claude-nomad 0.44.1 → 0.45.0

package/.gitleaks.toml

@@ -39,6 +39,27 @@ paths = [
 ]
 condition = "AND"
 
+# Path-scoped: SSH public-key fingerprints in git signature-verification
+# output (`git log --show-signature`, `git verify-commit`) land in session
+# transcripts as `Good "git" signature for <signer> with ED25519 key
+# SHA256:<43-char base64>`. The fingerprint is a hash of a PUBLIC key, not a
+# credential, but its 43-char base64 body trips generic-api-key. Anchoring on
+# the surrounding `with <keytype> key SHA256:` structure (via
+# regexTarget = "line") keeps this from whitelisting a bare token: a real
+# secret is never preceded by an SSH key-type label and the SHA256: scheme
+# prefix. `condition = "AND"` plus the session-jsonl path scope double-locks
+# it to synced transcripts.
+[[allowlists]]
+description = "claude-nomad: SSH public-key fingerprints (with <keytype> key SHA256:<b64>) in git signature output in synced session transcripts"
+regexTarget = "line"
+regexes = [
+    '''with (?:ED25519|ED25519-SK|ECDSA|ECDSA-SK|RSA|DSA) key SHA256:[A-Za-z0-9+/]{43}''',
+]
+paths = [
+    '''^shared/projects/[^/]+/.*\.jsonl$''',
+]
+condition = "AND"
+
 # Path-scoped: SonarCloud issue-listing tool output (`gh`/sonar API dumps of
 # the form `key: <20-char id>` immediately followed by `rule: <lang>:S<n>`)
 # lands in session transcripts during PR reviews. The issue key is an opaque

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.45.0](https://github.com/funkadelic/claude-nomad/compare/v0.44.1...v0.45.0) (2026-06-07)
+
+
+### Added
+
+* **doctor:** warn when settings.json drifts from the base+host merge ([#259](https://github.com/funkadelic/claude-nomad/issues/259)) ([6401732](https://github.com/funkadelic/claude-nomad/commit/6401732199aa9f883de78b15b323ec4dfecf8d3f))
+
+
+### Changed
+
+* **gitleaks:** allowlist SSH key fingerprints in signature output ([#257](https://github.com/funkadelic/claude-nomad/issues/257)) ([ca310aa](https://github.com/funkadelic/claude-nomad/commit/ca310aa7f3a23b152ed149224400d60332ada037))
+
+
+### Testing
+
+* kill mutation survivors from the full Stryker sweep ([#260](https://github.com/funkadelic/claude-nomad/issues/260)) ([314e315](https://github.com/funkadelic/claude-nomad/commit/314e31587cb97e0fdf5b410587bb0ca64a2e46d5))
+
 ## [0.44.1](https://github.com/funkadelic/claude-nomad/compare/v0.44.0...v0.44.1) (2026-06-06)
 
 

package/README.md

@@ -37,7 +37,9 @@ survives different file paths and your secrets never ride along.
   `--dry-run` on pull and push prints the plan without writing anything.
 - **One command tells you what is wrong.** `nomad doctor` is a read-only health check: wedged sync
   repo, broken hook references, hooks that would crash on session start because of a missing
-  `--preserve-symlinks-main` flag, version drift, oversized backup cache, each with a fix hint.
+  `--preserve-symlinks-main` flag, version drift, oversized backup cache, and settings drift (warns
+  when `~/.claude/settings.json` no longer matches the base+host merge nomad would write, the
+  silent-clobber case, with `nomad pull` as the fix), each with a fix hint.
 - **Self-healing sync.** Every overwrite is backed up first, and `nomad pull --force-remote`
   recovers a sync repo stuck mid-rebase while parking your stranded work on a branch, refusing
   entirely if shared config is at risk.

package/dist/nomad.mjs

@@ -1400,8 +1400,8 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync22 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { join as join27 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
@@ -2686,17 +2686,150 @@ function reportPreserveSymlinksCheck(section2) {
   }
 }
 
+// src/commands.doctor.checks.settings-drift.ts
+init_color();
+import { existsSync as existsSync21, readFileSync as readFileSync7 } from "node:fs";
+import { join as join25 } from "node:path";
+init_config();
+init_utils_json();
+function arraysEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (!deepEqual(a[i], b[i])) return false;
+  }
+  return true;
+}
+function objectsEqual(a, b) {
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (!Object.hasOwn(b, k)) return false;
+    if (!deepEqual(a[k], b[k])) return false;
+  }
+  return true;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return false;
+  if (Array.isArray(a) && Array.isArray(b)) return arraysEqual(a, b);
+  if (Array.isArray(a) || Array.isArray(b)) return false;
+  if (typeof a === "object" && typeof b === "object") {
+    return objectsEqual(a, b);
+  }
+  return false;
+}
+function diffMergedSettings(merged, settings) {
+  const missing = [];
+  const changed = [];
+  const extra = [];
+  const settingsKeys = new Set(Object.keys(settings));
+  for (const key of Object.keys(merged)) {
+    if (!settingsKeys.has(key)) {
+      missing.push(key);
+    } else if (!deepEqual(merged[key], settings[key])) {
+      changed.push(key);
+    }
+  }
+  const mergedKeys = new Set(Object.keys(merged));
+  for (const key of Object.keys(settings)) {
+    if (!mergedKeys.has(key)) extra.push(key);
+  }
+  const collator = (a, b) => a.localeCompare(b, "en");
+  return {
+    missing: missing.toSorted(collator),
+    changed: changed.toSorted(collator),
+    extra: extra.toSorted(collator)
+  };
+}
+function tryReadJson(filePath) {
+  try {
+    const raw = readFileSync7(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function reportSettingsDriftCheck(section2) {
+  const claude = claudeHome();
+  const repo = repoHome();
+  const host = HOST;
+  const settingsPath = join25(claude, "settings.json");
+  const basePath = join25(repo, "shared", "settings.base.json");
+  const hostPath = join25(repo, "hosts", `${host}.json`);
+  if (!existsSync21(settingsPath)) {
+    addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
+    return;
+  }
+  if (!existsSync21(basePath)) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
+    );
+    return;
+  }
+  const base = tryReadJson(basePath);
+  if (base === null) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} shared/settings.base.json unparseable; skipping merge-drift check`
+    );
+    return;
+  }
+  const settings = tryReadJson(settingsPath);
+  if (settings === null) {
+    return;
+  }
+  const hostExists = existsSync21(hostPath);
+  const hostObj = hostExists ? tryReadJson(hostPath) : null;
+  if (hostExists && hostObj === null) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} hosts/${host}.json unparseable; 'nomad pull' will fail (fix the host file)`
+    );
+    return;
+  }
+  const merged = deepMerge(base, hostObj ?? {});
+  const { missing, changed, extra } = diffMergedSettings(merged, settings);
+  emitDriftRows(section2, missing, changed, extra, host, hostExists);
+}
+function emitDriftRows(section2, missing, changed, extra, host, hostFileExists) {
+  if (missing.length > 0) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} settings.json drift: merged keys missing locally: ${missing.join(", ")} (external writer clobbered settings.json; run 'nomad pull')`
+    );
+  }
+  if (changed.length > 0) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} settings.json drift: merged keys with changed values: ${changed.join(", ")} (run 'nomad pull')`
+    );
+  }
+  if (extra.length > 0 && hostFileExists) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} settings.json has ${extra.length} local-only key(s) not in base+host merge: ${extra.join(", ")} (promotion candidates for shared/settings.base.json or hosts/${host}.json)`
+    );
+  }
+  if (missing.length === 0 && changed.length === 0 && extra.length === 0) {
+    addItem(section2, `${green(okGlyph)} settings.json matches base+host merge`);
+  }
+}
+
 // src/commands.doctor.ts
 init_config();
 
 // src/commands.doctor.engine.ts
 init_color();
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/commands.doctor.version.ts
 init_color();
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_config();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -2713,7 +2846,7 @@ function compareSemver(a, b) {
 function readLocalVersion() {
   try {
     const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync7(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
     }
@@ -2772,7 +2905,7 @@ function parseMinVersion(spec) {
 function readEnginesNode() {
   try {
     const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync8(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync9(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
     return null;
@@ -2801,8 +2934,8 @@ function reportNodeEngineCheck(section2) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { join as join26 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -2811,7 +2944,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join25(repoHome(), ".gitleaks.toml");
+  const tomlPath = join26(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -2823,7 +2956,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync21) {
+function reportGitleaksVersionCheck(section2, run = execFileSync7, tomlExists = existsSync22) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -3023,8 +3156,8 @@ function cmdDoctor(opts = {}) {
   reportHostAndPaths(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join26(repoHome(), "path-map.json");
-  const rawMap = existsSync22(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join27(repoHome(), "path-map.json");
+  const rawMap = existsSync23(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   const hooksScan = section("Hook targets");
@@ -3035,6 +3168,7 @@ function cmdDoctor(opts = {}) {
   const base = loadBaseSettings(settings);
   const parsedSettings = loadAndReportSettings(settings);
   reportHostOverrides(settings, base, parsedSettings);
+  reportSettingsDriftCheck(settings);
   const pathMap = section("Path map");
   reportPathMap(pathMap);
   const neverSync = section("Never-sync");
@@ -3078,8 +3212,8 @@ function cmdDoctor(opts = {}) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync9, statSync as statSync5 } from "node:fs";
-import { join as join29, relative as relative4 } from "node:path";
+import { existsSync as existsSync25, readdirSync as readdirSync9, statSync as statSync5 } from "node:fs";
+import { join as join30, relative as relative4 } from "node:path";
 
 // src/commands.drop-session.git.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
@@ -3121,8 +3255,8 @@ function isInIndex(rel, repo) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync23 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { join as join28 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript(id, matches);
@@ -3138,8 +3272,8 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript(id, matches) {
   try {
-    const mapPath = join27(repoHome(), "path-map.json");
-    if (!existsSync23(mapPath)) return null;
+    const mapPath = join28(repoHome(), "path-map.json");
+    if (!existsSync24(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
@@ -3147,8 +3281,8 @@ function resolveLiveTranscript(id, matches) {
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join27(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync23(live)) return live;
+      const live = join28(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync24(live)) return live;
     }
     return null;
   } catch {
@@ -3162,10 +3296,10 @@ init_utils();
 // src/utils.lockfile.ts
 init_config();
 init_utils();
-import { closeSync as closeSync3, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname4, join as join28 } from "node:path";
+import { closeSync as closeSync3, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync10, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join29 } from "node:path";
 function lockFilePath() {
-  return join28(home(), ".cache", "claude-nomad", "nomad.lock");
+  return join29(home(), ".cache", "claude-nomad", "nomad.lock");
 }
 function acquireLock(verb) {
   const lp = lockFilePath();
@@ -3208,7 +3342,7 @@ function releaseLock(handle) {
 function unlinkIfSamePid(expectedPidStr, lp) {
   let current;
   try {
-    current = readFileSync9(lp, "utf8").trim();
+    current = readFileSync10(lp, "utf8").trim();
   } catch {
     return false;
   }
@@ -3223,7 +3357,7 @@ function unlinkIfSamePid(expectedPidStr, lp) {
 function checkStaleAndRetry(verb, lp) {
   let pidStr;
   try {
-    pidStr = readFileSync9(lp, "utf8").trim();
+    pidStr = readFileSync10(lp, "utf8").trim();
   } catch {
     pidStr = "";
   }
@@ -3279,12 +3413,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync24(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync25(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join29(repo, "shared", "projects");
-    if (!existsSync24(repoProjects)) {
+    const repoProjects = join30(repo, "shared", "projects");
+    if (!existsSync25(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -3306,12 +3440,12 @@ function cmdDropSession(id) {
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
   for (const logical of readdirSync9(repoProjects)) {
-    const candidate = join29(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync24(candidate)) {
+    const candidate = join30(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync25(candidate)) {
       matches.push(relative4(repo, candidate));
     }
-    const dir = join29(repoProjects, logical, id);
-    if (existsSync24(dir) && statSync5(dir).isDirectory()) {
+    const dir = join30(repoProjects, logical, id);
+    if (existsSync25(dir) && statSync5(dir).isDirectory()) {
       const dirRel = relative4(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
@@ -3347,19 +3481,19 @@ function unstageOne(rel, repo) {
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync26, statSync as statSync7 } from "node:fs";
-import { dirname as dirname5, join as join31 } from "node:path";
+import { existsSync as existsSync27, statSync as statSync7 } from "node:fs";
+import { dirname as dirname5, join as join32 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync25, lstatSync as lstatSync7, readFileSync as readFileSync10, readdirSync as readdirSync10, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync26, lstatSync as lstatSync7, readFileSync as readFileSync11, readdirSync as readdirSync10, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join31 } from "node:path";
 init_utils_fs();
 function collectFiles(dir, out) {
-  if (!existsSync25(dir)) return;
+  if (!existsSync26(dir)) return;
   const st = lstatSync7(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync10(dir)) {
-    const abs = join30(dir, entry);
+    const abs = join31(dir, entry);
     const lst = lstatSync7(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
@@ -3396,7 +3530,7 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   if (!dryRun && total > 0) {
     for (const { path: filePath, findings } of dirty) {
       backupBeforeWrite(filePath, ts);
-      writeFileSync4(filePath, applyRedactions(readFileSync10(filePath, "utf8"), findings), "utf8");
+      writeFileSync4(filePath, applyRedactions(readFileSync11(filePath, "utf8"), findings), "utf8");
     }
   }
   return { total, dirty };
@@ -3409,15 +3543,15 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript2(id) {
   try {
-    const mapPath = join31(repoHome(), "path-map.json");
-    if (!existsSync26(mapPath)) return null;
+    const mapPath = join32(repoHome(), "path-map.json");
+    if (!existsSync27(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join31(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync26(live)) return live;
+      const live = join32(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync27(live)) return live;
     }
     return null;
   } catch {
@@ -3437,17 +3571,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync26(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync27(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript2(id);
-    if (localPath === null || !existsSync26(localPath)) {
+    if (localPath === null || !existsSync27(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join31(dirname5(localPath), id);
+    const sessionDir = join32(dirname5(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -3500,8 +3634,8 @@ ${lines}`);
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join40 } from "node:path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync8 } from "node:fs";
+import { join as join41 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -3589,8 +3723,8 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync29 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+import { join as join35 } from "node:path";
 
 // src/extras-sync.diff.ts
 init_utils();
@@ -3629,8 +3763,8 @@ function listDivergingFiles(a, b) {
 
 // src/extras-sync.core.ts
 init_config();
-import { cpSync as cpSync5, existsSync as existsSync27, rmSync as rmSync8 } from "node:fs";
-import { join as join32 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync28, rmSync as rmSync8 } from "node:fs";
+import { join as join33 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -3654,9 +3788,9 @@ init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
   const repo = repoHome();
-  const mapPath = join32(repo, "path-map.json");
-  const repoExtras = join32(repo, "shared", "extras");
-  if (!existsSync27(mapPath) || opts.requireRepoExtras === true && !existsSync27(repoExtras)) {
+  const mapPath = join33(repo, "path-map.json");
+  const repoExtras = join33(repo, "shared", "extras");
+  if (!existsSync28(mapPath) || opts.requireRepoExtras === true && !existsSync28(repoExtras)) {
     if (opts.missingMsg !== void 0) log(opts.missingMsg);
     return null;
   }
@@ -3698,8 +3832,8 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync28, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join34 } from "node:path";
 init_utils_fs();
 function runExtrasOp(v, dryRun, paths, backup) {
   const counts = { unmapped: 0, skipped: 0 };
@@ -3707,7 +3841,7 @@ function runExtrasOp(v, dryRun, paths, backup) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync28(src)) continue;
+    if (!existsSync29(src)) continue;
     const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item2);
@@ -3724,14 +3858,14 @@ function remapExtrasPush(ts, opts = {}) {
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
   const repo = repoHome();
-  const repoExtras = join33(repo, "shared", "extras");
+  const repoExtras = join34(repo, "shared", "extras");
   if (!dryRun) mkdirSync6(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname7 }) => ({
-      src: join33(localRoot, dirname7),
-      dst: join33(repoExtras, logical, dirname7)
+      src: join34(localRoot, dirname7),
+      dst: join34(repoExtras, logical, dirname7)
     }),
     (dst) => backupRepoWrite(dst, ts, repo)
   );
@@ -3744,13 +3878,13 @@ function remapExtrasPull(ts, opts = {}) {
     missingMsg: "no path-map or repo extras dir; skipping extras remap"
   });
   if (v === null) return { unmapped: 0, skipped: 0, pulled: [], wouldPull: [] };
-  const repoExtras = join33(repoHome(), "shared", "extras");
+  const repoExtras = join34(repoHome(), "shared", "extras");
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname7 }) => ({
-      src: join33(repoExtras, logical, dirname7),
-      dst: join33(localRoot, dirname7)
+      src: join34(repoExtras, logical, dirname7),
+      dst: join34(localRoot, dirname7)
     }),
     // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -3764,15 +3898,15 @@ function divergenceCheckExtras(ts) {
   const v = loadValidatedExtras({});
   if (v === null) return;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join34(backupBase(), ts, "extras");
+  const backupRoot = join35(backupBase(), ts, "extras");
   const repo = repoHome();
   for (const { logical, localRoot, dirname: dirname7 } of eachExtrasTarget(v, counts)) {
-    const local = join34(localRoot, dirname7);
-    const repoEntry = join34(repo, "shared", "extras", logical, dirname7);
-    if (!existsSync29(local) || !existsSync29(repoEntry)) continue;
+    const local = join35(localRoot, dirname7);
+    const repoEntry = join35(repo, "shared", "extras", logical, dirname7);
+    if (!existsSync30(local) || !existsSync30(repoEntry)) continue;
     const diff = listDivergingFiles(local, repoEntry);
     if (diff.length === 0) continue;
-    const projectBackupRoot = join34(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join35(backupRoot, encodePath(localRoot));
     warn(
       `local ${dirname7} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will overwrite them (backups at ${projectBackupRoot}/)`
     );
@@ -3785,8 +3919,8 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { existsSync as existsSync30, lstatSync as lstatSync8, rmSync as rmSync9 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync31, lstatSync as lstatSync8, rmSync as rmSync9 } from "node:fs";
+import { join as join36 } from "node:path";
 function emitAutoMove(onPreview, linkPath, ts, name) {
   if (onPreview) {
     onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
@@ -3807,11 +3941,11 @@ function applySharedLinks(ts, map, opts = {}) {
   const repo = repoHome();
   const linkNames = allSharedLinks(map);
   for (const name of linkNames) {
-    const linkPath = join35(claude, name);
-    const target = join35(repo, "shared", name);
-    if (!existsSync30(linkPath)) continue;
+    const linkPath = join36(claude, name);
+    const target = join36(repo, "shared", name);
+    if (!existsSync31(linkPath)) continue;
     if (lstatSync8(linkPath).isSymbolicLink()) continue;
-    if (!existsSync30(target)) continue;
+    if (!existsSync31(target)) continue;
     if (dryRun) {
       emitAutoMove(opts.onPreview, linkPath, ts, name);
       continue;
@@ -3820,30 +3954,30 @@ function applySharedLinks(ts, map, opts = {}) {
     rmSync9(linkPath, { recursive: true, force: true });
   }
   for (const name of linkNames) {
-    const target = join35(repo, "shared", name);
-    if (!existsSync30(target)) continue;
+    const target = join36(repo, "shared", name);
+    if (!existsSync31(target)) continue;
     if (dryRun) {
-      emitCreate(opts.onPreview, join35(claude, name), target);
+      emitCreate(opts.onPreview, join36(claude, name), target);
       continue;
     }
-    ensureSymlink(join35(claude, name), target);
+    ensureSymlink(join36(claude, name), target);
   }
 }
 function regenerateSettings(ts, opts = {}) {
   const dryRun = opts.dryRun === true;
   const repo = repoHome();
   const claude = claudeHome();
-  const basePath = join35(repo, "shared", "settings.base.json");
-  const hostPath = join35(repo, "hosts", `${HOST}.json`);
-  if (!existsSync30(basePath)) {
+  const basePath = join36(repo, "shared", "settings.base.json");
+  const hostPath = join36(repo, "hosts", `${HOST}.json`);
+  if (!existsSync31(basePath)) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const base = readJson(basePath);
-  const hasOverrides = existsSync30(hostPath);
+  const hasOverrides = existsSync31(hostPath);
   const overrides = hasOverrides ? readJson(hostPath) : {};
   const merged = deepMerge(base, overrides);
-  const settingsPath = join35(claude, "settings.json");
-  if (!hasOverrides && existsSync30(settingsPath)) {
+  const settingsPath = join36(claude, "settings.json");
+  if (!hasOverrides && existsSync31(settingsPath)) {
     try {
       const existing = readJson(settingsPath);
       const baseKeys = new Set(Object.keys(base));
@@ -3869,8 +4003,8 @@ function regenerateSettings(ts, opts = {}) {
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync31 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { join as join37 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -4156,7 +4290,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync31(path)) return null;
+  if (!existsSync32(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -4170,12 +4304,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync31(hostPath)) {
+  if (hostOverrides === null && existsSync32(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = deepMerge(base, hostOverrides ?? {});
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync31(settingsPath)) {
+  if (current === null && existsSync32(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const rawEqual = JSON.stringify(current ?? {}, null, 2) === JSON.stringify(merged, null, 2);
@@ -4215,9 +4349,9 @@ function computePreview(ts, map, verb = "pull") {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join36(repo, "shared", "settings.base.json"),
-    join36(repo, "hosts", `${HOST}.json`),
-    join36(claude, "settings.json")
+    join37(repo, "shared", "settings.base.json"),
+    join37(repo, "hosts", `${HOST}.json`),
+    join37(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -4233,21 +4367,21 @@ function computePreview(ts, map, verb = "pull") {
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync33 } from "node:fs";
+import { existsSync as existsSync34 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
-import { readFileSync as readFileSync11, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join39 } from "node:path";
+import { readFileSync as readFileSync12, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join40 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync6, existsSync as existsSync32, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
-import { dirname as dirname6, join as join37, sep as sep3 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync33, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
+import { dirname as dirname6, join as join38, sep as sep3 } from "node:path";
 init_push_gitleaks_scan();
 init_utils_json();
 init_utils();
@@ -4278,8 +4412,8 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join37(claude, "projects", encodePath(abs)) + sep3)) {
-      return join37(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join38(claude, "projects", encodePath(abs)) + sep3)) {
+      return join38(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -4303,7 +4437,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join37(dirname6(localPath), sid);
+  const sessionDir = join38(dirname6(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4337,9 +4471,9 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync7(stagedProjectDir, { recursive: true });
-  cpSync6(localPath, join37(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync32(sessionDir)) {
-    cpSync6(sessionDir, join37(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync6(localPath, join38(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync33(sessionDir)) {
+    cpSync6(sessionDir, join38(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
@@ -4347,14 +4481,14 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
 // src/commands.push.recovery.drop.ts
 init_config();
 import { rmSync as rmSync10 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join38(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join38(repo, "shared", "projects", logical, sid);
+    const jsonl = join39(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join39(repo, "shared", "projects", logical, sid);
     rmSync10(jsonl, { force: true });
     rmSync10(dir, { recursive: true, force: true });
   }
@@ -4474,10 +4608,10 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join39(repoHome2, ".gitleaksignore");
+  const ignPath = join40(repoHome2, ".gitleaksignore");
   let before;
   try {
-    before = readFileSync11(ignPath, "utf8");
+    before = readFileSync12(ignPath, "utf8");
   } catch {
     before = null;
   }
@@ -4573,7 +4707,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync33;
+  const check = deps.existsSyncFn ?? existsSync34;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -4781,8 +4915,8 @@ function cmdPull(opts = {}) {
   const forceRemote = opts.forceRemote === true;
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync34(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync34(join40(repo, "shared", "settings.base.json"))) {
+  if (!existsSync35(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync35(join41(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -4791,7 +4925,7 @@ function cmdPull(opts = {}) {
     const ts = freshBackupTs(backup);
     handleWedge(repo, forceRemote);
     if (!dryRun) {
-      const backupRoot = join40(backup, ts);
+      const backupRoot = join41(backup, ts);
       try {
         mkdirSync8(backupRoot, { recursive: true });
       } catch (err) {
@@ -4802,8 +4936,8 @@ function cmdPull(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
     gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
-    const mapPath = join40(repo, "path-map.json");
-    const map = existsSync34(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join41(repo, "path-map.json");
+    const map = existsSync35(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     if (dryRun) {
       computePreview(ts, map, "pull");
@@ -4825,8 +4959,8 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync36 } from "node:fs";
-import { join as join42, relative as relative5 } from "node:path";
+import { existsSync as existsSync37 } from "node:fs";
+import { join as join43, relative as relative5 } from "node:path";
 
 // src/commands.push.allowlist.ts
 init_config();
@@ -4906,9 +5040,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync35, mkdirSync as mkdirSync9, readdirSync as readdirSync11, rmSync as rmSync12 } from "node:fs";
+import { copyFileSync, existsSync as existsSync36, mkdirSync as mkdirSync9, readdirSync as readdirSync11, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -4923,13 +5057,13 @@ function stageSessions(tmpRoot, map) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join41(claudeHome(), "projects");
-  if (!existsSync35(localProjects)) return 0;
+  const localProjects = join42(claudeHome(), "projects");
+  if (!existsSync36(localProjects)) return 0;
   let staged = 0;
   for (const dir of readdirSync11(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join41(localProjects, dir), join41(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join42(localProjects, dir), join42(tmpRoot, "shared", "projects", logical));
     staged++;
   }
   return staged;
@@ -4945,9 +5079,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname7 of dirnames) {
       if (!whitelist.includes(dirname7)) continue;
-      const src = join41(localRoot, dirname7);
-      if (!existsSync35(src)) continue;
-      const dst = join41(tmpRoot, "shared", "extras", logical, dirname7);
+      const src = join42(localRoot, dirname7);
+      if (!existsSync36(src)) continue;
+      const dst = join42(tmpRoot, "shared", "extras", logical, dirname7);
       copyExtras(src, dst);
       staged++;
     }
@@ -4955,19 +5089,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map) {
-  const cacheDir = join41(homedir5(), ".cache", "claude-nomad");
+  const cacheDir = join42(homedir5(), ".cache", "claude-nomad");
   mkdirSync9(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join41(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join42(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join41(repoHome(), ".gitleaksignore");
-    if (existsSync35(ignoreFile)) {
-      copyFileSync(ignoreFile, join41(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join42(repoHome(), ".gitleaksignore");
+    if (existsSync36(ignoreFile)) {
+      copyFileSync(ignoreFile, join42(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -4989,7 +5123,7 @@ init_utils();
 init_utils_fs();
 init_utils_json();
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join42(repo, "shared"));
+  const gitlinks = findGitlinks(join43(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative5(repo, p);
@@ -5043,7 +5177,7 @@ async function cmdPush(opts = {}) {
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync36(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync37(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -5061,8 +5195,8 @@ async function cmdPush(opts = {}) {
       renderNoScanTree(st);
       return;
     }
-    const mapPath = join42(repo, "path-map.json");
-    if (!existsSync36(mapPath)) {
+    const mapPath = join43(repo, "path-map.json");
+    if (!existsSync37(mapPath)) {
       if (dryRun) return runDryRunPreview(st, null);
       die("path-map.json missing, cannot enforce push allow-list");
     }
@@ -5102,18 +5236,18 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync37 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync38 } from "node:fs";
+import { join as join44 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync37(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync38(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join43(repo, "path-map.json");
-    const map = existsSync37(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join44(repo, "path-map.json");
+    const map = existsSync38(mapPath) ? readPathMap(mapPath) : { projects: {} };
     computePreview(ts, map, "diff");
   } catch (err) {
     if (err instanceof NomadFatal) {
@@ -5127,8 +5261,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync39, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join45 } from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join46 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -5210,33 +5344,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync38, rmSync as rmSync13, statSync as statSync9 } from "node:fs";
-import { join as join44 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync39, rmSync as rmSync13, statSync as statSync9 } from "node:fs";
+import { join as join45 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join44(claude, name);
-    if (!existsSync38(src)) continue;
-    const dst = join44(repo, "shared", name);
+    const src = join45(claude, name);
+    if (!existsSync39(src)) continue;
+    const dst = join45(repo, "shared", name);
     if (statSync9(src).isDirectory()) {
-      const gk = join44(dst, ".gitkeep");
-      if (existsSync38(gk)) rmSync13(gk);
+      const gk = join45(dst, ".gitkeep");
+      if (existsSync39(gk)) rmSync13(gk);
       cpSync7(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join44(claude, "settings.json");
-  if (existsSync38(userSettings)) {
+  const userSettings = join45(claude, "settings.json");
+  if (existsSync39(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join44(repo, "hosts", `${HOST}.json`);
+    const hostFile = join45(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -5249,14 +5383,14 @@ var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.cl
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join45(repoHome2, "shared", "settings.base.json"),
-    join45(repoHome2, "shared", "CLAUDE.md"),
-    join45(repoHome2, "path-map.json"),
-    join45(repoHome2, "hosts"),
-    join45(repoHome2, "shared")
+    join46(repoHome2, "shared", "settings.base.json"),
+    join46(repoHome2, "shared", "CLAUDE.md"),
+    join46(repoHome2, "path-map.json"),
+    join46(repoHome2, "hosts"),
+    join46(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync39(c)) return c;
+    if (existsSync40(c)) return c;
   }
   return null;
 }
@@ -5271,25 +5405,25 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync10(join45(repo, "shared"), { recursive: true });
-  mkdirSync10(join45(repo, "hosts"), { recursive: true });
+  mkdirSync10(join46(repo, "shared"), { recursive: true });
+  mkdirSync10(join46(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync10(join45(repo, "shared", name), { recursive: true });
+    mkdirSync10(join46(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join45(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync39(userClaudeMd)) {
-    writeFileSync6(join45(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join46(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync40(userClaudeMd)) {
+    writeFileSync6(join46(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join45(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join46(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync6(join45(repo, "hosts", ".gitkeep"), "");
+  writeFileSync6(join46(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join45(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join46(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join45(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join46(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -5590,7 +5724,7 @@ function parsePushArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.44.1",
+  version: "0.45.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -5792,15 +5926,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync40, readFileSync as readFileSync12, readdirSync as readdirSync12 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync41, readFileSync as readFileSync13, readdirSync as readdirSync12 } from "node:fs";
+import { join as join47 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join46(claudeHome(), "projects");
-  if (!existsSync40(projectsRoot)) {
+  const projectsRoot = join47(claudeHome(), "projects");
+  if (!existsSync41(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -5814,8 +5948,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join46(repoHome(), "path-map.json");
-  if (!existsSync40(mapPath)) {
+  const mapPath = join47(repoHome(), "path-map.json");
+  if (!existsSync41(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -5838,13 +5972,13 @@ function resumeCmd(sessionId) {
 }
 function findTranscriptPath(projectsRoot, sessionId) {
   for (const dir of readdirSync12(projectsRoot)) {
-    const candidate = join46(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync40(candidate)) return candidate;
+    const candidate = join47(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync41(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync12(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync13(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.44.1",
+  "version": "0.45.0",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [