claude-nomad 0.50.2 → 0.51.0

package/.gitleaks.toml

@@ -6,14 +6,26 @@
 [extend]
 useDefault = true
 
+# Path-scoped: this tool-output noise (gitleaks fingerprints, coverage
+# line-keys, npm audit JSON id hashes, Sonar issue keys) accumulates in Claude
+# Code session transcripts when a conversation runs those tools. Two of these
+# regexes are structurally generic enough that, left global, they could suppress
+# a real credential that happened to sit in a `path:word:digit` or hex-`id`
+# context anywhere in the repo. Scoping to `shared/projects/<logical>/.../*.jsonl`
+# with `condition = "AND"` (matching every other block below) confines the
+# suppression to synced transcripts: a real secret in a source file still fires.
 [[allowlists]]
-description = "claude-nomad: structurally-distinguishable tool-output noise"
+description = "claude-nomad: structurally-distinguishable tool-output noise in synced session transcripts"
 regexes = [
     '''AY[A-Za-z0-9_-]{20,}''',
     '''[\w./-]+\.[A-Za-z0-9]+:[\w-]+:\d+''',
     '''"id"\s*:\s*"[a-f0-9]{40,64}"''',
     '''key=[a-f0-9]{8,} [\w./-]+\.\w+:\d+''',
 ]
+paths = [
+    '''^shared/projects/[^/]+/.*\.jsonl$''',
+]
+condition = "AND"
 
 # Path-scoped: the documented test-fixture github-pat literal AND the three
 # entropy-variant placeholders (zero-suffix, alphabet, repeat-A) accumulate

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## [0.51.0](https://github.com/funkadelic/claude-nomad/compare/v0.50.3...v0.51.0) (2026-06-18)
+
+
+### Added
+
+* **capture-settings:** direction-aware settings drift detection and capture command ([#314](https://github.com/funkadelic/claude-nomad/issues/314)) ([512c1a2](https://github.com/funkadelic/claude-nomad/commit/512c1a27a3a573b3c2684bae21e577a50a58a098))
+
+
+### Changed
+
+* **deps:** regenerate package-lock.json ([#312](https://github.com/funkadelic/claude-nomad/issues/312)) ([a80a974](https://github.com/funkadelic/claude-nomad/commit/a80a9740be72a1cad6e7865697548274ff0fbe51))
+
+## [0.50.3](https://github.com/funkadelic/claude-nomad/compare/v0.50.2...v0.50.3) (2026-06-17)
+
+
+### Fixed
+
+* **gitleaks:** scope tool-output noise allowlist to session transcripts ([#305](https://github.com/funkadelic/claude-nomad/issues/305)) ([ca76680](https://github.com/funkadelic/claude-nomad/commit/ca766803a425d21747f959606d6436989ce249e6))
+* **push:** make --redact-all all-or-nothing ([#302](https://github.com/funkadelic/claude-nomad/issues/302)) ([f2cffeb](https://github.com/funkadelic/claude-nomad/commit/f2cffeb9204b68fb046ee55c9768e065272fb431))
+* **push:** warn when drop-session/redact target is already in pushed history ([#304](https://github.com/funkadelic/claude-nomad/issues/304)) ([739676f](https://github.com/funkadelic/claude-nomad/commit/739676ffbf1345fc7ff124ac7eafb9802ba09be4))
+* **redact:** warn when a finding match is not located in the file ([#310](https://github.com/funkadelic/claude-nomad/issues/310)) ([db1442b](https://github.com/funkadelic/claude-nomad/commit/db1442b311db04944b655ece91a56ef23a39abe1))
+* **remap:** make session-transcript mirror copy atomic ([4fc518f](https://github.com/funkadelic/claude-nomad/commit/4fc518fd80ce7fffb56ba2a6d135e6f6b795bc91))
+* **utils:** guard deepMerge against prototype pollution ([#299](https://github.com/funkadelic/claude-nomad/issues/299)) ([8e57539](https://github.com/funkadelic/claude-nomad/commit/8e575393a320386dd7329aab8071fd84557ec4e9))
+
+
+### Changed
+
+* **config:** centralize path-map.json shape validation ([#306](https://github.com/funkadelic/claude-nomad/issues/306)) ([88edda3](https://github.com/funkadelic/claude-nomad/commit/88edda3f45954d4dc89d65e2ec55a7d9d5b6b3f8))
+* **dispatch:** share argv token-parser primitives ([#307](https://github.com/funkadelic/claude-nomad/issues/307)) ([9f62b51](https://github.com/funkadelic/claude-nomad/commit/9f62b5156bbc3b7e03f8a81fe0f844cbeb1da3fa))
+* **doctor:** rename repository check module to git-state ([#309](https://github.com/funkadelic/claude-nomad/issues/309)) ([b6a0d5c](https://github.com/funkadelic/claude-nomad/commit/b6a0d5c8461c2f63af7d77464db9558271d46f46))
+* **utils:** dedup backup helpers and document lock/exit conventions ([#308](https://github.com/funkadelic/claude-nomad/issues/308)) ([4c2d59d](https://github.com/funkadelic/claude-nomad/commit/4c2d59d97c875851733175e4b4346e5714c48a32))
+
+
+### Documentation
+
+* **recovery:** reflect session-scoped allowlist and redact no-match warning ([#311](https://github.com/funkadelic/claude-nomad/issues/311)) ([7faf564](https://github.com/funkadelic/claude-nomad/commit/7faf5647d7dfd30822950d687fd8be15b5c49910))
+
+
+### Testing
+
+* **push:** add full-pipeline cmdPush E2E against real git and gitleaks ([#303](https://github.com/funkadelic/claude-nomad/issues/303)) ([3c01262](https://github.com/funkadelic/claude-nomad/commit/3c012629e7b99dcf4c5e679d93acb353ee6c3409))
+
 ## [0.50.2](https://github.com/funkadelic/claude-nomad/compare/v0.50.1...v0.50.2) (2026-06-15)
 
 

package/README.md

@@ -40,9 +40,11 @@ survives different file paths and your secrets never ride along.
   `--dry-run` on pull and push prints the plan without writing anything.
 - **One command tells you what is wrong.** `nomad doctor` is a read-only health check: wedged sync
   repo, broken hook references, hooks that would crash on session start because of a missing
-  `--preserve-symlinks-main` flag, version drift, oversized backup cache, and settings drift (warns
-  when `~/.claude/settings.json` no longer matches the base+host merge nomad would write, the
-  silent-clobber case, with `nomad pull` as the fix), each with a fix hint.
+  `--preserve-symlinks-main` flag, version drift, oversized backup cache, and settings drift in both
+  directions: keys present in the repo merge but absent from your live `settings.json` (behind; the
+  next `nomad pull` will restore them, fix: `nomad pull`) and keys present locally but not yet in
+  the repo (ahead; local-only additions, fix: `nomad capture-settings`). Each issue includes a fix
+  hint.
 - **Self-healing sync.** Every overwrite is backed up first, and `nomad pull --force-remote`
   recovers two kinds of stuck sync repo: a repo stuck mid-rebase or mid-merge (aborts the operation,
   parks stranded work on a branch, refuses if shared config is at risk), and a repo where the rebase
@@ -100,6 +102,8 @@ When `nomad push` detects a potential secret, it drops into an interactive menu
 a recovery hint (non-TTY/CI). Three non-interactive recovery paths are available without the menu:
 
 - `nomad push --redact-all` -- scrub every finding from the local transcript in place, then push.
+  All-or-nothing: if any finding cannot be redacted (an active session, or one that does not map to
+  a synced transcript), nothing is changed and the push stops so you can handle those sessions.
 - `nomad push --allow <rule>` -- record findings matching one gitleaks rule id as false positives
   (appends their fingerprints to `.gitleaksignore`), then re-scan and push.
 - `nomad push --allow-all` -- record every current finding as a false positive, then re-scan and
@@ -121,6 +125,15 @@ surfaces any orphaned autostash entry, then re-pulls). Run `nomad doctor` first
 which state you are in; the Repository section names the specific problem and points at the right
 fix.
 
+If an external tool (such as Claude Code or GSD) wrote new keys into your `~/.claude/settings.json`
+that are not yet in your shared repo, run `nomad capture-settings` to promote them before the next
+`nomad pull` overwrites them. With `--host`, the keys land in `hosts/<NOMAD_HOST>.json` instead of
+`shared/settings.base.json` (useful for machine-specific values such as absolute paths). `--dry-run`
+shows what would be written without touching anything. Before it writes, `capture-settings` shows
+the destination and the keys and asks you to confirm; pass `--yes` (or `-y`) to skip the prompt,
+which is required when running without an interactive terminal. `nomad push` also warns when it
+detects ahead-drift so you have a prompt to act before the push completes.
+
 ## Claude Code plugin
 
 An optional companion plugin puts nomad one slash away inside Claude Code and warns you at session