "node:path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync8 } from "node:fs";
+import { join as join41 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -3554,8 +3723,8 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync29 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+import { join as join35 } from "node:path";
 
 // src/extras-sync.diff.ts
 init_utils();
@@ -3594,8 +3763,8 @@ function listDivergingFiles(a, b) {
 
 // src/extras-sync.core.ts
 init_config();
-import { cpSync as cpSync5, existsSync as existsSync27, rmSync as rmSync8 } from "node:fs";
-import { join as join32 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync28, rmSync as rmSync8 } from "node:fs";
+import { join as join33 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -3618,9 +3787,10 @@ function assertSafeLocalRoot(localRoot, logical) {
 init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
-  const mapPath = join32(REPO_HOME, "path-map.json");
-  const repoExtras = join32(REPO_HOME, "shared", "extras");
-  if (!existsSync27(mapPath) || opts.requireRepoExtras === true && !existsSync27(repoExtras)) {
+  const repo = repoHome();
+  const mapPath = join33(repo, "path-map.json");
+  const repoExtras = join33(repo, "shared", "extras");
+  if (!existsSync28(mapPath) || opts.requireRepoExtras === true && !existsSync28(repoExtras)) {
     if (opts.missingMsg !== void 0) log(opts.missingMsg);
     return null;
   }
@@ -3662,8 +3832,8 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync28, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join34 } from "node:path";
 init_utils_fs();
 function runExtrasOp(v, dryRun, paths, backup) {
   const counts = { unmapped: 0, skipped: 0 };
@@ -3671,15 +3841,15 @@ function runExtrasOp(v, dryRun, paths, backup) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync28(src)) continue;
-    const item = `${t.logical}/${t.dirname}`;
+    if (!existsSync29(src)) continue;
+    const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
-      would.push(item);
+      would.push(item2);
       continue;
     }
     backup(dst, t.localRoot);
     copyExtras(src, dst);
-    done.push(item);
+    done.push(item2);
   }
   return { ...counts, done, would };
 }
@@ -3687,16 +3857,17 @@ function remapExtrasPush(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
-  const repoExtras = join33(REPO_HOME, "shared", "extras");
+  const repo = repoHome();
+  const repoExtras = join34(repo, "shared", "extras");
   if (!dryRun) mkdirSync6(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname7 }) => ({
-      src: join33(localRoot, dirname7),
-      dst: join33(repoExtras, logical, dirname7)
+      src: join34(localRoot, dirname7),
+      dst: join34(repoExtras, logical, dirname7)
     }),
-    (dst) => backupRepoWrite(dst, ts, REPO_HOME)
+    (dst) => backupRepoWrite(dst, ts, repo)
   );
   return { unmapped, skipped, pushed: done, wouldPush: would };
 }
@@ -3707,13 +3878,13 @@ function remapExtrasPull(ts, opts = {}) {
     missingMsg: "no path-map or repo extras dir; skipping extras remap"
   });
   if (v === null) return { unmapped: 0, skipped: 0, pulled: [], wouldPull: [] };
-  const repoExtras = join33(REPO_HOME, "shared", "extras");
+  const repoExtras = join34(repoHome(), "shared", "extras");
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname7 }) => ({
-      src: join33(repoExtras, logical, dirname7),
-      dst: join33(localRoot, dirname7)
+      src: join34(repoExtras, logical, dirname7),
+      dst: join34(localRoot, dirname7)
     }),
     // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -3727,14 +3898,15 @@ function divergenceCheckExtras(ts) {
   const v = loadValidatedExtras({});
   if (v === null) return;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join34(BACKUP_BASE, ts, "extras");
+  const backupRoot = join35(backupBase(), ts, "extras");
+  const repo = repoHome();
   for (const { logical, localRoot, dirname: dirname7 } of eachExtrasTarget(v, counts)) {
-    const local = join34(localRoot, dirname7);
-    const repo = join34(REPO_HOME, "shared", "extras", logical, dirname7);
-    if (!existsSync29(local) || !existsSync29(repo)) continue;
-    const diff = listDivergingFiles(local, repo);
+    const local = join35(localRoot, dirname7);
+    const repoEntry = join35(repo, "shared", "extras", logical, dirname7);
+    if (!existsSync30(local) || !existsSync30(repoEntry)) continue;
+    const diff = listDivergingFiles(local, repoEntry);
     if (diff.length === 0) continue;
-    const projectBackupRoot = join34(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join35(backupRoot, encodePath(localRoot));
     warn(
       `local ${dirname7} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will overwrite them (backups at ${projectBackupRoot}/)`
     );
@@ -3747,8 +3919,8 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { existsSync as existsSync30, lstatSync as lstatSync8, rmSync as rmSync9 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync31, lstatSync as lstatSync8, rmSync as rmSync9 } from "node:fs";
+import { join as join36 } from "node:path";
 function emitAutoMove(onPreview, linkPath, ts, name) {
   if (onPreview) {
     onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
@@ -3765,13 +3937,15 @@ function emitCreate(onPreview, from, to) {
 }
 function applySharedLinks(ts, map, opts = {}) {
   const dryRun = opts.dryRun === true;
+  const claude = claudeHome();
+  const repo = repoHome();
   const linkNames = allSharedLinks(map);
   for (const name of linkNames) {
-    const linkPath = join35(CLAUDE_HOME, name);
-    const target = join35(REPO_HOME, "shared", name);
-    if (!existsSync30(linkPath)) continue;
+    const linkPath = join36(claude, name);
+    const target = join36(repo, "shared", name);
+    if (!existsSync31(linkPath)) continue;
     if (lstatSync8(linkPath).isSymbolicLink()) continue;
-    if (!existsSync30(target)) continue;
+    if (!existsSync31(target)) continue;
     if (dryRun) {
       emitAutoMove(opts.onPreview, linkPath, ts, name);
       continue;
@@ -3780,28 +3954,30 @@ function applySharedLinks(ts, map, opts = {}) {
     rmSync9(linkPath, { recursive: true, force: true });
   }
   for (const name of linkNames) {
-    const target = join35(REPO_HOME, "shared", name);
-    if (!existsSync30(target)) continue;
+    const target = join36(repo, "shared", name);
+    if (!existsSync31(target)) continue;
     if (dryRun) {
-      emitCreate(opts.onPreview, join35(CLAUDE_HOME, name), target);
+      emitCreate(opts.onPreview, join36(claude, name), target);
       continue;
     }
-    ensureSymlink(join35(CLAUDE_HOME, name), target);
+    ensureSymlink(join36(claude, name), target);
   }
 }
 function regenerateSettings(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
-  const basePath = join35(REPO_HOME, "shared", "settings.base.json");
-  const hostPath = join35(REPO_HOME, "hosts", `${HOST}.json`);
-  if (!existsSync30(basePath)) {
+  const repo = repoHome();
+  const claude = claudeHome();
+  const basePath = join36(repo, "shared", "settings.base.json");
+  const hostPath = join36(repo, "hosts", `${HOST}.json`);
+  if (!existsSync31(basePath)) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const base = readJson(basePath);
-  const hasOverrides = existsSync30(hostPath);
+  const hasOverrides = existsSync31(hostPath);
   const overrides = hasOverrides ? readJson(hostPath) : {};
   const merged = deepMerge(base, overrides);
-  const settingsPath = join35(CLAUDE_HOME, "settings.json");
-  if (!hasOverrides && existsSync30(settingsPath)) {
+  const settingsPath = join36(claude, "settings.json");
+  if (!hasOverrides && existsSync31(settingsPath)) {
     try {
       const existing = readJson(settingsPath);
       const baseKeys = new Set(Object.keys(base));
@@ -3827,8 +4003,8 @@ function regenerateSettings(ts, opts = {}) {
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync31 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { join as join37 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -4114,7 +4290,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync31(path)) return null;
+  if (!existsSync32(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -4128,12 +4304,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync31(hostPath)) {
+  if (hostOverrides === null && existsSync32(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = deepMerge(base, hostOverrides ?? {});
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync31(settingsPath)) {
+  if (current === null && existsSync32(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const rawEqual = JSON.stringify(current ?? {}, null, 2) === JSON.stringify(merged, null, 2);
@@ -4163,6 +4339,8 @@ function buildSettingsSectionForPreview(result) {
   return s;
 }
 function computePreview(ts, map, verb = "pull") {
+  const repo = repoHome();
+  const claude = claudeHome();
   console.log(`would pull on host=${HOST} (dry-run; no mutation)`);
   console.log("");
   const links = section("Symlinks");
@@ -4171,9 +4349,9 @@ function computePreview(ts, map, verb = "pull") {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join36(REPO_HOME, "shared", "settings.base.json"),
-    join36(REPO_HOME, "hosts", `${HOST}.json`),
-    join36(CLAUDE_HOME, "settings.json")
+    join37(repo, "shared", "settings.base.json"),
+    join37(repo, "hosts", `${HOST}.json`),
+    join37(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -4189,21 +4367,21 @@ function computePreview(ts, map, verb = "pull") {
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync33 } from "node:fs";
+import { existsSync as existsSync34 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
-import { readFileSync as readFileSync11, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join39 } from "node:path";
+import { readFileSync as readFileSync12, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join40 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync6, existsSync as existsSync32, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
-import { dirname as dirname6, join as join37, sep as sep3 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync33, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
+import { dirname as dirname6, join as join38, sep as sep3 } from "node:path";
 init_push_gitleaks_scan();
 init_utils_json();
 init_utils();
@@ -4229,13 +4407,13 @@ function parseAction(raw) {
 }
 
 // src/commands.push.recovery.redact.ts
-function resolveStagedDir(localPath, map) {
+function resolveStagedDir(localPath, map, claude, repo) {
   for (const [logical, hostMap] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join37(CLAUDE_HOME, "projects", encodePath(abs)) + sep3)) {
-      return join37(REPO_HOME, "shared", "projects", logical);
+    if (localPath.startsWith(join38(claude, "projects", encodePath(abs)) + sep3)) {
+      return join38(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -4245,6 +4423,8 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     log(msg);
     return false;
   };
+  const claude = claudeHome();
+  const repo = repoHome();
   const sid = sessionIdFromFinding(f);
   if (sid === null) {
     return refuse(
@@ -4257,7 +4437,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join37(dirname6(localPath), sid);
+  const sessionDir = join38(dirname6(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4266,7 +4446,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
   End the session and choose Redact again, or choose Drop session (holds this session back from the push, local copy kept) or Skip.`
     );
   }
-  const stagedProjectDir = resolveStagedDir(localPath, map);
+  const stagedProjectDir = resolveStagedDir(localPath, map, claude, repo);
   if (stagedProjectDir === null) {
     return refuse(
       `could not map the local transcript for session ${sid} to a staged copy; choose Drop session or Skip.`
@@ -4291,9 +4471,9 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync7(stagedProjectDir, { recursive: true });
-  cpSync6(localPath, join37(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync32(sessionDir)) {
-    cpSync6(sessionDir, join37(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync6(localPath, join38(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync33(sessionDir)) {
+    cpSync6(sessionDir, join38(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
@@ -4301,13 +4481,14 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
 // src/commands.push.recovery.drop.ts
 init_config();
 import { rmSync as rmSync10 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
+  const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join38(REPO_HOME, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join38(REPO_HOME, "shared", "projects", logical, sid);
+    const jsonl = join39(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join39(repo, "shared", "projects", logical, sid);
     rmSync10(jsonl, { force: true });
     rmSync10(dir, { recursive: true, force: true });
   }
@@ -4317,19 +4498,19 @@ function dropSessionFromStaged(sid, map) {
 // src/commands.push.recovery.actions.ts
 init_push_gitleaks_scan();
 init_utils();
-function applyAllow(f) {
-  appendGitleaksIgnore(f.Fingerprint);
+function applyAllow(f, repo) {
+  appendGitleaksIgnore(f.Fingerprint, repo);
 }
-function allowAllFindings(findings) {
+function allowAllFindings(findings, repo) {
   for (const f of findings) {
-    appendGitleaksIgnore(f.Fingerprint);
+    appendGitleaksIgnore(f.Fingerprint, repo);
   }
 }
-function allowFindingsByRule(findings, ruleId) {
+function allowFindingsByRule(findings, ruleId, repo) {
   let count = 0;
   for (const f of findings) {
     if (f.RuleID === ruleId) {
-      appendGitleaksIgnore(f.Fingerprint);
+      appendGitleaksIgnore(f.Fingerprint, repo);
       count++;
     }
   }
@@ -4351,7 +4532,7 @@ function dispatchOne(f, ctx) {
   const sid = sessionIdFromFinding(f);
   if (sid !== null && ctx.droppedSids.has(sid)) return;
   if (action === "allow") {
-    applyAllow(f);
+    applyAllow(f, ctx.repo);
     return;
   }
   if (sid === null) return;
@@ -4368,12 +4549,14 @@ function dispatchOne(f, ctx) {
     if (applyRedact(f, ctx.ts, ctx.map, ctx.nowMs, ctx.scan)) ctx.redactedSids.add(sid);
   }
 }
-function dispatchActions(findings, actions, ts, map, nowMs, scan = scanFile, drop = dropSessionFromStaged) {
+function dispatchActions(findings, actions, opts) {
+  const { ts, map, nowMs, repo, scan = scanFile, drop = dropSessionFromStaged } = opts;
   const ctx = {
     actions,
     ts,
     map,
     nowMs,
+    repo,
     scan,
     drop,
     redactedSids: /* @__PURE__ */ new Set(),
@@ -4415,26 +4598,26 @@ function printRecoveryLegend(print = console.log) {
   print("  Skip         - leave unresolved (the push aborts)");
   print("");
 }
-function applyThenRescan(scanVerdict, repoHome) {
-  gitOrFatal(["add", "-A"], "git add", repoHome);
-  const next = scanVerdict();
+function applyThenRescan(scanVerdict, repoHome2) {
+  gitOrFatal(["add", "-A"], "git add", repoHome2);
+  const next = scanVerdict(repoHome2);
   if (next.leak) {
     const { bySession, other } = partitionFindings(next.findings);
     throw new NomadFatal(buildSessionAwareFatal(bySession, other));
   }
   return next;
 }
-function allowThenRescan(append, scanVerdict, repoHome) {
-  const ignPath = join39(repoHome, ".gitleaksignore");
+function allowThenRescan(append, scanVerdict, repoHome2) {
+  const ignPath = join40(repoHome2, ".gitleaksignore");
   let before;
   try {
-    before = readFileSync11(ignPath, "utf8");
+    before = readFileSync12(ignPath, "utf8");
   } catch {
     before = null;
   }
   append();
   try {
-    return applyThenRescan(scanVerdict, repoHome);
+    return applyThenRescan(scanVerdict, repoHome2);
   } catch (err) {
     if (before === null) rmSync11(ignPath, { force: true });
     else writeFileSync5(ignPath, before, "utf8");
@@ -4467,22 +4650,23 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
     printLegend = printRecoveryLegend
   } = deps;
   const scanVerdict = deps.scanVerdict ?? (await Promise.resolve().then(() => (init_push_leak_verdict(), push_leak_verdict_exports))).scanPushVerdict;
+  const repo = repoHome();
   let current = verdict;
   if (redactAll) {
     redactAllFindings(current.findings, ts, map, nowMs, scan);
-    return applyThenRescan(scanVerdict, REPO_HOME);
+    return applyThenRescan(scanVerdict, repo);
   }
   if (allowAll) {
-    return allowThenRescan(() => allowAllFindings(current.findings), scanVerdict, REPO_HOME);
+    return allowThenRescan(() => allowAllFindings(current.findings, repo), scanVerdict, repo);
   }
   if (allowRule !== void 0) {
     return allowThenRescan(
       () => {
-        const matched = allowFindingsByRule(current.findings, allowRule);
+        const matched = allowFindingsByRule(current.findings, allowRule, repo);
         if (matched === 0) log(`no findings matched rule ${allowRule}; re-scanning`);
       },
       scanVerdict,
-      REPO_HOME
+      repo
     );
   }
   if (!isTTYCheck()) {
@@ -4497,9 +4681,9 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
       const { bySession, other } = partitionFindings(unresolved);
       throw new NomadFatal(buildSessionAwareFatal(bySession, other));
     }
-    dispatchActions(current.findings, actions, ts, map, nowMs, scan);
-    gitOrFatal(["add", "-A"], "git add", REPO_HOME);
-    current = scanVerdict();
+    dispatchActions(current.findings, actions, { ts, map, nowMs, repo, scan });
+    gitOrFatal(["add", "-A"], "git add", repo);
+    current = scanVerdict(repo);
   }
   return current;
 }
@@ -4523,7 +4707,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync33;
+  const check = deps.existsSyncFn ?? existsSync34;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -4729,17 +4913,19 @@ function handleWedge(repo, forceRemote) {
 function cmdPull(opts = {}) {
   const dryRun = opts.dryRun === true;
   const forceRemote = opts.forceRemote === true;
-  if (!existsSync34(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
-  if (!existsSync34(join40(REPO_HOME, "shared", "settings.base.json"))) {
+  const repo = repoHome();
+  const backup = backupBase();
+  if (!existsSync35(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync35(join41(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
   if (handle === null) process.exit(0);
   try {
-    const ts = freshBackupTs(BACKUP_BASE);
-    handleWedge(REPO_HOME, forceRemote);
+    const ts = freshBackupTs(backup);
+    handleWedge(repo, forceRemote);
     if (!dryRun) {
-      const backupRoot = join40(BACKUP_BASE, ts);
+      const backupRoot = join41(backup, ts);
       try {
         mkdirSync8(backupRoot, { recursive: true });
       } catch (err) {
@@ -4749,9 +4935,9 @@ function cmdPull(opts = {}) {
     log(
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
-    gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", REPO_HOME);
-    const mapPath = join40(REPO_HOME, "path-map.json");
-    const map = existsSync34(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
+    const mapPath = join41(repo, "path-map.json");
+    const map = existsSync35(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     if (dryRun) {
       computePreview(ts, map, "pull");
@@ -4773,8 +4959,8 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync36 } from "node:fs";
-import { join as join42, relative as relative5 } from "node:path";
+import { existsSync as existsSync37 } from "node:fs";
+import { join as join43, relative as relative5 } from "node:path";
 
 // src/commands.push.allowlist.ts
 init_config();
@@ -4854,9 +5040,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync35, mkdirSync as mkdirSync9, readdirSync as readdirSync11, rmSync as rmSync12 } from "node:fs";
+import { copyFileSync, existsSync as existsSync36, mkdirSync as mkdirSync9, readdirSync as readdirSync11, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -4871,13 +5057,13 @@ function stageSessions(tmpRoot, map) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join41(CLAUDE_HOME, "projects");
-  if (!existsSync35(localProjects)) return 0;
+  const localProjects = join42(claudeHome(), "projects");
+  if (!existsSync36(localProjects)) return 0;
   let staged = 0;
   for (const dir of readdirSync11(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join41(localProjects, dir), join41(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join42(localProjects, dir), join42(tmpRoot, "shared", "projects", logical));
     staged++;
   }
   return staged;
@@ -4893,9 +5079,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname7 of dirnames) {
       if (!whitelist.includes(dirname7)) continue;
-      const src = join41(localRoot, dirname7);
-      if (!existsSync35(src)) continue;
-      const dst = join41(tmpRoot, "shared", "extras", logical, dirname7);
+      const src = join42(localRoot, dirname7);
+      if (!existsSync36(src)) continue;
+      const dst = join42(tmpRoot, "shared", "extras", logical, dirname7);
       copyExtras(src, dst);
       staged++;
     }
@@ -4903,19 +5089,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map) {
-  const cacheDir = join41(homedir5(), ".cache", "claude-nomad");
+  const cacheDir = join42(homedir5(), ".cache", "claude-nomad");
   mkdirSync9(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join41(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join42(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join41(REPO_HOME, ".gitleaksignore");
-    if (existsSync35(ignoreFile)) {
-      copyFileSync(ignoreFile, join41(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join42(repoHome(), ".gitleaksignore");
+    if (existsSync36(ignoreFile)) {
+      copyFileSync(ignoreFile, join42(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -4936,11 +5122,11 @@ function previewPushLeaks(map) {
 init_utils();
 init_utils_fs();
 init_utils_json();
-function guardGitlinks() {
-  const gitlinks = findGitlinks(join42(REPO_HOME, "shared"));
+function guardGitlinks(repo) {
+  const gitlinks = findGitlinks(join43(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
-    const rel = relative5(REPO_HOME, p);
+    const rel = relative5(repo, p);
     fail(`gitlink: ${rel} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`);
   }
   const noun = gitlinks.length === 1 ? "entry" : "entries";
@@ -4948,15 +5134,15 @@ function guardGitlinks() {
     `gitlink trap: ${gitlinks.length} nested .git ${noun} in shared/; remove before retry`
   );
 }
-async function commitAndPush(st, ts, map, redactAll, allowAll, allowRule) {
-  gitOrFatal(["add", "-A"], "git add", REPO_HOME);
-  let verdict = withSpinner("Scanning for secrets", scanPushVerdict);
+async function commitAndPush(st, ts, map, redactAll, allowAll, allowRule, repo) {
+  gitOrFatal(["add", "-A"], "git add", repo);
+  let verdict = withSpinner("Scanning for secrets", () => scanPushVerdict(repo));
   if (verdict.leak) {
     renderPushTree(st, verdict);
     verdict = await resolveLeakFindings(verdict, ts, map, { redactAll, allowAll, allowRule });
   }
-  gitOrFatal(["commit", "-m", `chore: sync from ${HOST}`], "git commit", REPO_HOME);
-  withSpinner("Pushing", () => gitOrFatal(["push"], "git push", REPO_HOME));
+  gitOrFatal(["commit", "-m", `chore: sync from ${HOST}`], "git commit", repo);
+  withSpinner("Pushing", () => gitOrFatal(["push"], "git push", repo));
   renderPushTree(st, verdict);
 }
 function runDryRunPreview(st, map) {
@@ -4989,33 +5175,35 @@ async function cmdPush(opts = {}) {
   const allowAll = opts.allowAll === true;
   const allowRule = opts.allowRule;
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
-  if (!existsSync36(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
+  const repo = repoHome();
+  const backup = backupBase();
+  if (!existsSync37(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
     console.log(dryRun ? `push on host=${HOST} (dry-run)` : `push on host=${HOST}`);
     probeGitleaks();
-    withSpinner("Rebasing onto origin", rebaseBeforePush);
-    const ts = freshBackupTs(BACKUP_BASE);
+    withSpinner("Rebasing onto origin", () => rebaseBeforePush(repo));
+    const ts = freshBackupTs(backup);
     const remap = withSpinner("Syncing sessions", () => remapPush(ts, { dryRun }));
     const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
     const st = { dryRun, remap, extras };
-    guardGitlinks();
-    const status = gitStatusPorcelainZ(REPO_HOME, { untrackedAll: true });
+    guardGitlinks(repo);
+    const status = gitStatusPorcelainZ(repo, { untrackedAll: true });
     if (!dryRun && !status) {
       log("nothing to commit");
       renderNoScanTree(st);
       return;
     }
-    const mapPath = join42(REPO_HOME, "path-map.json");
-    if (!existsSync36(mapPath)) {
+    const mapPath = join43(repo, "path-map.json");
+    if (!existsSync37(mapPath)) {
       if (dryRun) return runDryRunPreview(st, null);
       die("path-map.json missing, cannot enforce push allow-list");
     }
     const map = readPathMap(mapPath);
     if (status) enforceAllowList(status, map);
     if (dryRun) return runDryRunPreview(st, map);
-    await commitAndPush(st, ts, map, redactAll, allowAll, allowRule);
+    await commitAndPush(st, ts, map, redactAll, allowAll, allowRule, repo);
   } catch (err) {
     if (err instanceof NomadFatal) {
       fail(err.message);
@@ -5048,17 +5236,18 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync37 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync38 } from "node:fs";
+import { join as join44 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
-    if (!existsSync37(REPO_HOME)) die(`repo not cloned at ${REPO_HOME}`);
-    const ts = freshBackupTs(BACKUP_BASE);
-    const mapPath = join43(REPO_HOME, "path-map.json");
-    const map = existsSync37(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const repo = repoHome();
+    if (!existsSync38(repo)) die(`repo not cloned at ${repo}`);
+    const ts = freshBackupTs(backupBase());
+    const mapPath = join44(repo, "path-map.json");
+    const map = existsSync38(mapPath) ? readPathMap(mapPath) : { projects: {} };
     computePreview(ts, map, "diff");
   } catch (err) {
     if (err instanceof NomadFatal) {
@@ -5072,8 +5261,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync39, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join45 } from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join46 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -5090,8 +5279,9 @@ function ensureOriginRepo(repoName, run = execFileSync16) {
       `invalid repo name: ${JSON.stringify(repoName)}. Use only letters, digits, hyphens, underscores, and dots (1-100 chars).`
     );
   }
+  const repo = repoHome();
   try {
-    readOriginRemote(REPO_HOME, run);
+    readOriginRemote(repo, run);
     return;
   } catch {
   }
@@ -5106,7 +5296,7 @@ function ensureOriginRepo(repoName, run = execFileSync16) {
     die("gh CLI is not authenticated. Run `gh auth login` and retry.");
   }
   try {
-    run("git", ["init", "-b", "main"], { cwd: REPO_HOME, stdio: ["ignore", "ignore", "pipe"] });
+    run("git", ["init", "-b", "main"], { cwd: repo, stdio: ["ignore", "ignore", "pipe"] });
   } catch (err) {
     const e = err;
     throw new NomadFatal(`git init failed: ${e.message}`);
@@ -5139,7 +5329,7 @@ function ensureOriginRepo(repoName, run = execFileSync16) {
   }
   try {
     run("git", ["remote", "add", "origin", `git@github.com:${owner}/${repoName}.git`], {
-      cwd: REPO_HOME,
+      cwd: repo,
       stdio: ["ignore", "ignore", "pipe"]
     });
   } catch (err) {
@@ -5154,31 +5344,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync38, rmSync as rmSync13, statSync as statSync9 } from "node:fs";
-import { join as join44 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync39, rmSync as rmSync13, statSync as statSync9 } from "node:fs";
+import { join as join45 } from "node:path";
 function snapshotIntoShared(map) {
+  const repo = repoHome();
+  const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join44(CLAUDE_HOME, name);
-    if (!existsSync38(src)) continue;
-    const dst = join44(REPO_HOME, "shared", name);
+    const src = join45(claude, name);
+    if (!existsSync39(src)) continue;
+    const dst = join45(repo, "shared", name);
     if (statSync9(src).isDirectory()) {
-      const gk = join44(dst, ".gitkeep");
-      if (existsSync38(gk)) rmSync13(gk);
+      const gk = join45(dst, ".gitkeep");
+      if (existsSync39(gk)) rmSync13(gk);
       cpSync7(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join44(CLAUDE_HOME, "settings.json");
-  if (existsSync38(userSettings)) {
+  const userSettings = join45(claude, "settings.json");
+  if (existsSync39(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join44(REPO_HOME, "hosts", `${HOST}.json`);
+    const hostFile = join45(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -5189,62 +5381,64 @@ init_utils();
 init_utils_fs();
 var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.claude/CLAUDE.md by nomad pull -->\n";
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
-function preflightConflict(repoHome) {
+function preflightConflict(repoHome2) {
   const candidates = [
-    join45(repoHome, "shared", "settings.base.json"),
-    join45(repoHome, "shared", "CLAUDE.md"),
-    join45(repoHome, "path-map.json"),
-    join45(repoHome, "hosts"),
-    join45(repoHome, "shared")
+    join46(repoHome2, "shared", "settings.base.json"),
+    join46(repoHome2, "shared", "CLAUDE.md"),
+    join46(repoHome2, "path-map.json"),
+    join46(repoHome2, "hosts"),
+    join46(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync39(c)) return c;
+    if (existsSync40(c)) return c;
   }
   return null;
 }
 function cmdInit(opts = {}) {
   const snapshot = opts.snapshot === true;
   const keepActions = opts.keepActions === true;
-  mkdirSync10(REPO_HOME, { recursive: true });
-  const conflict = preflightConflict(REPO_HOME);
+  const repo = repoHome();
+  const claude = claudeHome();
+  mkdirSync10(repo, { recursive: true });
+  const conflict = preflightConflict(repo);
   if (conflict !== null) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync10(join45(REPO_HOME, "shared"), { recursive: true });
-  mkdirSync10(join45(REPO_HOME, "hosts"), { recursive: true });
+  mkdirSync10(join46(repo, "shared"), { recursive: true });
+  mkdirSync10(join46(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync10(join45(REPO_HOME, "shared", name), { recursive: true });
+    mkdirSync10(join46(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join45(CLAUDE_HOME, "CLAUDE.md");
-  if (!snapshot || !existsSync39(userClaudeMd)) {
-    writeFileSync6(join45(REPO_HOME, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
-    log("created shared/CLAUDE.md");
+  const userClaudeMd = join46(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync40(userClaudeMd)) {
+    writeFileSync6(join46(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+    item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join45(REPO_HOME, "shared", name, ".gitkeep"), "");
-    log(`created shared/${name}/.gitkeep`);
-  }
-  writeFileSync6(join45(REPO_HOME, "hosts", ".gitkeep"), "");
-  log("created hosts/.gitkeep");
-  writeJsonAtomic(join45(REPO_HOME, "shared", "settings.base.json"), {});
-  log("created shared/settings.base.json");
-  writeJsonAtomic(join45(REPO_HOME, "path-map.json"), { projects: {} });
-  log("created path-map.json");
+    writeFileSync6(join46(repo, "shared", name, ".gitkeep"), "");
+    item(`created shared/${name}/.gitkeep`);
+  }
+  writeFileSync6(join46(repo, "hosts", ".gitkeep"), "");
+  item("created hosts/.gitkeep");
+  writeJsonAtomic(join46(repo, "shared", "settings.base.json"), {});
+  item("created shared/settings.base.json");
+  writeJsonAtomic(join46(repo, "path-map.json"), { projects: {} });
+  item("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
     log(`snapshot staged in shared/; review, then 'nomad push' to share with other hosts.`);
     log("~/.claude/ originals were NOT removed.");
   }
   if (!keepActions) {
-    maybeDisableRepoActions(REPO_HOME, opts.run);
+    maybeDisableRepoActions(repo, opts.run);
   }
   log("init complete");
 }
-function maybeDisableRepoActions(repoHome, run) {
+function maybeDisableRepoActions(repoHome2, run) {
   let remote;
   try {
-    remote = readOriginRemote(repoHome, run);
+    remote = readOriginRemote(repoHome2, run);
   } catch {
     return;
   }
@@ -5530,7 +5724,7 @@ function parsePushArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.44.0",
+  version: "0.45.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -5597,6 +5791,8 @@ var package_default = {
     "@commitlint/cli": "^21.0.1",
     "@commitlint/config-conventional": "^21.0.1",
     "@eslint/js": "^10.0.1",
+    "@stryker-mutator/core": "9.6.1",
+    "@stryker-mutator/vitest-runner": "9.6.1",
     "@types/node": "^22.0.0",
     "@vitest/coverage-v8": "^4.1.6",
     diff: "^9.0.0",
@@ -5730,15 +5926,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync40, readFileSync as readFileSync12, readdirSync as readdirSync12 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync41, readFileSync as readFileSync13, readdirSync as readdirSync12 } from "node:fs";
+import { join as join47 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join46(CLAUDE_HOME, "projects");
-  if (!existsSync40(projectsRoot)) {
+  const projectsRoot = join47(claudeHome(), "projects");
+  if (!existsSync41(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -5752,8 +5948,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join46(REPO_HOME, "path-map.json");
-  if (!existsSync40(mapPath)) {
+  const mapPath = join47(repoHome(), "path-map.json");
+  if (!existsSync41(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -5776,13 +5972,13 @@ function resumeCmd(sessionId) {
 }
 function findTranscriptPath(projectsRoot, sessionId) {
   for (const dir of readdirSync12(projectsRoot)) {
-    const candidate = join46(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync40(candidate)) return candidate;
+    const candidate = join47(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync41(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync12(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync13(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);
@@ -5832,7 +6028,8 @@ function shQuote(s) {
 
 // src/nomad.ts
 init_utils();
-if (!HOME) {
+var h = home();
+if (!h) {
   fail(
     "could not determine home directory (HOME env unset and no uid mapping). Set HOME and retry."
   );