claude-nomad 0.50.2 → 0.51.0

package/dist/nomad.mjs

@@ -451,16 +451,41 @@ function readJson(path) {
   return data;
 }
 function readPathMap(mapPath) {
+  let parsed;
   try {
-    return readJson(mapPath);
+    parsed = readJson(mapPath);
   } catch (err) {
     const verb = err instanceof SyntaxError ? "parse" : "read";
     throw new NomadFatal(`could not ${verb} path-map.json: ${err.message}`);
   }
+  const shapeError = validatePathMapShape(parsed);
+  if (shapeError !== null) throw new NomadFatal(shapeError);
+  return parsed;
+}
+function validatePathMapShape(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return "path-map.json invalid schema: top-level value must be an object";
+  }
+  const projects = raw.projects;
+  if (projects === null || typeof projects !== "object" || Array.isArray(projects)) {
+    return 'path-map.json invalid schema: "projects" must be an object';
+  }
+  for (const [name, hosts] of Object.entries(projects)) {
+    if (hosts === null || typeof hosts !== "object" || Array.isArray(hosts)) {
+      return `path-map.json invalid schema: project "${name}" hosts must be an object`;
+    }
+    for (const [host, value] of Object.entries(hosts)) {
+      if (typeof value !== "string") {
+        return `path-map.json invalid schema: project "${name}" host "${host}" path must be a string`;
+      }
+    }
+  }
+  return null;
 }
 function deepMerge(target, source) {
   const out = { ...target };
   for (const [key, value] of Object.entries(source)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
     const existing = out[key];
     const bothObjects = value !== null && typeof value === "object" && !Array.isArray(value) && existing !== null && typeof existing === "object" && !Array.isArray(existing);
     out[key] = bothObjects ? deepMerge(existing, value) : value;
@@ -502,7 +527,7 @@ import {
   symlinkSync,
   writeFileSync
 } from "node:fs";
-import { dirname, join as join2, relative } from "node:path";
+import { dirname, join as join2, relative, sep } from "node:path";
 function writeJsonAtomic(path, data) {
   const mode = existsSync(path) ? statSync(path).mode & 511 : 384;
   const tmp = `${path}.tmp.${process.pid}`;
@@ -542,33 +567,22 @@ function ensureSymlink(linkPath, target) {
   symlinkSync(target, linkPath);
   log(`linked ${linkPath} -> ${target}`);
 }
-function backupBeforeWrite(absPath, ts) {
+function backupUnder(absPath, anchor, destRoot) {
   if (!existsSync(absPath)) return;
-  const claude = claudeHome();
-  const rel = relative(claude, absPath);
-  if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join2(backupBase(), ts);
-  const dst = join2(backupRoot, rel);
+  const rel = relative(anchor, absPath);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`)) return;
+  const dst = join2(destRoot, rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
 }
+function backupBeforeWrite(absPath, ts) {
+  backupUnder(absPath, claudeHome(), join2(backupBase(), ts));
+}
 function backupRepoWrite(absPath, ts, repoHome2) {
-  if (!existsSync(absPath)) return;
-  const rel = relative(repoHome2, absPath);
-  if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join2(backupBase(), ts, "repo");
-  const dst = join2(backupRoot, rel);
-  mkdirSync(dirname(dst), { recursive: true });
-  cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  backupUnder(absPath, repoHome2, join2(backupBase(), ts, "repo"));
 }
 function backupExtrasWrite(absPath, ts, projectRoot) {
-  if (!existsSync(absPath)) return;
-  const rel = relative(projectRoot, absPath);
-  if (rel.startsWith("..") || rel === "") return;
-  const backupRoot = join2(backupBase(), ts, "extras");
-  const dst = join2(backupRoot, encodePath(projectRoot), rel);
-  mkdirSync(dirname(dst), { recursive: true });
-  cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  backupUnder(absPath, projectRoot, join2(backupBase(), ts, "extras", encodePath(projectRoot)));
 }
 var init_utils_fs = __esm({
   "src/utils.fs.ts"() {
@@ -581,12 +595,12 @@ var init_utils_fs = __esm({
 
 // src/commands.pull.wedge.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join14 } from "node:path";
 function detectWedge(repo) {
-  const g = join11(repo, ".git");
-  if (existsSync10(join11(g, "rebase-merge")) || existsSync10(join11(g, "rebase-apply"))) return "rebase";
-  if (existsSync10(join11(g, "MERGE_HEAD"))) return "merge";
+  const g = join14(repo, ".git");
+  if (existsSync12(join14(g, "rebase-merge")) || existsSync12(join14(g, "rebase-apply"))) return "rebase";
+  if (existsSync12(join14(g, "MERGE_HEAD"))) return "merge";
   return null;
 }
 function unmergedIndexPresent(repo) {
@@ -643,32 +657,32 @@ var init_commands_pull_wedge = __esm({
 });
 
 // src/push-gitleaks.config.ts
-import { existsSync as existsSync11, mkdtempSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync13, mkdtempSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join15 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveTomlPath(repo = repoHome()) {
-  const repoToml = join12(repo, ".gitleaks.toml");
-  if (existsSync11(repoToml)) return repoToml;
+  const repoToml = join15(repo, ".gitleaks.toml");
+  if (existsSync13(repoToml)) return repoToml;
   const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync11(bundled) ? bundled : null;
+  return existsSync13(bundled) ? bundled : null;
 }
 function buildOverlayTempConfig(overlayBody, bundled) {
   const tempBody = `[extend]
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join12(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join12(tempPath, "config.toml");
-  writeFileSync2(configPath, tempBody, { mode: 384, flag: "wx" });
+  const tempPath = mkdtempSync(join15(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join15(tempPath, "config.toml");
+  writeFileSync3(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
   const repo = repoHome();
-  const overlayPath = join12(repo, ".gitleaks.overlay.toml");
-  const repoToml = join12(repo, ".gitleaks.toml");
+  const overlayPath = join15(repo, ".gitleaks.overlay.toml");
+  const repoToml = join15(repo, ".gitleaks.toml");
   const bundled = resolveTomlPath(repo);
-  if (!existsSync11(overlayPath)) {
+  if (!existsSync13(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -681,7 +695,7 @@ function resolveTomlConfig() {
     return { path: null, tempPath: null };
   }
   try {
-    const overlayBody = readFileSync3(overlayPath, "utf8");
+    const overlayBody = readFileSync4(overlayPath, "utf8");
     if (OVERLAY_EXTEND_RE.test(overlayBody)) {
       throw new NomadFatal(
         ".gitleaks.overlay.toml must not contain an [extend] block; it is generated automatically. Remove the [extend] section and retry."
@@ -709,9 +723,9 @@ var init_push_gitleaks_config = __esm({
 
 // src/push-checks.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { readdirSync as readdirSync4, rmSync as rmSync4 } from "node:fs";
+import { readdirSync as readdirSync4, rmSync as rmSync5 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join16 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -754,7 +768,7 @@ function findGitlinks(dir) {
       return;
     }
     for (const e of entries) {
-      const p = join13(current, e.name);
+      const p = join16(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
@@ -776,7 +790,7 @@ function probeGitleaks() {
     if (e.code === "ENOENT") throw new NomadFatal(gitleaksInstallHint());
     throw new NomadFatal(`gitleaks --version failed: ${e.message}`);
   } finally {
-    if (tempPath !== null) rmSync4(tempPath, { recursive: true, force: true });
+    if (tempPath !== null) rmSync5(tempPath, { recursive: true, force: true });
   }
 }
 function wedgePreflight(wedge) {
@@ -813,12 +827,12 @@ var init_push_checks = __esm({
 
 // src/push-gitleaks.scan.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync5 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync6 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join20 } from "node:path";
 function readGitleaksReport(reportPath) {
   try {
-    const raw = readFileSync4(reportPath, "utf8");
+    const raw = readFileSync5(reportPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return null;
     return parsed;
@@ -827,9 +841,9 @@ function readGitleaksReport(reportPath) {
   }
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join17(homedir3(), ".cache", "claude-nomad");
-  mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join17(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const cacheDir = join20(homedir3(), ".cache", "claude-nomad");
+  mkdirSync3(cacheDir, { recursive: true });
+  const reportPath = join20(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -856,14 +870,14 @@ function scanStagedTree(repoDir, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync5(tempPath, { recursive: true, force: true });
-    rmSync5(reportPath, { force: true });
+    if (tempPath !== null) rmSync6(tempPath, { recursive: true, force: true });
+    rmSync6(reportPath, { force: true });
   }
 }
 function scanFile(filePath, forwardStreams = false) {
-  const cacheDir = join17(homedir3(), ".cache", "claude-nomad");
-  mkdirSync2(cacheDir, { recursive: true });
-  const reportPath = join17(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
+  const cacheDir = join20(homedir3(), ".cache", "claude-nomad");
+  mkdirSync3(cacheDir, { recursive: true });
+  const reportPath = join20(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "detect",
@@ -888,8 +902,8 @@ function scanFile(filePath, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync5(tempPath, { recursive: true, force: true });
-    rmSync5(reportPath, { force: true });
+    if (tempPath !== null) rmSync6(tempPath, { recursive: true, force: true });
+    rmSync6(reportPath, { force: true });
   }
 }
 var init_push_gitleaks_scan = __esm({
@@ -1250,11 +1264,406 @@ function cmdAllow(fingerprints) {
   log(`allowed ${fingerprints.length} fingerprint(s)`);
 }
 
+// src/commands.capture-settings.ts
+init_config();
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join7 } from "node:path";
+import { createInterface } from "node:readline/promises";
+
+// src/commands.capture-settings.core.ts
+function arraysEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (!deepEqual(a[i], b[i])) return false;
+  }
+  return true;
+}
+function objectsEqual(a, b) {
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (!Object.hasOwn(b, k)) return false;
+    if (!deepEqual(a[k], b[k])) return false;
+  }
+  return true;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return false;
+  if (Array.isArray(a) && Array.isArray(b)) return arraysEqual(a, b);
+  if (Array.isArray(a) || Array.isArray(b)) return false;
+  if (typeof a === "object" && typeof b === "object") {
+    return objectsEqual(a, b);
+  }
+  return false;
+}
+function classifySettingsDrift(merged, settings) {
+  const behind = [];
+  const ahead = [];
+  const changed = [];
+  const settingsKeys = new Set(Object.keys(settings));
+  for (const key of Object.keys(merged)) {
+    if (!settingsKeys.has(key)) {
+      behind.push(key);
+    } else if (!deepEqual(merged[key], settings[key])) {
+      changed.push(key);
+    }
+  }
+  const mergedKeys = new Set(Object.keys(merged));
+  for (const key of Object.keys(settings)) {
+    if (!mergedKeys.has(key)) ahead.push(key);
+  }
+  const collator = (a, b) => a.localeCompare(b, "en");
+  return {
+    behind: behind.toSorted(collator),
+    ahead: ahead.toSorted(collator),
+    changed: changed.toSorted(collator)
+  };
+}
+var CAPTURE_EXCLUDED_KEYS = /* @__PURE__ */ new Set([
+  "apiKeyHelper",
+  "awsAuthRefresh",
+  "awsCredentialExport",
+  "otelHeadersHelper",
+  "env"
+]);
+function partitionByCaptureExclusion(keys) {
+  const promotable = [];
+  const excluded = [];
+  for (const key of keys) {
+    if (CAPTURE_EXCLUDED_KEYS.has(key)) excluded.push(key);
+    else promotable.push(key);
+  }
+  return { promotable, excluded };
+}
+var BIN_NODE_RE = /^(?:[A-Za-z]:)?[\\/](?:.*[\\/])?bin[\\/]node$/;
+function normalizeNodePathsDeep(value) {
+  if (typeof value === "string") {
+    return BIN_NODE_RE.test(value) ? "node" : value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(normalizeNodePathsDeep);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = normalizeNodePathsDeep(v);
+    }
+    return out;
+  }
+  return value;
+}
+function buildCaptureSubset(merged, settings, opts) {
+  const { ahead } = classifySettingsDrift(merged, settings);
+  const out = {};
+  for (const key of ahead) {
+    if (CAPTURE_EXCLUDED_KEYS.has(key)) continue;
+    const raw = settings[key];
+    out[key] = opts.normalizeNodePath ? normalizeNodePathsDeep(raw) : raw;
+  }
+  return out;
+}
+
+// src/links.ts
+init_config();
+import { existsSync as existsSync4, lstatSync as lstatSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+init_utils();
+init_utils_fs();
+init_utils_json();
+function emitAutoMove(onPreview, linkPath, ts, name) {
+  if (onPreview) {
+    onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
+  } else {
+    log(`would auto-move non-symlink: ${linkPath} -> backup/${ts}/${name}`);
+  }
+}
+function emitCreate(onPreview, from, to) {
+  if (onPreview) {
+    onPreview({ kind: "create", from, to });
+  } else {
+    log(`would create symlink: ${from} -> ${to}`);
+  }
+}
+function isAlreadySymlink(linkPath) {
+  return existsSync4(linkPath) && lstatSync3(linkPath).isSymbolicLink();
+}
+function runAutoMovePasses(linkNames, claude, repo, ts, dryRun, onPreview) {
+  for (const name of linkNames) {
+    const linkPath = join5(claude, name);
+    const target = join5(repo, "shared", name);
+    if (!existsSync4(linkPath)) continue;
+    if (lstatSync3(linkPath).isSymbolicLink()) continue;
+    if (!existsSync4(target)) continue;
+    if (dryRun) {
+      emitAutoMove(onPreview, linkPath, ts, name);
+      continue;
+    }
+    backupBeforeWrite(linkPath, ts);
+    rmSync2(linkPath, { recursive: true, force: true });
+  }
+}
+function applySharedLinks(ts, map, opts = {}) {
+  const dryRun = opts.dryRun === true;
+  const claude = claudeHome();
+  const repo = repoHome();
+  const linkNames = allSharedLinks(map);
+  runAutoMovePasses(linkNames, claude, repo, ts, dryRun, opts.onPreview);
+  for (const name of linkNames) {
+    const target = join5(repo, "shared", name);
+    if (!existsSync4(target)) continue;
+    const linkPath = join5(claude, name);
+    if (isAlreadySymlink(linkPath)) continue;
+    if (dryRun) {
+      emitCreate(opts.onPreview, linkPath, target);
+      continue;
+    }
+    ensureSymlink(linkPath, target);
+  }
+}
+function regenerateSettings(ts, opts = {}) {
+  const dryRun = opts.dryRun === true;
+  const suppressDriftWarn = opts.suppressDriftWarn === true;
+  const repo = repoHome();
+  const claude = claudeHome();
+  const basePath = join5(repo, "shared", "settings.base.json");
+  const hostPath = join5(repo, "hosts", `${HOST}.json`);
+  if (!existsSync4(basePath)) {
+    die("repo not initialized; run 'nomad init' to scaffold");
+  }
+  const base = readJson(basePath);
+  const hasOverrides = existsSync4(hostPath);
+  const overrides = hasOverrides ? readJson(hostPath) : {};
+  const merged = deepMerge(base, overrides);
+  const settingsPath = join5(claude, "settings.json");
+  if (!suppressDriftWarn && existsSync4(settingsPath)) {
+    try {
+      const existing = readJson(settingsPath);
+      const drift = classifySettingsDrift(merged, existing);
+      if (drift.behind.length > 0) {
+        warn(
+          `existing settings.json is missing merged keys ${JSON.stringify(drift.behind)}. Run 'nomad pull' to restore them.`
+        );
+      }
+      const { promotable } = partitionByCaptureExclusion(drift.ahead);
+      if (promotable.length > 0) {
+        warn(
+          `existing settings.json has local-only keys ${JSON.stringify(promotable)}. Run 'nomad capture-settings' to promote them into the repo before they are overwritten.`
+        );
+      }
+    } catch {
+      warn("existing settings.json is malformed; skipping drift-check and regenerating.");
+    }
+  }
+  const overrideLabel = hasOverrides ? `${HOST}.json` : "no host overrides";
+  if (dryRun) {
+    log(`would write settings.json (base + ${overrideLabel})`);
+    return { label: overrideLabel };
+  }
+  backupBeforeWrite(settingsPath, ts);
+  writeJsonAtomic(settingsPath, merged);
+  return { label: overrideLabel };
+}
+
+// src/commands.capture-settings.ts
+init_utils_fs();
+init_utils_json();
+
+// src/utils.lockfile.ts
+init_config();
+init_utils();
+import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join6 } from "node:path";
+function lockFilePath() {
+  return join6(home(), ".cache", "claude-nomad", "nomad.lock");
+}
+function acquireLock(verb) {
+  const lp = lockFilePath();
+  mkdirSync2(dirname2(lp), { recursive: true });
+  try {
+    const fd = openSync2(lp, "wx");
+    try {
+      writeFileSync2(fd, String(process.pid));
+    } catch (writeErr) {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+      try {
+        unlinkSync(lp);
+      } catch {
+      }
+      throw writeErr;
+    }
+    return { fd, path: lp };
+  } catch (err) {
+    const code = err.code;
+    if (code !== "EEXIST") throw err;
+    return checkStaleAndRetry(verb, lp);
+  }
+}
+function releaseLock(handle) {
+  if (handle === null) return;
+  const lp = handle.path;
+  try {
+    closeSync2(handle.fd);
+  } catch {
+  }
+  try {
+    unlinkSync(lp);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+function unlinkIfSamePid(expectedPidStr, lp) {
+  let current;
+  try {
+    current = readFileSync3(lp, "utf8").trim();
+  } catch {
+    return false;
+  }
+  if (current !== expectedPidStr) return false;
+  try {
+    unlinkSync(lp);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function checkStaleAndRetry(verb, lp) {
+  let pidStr;
+  try {
+    pidStr = readFileSync3(lp, "utf8").trim();
+  } catch {
+    pidStr = "";
+  }
+  const pid = Number.parseInt(pidStr, 10);
+  if (!Number.isFinite(pid) || pid <= 0) {
+    if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+  try {
+    process.kill(pid, 0);
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH") {
+      if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
+      warn(`another nomad ${verb} running, skipping`);
+      return null;
+    }
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+}
+function retryOnce(verb, lp) {
+  try {
+    const fd = openSync2(lp, "wx");
+    try {
+      writeFileSync2(fd, String(process.pid));
+    } catch {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+      try {
+        unlinkSync(lp);
+      } catch {
+      }
+      warn(`another nomad ${verb} running, skipping`);
+      return null;
+    }
+    return { fd, path: lp };
+  } catch {
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+}
+
+// src/commands.capture-settings.ts
+init_utils();
+async function confirmCapture(destLabel, keys) {
+  if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+    warn(
+      `refusing to write ${destLabel} without confirmation in a non-interactive shell; re-run with --yes (or --dry-run to preview)`
+    );
+    return false;
+  }
+  log(`About to promote ${keys.length} key(s) into ${destLabel}: ${keys.join(", ")}`);
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question("Proceed? [y/N] ");
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+function resolveCaptureDestination(repo, useHost) {
+  const destPath = useHost ? join7(repo, "hosts", `${HOST}.json`) : join7(repo, "shared", "settings.base.json");
+  const existing = existsSync5(destPath) ? readJson(destPath) : {};
+  return { destPath, existing };
+}
+async function cmdCaptureSettings(opts) {
+  const { host: useHost, dryRun } = opts;
+  const repo = repoHome();
+  if (!existsSync5(repo)) die(`repo not cloned at ${repo}`);
+  const handle = acquireLock("capture-settings");
+  if (handle === null) process.exit(0);
+  try {
+    const claude = claudeHome();
+    const basePath = join7(repo, "shared", "settings.base.json");
+    if (!existsSync5(basePath)) {
+      die("repo not initialized; run 'nomad init' to scaffold");
+    }
+    const settingsPath = join7(claude, "settings.json");
+    if (!existsSync5(settingsPath)) {
+      log("no ~/.claude/settings.json found; nothing to capture");
+      return;
+    }
+    const base = readJson(basePath);
+    const hostPath = join7(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync5(hostPath) ? readJson(hostPath) : {};
+    const merged = deepMerge(base, overrides);
+    const settings = readJson(settingsPath);
+    const subset = buildCaptureSubset(merged, settings, { normalizeNodePath: !useHost });
+    if (Object.keys(subset).length === 0) {
+      log("nothing to capture: no local-only keys found");
+      return;
+    }
+    const { destPath, existing } = resolveCaptureDestination(repo, useHost);
+    const newContent = deepMerge(existing, subset);
+    const dest = useHost ? `hosts/${HOST}.json` : "shared/settings.base.json";
+    const keys = Object.keys(subset).sort((a, b) => a.localeCompare(b, "en"));
+    if (dryRun) {
+      log(`dry-run: would write ${dest} with keys: ${keys.join(", ")}`);
+      return;
+    }
+    if (opts.yes !== true) {
+      const confirm = opts.confirm ?? confirmCapture;
+      const proceed = await confirm(dest, keys);
+      if (!proceed) {
+        log("capture aborted; nothing written");
+        return;
+      }
+    }
+    const ts = freshBackupTs(backupBase());
+    backupRepoWrite(destPath, ts, repo);
+    writeJsonAtomic(destPath, newContent);
+    regenerateSettings(ts, { suppressDriftWarn: true });
+    log(`captured ${keys.length} key(s) into ${dest} (backup: ${ts})`);
+  } finally {
+    releaseLock(handle);
+  }
+}
+
 // src/commands.clean.ts
 init_config();
 init_utils();
-import { existsSync as existsSync4, lstatSync as lstatSync3, readdirSync, rmSync as rmSync2, statSync as statSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync4, readdirSync, rmSync as rmSync3, statSync as statSync2 } from "node:fs";
+import { join as join8 } from "node:path";
 var TS_SHAPE = /^\d{8}-\d{6}(-\d+)?$/;
 var DURATION_RE = /^(\d+)([dhm])$/;
 var UNIT_MS = { d: 864e5, h: 36e5, m: 6e4 };
@@ -1268,8 +1677,8 @@ function parseDuration(s) {
   return Number(m[1]) * UNIT_MS[m[2]];
 }
 function listBackupDirs(backupBase2) {
-  if (!existsSync4(backupBase2)) return [];
-  return readdirSync(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join5(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
+  if (!existsSync6(backupBase2)) return [];
+  return readdirSync(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join8(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
 function prunableByAge(dirs, olderThanMs, nowMs) {
   return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
@@ -1279,10 +1688,10 @@ function prunableByCount(dirs, keep) {
 }
 function safeDelete(backupBase2, name) {
   if (!isTsDir(name)) return;
-  const full = join5(backupBase2, name);
-  const st = lstatSync3(full, { throwIfNoEntry: false });
+  const full = join8(backupBase2, name);
+  const st = lstatSync4(full, { throwIfNoEntry: false });
   if (!st || st.isSymbolicLink() || !st.isDirectory()) return;
-  rmSync2(full, { recursive: true, force: true });
+  rmSync3(full, { recursive: true, force: true });
 }
 function resolveTargets(dirs, olderThanMs, keep) {
   if (keep !== void 0) return prunableByCount(dirs, keep);
@@ -1318,8 +1727,8 @@ function cmdClean(opts, backupBase2 = backupBase()) {
 init_config();
 init_utils();
 init_utils_json();
-import { cpSync as cpSync3, existsSync as existsSync5, lstatSync as lstatSync4, realpathSync, renameSync as renameSync2, rmSync as rmSync3 } from "node:fs";
-import { join as join6, sep } from "node:path";
+import { cpSync as cpSync3, existsSync as existsSync7, lstatSync as lstatSync5, realpathSync, renameSync as renameSync2, rmSync as rmSync4 } from "node:fs";
+import { join as join9, sep as sep2 } from "node:path";
 function ejectChecklist() {
   return [
     "Manual steps remaining to finish leaving claude-nomad on this host:",
@@ -1335,33 +1744,33 @@ function errMessage(err) {
 }
 function lexists2(p) {
   try {
-    lstatSync4(p);
+    lstatSync5(p);
     return true;
   } catch {
     return false;
   }
 }
 function readMapIfPresent2(repoHome2) {
-  const mapPath = join6(repoHome2, "path-map.json");
-  return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join9(repoHome2, "path-map.json");
+  return existsSync7(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function classifyName(linkPath) {
   if (!lexists2(linkPath)) return "absent";
-  if (!lstatSync4(linkPath).isSymbolicLink()) return "skip-real";
-  if (!existsSync5(linkPath)) return "dangling";
+  if (!lstatSync5(linkPath).isSymbolicLink()) return "skip-real";
+  if (!existsSync7(linkPath)) return "dangling";
   return "materialize";
 }
 function resolveSharedRoot(repoHome2) {
   try {
-    return realpathSync(join6(repoHome2, "shared"));
+    return realpathSync(join9(repoHome2, "shared"));
   } catch {
     return die(
-      `cannot resolve ${join6(repoHome2, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
+      `cannot resolve ${join9(repoHome2, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
     );
   }
 }
 function isManagedTarget(target, sharedRoot) {
-  return target.startsWith(sharedRoot + sep);
+  return target.startsWith(sharedRoot + sep2);
 }
 function materializeOne(name, linkPath, sharedRoot) {
   const target = realpathSync(linkPath);
@@ -1371,20 +1780,20 @@ function materializeOne(name, linkPath, sharedRoot) {
   }
   const tmp = `${linkPath}.eject.tmp.${process.pid}.${Date.now()}`;
   try {
-    rmSync3(tmp, { recursive: true, force: true });
+    rmSync4(tmp, { recursive: true, force: true });
     cpSync3(target, tmp, {
       recursive: true,
       force: true,
       dereference: true,
       preserveTimestamps: true
     });
-    rmSync3(linkPath, { force: true });
+    rmSync4(linkPath, { force: true });
     renameSync2(tmp, linkPath);
     item(`ejected: ${name}`);
     return true;
   } catch (err) {
     try {
-      rmSync3(tmp, { recursive: true, force: true });
+      rmSync4(tmp, { recursive: true, force: true });
     } catch {
     }
     throw err;
@@ -1393,7 +1802,7 @@ function materializeOne(name, linkPath, sharedRoot) {
 function previewDryRun(names, classifications, claudeHome2, sharedRoot) {
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join6(claudeHome2, name);
+    const linkPath = join9(claudeHome2, name);
     if (cls === "absent") {
       item(`skipped (absent): ${name}`);
     } else if (cls === "skip-real") {
@@ -1423,7 +1832,7 @@ function runLiveEject(names, classifications, claudeHome2, sharedRoot) {
   let skipped = 0;
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join6(claudeHome2, name);
+    const linkPath = join9(claudeHome2, name);
     if (cls === "absent") {
       item(`skipped (absent): ${name}`);
       skipped++;
@@ -1459,7 +1868,7 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   const names = allSharedLinks(map);
   const classifications = /* @__PURE__ */ new Map();
   for (const name of names) {
-    classifications.set(name, classifyName(join6(claudeHome2, name)));
+    classifications.set(name, classifyName(join9(claudeHome2, name)));
   }
   const dangling = names.filter((n) => classifications.get(n) === "dangling");
   if (dangling.length > 0) {
@@ -1482,14 +1891,14 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync27 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync29 } from "node:fs";
+import { join as join35 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
 init_config();
-import { existsSync as existsSync7, lstatSync as lstatSync5, statSync as statSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync9, lstatSync as lstatSync6, statSync as statSync3 } from "node:fs";
+import { join as join11 } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -1567,15 +1976,15 @@ function readJsonSafe(path, label, section2) {
 // src/init.classify.ts
 init_config();
 init_utils_json();
-import { existsSync as existsSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync8 } from "node:fs";
+import { join as join10 } from "node:path";
 function classifyRepoState(repoHome2, host) {
-  const basePath = join7(repoHome2, "shared", "settings.base.json");
-  const mapPath = join7(repoHome2, "path-map.json");
-  const hostPath = join7(repoHome2, "hosts", `${host}.json`);
-  const hasBase = existsSync6(basePath);
-  const hasMap = existsSync6(mapPath);
-  const hasHost = existsSync6(hostPath);
+  const basePath = join10(repoHome2, "shared", "settings.base.json");
+  const mapPath = join10(repoHome2, "path-map.json");
+  const hostPath = join10(repoHome2, "hosts", `${host}.json`);
+  const hasBase = existsSync8(basePath);
+  const hasMap = existsSync8(mapPath);
+  const hasHost = existsSync8(hostPath);
   let mapEntryCount = 0;
   if (hasMap) {
     try {
@@ -1590,11 +1999,11 @@ function classifyRepoState(repoHome2, host) {
   return "partial";
 }
 function reasonForPartial(repoHome2, host) {
-  const basePath = join7(repoHome2, "shared", "settings.base.json");
-  const mapPath = join7(repoHome2, "path-map.json");
-  const hostPath = join7(repoHome2, "hosts", `${host}.json`);
-  if (!existsSync6(basePath)) return "- shared/settings.base.json missing";
-  if (!existsSync6(mapPath)) return "- path-map.json missing";
+  const basePath = join10(repoHome2, "shared", "settings.base.json");
+  const mapPath = join10(repoHome2, "path-map.json");
+  const hostPath = join10(repoHome2, "hosts", `${host}.json`);
+  if (!existsSync8(basePath)) return "- shared/settings.base.json missing";
+  if (!existsSync8(mapPath)) return "- path-map.json missing";
   let mapEntryCount;
   try {
     const map = readJson(mapPath);
@@ -1603,7 +2012,7 @@ function reasonForPartial(repoHome2, host) {
     mapEntryCount = 0;
   }
   if (mapEntryCount === 0) return "- path-map.json.projects has no entries";
-  if (!existsSync6(hostPath)) return `- hosts/${host}.json missing`;
+  if (!existsSync8(hostPath)) return `- hosts/${host}.json missing`;
   return "- partial state (unknown gap)";
 }
 
@@ -1619,10 +2028,10 @@ function reportHostAndPaths(section2) {
   if (isOverrideActive()) {
     addItem(section2, `${dim(infoGlyph)} NOMAD_REPO: ${blue(repo)}`);
   }
-  addItem(section2, `${existsSync7(repo) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(repo)}`);
+  addItem(section2, `${existsSync9(repo) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(repo)}`);
   addItem(
     section2,
-    `${existsSync7(claude) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(claude)}`
+    `${existsSync9(claude) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(claude)}`
   );
 }
 function reportRepoState(section2) {
@@ -1645,12 +2054,12 @@ function reportRepoState(section2) {
   }
 }
 function repoHasSharedSource(name) {
-  return existsSync7(join8(repoHome(), "shared", name));
+  return existsSync9(join11(repoHome(), "shared", name));
 }
 function classifySharedLink(name, p) {
   let stat;
   try {
-    stat = lstatSync5(p);
+    stat = lstatSync6(p);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -1693,7 +2102,7 @@ function classifySymlinkTarget(name, p) {
 function reportSharedLinks(section2, map) {
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const p = join8(claude, name);
+    const p = join11(claude, name);
     const { line, fail: fail2 } = classifySharedLink(name, p);
     addItem(section2, line);
     if (fail2) process.exitCode = 1;
@@ -1702,10 +2111,10 @@ function reportSharedLinks(section2, map) {
 function reportDroppedNamesMigration(section2) {
   const claude = claudeHome();
   for (const name of GSD_DROPPED_NAMES) {
-    const p = join8(claude, name);
+    const p = join11(claude, name);
     let stat;
     try {
-      stat = lstatSync5(p);
+      stat = lstatSync6(p);
     } catch {
       continue;
     }
@@ -1720,11 +2129,11 @@ function reportDroppedNamesMigration(section2) {
 // src/commands.doctor.checks.settings.ts
 init_color();
 init_config();
-import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync2 } from "node:fs";
+import { join as join12 } from "node:path";
 function loadBaseSettings(section2) {
-  const basePath = join9(repoHome(), "shared", "settings.base.json");
-  if (!existsSync8(basePath)) {
+  const basePath = join12(repoHome(), "shared", "settings.base.json");
+  if (!existsSync10(basePath)) {
     addItem(section2, `${red(failGlyph)} shared/settings.base.json missing at ${blue(basePath)}`);
     process.exitCode = 1;
     return null;
@@ -1732,8 +2141,8 @@ function loadBaseSettings(section2) {
   return readJsonSafe(basePath, basePath, section2);
 }
 function loadAndReportSettings(section2) {
-  const settingsPath = join9(claudeHome(), "settings.json");
-  if (!existsSync8(settingsPath)) return null;
+  const settingsPath = join12(claudeHome(), "settings.json");
+  if (!existsSync10(settingsPath)) return null;
   const settings = readJsonSafe(settingsPath, settingsPath, section2);
   if (settings === null) return null;
   const unknownKeys = Object.keys(settings).filter((k) => !KNOWN_SETTINGS_KEYS.has(k));
@@ -1749,13 +2158,13 @@ function loadAndReportSettings(section2) {
 }
 function reportHostOverrides(section2, base, settings) {
   const repo = repoHome();
-  const hostFile = join9(repo, "hosts", `${HOST}.json`);
+  const hostFile = join12(repo, "hosts", `${HOST}.json`);
   let drift = [];
   if (base !== null && settings !== null) {
     const baseKeys = new Set(Object.keys(base));
     drift = Object.keys(settings).filter((k) => !baseKeys.has(k));
   }
-  if (existsSync8(hostFile)) {
+  if (existsSync10(hostFile)) {
     if (readJsonSafe(hostFile, hostFile, section2) !== null) {
       addItem(section2, `${green(okGlyph)} host overrides: ${blue(hostFile)}`);
     }
@@ -1764,8 +2173,8 @@ function reportHostOverrides(section2, base, settings) {
       section2,
       `${red(failGlyph)} no hosts/${HOST}.json AND settings.json has unbased keys ${JSON.stringify(drift)}`
     );
-    const hostsDir = join9(repo, "hosts");
-    if (existsSync8(hostsDir)) {
+    const hostsDir = join12(repo, "hosts");
+    if (existsSync10(hostsDir)) {
       const cands = readdirSync2(hostsDir).filter((f) => f.endsWith(".json"));
       if (cands.length > 0) addItem(section2, `${dim(infoGlyph)} candidates: ${cands.join(", ")}`);
     }
@@ -1781,8 +2190,8 @@ function reportHostOverrides(section2, base, settings) {
 // src/commands.doctor.checks.pathmap.ts
 init_color();
 init_config();
-import { existsSync as existsSync9, readdirSync as readdirSync3 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync3 } from "node:fs";
+import { join as join13 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
@@ -1792,8 +2201,8 @@ function reportMappedProjects(section2, map) {
   }
 }
 function reportUnmappedProjects(section2, map) {
-  const localProjects = join10(claudeHome(), "projects");
-  if (!existsSync9(localProjects)) return;
+  const localProjects = join13(claudeHome(), "projects");
+  if (!existsSync11(localProjects)) return;
   let localDirs;
   try {
     localDirs = readdirSync3(localProjects);
@@ -1833,43 +2242,20 @@ function reportPathCollisions(section2, map) {
   else addItem(section2, `${green(okGlyph)} path-encoding: no collisions`);
 }
 function reportPathMap(section2) {
-  const mapPath = join10(repoHome(), "path-map.json");
-  if (!existsSync9(mapPath)) {
+  const mapPath = join13(repoHome(), "path-map.json");
+  if (!existsSync11(mapPath)) {
     addItem(section2, `${red(failGlyph)} path-map.json missing at ${blue(mapPath)}`);
     process.exitCode = 1;
     return;
   }
   const map = readJsonSafe(mapPath, mapPath, section2);
   if (map === null) return;
-  const projects = map.projects;
-  if (projects === null || typeof projects !== "object" || Array.isArray(projects)) {
-    addItem(
-      section2,
-      `${red(failGlyph)} path-map.json invalid schema: "projects" must be an object`
-    );
+  const shapeError = validatePathMapShape(map);
+  if (shapeError !== null) {
+    addItem(section2, `${red(failGlyph)} ${shapeError}`);
     process.exitCode = 1;
     return;
   }
-  for (const [name, hosts] of Object.entries(projects)) {
-    if (hosts === null || typeof hosts !== "object" || Array.isArray(hosts)) {
-      addItem(
-        section2,
-        `${red(failGlyph)} path-map.json invalid schema: project "${name}" hosts must be an object`
-      );
-      process.exitCode = 1;
-      return;
-    }
-    for (const [hostName, mappedPath] of Object.entries(hosts)) {
-      if (typeof mappedPath !== "string") {
-        addItem(
-          section2,
-          `${red(failGlyph)} path-map.json invalid schema: project "${name}" host "${hostName}" path must be a string`
-        );
-        process.exitCode = 1;
-        return;
-      }
-    }
-  }
   reportMappedProjects(section2, map);
   reportUnmappedProjects(section2, map);
   reportPathCollisions(section2, map);
@@ -1883,12 +2269,12 @@ function reportNeverSync(section2) {
   );
 }
 
-// src/commands.doctor.checks.repository.ts
+// src/commands.doctor.checks.git-state.ts
 init_color();
 init_config();
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join14, relative as relative2 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { join as join17, relative as relative2 } from "node:path";
 init_commands_pull_wedge();
 init_push_checks();
 init_utils();
@@ -1911,8 +2297,8 @@ function reportGitleaksProbe(section2) {
 }
 function reportGitlinks(section2) {
   const repo = repoHome();
-  const sharedDir = join14(repo, "shared");
-  if (existsSync12(sharedDir)) {
+  const sharedDir = join17(repo, "shared");
+  if (existsSync14(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
       const rel = relative2(repo, p);
@@ -1985,8 +2371,8 @@ function reportOrphanedAutostash(sec) {
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync13, lstatSync as lstatSync6, readdirSync as readdirSync5 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync15, lstatSync as lstatSync7, readdirSync as readdirSync5 } from "node:fs";
+import { join as join18 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
 function safeReaddir(dir) {
@@ -2002,8 +2388,8 @@ var BYTES_PER_MB = 1024 * 1024;
 function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
-    const full = join15(dir, entry);
-    const st = lstatSync6(full, { throwIfNoEntry: false });
+    const full = join18(dir, entry);
+    const st = lstatSync7(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) bytes += dirSizeBytes(full);
@@ -2013,11 +2399,11 @@ function dirSizeBytes(dir) {
 }
 function totalSizeMb(backupBase2, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join15(backupBase2, name));
+  for (const name of dirs) bytes += dirSizeBytes(join18(backupBase2, name));
   return bytes / BYTES_PER_MB;
 }
 function reportBackupsCheck(section2, backupBase2 = backupBase()) {
-  if (!existsSync13(backupBase2)) return;
+  if (!existsSync15(backupBase2)) return;
   const dirs = safeReaddir(backupBase2).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
   const sizeMb = totalSizeMb(backupBase2, dirs);
@@ -2031,8 +2417,8 @@ function reportBackupsCheck(section2, backupBase2 = backupBase()) {
 
 // src/commands.doctor.check-schema.ts
 init_color();
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { join as join19 } from "node:path";
 init_config();
 
 // src/http-fetch.ts
@@ -2069,8 +2455,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join16(claudeHome(), "settings.json");
-  if (!existsSync14(settingsPath)) {
+  const settingsPath = join19(claudeHome(), "settings.json");
+  if (!existsSync16(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -2100,18 +2486,18 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync4, readdirSync as readdirSync7, rmSync as rmSync7 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readdirSync as readdirSync7, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join23 } from "node:path";
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
-import { join as join18 } from "node:path";
+import { join as join21 } from "node:path";
 init_config();
 init_push_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join18(claudeHome(), "projects", encoded, `${sid}.jsonl`);
+  return join21(claudeHome(), "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -2203,21 +2589,27 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { cpSync as cpSync4, existsSync as existsSync15, mkdirSync as mkdirSync3, readdirSync as readdirSync6, rmSync as rmSync6, statSync as statSync4 } from "node:fs";
-import { join as join19, relative as relative3, sep as sep2 } from "node:path";
+import { cpSync as cpSync4, existsSync as existsSync17, mkdirSync as mkdirSync4, readdirSync as readdirSync6, renameSync as renameSync3, rmSync as rmSync7, statSync as statSync4 } from "node:fs";
+import { join as join22, relative as relative3, sep as sep3 } from "node:path";
+var TMP_SUFFIX = ".nomad-tmp";
+function atomicMirror(src, dst, options) {
+  const tmp = `${dst}${TMP_SUFFIX}`;
+  rmSync7(tmp, { recursive: true, force: true });
+  cpSync4(src, tmp, options);
+  rmSync7(dst, { recursive: true, force: true });
+  renameSync3(tmp, dst);
+}
 function copyDir(src, dst) {
-  rmSync6(dst, { recursive: true, force: true });
-  cpSync4(src, dst, { recursive: true, force: true });
+  atomicMirror(src, dst, { recursive: true, force: true });
 }
 function copyDirJsonlOnly(src, dst) {
-  rmSync6(dst, { recursive: true, force: true });
-  cpSync4(src, dst, {
+  atomicMirror(src, dst, {
     recursive: true,
     force: true,
     filter: (srcPath) => {
       const rel = relative3(src, srcPath);
       if (rel === "") return true;
-      if (rel.split(sep2).length > 1) return true;
+      if (rel.split(sep3).length > 1) return true;
       if (statSync4(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       item(`skip ${rel}: extension not in allowlist`);
@@ -2236,16 +2628,16 @@ function remapPull(ts, opts = {}) {
   const wouldPull = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join19(repo, "path-map.json");
-  const repoProjects = join19(repo, "shared", "projects");
-  if (!existsSync15(mapPath) || !existsSync15(repoProjects)) {
+  const mapPath = join22(repo, "path-map.json");
+  const repoProjects = join22(repo, "shared", "projects");
+  if (!existsSync17(mapPath) || !existsSync17(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
-  const map = readJson(mapPath);
-  const localProjects = join19(claude, "projects");
-  if (!dryRun) mkdirSync3(localProjects, { recursive: true });
+  const map = readPathMap(mapPath);
+  const localProjects = join22(claude, "projects");
+  if (!dryRun) mkdirSync4(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const localPath = hosts[HOST];
@@ -2253,9 +2645,9 @@ function remapPull(ts, opts = {}) {
       unmapped++;
       continue;
     }
-    const src = join19(repoProjects, logical);
-    if (!existsSync15(src)) continue;
-    const dst = join19(localProjects, encodePath(localPath));
+    const src = join22(repoProjects, logical);
+    if (!existsSync17(src)) continue;
+    const dst = join22(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -2302,30 +2694,31 @@ function remapPush(ts, opts = {}) {
   const wouldPush = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join19(repo, "path-map.json");
-  if (!existsSync15(mapPath)) {
+  const mapPath = join22(repo, "path-map.json");
+  if (!existsSync17(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
-  const map = readJson(mapPath);
-  const localProjects = join19(claude, "projects");
-  const repoProjects = join19(repo, "shared", "projects");
+  const map = readPathMap(mapPath);
+  const localProjects = join22(claude, "projects");
+  const repoProjects = join22(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync15(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
-  if (!dryRun) mkdirSync3(repoProjects, { recursive: true });
+  if (!existsSync17(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!dryRun) mkdirSync4(repoProjects, { recursive: true });
   for (const dir of readdirSync6(localProjects)) {
+    if (dir.endsWith(TMP_SUFFIX)) continue;
     const logical = reverse.get(dir);
     if (!logical) {
       unmapped++;
       continue;
     }
-    const repoDst = join19(repoProjects, logical);
+    const repoDst = join22(repoProjects, logical);
     if (dryRun) {
       wouldPush.push(logical);
       continue;
     }
     backupRepoWrite(repoDst, ts, repo);
-    copyDirJsonlOnly(join19(localProjects, dir), repoDst);
+    copyDirJsonlOnly(join22(localProjects, dir), repoDst);
     pushed.push(logical);
   }
   return { unmapped, collisions: 0, pushed, wouldPush };
@@ -2338,8 +2731,8 @@ function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
   const repo = repoHome();
-  const mapPath = join20(repo, "path-map.json");
-  if (!existsSync16(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join23(repo, "path-map.json");
+  if (!existsSync18(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -2356,12 +2749,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join20(claudeHome(), "projects");
-  if (!existsSync16(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  const localProjects = join23(claudeHome(), "projects");
+  if (!existsSync18(localProjects)) return { logicalToEncoded, staged, malformed: false };
   for (const dir of readdirSync7(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join20(localProjects, dir), join20(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join23(localProjects, dir), join23(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -2392,11 +2785,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
 }
 function reportCheckShared(section2, gitleaksReady) {
   if (!ensureGitleaksReady(section2, gitleaksReady)) return;
-  const cacheDir = join20(homedir4(), ".cache", "claude-nomad");
-  mkdirSync4(cacheDir, { recursive: true });
+  const cacheDir = join23(homedir4(), ".cache", "claude-nomad");
+  mkdirSync5(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const reportPath = join20(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join20(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join23(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join23(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -2410,19 +2803,19 @@ function reportCheckShared(section2, gitleaksReady) {
     }
     scanAndReport(section2, tmpRoot, staged, logicalToEncoded);
   } finally {
-    rmSync7(reportPath, { force: true });
-    rmSync7(tmpRoot, { recursive: true, force: true });
+    rmSync8(reportPath, { force: true });
+    rmSync8(tmpRoot, { recursive: true, force: true });
   }
 }
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync17, readFileSync as readFileSync5, readdirSync as readdirSync8, realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname2, extname, join as join21 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync6, readdirSync as readdirSync8, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname3, extname, join as join24 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
-    const parsed = JSON.parse(readFileSync5(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(pkgPath, "utf8"));
     return parsed.type === "module" ? "esm" : "cjs";
   } catch {
     return "cjs";
@@ -2438,11 +2831,11 @@ function effectiveType(hookPath) {
   } catch {
     return null;
   }
-  let dir = dirname2(real);
+  let dir = dirname3(real);
   for (; ; ) {
-    const pkg = join21(dir, "package.json");
-    if (existsSync17(pkg)) return typeFromPackageJson(pkg);
-    const parent = dirname2(dir);
+    const pkg = join24(dir, "package.json");
+    if (existsSync19(pkg)) return typeFromPackageJson(pkg);
+    const parent = dirname3(dir);
     if (parent === dir) return "cjs";
     dir = parent;
   }
@@ -2477,21 +2870,21 @@ function safeReaddir2(dir) {
 }
 function safeRead(path) {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return null;
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join21(claudeHome(), "hooks");
-  if (!existsSync17(hooksDir)) {
+  const hooksDir = join24(claudeHome(), "hooks");
+  if (!existsSync19(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join21(hooksDir, name);
+    const abs = join24(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -2511,8 +2904,8 @@ function reportHookScopeCheck(section2) {
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { join as join25 } from "node:path";
 init_config();
 function expandHome(token) {
   const h2 = home();
@@ -2551,7 +2944,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync18(resolved)) continue;
+        if (existsSync20(resolved)) continue;
         addItem(
           section2,
           `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
@@ -2564,8 +2957,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join22(claudeHome(), "settings.json");
-  if (!existsSync18(settingsPath)) {
+  const settingsPath = join25(claudeHome(), "settings.json");
+  if (!existsSync20(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -2588,12 +2981,12 @@ function reportHooksTargetCheck(section2) {
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.ts
 init_color();
-import { existsSync as existsSync20, readFileSync as readFileSync6 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync7 } from "node:fs";
+import { join as join27 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync2, existsSync as existsSync19, openSync as openSync2, readSync, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname3, join as join23, resolve as resolve2 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync21, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname4, join as join26, resolve as resolve2 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
   const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
@@ -2625,12 +3018,12 @@ function topRelativeSpecifiers(src) {
 }
 function specifierIsMissing(specifier, baseDir) {
   const base = resolve2(baseDir, specifier);
-  if (existsSync19(base)) return false;
+  if (existsSync21(base)) return false;
   for (const ext of [".js", ".cjs", ".mjs"]) {
-    if (existsSync19(base + ext)) return false;
+    if (existsSync21(base + ext)) return false;
   }
   for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
-    if (existsSync19(join23(base, idx))) return false;
+    if (existsSync21(join26(base, idx))) return false;
   }
   return true;
 }
@@ -2643,20 +3036,20 @@ function relativeRequireTargetsBroken(scriptPath) {
   }
   let raw;
   try {
-    const fd = openSync2(realPath, "r");
+    const fd = openSync3(realPath, "r");
     try {
       const buf = Buffer.alloc(65536);
       const bytesRead = readSync(fd, buf, 0, 65536, 0);
       raw = buf.toString("utf8", 0, bytesRead);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
   } catch {
     return false;
   }
   const specifiers = topRelativeSpecifiers(raw);
   if (specifiers.length === 0) return false;
-  const baseDir = dirname3(realPath);
+  const baseDir = dirname4(realPath);
   for (const spec of specifiers) {
     if (specifierIsMissing(spec, baseDir)) return true;
   }
@@ -2685,10 +3078,10 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join24(repoHome(), "path-map.json");
-  if (!existsSync20(mapPath)) return { projects: {} };
+  const mapPath = join27(repoHome(), "path-map.json");
+  if (!existsSync22(mapPath)) return { projects: {} };
   try {
-    return JSON.parse(readFileSync6(mapPath, "utf8"));
+    return JSON.parse(readFileSync7(mapPath, "utf8"));
   } catch {
     return { projects: {} };
   }
@@ -2759,8 +3152,8 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join24(claudeHome(), "settings.json");
-  if (!existsSync20(settingsPath)) {
+  const settingsPath = join27(claudeHome(), "settings.json");
+  if (!existsSync22(settingsPath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
@@ -2769,7 +3162,7 @@ function reportPreserveSymlinksCheck(section2) {
   }
   let settings;
   try {
-    settings = JSON.parse(readFileSync6(settingsPath, "utf8"));
+    settings = JSON.parse(readFileSync7(settingsPath, "utf8"));
   } catch {
     return;
   }
@@ -2781,75 +3174,29 @@ function reportPreserveSymlinksCheck(section2) {
   }
   const map = readPathMapSafe();
   const sharedLinkNames = allSharedLinks(map);
-  let anyWarn = false;
-  for (const [event, groups] of Object.entries(hooks)) {
-    if (!Array.isArray(groups)) continue;
-    if (checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)) anyWarn = true;
-  }
-  if (!anyWarn) {
-    addItem(section2, `${green(okGlyph)} hooks: preserve-symlinks-main not needed`);
-  }
-}
-
-// src/commands.doctor.checks.settings-drift.ts
-init_color();
-import { existsSync as existsSync21, readFileSync as readFileSync7 } from "node:fs";
-import { join as join25 } from "node:path";
-init_config();
-init_utils_json();
-function arraysEqual(a, b) {
-  if (a.length !== b.length) return false;
-  for (let i = 0; i < a.length; i++) {
-    if (!deepEqual(a[i], b[i])) return false;
-  }
-  return true;
-}
-function objectsEqual(a, b) {
-  const aKeys = Object.keys(a);
-  const bKeys = Object.keys(b);
-  if (aKeys.length !== bKeys.length) return false;
-  for (const k of aKeys) {
-    if (!Object.hasOwn(b, k)) return false;
-    if (!deepEqual(a[k], b[k])) return false;
+  let anyWarn = false;
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    if (checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)) anyWarn = true;
   }
-  return true;
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null) return false;
-  if (Array.isArray(a) && Array.isArray(b)) return arraysEqual(a, b);
-  if (Array.isArray(a) || Array.isArray(b)) return false;
-  if (typeof a === "object" && typeof b === "object") {
-    return objectsEqual(a, b);
+  if (!anyWarn) {
+    addItem(section2, `${green(okGlyph)} hooks: preserve-symlinks-main not needed`);
   }
-  return false;
 }
+
+// src/commands.doctor.checks.settings-drift.ts
+init_color();
+import { existsSync as existsSync23, readFileSync as readFileSync8 } from "node:fs";
+import { join as join28 } from "node:path";
+init_config();
+init_utils_json();
 function diffMergedSettings(merged, settings) {
-  const missing = [];
-  const changed = [];
-  const extra = [];
-  const settingsKeys = new Set(Object.keys(settings));
-  for (const key of Object.keys(merged)) {
-    if (!settingsKeys.has(key)) {
-      missing.push(key);
-    } else if (!deepEqual(merged[key], settings[key])) {
-      changed.push(key);
-    }
-  }
-  const mergedKeys = new Set(Object.keys(merged));
-  for (const key of Object.keys(settings)) {
-    if (!mergedKeys.has(key)) extra.push(key);
-  }
-  const collator = (a, b) => a.localeCompare(b, "en");
-  return {
-    missing: missing.toSorted(collator),
-    changed: changed.toSorted(collator),
-    extra: extra.toSorted(collator)
-  };
+  const { behind, changed, ahead } = classifySettingsDrift(merged, settings);
+  return { missing: behind, changed, extra: ahead };
 }
 function tryReadJson(filePath) {
   try {
-    const raw = readFileSync7(filePath, "utf8");
+    const raw = readFileSync8(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
@@ -2861,14 +3208,14 @@ function reportSettingsDriftCheck(section2) {
   const claude = claudeHome();
   const repo = repoHome();
   const host = HOST;
-  const settingsPath = join25(claude, "settings.json");
-  const basePath = join25(repo, "shared", "settings.base.json");
-  const hostPath = join25(repo, "hosts", `${host}.json`);
-  if (!existsSync21(settingsPath)) {
+  const settingsPath = join28(claude, "settings.json");
+  const basePath = join28(repo, "shared", "settings.base.json");
+  const hostPath = join28(repo, "hosts", `${host}.json`);
+  if (!existsSync23(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
     return;
   }
-  if (!existsSync21(basePath)) {
+  if (!existsSync23(basePath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
@@ -2887,7 +3234,7 @@ function reportSettingsDriftCheck(section2) {
   if (settings === null) {
     return;
   }
-  const hostExists = existsSync21(hostPath);
+  const hostExists = existsSync23(hostPath);
   const hostObj = hostExists ? tryReadJson(hostPath) : null;
   if (hostExists && hostObj === null) {
     addItem(
@@ -2898,9 +3245,10 @@ function reportSettingsDriftCheck(section2) {
   }
   const merged = deepMerge(base, hostObj ?? {});
   const { missing, changed, extra } = diffMergedSettings(merged, settings);
-  emitDriftRows(section2, missing, changed, extra, host, hostExists);
+  const { promotable, excluded } = partitionByCaptureExclusion(extra);
+  emitDriftRows(section2, missing, changed, promotable, excluded, hostExists);
 }
-function emitDriftRows(section2, missing, changed, extra, host, hostFileExists) {
+function emitDriftRows(section2, missing, changed, promotable, excluded, hostFileExists) {
   if (missing.length > 0) {
     addItem(
       section2,
@@ -2913,13 +3261,19 @@ function emitDriftRows(section2, missing, changed, extra, host, hostFileExists)
       `${yellow(warnGlyph)} settings.json drift: merged keys with changed values: ${changed.join(", ")} (run 'nomad pull')`
     );
   }
-  if (extra.length > 0 && hostFileExists) {
+  if (promotable.length > 0 && hostFileExists) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} settings.json has ${promotable.length} local-only key(s) not in base+host merge: ${promotable.join(", ")} (run 'nomad capture-settings' to promote them into the repo)`
+    );
+  }
+  if (excluded.length > 0 && hostFileExists) {
     addItem(
       section2,
-      `${dim(infoGlyph)} settings.json has ${extra.length} local-only key(s) not in base+host merge: ${extra.join(", ")} (promotion candidates for shared/settings.base.json or hosts/${host}.json)`
+      `${dim(infoGlyph)} settings.json has ${excluded.length} local-only key(s) outside the sync set (credential or host-local; nomad does not promote these)`
     );
   }
-  if (missing.length === 0 && changed.length === 0 && extra.length === 0) {
+  if (missing.length === 0 && changed.length === 0 && promotable.length === 0 && excluded.length === 0) {
     addItem(section2, `${green(okGlyph)} settings.json matches base+host merge`);
   }
 }
@@ -2929,12 +3283,12 @@ init_config();
 
 // src/commands.doctor.engine.ts
 init_color();
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/commands.doctor.version.ts
 init_color();
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_config();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -2951,7 +3305,7 @@ function compareSemver(a, b) {
 function readLocalVersion() {
   try {
     const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync8(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync9(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
     }
@@ -3010,7 +3364,7 @@ function parseMinVersion(spec) {
 function readEnginesNode() {
   try {
     const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync9(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync10(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
     return null;
@@ -3038,43 +3392,44 @@ function reportNodeEngineCheck(section2) {
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync25 } from "node:fs";
+import { existsSync as existsSync27 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
-import { readFileSync as readFileSync13, rmSync as rmSync9, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join31 } from "node:path";
-import { createInterface } from "node:readline/promises";
+import { readFileSync as readFileSync13, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join33 } from "node:path";
+import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/commands.push.recovery.actions.ts
 init_config();
 import { readFileSync as readFileSync12 } from "node:fs";
-import { isAbsolute, resolve as resolve3, sep as sep4 } from "node:path";
+import { isAbsolute, resolve as resolve3, sep as sep5 } from "node:path";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync5, existsSync as existsSync24, mkdirSync as mkdirSync6, statSync as statSync7 } from "node:fs";
-import { dirname as dirname6, join as join29, sep as sep3 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync26, mkdirSync as mkdirSync6, statSync as statSync7 } from "node:fs";
+import { dirname as dirname6, join as join31, sep as sep4 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync23, statSync as statSync6 } from "node:fs";
-import { dirname as dirname5, join as join28 } from "node:path";
+import { existsSync as existsSync25, statSync as statSync6 } from "node:fs";
+import { dirname as dirname5, join as join30 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync22, lstatSync as lstatSync7, readFileSync as readFileSync10, readdirSync as readdirSync9, statSync as statSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync24, lstatSync as lstatSync8, readFileSync as readFileSync11, readdirSync as readdirSync9, statSync as statSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join29 } from "node:path";
 init_utils_fs();
+init_utils();
 function collectFiles(dir, out) {
-  if (!existsSync22(dir)) return;
-  const st = lstatSync7(dir);
+  if (!existsSync24(dir)) return;
+  const st = lstatSync8(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync9(dir)) {
-    const abs = join26(dir, entry);
-    const lst = lstatSync7(abs);
+    const abs = join29(dir, entry);
+    const lst = lstatSync8(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -3110,143 +3465,83 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   if (!dryRun && total > 0) {
     for (const { path: filePath, findings } of dirty) {
       backupBeforeWrite(filePath, ts);
-      writeFileSync3(filePath, applyRedactions(readFileSync10(filePath, "utf8"), findings), "utf8");
+      const before = readFileSync11(filePath, "utf8");
+      const after = applyRedactions(before, findings);
+      if (after === before) {
+        log(
+          `warning: no redaction applied to ${filePath}: finding match values were not located in the file. Inspect it manually; the push re-scan still blocks a real leak.`
+        );
+      }
+      writeFileSync4(filePath, after, "utf8");
     }
   }
   return { total, dirty };
 }
 
-// src/commands.redact.ts
-init_push_gitleaks_scan();
-init_utils_fs();
-init_utils_json();
-init_utils();
-
-// src/utils.lockfile.ts
-init_config();
+// src/commands.pushed-history.ts
 init_utils();
-import { closeSync as closeSync3, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync11, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join27 } from "node:path";
-function lockFilePath() {
-  return join27(home(), ".cache", "claude-nomad", "nomad.lock");
-}
-function acquireLock(verb) {
-  const lp = lockFilePath();
-  mkdirSync5(dirname4(lp), { recursive: true });
-  try {
-    const fd = openSync3(lp, "wx");
-    try {
-      writeFileSync4(fd, String(process.pid));
-    } catch (writeErr) {
-      try {
-        closeSync3(fd);
-      } catch {
-      }
-      try {
-        unlinkSync(lp);
-      } catch {
-      }
-      throw writeErr;
-    }
-    return { fd, path: lp };
-  } catch (err) {
-    const code = err.code;
-    if (code !== "EEXIST") throw err;
-    return checkStaleAndRetry(verb, lp);
-  }
-}
-function releaseLock(handle) {
-  if (handle === null) return;
-  const lp = handle.path;
+import { execFileSync as execFileSync8 } from "node:child_process";
+function pushedRef(repo) {
   try {
-    closeSync3(handle.fd);
+    const ref = execFileSync8("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+      cwd: repo,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+    return ref.length > 0 ? ref : null;
   } catch {
-  }
-  try {
-    unlinkSync(lp);
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
+    return null;
   }
 }
-function unlinkIfSamePid(expectedPidStr, lp) {
-  let current;
-  try {
-    current = readFileSync11(lp, "utf8").trim();
-  } catch {
-    return false;
-  }
-  if (current !== expectedPidStr) return false;
+function sessionInPushedHistory(id, repo) {
+  const ref = pushedRef(repo);
+  if (ref === null) return false;
   try {
-    unlinkSync(lp);
-    return true;
+    const out = execFileSync8(
+      "git",
+      [
+        "log",
+        ref,
+        "--oneline",
+        "-1",
+        "--",
+        `shared/projects/*/${id}.jsonl`,
+        `shared/projects/*/${id}/*`
+      ],
+      { cwd: repo, stdio: ["ignore", "pipe", "ignore"] }
+    ).toString().trim();
+    return out.length > 0;
   } catch {
     return false;
   }
 }
-function checkStaleAndRetry(verb, lp) {
-  let pidStr;
-  try {
-    pidStr = readFileSync11(lp, "utf8").trim();
-  } catch {
-    pidStr = "";
-  }
-  const pid = Number.parseInt(pidStr, 10);
-  if (!Number.isFinite(pid) || pid <= 0) {
-    if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  }
-  try {
-    process.kill(pid, 0);
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  } catch (err) {
-    const code = err.code;
-    if (code === "ESRCH") {
-      if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
-      warn(`another nomad ${verb} running, skipping`);
-      return null;
-    }
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  }
-}
-function retryOnce(verb, lp) {
-  try {
-    const fd = openSync3(lp, "wx");
-    try {
-      writeFileSync4(fd, String(process.pid));
-    } catch {
-      try {
-        closeSync3(fd);
-      } catch {
-      }
-      try {
-        unlinkSync(lp);
-      } catch {
-      }
-      warn(`another nomad ${verb} running, skipping`);
-      return null;
-    }
-    return { fd, path: lp };
-  } catch {
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  }
+function warnIfSessionPushed(id, repo) {
+  if (!sessionInPushedHistory(id, repo)) return;
+  log(
+    `warning: session ${id} is already in pushed history (origin).
+  This command only changes your local copy and the next push; it does NOT
+  remove the secret from commits already on the remote.
+  To fully remediate a real secret: rotate the credential, then rewrite
+  history (e.g. with git filter-repo) and force-push, coordinating with
+  anyone else who has cloned the repo.`
+  );
 }
 
 // src/commands.redact.ts
+init_push_gitleaks_scan();
+init_utils_fs();
+init_utils_json();
+init_utils();
 function resolveLiveTranscript(id) {
   try {
-    const mapPath = join28(repoHome(), "path-map.json");
-    if (!existsSync23(mapPath)) return null;
+    const mapPath = join30(repoHome(), "path-map.json");
+    if (!existsSync25(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join28(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync23(live)) return live;
+      const live = join30(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync25(live)) return live;
     }
     return null;
   } catch {
@@ -3266,17 +3561,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync23(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync25(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync23(localPath)) {
+    if (localPath === null || !existsSync25(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join28(dirname5(localPath), id);
+    const sessionDir = join30(dirname5(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync6(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -3317,6 +3612,7 @@ ${lines}`);
       return;
     }
     log(`redacted ${totalCount} finding(s) in ${localPath} (backup: ${ts})`);
+    warnIfSessionPushed(id, repo);
   } catch (err) {
     if (!(err instanceof NomadFatal)) {
       throw err;
@@ -3391,12 +3687,28 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join29(claude, "projects", encodePath(abs)) + sep3)) {
-      return join29(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join31(claude, "projects", encodePath(abs)) + sep4)) {
+      return join31(repo, "shared", "projects", logical);
     }
   }
   return null;
 }
+function preflightRedactable(f, map, nowMs) {
+  const sid = sessionIdFromFinding(f);
+  if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
+  const localPath = resolveLiveTranscript(sid);
+  if (localPath === null) return `session ${sid}: local transcript not found`;
+  const sessionDir = join31(dirname6(localPath), sid);
+  const subtreeFiles = listSubtreeFiles(sessionDir);
+  const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
+  if (isRecentlyModified(subtreeMtime, nowMs())) {
+    return `session ${sid}: looks active (modified within the last 5 minutes)`;
+  }
+  if (resolveStagedDir(localPath, map, claudeHome(), repoHome()) === null) {
+    return `session ${sid}: not mapped to a staged copy`;
+  }
+  return null;
+}
 function applyRedact(f, ts, map, nowMs, scan = scanFile) {
   const refuse = (msg) => {
     log(msg);
@@ -3416,7 +3728,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join29(dirname6(localPath), sid);
+  const sessionDir = join31(dirname6(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -3450,26 +3762,26 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync6(stagedProjectDir, { recursive: true });
-  cpSync5(localPath, join29(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync24(sessionDir)) {
-    cpSync5(sessionDir, join29(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync5(localPath, join31(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync26(sessionDir)) {
+    cpSync5(sessionDir, join31(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
 
 // src/commands.push.recovery.drop.ts
 init_config();
-import { rmSync as rmSync8 } from "node:fs";
-import { join as join30 } from "node:path";
+import { rmSync as rmSync9 } from "node:fs";
+import { join as join32 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join30(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join30(repo, "shared", "projects", logical, sid);
-    rmSync8(jsonl, { force: true });
-    rmSync8(dir, { recursive: true, force: true });
+    const jsonl = join32(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join32(repo, "shared", "projects", logical, sid);
+    rmSync9(jsonl, { force: true });
+    rmSync9(dir, { recursive: true, force: true });
   }
   return true;
 }
@@ -3500,7 +3812,7 @@ function makeDefaultReadLine(repo) {
     try {
       const repoRoot = resolve3(repo);
       const target = resolve3(repoRoot, file);
-      if (isAbsolute(file) || target !== repoRoot && !target.startsWith(repoRoot + sep4)) {
+      if (isAbsolute(file) || target !== repoRoot && !target.startsWith(repoRoot + sep5)) {
         return null;
       }
       const content = readFileSync12(target, "utf8");
@@ -3567,6 +3879,22 @@ function dispatchActions(findings, actions, opts) {
   }
 }
 function redactAllFindings(findings, ts, map, nowMs, scan = scanFile) {
+  const refusals = [];
+  const preflighted = /* @__PURE__ */ new Set();
+  for (const f of findings) {
+    const dedupeKey = sessionIdFromFinding(f) ?? findingKey(f);
+    if (preflighted.has(dedupeKey)) continue;
+    preflighted.add(dedupeKey);
+    const reason = preflightRedactable(f, map, nowMs);
+    if (reason !== null) refusals.push(reason);
+  }
+  if (refusals.length > 0) {
+    throw new NomadFatal(
+      `--redact-all cannot redact every finding, so no changes were made:
+` + refusals.map((r) => `  - ${r}`).join("\n") + `
+  Re-run without --redact-all to triage these interactively (Drop session / Skip), or end any active session and retry.`
+    );
+  }
   const redactedSids = /* @__PURE__ */ new Set();
   for (const f of findings) {
     const sid = sessionIdFromFinding(f);
@@ -3608,7 +3936,7 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join31(repoHome2, ".gitleaksignore");
+  const ignPath = join33(repoHome2, ".gitleaksignore");
   let before;
   try {
     before = readFileSync13(ignPath, "utf8");
@@ -3619,14 +3947,14 @@ function allowThenRescan(append, scanVerdict, repoHome2) {
   try {
     return applyThenRescan(scanVerdict, repoHome2);
   } catch (err) {
-    if (before === null) rmSync9(ignPath, { force: true });
+    if (before === null) rmSync10(ignPath, { force: true });
     else writeFileSync5(ignPath, before, "utf8");
     throw err;
   }
 }
 function makeRealPrompt() {
   return async (prompt) => {
-    const rl = createInterface({
+    const rl = createInterface2({
       input: process.stdin,
       output: process.stdout,
       terminal: true
@@ -3707,7 +4035,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync25;
+  const check = deps.existsSyncFn ?? existsSync27;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -3773,9 +4101,9 @@ function withSpinner(label, fn, deps) {
 
 // src/commands.doctor.gitleaks-version.ts
 init_color();
-import { execFileSync as execFileSync8 } from "node:child_process";
-import { existsSync as existsSync26 } from "node:fs";
-import { join as join32 } from "node:path";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { existsSync as existsSync28 } from "node:fs";
+import { join as join34 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -3784,7 +4112,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join32(repoHome(), ".gitleaks.toml");
+  const tomlPath = join34(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -3796,7 +4124,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync8, tomlExists = existsSync26) {
+function reportGitleaksVersionCheck(section2, run = execFileSync9, tomlExists = existsSync28) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -3816,7 +4144,7 @@ function reportGitleaksVersionCheck(section2, run = execFileSync8, tomlExists =
 
 // src/commands.doctor.checks.deps.ts
 init_color();
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 var VERSION_TOKEN = /(\d{1,9}\.\d{1,9}\.\d{1,9})/;
 var PROBE_TIMEOUT_MS = 3e3;
 var FETCHER_BASE = "HTTP fetcher";
@@ -3853,7 +4181,7 @@ function reportFetcherRow(section2, run) {
     );
   }
 }
-function reportOptionalDeps(section2, run = execFileSync9) {
+function reportOptionalDeps(section2, run = execFileSync10) {
   const gh = probeOptionalDep("gh", run);
   if (gh.status === "present") {
     addItem(section2, `${green(okGlyph)} gh: ${gh.version ?? "present"}`);
@@ -3868,11 +4196,11 @@ function reportOptionalDeps(section2, run = execFileSync9) {
 
 // src/commands.doctor.actions-drift.ts
 init_color();
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 init_config();
 
 // src/gh-actions.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 var GH_TIMEOUT_MS = 5e3;
 function parseGitHubRemote(remoteUrl) {
   const normalized = remoteUrl.trim().replace(/\/$/, "");
@@ -3880,7 +4208,7 @@ function parseGitHubRemote(remoteUrl) {
   if (m === null) return null;
   return { owner: m[1], repo: m[2] };
 }
-function ghAuthStatus(run = execFileSync10) {
+function ghAuthStatus(run = execFileSync11) {
   try {
     run("gh", ["auth", "status"], {
       stdio: ["ignore", "ignore", "ignore"],
@@ -3894,7 +4222,7 @@ function ghAuthStatus(run = execFileSync10) {
     return "gh-probe-error";
   }
 }
-function isRepoPrivate(ref, run = execFileSync10) {
+function isRepoPrivate(ref, run = execFileSync11) {
   const out = run("gh", ["repo", "view", `${ref.owner}/${ref.repo}`, "--json", "isPrivate"], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: GH_TIMEOUT_MS
@@ -3902,7 +4230,7 @@ function isRepoPrivate(ref, run = execFileSync10) {
   const parsed = JSON.parse(out);
   return parsed.isPrivate === true;
 }
-function isActionsEnabled(ref, run = execFileSync10) {
+function isActionsEnabled(ref, run = execFileSync11) {
   const out = run(
     "gh",
     ["api", `repos/${ref.owner}/${ref.repo}/actions/permissions`, "--jq", ".enabled"],
@@ -3910,7 +4238,7 @@ function isActionsEnabled(ref, run = execFileSync10) {
   ).toString().trim();
   return out === "true";
 }
-function disableActions(ref, run = execFileSync10) {
+function disableActions(ref, run = execFileSync11) {
   run(
     "gh",
     [
@@ -3924,7 +4252,7 @@ function disableActions(ref, run = execFileSync10) {
     { stdio: ["ignore", "ignore", "pipe"], timeout: GH_TIMEOUT_MS }
   );
 }
-function readOriginRemote(cwd, run = execFileSync10) {
+function readOriginRemote(cwd, run = execFileSync11) {
   return run("git", ["remote", "get-url", "origin"], {
     cwd,
     stdio: ["ignore", "pipe", "ignore"]
@@ -3932,7 +4260,7 @@ function readOriginRemote(cwd, run = execFileSync10) {
 }
 
 // src/commands.doctor.actions-drift.ts
-function reportActionsDrift(section2, run = execFileSync11) {
+function reportActionsDrift(section2, run = execFileSync12) {
   let remote;
   try {
     remote = readOriginRemote(repoHome(), run);
@@ -3993,8 +4321,8 @@ function gatherDoctorSections(opts) {
   reportHostAndPaths(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join33(repoHome(), "path-map.json");
-  const rawMap = existsSync27(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join35(repoHome(), "path-map.json");
+  const rawMap = existsSync29(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   reportDroppedNamesMigration(links);
@@ -4061,15 +4389,15 @@ function cmdDoctor(opts = {}) {
 
 // src/commands.drop-session.ts
 init_config();
-import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync29, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
-import { join as join35, relative as relative4 } from "node:path";
+import { execFileSync as execFileSync14 } from "node:child_process";
+import { existsSync as existsSync31, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
+import { join as join37, relative as relative4 } from "node:path";
 
 // src/commands.drop-session.git.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync13 } from "node:child_process";
 function expandStagedDir(dirRel, repo) {
   try {
-    const out = execFileSync12("git", ["ls-files", "-z", "--", dirRel], {
+    const out = execFileSync13("git", ["ls-files", "-z", "--", dirRel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4080,7 +4408,7 @@ function expandStagedDir(dirRel, repo) {
 }
 function isTrackedInHead(rel, repo) {
   try {
-    execFileSync12("git", ["cat-file", "-e", `HEAD:${rel}`], {
+    execFileSync13("git", ["cat-file", "-e", `HEAD:${rel}`], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4091,7 +4419,7 @@ function isTrackedInHead(rel, repo) {
 }
 function isInIndex(rel, repo) {
   try {
-    const out = execFileSync12("git", ["ls-files", "--", rel], {
+    const out = execFileSync13("git", ["ls-files", "--", rel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4105,8 +4433,8 @@ function isInIndex(rel, repo) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync28 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+import { join as join36 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript2(id, matches);
@@ -4122,8 +4450,8 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript2(id, matches) {
   try {
-    const mapPath = join34(repoHome(), "path-map.json");
-    if (!existsSync28(mapPath)) return null;
+    const mapPath = join36(repoHome(), "path-map.json");
+    if (!existsSync30(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
@@ -4131,8 +4459,8 @@ function resolveLiveTranscript2(id, matches) {
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join34(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync28(live)) return live;
+      const live = join36(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync30(live)) return live;
     }
     return null;
   } catch {
@@ -4148,12 +4476,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync29(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync31(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join35(repo, "shared", "projects");
-    if (!existsSync29(repoProjects)) {
+    const repoProjects = join37(repo, "shared", "projects");
+    if (!existsSync31(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -4162,6 +4490,7 @@ function cmdDropSession(id) {
     }
     for (const rel of matches) unstageOne(rel, repo);
     reportScrubHint(id, matches);
+    warnIfSessionPushed(id, repo);
   } catch (err) {
     if (!(err instanceof NomadFatal)) {
       throw err;
@@ -4175,12 +4504,12 @@ function cmdDropSession(id) {
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
   for (const logical of readdirSync10(repoProjects)) {
-    const candidate = join35(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync29(candidate)) {
+    const candidate = join37(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync31(candidate)) {
       matches.push(relative4(repo, candidate));
     }
-    const dir = join35(repoProjects, logical, id);
-    if (existsSync29(dir) && statSync8(dir).isDirectory()) {
+    const dir = join37(repoProjects, logical, id);
+    if (existsSync31(dir) && statSync8(dir).isDirectory()) {
       const dirRel = relative4(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
@@ -4196,12 +4525,12 @@ function unstageOne(rel, repo) {
   }
   try {
     if (isTrackedInHead(rel, repo)) {
-      execFileSync13("git", ["restore", "--staged", "--worktree", "--", rel], {
+      execFileSync14("git", ["restore", "--staged", "--worktree", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
     } else {
-      execFileSync13("git", ["rm", "--cached", "-f", "--", rel], {
+      execFileSync14("git", ["rm", "--cached", "-f", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -4215,8 +4544,8 @@ function unstageOne(rel, repo) {
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync9 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync9 } from "node:fs";
+import { join as join44 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -4311,12 +4640,12 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync32 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync34 } from "node:fs";
+import { join as join41 } from "node:path";
 
 // src/extras-sync.diff.ts
 init_utils();
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 function labelDiffLine(line) {
   const tab = line.indexOf("	");
   if (tab === -1) return line;
@@ -4331,7 +4660,7 @@ function parseDiffOutput(stdout) {
 }
 function listDivergingFiles(a, b) {
   try {
-    const stdout = execFileSync14("git", ["diff", "--no-index", "--name-status", a, b], {
+    const stdout = execFileSync15("git", ["diff", "--no-index", "--name-status", a, b], {
       stdio: ["ignore", "pipe", "pipe"]
     }).toString();
     return parseDiffOutput(stdout);
@@ -4351,8 +4680,8 @@ function listDivergingFiles(a, b) {
 
 // src/extras-sync.core.ts
 init_config();
-import { cpSync as cpSync6, existsSync as existsSync30, lstatSync as lstatSync8, readdirSync as readdirSync11, rmSync as rmSync10 } from "node:fs";
-import { basename, join as join36 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync32, lstatSync as lstatSync9, readdirSync as readdirSync11, rmSync as rmSync11 } from "node:fs";
+import { basename, join as join38 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -4376,9 +4705,9 @@ init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
   const repo = repoHome();
-  const mapPath = join36(repo, "path-map.json");
-  const repoExtras = join36(repo, "shared", "extras");
-  if (!existsSync30(mapPath) || opts.requireRepoExtras === true && !existsSync30(repoExtras)) {
+  const mapPath = join38(repo, "path-map.json");
+  const repoExtras = join38(repo, "shared", "extras");
+  if (!existsSync32(mapPath) || opts.requireRepoExtras === true && !existsSync32(repoExtras)) {
     if (opts.missingMsg !== void 0) log(opts.missingMsg);
     return null;
   }
@@ -4428,14 +4757,14 @@ function copyExtrasOverlayFiltered(src, dst, blockSet) {
   }
 }
 function copyExtras(src, dst) {
-  rmSync10(dst, { recursive: true, force: true });
+  rmSync11(dst, { recursive: true, force: true });
   cpSync6(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
 }
 function extrasDenySet(dirname8) {
   return dirname8 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function copyExtrasFiltered(src, dst, blockSet) {
-  rmSync10(dst, { recursive: true, force: true });
+  rmSync11(dst, { recursive: true, force: true });
   cpSync6(src, dst, {
     recursive: true,
     force: true,
@@ -4446,25 +4775,25 @@ function copyExtrasFiltered(src, dst, blockSet) {
 function prunePreservingDenied(src, dst, blockSet) {
   for (const name of readdirSync11(dst)) {
     if (blockSet.has(name)) continue;
-    const dstPath = join36(dst, name);
-    const srcStat = lstatSync8(join36(src, name), { throwIfNoEntry: false });
+    const dstPath = join38(dst, name);
+    const srcStat = lstatSync9(join38(src, name), { throwIfNoEntry: false });
     if (srcStat === void 0) {
-      rmSync10(dstPath, { recursive: true, force: true });
+      rmSync11(dstPath, { recursive: true, force: true });
       continue;
     }
-    const dstStat = lstatSync8(dstPath);
+    const dstStat = lstatSync9(dstPath);
     if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingDenied(join36(src, name), dstPath, blockSet);
+      prunePreservingDenied(join38(src, name), dstPath, blockSet);
     } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync10(dstPath, { recursive: true, force: true });
+      rmSync11(dstPath, { recursive: true, force: true });
     }
   }
 }
 function copyExtrasFilteredPreserving(src, dst, blockSet) {
-  const dstStat = lstatSync8(dst, { throwIfNoEntry: false });
+  const dstStat = lstatSync9(dst, { throwIfNoEntry: false });
   if (dstStat !== void 0) {
     if (dstStat.isDirectory()) prunePreservingDenied(src, dst, blockSet);
-    else rmSync10(dst, { recursive: true, force: true });
+    else rmSync11(dst, { recursive: true, force: true });
   }
   cpSync6(src, dst, {
     recursive: true,
@@ -4476,25 +4805,25 @@ function copyExtrasFilteredPreserving(src, dst, blockSet) {
 function prunePreservingBy(src, dst, isPreserved) {
   for (const name of readdirSync11(dst)) {
     if (isPreserved(name)) continue;
-    const dstPath = join36(dst, name);
-    const srcStat = lstatSync8(join36(src, name), { throwIfNoEntry: false });
+    const dstPath = join38(dst, name);
+    const srcStat = lstatSync9(join38(src, name), { throwIfNoEntry: false });
     if (srcStat === void 0) {
-      rmSync10(dstPath, { recursive: true, force: true });
+      rmSync11(dstPath, { recursive: true, force: true });
       continue;
     }
-    const dstStat = lstatSync8(dstPath);
+    const dstStat = lstatSync9(dstPath);
     if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingBy(join36(src, name), dstPath, isPreserved);
+      prunePreservingBy(join38(src, name), dstPath, isPreserved);
     } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync10(dstPath, { recursive: true, force: true });
+      rmSync11(dstPath, { recursive: true, force: true });
     }
   }
 }
 function copyExtrasFilteredPreservingBy(src, dst, isPreserved) {
-  const dstStat = lstatSync8(dst, { throwIfNoEntry: false });
+  const dstStat = lstatSync9(dst, { throwIfNoEntry: false });
   if (dstStat !== void 0) {
     if (dstStat.isDirectory()) prunePreservingBy(src, dst, isPreserved);
-    else rmSync10(dst, { recursive: true, force: true });
+    else rmSync11(dst, { recursive: true, force: true });
   }
   cpSync6(src, dst, {
     recursive: true,
@@ -4510,11 +4839,11 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync31, mkdirSync as mkdirSync7, readdirSync as readdirSync12, realpathSync as realpathSync4, rmSync as rmSync11 } from "node:fs";
-import { dirname as dirname7, join as join38, sep as sep6 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync7, readdirSync as readdirSync12, realpathSync as realpathSync4, rmSync as rmSync12 } from "node:fs";
+import { dirname as dirname7, join as join40, sep as sep7 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
-import { join as join37, normalize as normalize2, sep as sep5 } from "node:path";
+import { join as join39, normalize as normalize2, sep as sep6 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -4566,15 +4895,15 @@ function planningDeleteTargets(opts) {
   const { deleted } = parsePlanningDiff(raw);
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
-  const planningRoot = join37(localRoot, ".planning");
-  const planningRootBoundary = planningRoot + sep5;
+  const planningRoot = join39(localRoot, ".planning");
+  const planningRootBoundary = planningRoot + sep6;
   const targets = [];
   for (const repoPath of deleted) {
     if (!repoPath.startsWith(prefix)) {
       continue;
     }
     const remainder = repoPath.slice(logicalPrefix.length);
-    const candidate = join37(localRoot, remainder);
+    const candidate = join39(localRoot, remainder);
     const resolved = normalize2(candidate);
     if (!resolved.startsWith(planningRootBoundary)) {
       throw new NomadFatal(
@@ -4595,7 +4924,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync31(src)) continue;
+    if (!existsSync33(src)) continue;
     const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item2);
@@ -4609,10 +4938,10 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
 }
 function pruneEmptyAncestors(target, planningRoot) {
   let dir = dirname7(target);
-  while (dir !== planningRoot && dir.startsWith(planningRoot + sep6)) {
+  while (dir !== planningRoot && dir.startsWith(planningRoot + sep7)) {
     try {
       if (readdirSync12(dir).length > 0) break;
-      rmSync11(dir, { recursive: true, force: true });
+      rmSync12(dir, { recursive: true, force: true });
     } catch {
       break;
     }
@@ -4627,20 +4956,20 @@ function tryRealpath(dir) {
   }
 }
 function isInsidePlanningRoot(parentReal, rootReal) {
-  return parentReal === rootReal || parentReal.startsWith(rootReal + sep6);
+  return parentReal === rootReal || parentReal.startsWith(rootReal + sep7);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
-  if (existsSync31(repoCounterpart)) return;
+  if (existsSync33(repoCounterpart)) return;
   const parentReal = tryRealpath(dirname7(target));
   if (parentReal === void 0) return;
   const rootReal = tryRealpath(planningRoot);
   if (rootReal === void 0) return;
   if (!isInsidePlanningRoot(parentReal, rootReal)) return;
-  rmSync11(target, { recursive: true, force: true });
+  rmSync12(target, { recursive: true, force: true });
   pruneEmptyAncestors(target, planningRoot);
 }
 function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
-  const repoExtras = join38(repo, "shared", "extras");
+  const repoExtras = join40(repo, "shared", "extras");
   for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
     if (t.dirname !== ".planning") continue;
     let raw;
@@ -4666,11 +4995,11 @@ function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
     }
     const targets = planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot });
     if (targets.length === 0) continue;
-    backupExtrasWrite(join38(t.localRoot, t.dirname), ts, t.localRoot);
-    const planningRoot = join38(t.localRoot, ".planning");
+    backupExtrasWrite(join40(t.localRoot, t.dirname), ts, t.localRoot);
+    const planningRoot = join40(t.localRoot, ".planning");
     for (const target of targets) {
-      const relToLocal = target.slice(t.localRoot.length + sep6.length);
-      deletePlanningTarget(target, planningRoot, join38(repoExtras, t.logical, relToLocal));
+      const relToLocal = target.slice(t.localRoot.length + sep7.length);
+      deletePlanningTarget(target, planningRoot, join40(repoExtras, t.logical, relToLocal));
     }
   }
 }
@@ -4679,14 +5008,14 @@ function remapExtrasPush(ts, opts = {}) {
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
   const repo = repoHome();
-  const repoExtras = join38(repo, "shared", "extras");
+  const repoExtras = join40(repo, "shared", "extras");
   if (!dryRun) mkdirSync7(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname8 }) => ({
-      src: join38(localRoot, dirname8),
-      dst: join38(repoExtras, logical, dirname8)
+      src: join40(localRoot, dirname8),
+      dst: join40(repoExtras, logical, dirname8)
     }),
     (dst) => backupRepoWrite(dst, ts, repo),
     // Push copy routing per extra type:
@@ -4715,8 +5044,8 @@ function remapExtrasPull(ts, opts = {}) {
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname8 }) => ({
-      src: join38(repo, "shared", "extras", logical, dirname8),
-      dst: join38(localRoot, dirname8)
+      src: join40(repo, "shared", "extras", logical, dirname8),
+      dst: join40(localRoot, dirname8)
     }),
     // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -4740,129 +5069,34 @@ function remapExtrasPull(ts, opts = {}) {
   if (!dryRun && prePostHeads !== void 0) {
     propagatePlanningDeletes(v, ts, prePostHeads, repo);
   }
-  return { unmapped, skipped, pulled: done, wouldPull: would };
-}
-
-// src/extras-sync.ts
-function divergenceCheckExtras(ts) {
-  const v = loadValidatedExtras({});
-  if (v === null) return;
-  const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join39(backupBase(), ts, "extras");
-  const repo = repoHome();
-  for (const { logical, localRoot, dirname: dirname8 } of eachExtrasTarget(v, counts)) {
-    const local = join39(localRoot, dirname8);
-    const repoEntry = join39(repo, "shared", "extras", logical, dirname8);
-    if (!existsSync32(local) || !existsSync32(repoEntry)) continue;
-    const diff = listDivergingFiles(local, repoEntry);
-    if (diff.length === 0) continue;
-    const projectBackupRoot = join39(backupRoot, encodePath(localRoot));
-    warn(
-      `local ${dirname8} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will merge changes (.planning overlays, .claude/.CLAUDE.md mirror; backups at ${projectBackupRoot}/)`
-    );
-    for (const f of diff) warn(`  ${f}`);
-  }
-}
-
-// src/links.ts
-init_config();
-init_utils();
-init_utils_fs();
-init_utils_json();
-import { existsSync as existsSync33, lstatSync as lstatSync9, rmSync as rmSync12 } from "node:fs";
-import { join as join40 } from "node:path";
-function emitAutoMove(onPreview, linkPath, ts, name) {
-  if (onPreview) {
-    onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
-  } else {
-    log(`would auto-move non-symlink: ${linkPath} -> backup/${ts}/${name}`);
-  }
-}
-function emitCreate(onPreview, from, to) {
-  if (onPreview) {
-    onPreview({ kind: "create", from, to });
-  } else {
-    log(`would create symlink: ${from} -> ${to}`);
-  }
-}
-function isAlreadySymlink(linkPath) {
-  return existsSync33(linkPath) && lstatSync9(linkPath).isSymbolicLink();
-}
-function runAutoMovePasses(linkNames, claude, repo, ts, dryRun, onPreview) {
-  for (const name of linkNames) {
-    const linkPath = join40(claude, name);
-    const target = join40(repo, "shared", name);
-    if (!existsSync33(linkPath)) continue;
-    if (lstatSync9(linkPath).isSymbolicLink()) continue;
-    if (!existsSync33(target)) continue;
-    if (dryRun) {
-      emitAutoMove(onPreview, linkPath, ts, name);
-      continue;
-    }
-    backupBeforeWrite(linkPath, ts);
-    rmSync12(linkPath, { recursive: true, force: true });
-  }
-}
-function applySharedLinks(ts, map, opts = {}) {
-  const dryRun = opts.dryRun === true;
-  const claude = claudeHome();
-  const repo = repoHome();
-  const linkNames = allSharedLinks(map);
-  runAutoMovePasses(linkNames, claude, repo, ts, dryRun, opts.onPreview);
-  for (const name of linkNames) {
-    const target = join40(repo, "shared", name);
-    if (!existsSync33(target)) continue;
-    const linkPath = join40(claude, name);
-    if (isAlreadySymlink(linkPath)) continue;
-    if (dryRun) {
-      emitCreate(opts.onPreview, linkPath, target);
-      continue;
-    }
-    ensureSymlink(linkPath, target);
-  }
+  return { unmapped, skipped, pulled: done, wouldPull: would };
 }
-function regenerateSettings(ts, opts = {}) {
-  const dryRun = opts.dryRun === true;
+
+// src/extras-sync.ts
+function divergenceCheckExtras(ts) {
+  const v = loadValidatedExtras({});
+  if (v === null) return;
+  const counts = { unmapped: 0, skipped: 0 };
+  const backupRoot = join41(backupBase(), ts, "extras");
   const repo = repoHome();
-  const claude = claudeHome();
-  const basePath = join40(repo, "shared", "settings.base.json");
-  const hostPath = join40(repo, "hosts", `${HOST}.json`);
-  if (!existsSync33(basePath)) {
-    die("repo not initialized; run 'nomad init' to scaffold");
-  }
-  const base = readJson(basePath);
-  const hasOverrides = existsSync33(hostPath);
-  const overrides = hasOverrides ? readJson(hostPath) : {};
-  const merged = deepMerge(base, overrides);
-  const settingsPath = join40(claude, "settings.json");
-  if (!hasOverrides && existsSync33(settingsPath)) {
-    try {
-      const existing = readJson(settingsPath);
-      const baseKeys = new Set(Object.keys(base));
-      const drift = Object.keys(existing).filter((k) => !baseKeys.has(k));
-      if (drift.length > 0) {
-        warn(
-          `no hosts/${HOST}.json found; existing settings has unbased keys ${JSON.stringify(drift)}. Set NOMAD_HOST to match a hosts/*.json or rerun 'nomad doctor' for candidates.`
-        );
-      }
-    } catch {
-      warn("existing settings.json is malformed; skipping drift-check and regenerating.");
-    }
-  }
-  const overrideLabel = hasOverrides ? `${HOST}.json` : "no host overrides";
-  if (dryRun) {
-    log(`would write settings.json (base + ${overrideLabel})`);
-    return { label: overrideLabel };
+  for (const { logical, localRoot, dirname: dirname8 } of eachExtrasTarget(v, counts)) {
+    const local = join41(localRoot, dirname8);
+    const repoEntry = join41(repo, "shared", "extras", logical, dirname8);
+    if (!existsSync34(local) || !existsSync34(repoEntry)) continue;
+    const diff = listDivergingFiles(local, repoEntry);
+    if (diff.length === 0) continue;
+    const projectBackupRoot = join41(backupRoot, encodePath(localRoot));
+    warn(
+      `local ${dirname8} for ${logical} diverges from origin in ${diff.length} file(s); next remapExtrasPull will merge changes (.planning overlays, .claude/.CLAUDE.md mirror; backups at ${projectBackupRoot}/)`
+    );
+    for (const f of diff) warn(`  ${f}`);
   }
-  backupBeforeWrite(settingsPath, ts);
-  writeJsonAtomic(settingsPath, merged);
-  return { label: overrideLabel };
 }
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync34, lstatSync as lstatSync10, mkdirSync as mkdirSync8, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync35, lstatSync as lstatSync10, mkdirSync as mkdirSync8, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
+import { join as join42 } from "node:path";
 init_utils_fs();
 function isGsdOwned(name) {
   return name.startsWith(GSD_PREFIX);
@@ -4882,9 +5116,9 @@ function copySkillsPull(src, dst) {
   copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded);
 }
 function syncSkillsPull(ts) {
-  const sharedSkills = join41(repoHome(), "shared", "skills");
-  if (!existsSync34(sharedSkills)) return;
-  const localSkills = join41(claudeHome(), "skills");
+  const sharedSkills = join42(repoHome(), "shared", "skills");
+  if (!existsSync35(sharedSkills)) return;
+  const localSkills = join42(claudeHome(), "skills");
   const dstStat = lstatSync10(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     backupBeforeWrite(localSkills, ts);
@@ -4894,18 +5128,18 @@ function syncSkillsPull(ts) {
   copySkillsPull(sharedSkills, localSkills);
 }
 function syncSkillsPush() {
-  const localSkills = join41(claudeHome(), "skills");
+  const localSkills = join42(claudeHome(), "skills");
   const stat = lstatSync10(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
-  const sharedSkills = join41(repoHome(), "shared", "skills");
+  const sharedSkills = join42(repoHome(), "shared", "skills");
   copySkillsPush(localSkills, sharedSkills);
 }
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync35 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync36 } from "node:fs";
+import { join as join43 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -5191,7 +5425,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync35(path)) return null;
+  if (!existsSync36(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -5205,12 +5439,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync35(hostPath)) {
+  if (hostOverrides === null && existsSync36(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = deepMerge(base, hostOverrides ?? {});
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync35(settingsPath)) {
+  if (current === null && existsSync36(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const rawEqual = JSON.stringify(current ?? {}, null, 2) === JSON.stringify(merged, null, 2);
@@ -5250,9 +5484,9 @@ function computePreview(ts, map, verb = "pull") {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join42(repo, "shared", "settings.base.json"),
-    join42(repo, "hosts", `${HOST}.json`),
-    join42(claude, "settings.json")
+    join43(repo, "shared", "settings.base.json"),
+    join43(repo, "hosts", `${HOST}.json`),
+    join43(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -5274,9 +5508,9 @@ init_config();
 init_commands_pull_wedge();
 init_utils();
 init_utils_fs();
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 function gitCapture(args, cwd) {
-  return execFileSync15("git", args, {
+  return execFileSync16("git", args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     maxBuffer: 64 * 1024 * 1024
@@ -5453,8 +5687,8 @@ function cmdPull(opts = {}) {
   const forceRemote = opts.forceRemote === true;
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync36(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync36(join43(repo, "shared", "settings.base.json"))) {
+  if (!existsSync37(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync37(join44(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -5463,7 +5697,7 @@ function cmdPull(opts = {}) {
     const ts = freshBackupTs(backup);
     handleWedge(repo, forceRemote);
     if (!dryRun) {
-      const backupRoot = join43(backup, ts);
+      const backupRoot = join44(backup, ts);
       try {
         mkdirSync9(backupRoot, { recursive: true });
       } catch (err) {
@@ -5476,8 +5710,8 @@ function cmdPull(opts = {}) {
     const prePostHeads = capturePrePostHeads(repo, () => {
       gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
     });
-    const mapPath = join43(repo, "path-map.json");
-    const map = existsSync36(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join44(repo, "path-map.json");
+    const map = existsSync37(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     if (dryRun) {
       computePreview(ts, map, "pull");
@@ -5499,8 +5733,8 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync38 } from "node:fs";
-import { join as join45, relative as relative5 } from "node:path";
+import { existsSync as existsSync39 } from "node:fs";
+import { join as join46, relative as relative5 } from "node:path";
 
 // src/commands.push.allowlist.ts
 init_config();
@@ -5593,7 +5827,7 @@ function enforceAllowList(statusPorcelain, map) {
 
 // src/push-global-config.ts
 init_config();
-import { execFileSync as execFileSync16 } from "node:child_process";
+import { execFileSync as execFileSync17 } from "node:child_process";
 var STATUS_LABELS = {
   A: "add",
   M: "modify",
@@ -5633,7 +5867,7 @@ function isInScope(filePath, exactPrefixes, dirPrefixes) {
 }
 function collectGlobalConfigChanges(repoHome2, hostname2, opts) {
   const args = opts.staged ? ["diff", "--cached", "--name-status", "-z"] : ["diff", "HEAD", "--name-status", "-z"];
-  const raw = execFileSync16("git", args, {
+  const raw = execFileSync17("git", args, {
     cwd: repoHome2,
     stdio: ["ignore", "pipe", "pipe"]
   }).toString();
@@ -5672,9 +5906,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync37, mkdirSync as mkdirSync10, readdirSync as readdirSync14, rmSync as rmSync14 } from "node:fs";
+import { copyFileSync, existsSync as existsSync38, mkdirSync as mkdirSync10, readdirSync as readdirSync14, rmSync as rmSync14 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -5689,13 +5923,13 @@ function stageSessions(tmpRoot, map) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join44(claudeHome(), "projects");
-  if (!existsSync37(localProjects)) return 0;
+  const localProjects = join45(claudeHome(), "projects");
+  if (!existsSync38(localProjects)) return 0;
   let staged = 0;
   for (const dir of readdirSync14(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join44(localProjects, dir), join44(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join45(localProjects, dir), join45(tmpRoot, "shared", "projects", logical));
     staged++;
   }
   return staged;
@@ -5711,9 +5945,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname8 of dirnames) {
       if (!whitelist.includes(dirname8)) continue;
-      const src = join44(localRoot, dirname8);
-      if (!existsSync37(src)) continue;
-      const dst = join44(tmpRoot, "shared", "extras", logical, dirname8);
+      const src = join45(localRoot, dirname8);
+      if (!existsSync38(src)) continue;
+      const dst = join45(tmpRoot, "shared", "extras", logical, dirname8);
       copyExtras(src, dst);
       staged++;
     }
@@ -5721,19 +5955,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map) {
-  const cacheDir = join44(homedir5(), ".cache", "claude-nomad");
+  const cacheDir = join45(homedir5(), ".cache", "claude-nomad");
   mkdirSync10(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join44(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join45(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join44(repoHome(), ".gitleaksignore");
-    if (existsSync37(ignoreFile)) {
-      copyFileSync(ignoreFile, join44(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join45(repoHome(), ".gitleaksignore");
+    if (existsSync38(ignoreFile)) {
+      copyFileSync(ignoreFile, join45(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -5754,8 +5988,29 @@ function previewPushLeaks(map) {
 init_utils();
 init_utils_fs();
 init_utils_json();
+function reportSettingsAheadDrift(repo) {
+  const basePath = join46(repo, "shared", "settings.base.json");
+  if (!existsSync39(basePath)) return;
+  const settingsPath = join46(claudeHome(), "settings.json");
+  if (!existsSync39(settingsPath)) return;
+  try {
+    const base = readJson(basePath);
+    const hostPath = join46(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync39(hostPath) ? readJson(hostPath) : {};
+    const merged = deepMerge(base, overrides);
+    const settings = readJson(settingsPath);
+    const { ahead } = classifySettingsDrift(merged, settings);
+    const { promotable } = partitionByCaptureExclusion(ahead);
+    if (promotable.length === 0) return;
+    const keys = JSON.stringify(promotable);
+    warn(
+      `settings.json has local-only keys ${keys} not in the repo. Run 'nomad capture-settings' to promote them (or 'nomad capture-settings --host' for host-specific values).`
+    );
+  } catch {
+  }
+}
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join45(repo, "shared"));
+  const gitlinks = findGitlinks(join46(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative5(repo, p);
@@ -5821,11 +6076,12 @@ async function cmdPush(opts = {}) {
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync38(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync39(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
     console.log(dryRun ? `push on host=${HOST} (dry-run)` : `push on host=${HOST}`);
+    reportSettingsAheadDrift(repo);
     probeGitleaks();
     withSpinner("Rebasing onto origin", () => rebaseBeforePush(repo));
     const ts = freshBackupTs(backup);
@@ -5840,8 +6096,8 @@ async function cmdPush(opts = {}) {
       renderNoScanTree(st);
       return;
     }
-    const mapPath = join45(repo, "path-map.json");
-    if (!existsSync38(mapPath)) {
+    const mapPath = join46(repo, "path-map.json");
+    if (!existsSync39(mapPath)) {
       if (dryRun) return runDryRunPreview(st, null, repo);
       die("path-map.json missing, cannot enforce push allow-list");
     }
@@ -5862,16 +6118,16 @@ async function cmdPush(opts = {}) {
 }
 
 // src/commands.update.ts
-import { execFileSync as execFileSync17 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 init_utils();
-function readInstalledVersion(run = execFileSync17) {
+function readInstalledVersion(run = execFileSync18) {
   try {
     return run("nomad", ["--version"], { encoding: "utf8" }).toString().trim() || null;
   } catch {
     return null;
   }
 }
-function cmdUpdate(run = execFileSync17) {
+function cmdUpdate(run = execFileSync18) {
   console.log("Updating claude-nomad CLI via npm...");
   try {
     run("npm", ["update", "-g", "claude-nomad"], { stdio: "inherit" });
@@ -5895,18 +6151,18 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync39 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync40 } from "node:fs";
+import { join as join47 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync39(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync40(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join46(repo, "path-map.json");
-    const map = existsSync39(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join47(repo, "path-map.json");
+    const map = existsSync40(mapPath) ? readPathMap(mapPath) : { projects: {} };
     computePreview(ts, map, "diff");
   } catch (err) {
     if (err instanceof NomadFatal) {
@@ -5920,19 +6176,19 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync41, mkdirSync as mkdirSync11, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join48 } from "node:path";
+import { existsSync as existsSync42, mkdirSync as mkdirSync11, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join49 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 init_utils();
 var DEFAULT_REPO_NAME = "claude-nomad-config";
 function isValidRepoName(name) {
   return /^[A-Za-z0-9._-]{1,100}$/.test(name);
 }
 var GH_NETWORK_TIMEOUT_MS = 3e4;
-function ensureOriginRepo(repoName, run = execFileSync18) {
+function ensureOriginRepo(repoName, run = execFileSync19) {
   if (!isValidRepoName(repoName)) {
     die(
       `invalid repo name: ${JSON.stringify(repoName)}. Use only letters, digits, hyphens, underscores, and dots (1-100 chars).`
@@ -6003,33 +6259,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync40, rmSync as rmSync15, statSync as statSync9 } from "node:fs";
-import { join as join47 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync41, rmSync as rmSync15, statSync as statSync9 } from "node:fs";
+import { join as join48 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join47(claude, name);
-    if (!existsSync40(src)) continue;
-    const dst = join47(repo, "shared", name);
+    const src = join48(claude, name);
+    if (!existsSync41(src)) continue;
+    const dst = join48(repo, "shared", name);
     if (statSync9(src).isDirectory()) {
-      const gk = join47(dst, ".gitkeep");
-      if (existsSync40(gk)) rmSync15(gk);
+      const gk = join48(dst, ".gitkeep");
+      if (existsSync41(gk)) rmSync15(gk);
       cpSync7(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join47(claude, "settings.json");
-  if (existsSync40(userSettings)) {
+  const userSettings = join48(claude, "settings.json");
+  if (existsSync41(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join47(repo, "hosts", `${HOST}.json`);
+    const hostFile = join48(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -6042,14 +6298,14 @@ var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.cl
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join48(repoHome2, "shared", "settings.base.json"),
-    join48(repoHome2, "shared", "CLAUDE.md"),
-    join48(repoHome2, "path-map.json"),
-    join48(repoHome2, "hosts"),
-    join48(repoHome2, "shared")
+    join49(repoHome2, "shared", "settings.base.json"),
+    join49(repoHome2, "shared", "CLAUDE.md"),
+    join49(repoHome2, "path-map.json"),
+    join49(repoHome2, "hosts"),
+    join49(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync41(c)) return c;
+    if (existsSync42(c)) return c;
   }
   return null;
 }
@@ -6064,25 +6320,25 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync11(join48(repo, "shared"), { recursive: true });
-  mkdirSync11(join48(repo, "hosts"), { recursive: true });
+  mkdirSync11(join49(repo, "shared"), { recursive: true });
+  mkdirSync11(join49(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync11(join48(repo, "shared", name), { recursive: true });
+    mkdirSync11(join49(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join48(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync41(userClaudeMd)) {
-    writeFileSync6(join48(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join49(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync42(userClaudeMd)) {
+    writeFileSync6(join49(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join48(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join49(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync6(join48(repo, "hosts", ".gitkeep"), "");
+  writeFileSync6(join49(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join48(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join49(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join48(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join49(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -6145,86 +6401,20 @@ function maybeDisableRepoActions(repoHome2, run) {
   }
 }
 
-// src/nomad.dispatch.ts
+// src/nomad.dispatch.helpers.ts
+var REJECT = { ok: false, advance: 0 };
+function applyBool(seen, set) {
+  if (seen) return REJECT;
+  set();
+  return { ok: true, advance: 1 };
+}
 function extractFlagValue(argv, i) {
   const val = argv[i + 1];
   if (val === void 0 || val.startsWith("--")) return null;
   return val;
 }
-function applyInitToken(argv, i, st) {
-  const token = argv[i];
-  if (token === "--snapshot") {
-    if (st.sawSnapshot) return { ok: false, advance: 0 };
-    st.sawSnapshot = true;
-    st.snapshot = true;
-    return { ok: true, advance: 1 };
-  }
-  if (token === "--keep-actions") {
-    if (st.sawKeepActions) return { ok: false, advance: 0 };
-    st.sawKeepActions = true;
-    st.keepActions = true;
-    return { ok: true, advance: 1 };
-  }
-  if (token === "--repo") {
-    if (st.sawRepo) return { ok: false, advance: 0 };
-    st.sawRepo = true;
-    const val = extractFlagValue(argv, i);
-    if (val === null) return { ok: false, advance: 0 };
-    st.repoName = val;
-    return { ok: true, advance: 2 };
-  }
-  return { ok: false, advance: 0 };
-}
-function parseInitArgs(argv) {
-  const st = {
-    snapshot: false,
-    keepActions: false,
-    repoName: void 0,
-    sawSnapshot: false,
-    sawKeepActions: false,
-    sawRepo: false
-  };
-  let i = 3;
-  while (i < argv.length) {
-    const { ok: ok2, advance } = applyInitToken(argv, i, st);
-    if (!ok2) return null;
-    i += advance;
-  }
-  return { snapshot: st.snapshot, keepActions: st.keepActions, repoName: st.repoName };
-}
-function parseRedactArgs(argv) {
-  const id = argv[3];
-  if (typeof id !== "string" || !/^\w[\w-]{0,127}$/.test(id)) {
-    return null;
-  }
-  let rule;
-  let dryRun = false;
-  let sawRule = false;
-  let sawDryRun = false;
-  let i = 4;
-  while (i < argv.length) {
-    const token = argv[i];
-    if (token === "--dry-run") {
-      if (sawDryRun) return null;
-      sawDryRun = true;
-      dryRun = true;
-      i++;
-    } else if (token === "--rule") {
-      if (sawRule) return null;
-      sawRule = true;
-      const val = argv[i + 1];
-      if (val === void 0 || val.startsWith("--")) return null;
-      rule = val;
-      i += 2;
-    } else {
-      return null;
-    }
-  }
-  return { id, rule, dryRun };
-}
 
 // src/nomad.dispatch.clean.ts
-var REJECT = { ok: false, advance: 0 };
 function applyOlderThan(argv, i, st) {
   if (st.olderThan !== void 0) return REJECT;
   const val = extractFlagValue(argv, i);
@@ -6239,11 +6429,6 @@ function applyKeep(argv, i, st) {
   st.keep = Number(val);
   return { ok: true, advance: 2 };
 }
-function applyBool(seen, set) {
-  if (seen) return REJECT;
-  set();
-  return { ok: true, advance: 1 };
-}
 function applyCleanToken(argv, i, st) {
   switch (argv[i]) {
     case "--backups":
@@ -6276,6 +6461,31 @@ function parseCleanArgs(argv) {
   return { dryRun: st.dryRun, olderThan: st.olderThan, keep: st.keep };
 }
 
+// src/nomad.dispatch.capture-settings.ts
+function parseCaptureSettingsArgs(argv) {
+  let host = false;
+  let dryRun = false;
+  let yes = false;
+  let i = 3;
+  while (i < argv.length) {
+    const token = argv[i];
+    if (token === "--host") {
+      if (host) return null;
+      host = true;
+    } else if (token === "--dry-run") {
+      if (dryRun) return null;
+      dryRun = true;
+    } else if (token === "--yes" || token === "-y") {
+      if (yes) return null;
+      yes = true;
+    } else {
+      return null;
+    }
+    i++;
+  }
+  return { host, dryRun, yes };
+}
+
 // src/nomad.dispatch.eject.ts
 function parseEjectArgs(argv) {
   let dryRun = false;
@@ -6293,6 +6503,79 @@ function parseEjectArgs(argv) {
   return { dryRun };
 }
 
+// src/nomad.dispatch.ts
+function applyInitToken(argv, i, st) {
+  const token = argv[i];
+  if (token === "--snapshot") {
+    if (st.sawSnapshot) return REJECT;
+    st.sawSnapshot = true;
+    st.snapshot = true;
+    return { ok: true, advance: 1 };
+  }
+  if (token === "--keep-actions") {
+    if (st.sawKeepActions) return REJECT;
+    st.sawKeepActions = true;
+    st.keepActions = true;
+    return { ok: true, advance: 1 };
+  }
+  if (token === "--repo") {
+    if (st.sawRepo) return REJECT;
+    st.sawRepo = true;
+    const val = extractFlagValue(argv, i);
+    if (val === null) return REJECT;
+    st.repoName = val;
+    return { ok: true, advance: 2 };
+  }
+  return REJECT;
+}
+function parseInitArgs(argv) {
+  const st = {
+    snapshot: false,
+    keepActions: false,
+    repoName: void 0,
+    sawSnapshot: false,
+    sawKeepActions: false,
+    sawRepo: false
+  };
+  let i = 3;
+  while (i < argv.length) {
+    const { ok: ok2, advance } = applyInitToken(argv, i, st);
+    if (!ok2) return null;
+    i += advance;
+  }
+  return { snapshot: st.snapshot, keepActions: st.keepActions, repoName: st.repoName };
+}
+function parseRedactArgs(argv) {
+  const id = argv[3];
+  if (typeof id !== "string" || !/^\w[\w-]{0,127}$/.test(id)) {
+    return null;
+  }
+  let rule;
+  let dryRun = false;
+  let sawRule = false;
+  let sawDryRun = false;
+  let i = 4;
+  while (i < argv.length) {
+    const token = argv[i];
+    if (token === "--dry-run") {
+      if (sawDryRun) return null;
+      sawDryRun = true;
+      dryRun = true;
+      i++;
+    } else if (token === "--rule") {
+      if (sawRule) return null;
+      sawRule = true;
+      const val = extractFlagValue(argv, i);
+      if (val === null) return null;
+      rule = val;
+      i += 2;
+    } else {
+      return null;
+    }
+  }
+  return { id, rule, dryRun };
+}
+
 // src/nomad.dispatch.allow.ts
 function parseAllowArgs(argv) {
   const positionals = argv.slice(3);
@@ -6326,32 +6609,26 @@ function parsePullArgs(argv) {
 }
 
 // src/nomad.dispatch.push.ts
-var REJECT2 = { ok: false, advance: 0 };
-function applyBool2(seen, set) {
-  if (seen) return REJECT2;
-  set();
-  return { ok: true, advance: 1 };
-}
 var RULE_ID_RE = /^\w[\w-]*$/;
 function applyAllow2(argv, i, st) {
-  if (st.allowRule !== void 0) return REJECT2;
+  if (st.allowRule !== void 0) return REJECT;
   const val = extractFlagValue(argv, i);
-  if (val === null || !RULE_ID_RE.test(val)) return REJECT2;
+  if (val === null || !RULE_ID_RE.test(val)) return REJECT;
   st.allowRule = val;
   return { ok: true, advance: 2 };
 }
 function applyPushToken(argv, i, st) {
   switch (argv[i]) {
     case "--dry-run":
-      return applyBool2(st.dryRun, () => st.dryRun = true);
+      return applyBool(st.dryRun, () => st.dryRun = true);
     case "--redact-all":
-      return applyBool2(st.redactAll, () => st.redactAll = true);
+      return applyBool(st.redactAll, () => st.redactAll = true);
     case "--allow-all":
-      return applyBool2(st.allowAll, () => st.allowAll = true);
+      return applyBool(st.allowAll, () => st.allowAll = true);
     case "--allow":
       return applyAllow2(argv, i, st);
     default:
-      return REJECT2;
+      return REJECT;
   }
 }
 function parsePushArgs(argv) {
@@ -6383,7 +6660,7 @@ function parsePushArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.50.2",
+  version: "0.51.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -6548,6 +6825,21 @@ var DEFAULT_HELP = [
   cont("manual-remainder checklist (uninstall CLI, drop env vars, optional deletes)."),
   row("       --dry-run", "List what would be materialized without writing anything."),
   "",
+  row(
+    "  capture-settings",
+    "Promote local-only settings.json keys into the shared repo so they survive"
+  ),
+  cont("the next pull. Backs up the destination, writes atomically, then regenerates"),
+  cont("settings.json so local matches. Idempotent when no local-only keys remain."),
+  cont("Prompts for confirmation before writing (shows the destination and keys)."),
+  row("       --host", "Write into hosts/<HOST>.json (host-specific values) instead of"),
+  cont("shared/settings.base.json (default; normalizes absolute node launcher paths)."),
+  row(
+    "       --dry-run",
+    "Show the destination and keys that would be written without changing anything."
+  ),
+  row("       --yes, -y", "Skip the confirmation prompt (required in a non-interactive shell)."),
+  "",
   row(
     "  redact <session-id>",
     "Rewrite the secret span in the local source transcript for a session,"
@@ -6584,15 +6876,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync42, readFileSync as readFileSync14, readdirSync as readdirSync15 } from "node:fs";
-import { join as join49 } from "node:path";
+import { existsSync as existsSync43, readFileSync as readFileSync14, readdirSync as readdirSync15 } from "node:fs";
+import { join as join50 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join49(claudeHome(), "projects");
-  if (!existsSync42(projectsRoot)) {
+  const projectsRoot = join50(claudeHome(), "projects");
+  if (!existsSync43(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -6606,13 +6898,13 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join49(repoHome(), "path-map.json");
-  if (!existsSync42(mapPath)) {
+  const mapPath = join50(repoHome(), "path-map.json");
+  if (!existsSync43(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
   const map = readJson(mapPath);
-  const schemaError = validatePathMap(map);
+  const schemaError = validatePathMapShape(map);
   if (schemaError !== null) {
     fail(schemaError);
     process.exit(1);
@@ -6630,8 +6922,8 @@ function resumeCmd(sessionId) {
 }
 function findTranscriptPath(projectsRoot, sessionId) {
   for (const dir of readdirSync15(projectsRoot)) {
-    const candidate = join49(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync42(candidate)) return candidate;
+    const candidate = join50(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync43(candidate)) return candidate;
   }
   return null;
 }
@@ -6647,26 +6939,6 @@ function extractRecordedCwd(jsonlPath) {
   }
   return null;
 }
-function validatePathMap(raw) {
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-    return "path-map.json invalid schema: top-level value must be an object";
-  }
-  const projects = raw.projects;
-  if (projects === null || typeof projects !== "object" || Array.isArray(projects)) {
-    return 'path-map.json invalid schema: "projects" must be an object';
-  }
-  for (const [name, hosts] of Object.entries(projects)) {
-    if (hosts === null || typeof hosts !== "object" || Array.isArray(hosts)) {
-      return `path-map.json invalid schema: project "${name}" hosts must be an object`;
-    }
-    for (const [host, value] of Object.entries(hosts)) {
-      if (typeof value !== "string") {
-        return `path-map.json invalid schema: project "${name}" host "${host}" path must be a string`;
-      }
-    }
-  }
-  return null;
-}
 function lookupLocalPath(map, recordedCwd) {
   for (const [logical, hosts] of Object.entries(map.projects)) {
     const isUnderMappedPath = Object.values(hosts).some(
@@ -6775,6 +7047,19 @@ try {
       cmdEject({ dryRun: ejectArgs.dryRun });
       break;
     }
+    case "capture-settings": {
+      const captureArgs = parseCaptureSettingsArgs(process.argv);
+      if (captureArgs === null) {
+        console.error("usage: nomad capture-settings [--host] [--dry-run] [--yes]");
+        process.exit(1);
+      }
+      await cmdCaptureSettings({
+        host: captureArgs.host,
+        dryRun: captureArgs.dryRun,
+        yes: captureArgs.yes
+      });
+      break;
+    }
     case "doctor":
       if (process.argv[3] === void 0) {
         cmdDoctor();