claude-nomad 0.55.0 → 0.56.0

package/dist/nomad.mjs

@@ -410,6 +410,9 @@ function repoHome() {
 function backupBase() {
   return join(home(), ".cache", "claude-nomad", "backup");
 }
+function manifestPath() {
+  return join(home(), ".cache", "claude-nomad", `push-manifest-${encodeURIComponent(HOST)}.json`);
+}
 function allSharedLinks(map) {
   const extras = [];
   for (const entry of map.sharedDirs ?? []) {
@@ -423,7 +426,7 @@ function allSharedLinks(map) {
   }
   return [...SHARED_LINKS, ...extras];
 }
-var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
+var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -434,6 +437,7 @@ var init_config = __esm({
     SETTINGS_SCHEMA_URL = "https://json.schemastore.org/claude-code-settings.json";
     NPM_REGISTRY_LATEST_URL = "https://registry.npmjs.org/claude-nomad/latest";
     GITLEAKS_PINNED_VERSION = "8.30.1";
+    GITLEAKS_SCAN_TIMEOUT_MS = 9e5;
     HOST = (process.env.NOMAD_HOST || hostname()).toLowerCase();
     SHARED_LINKS = ["CLAUDE.md", "commands", "rules", "my-statusline.cjs"];
     GSD_PREFIX = "gsd-";
@@ -523,13 +527,23 @@ function sortKeysDeep(value) {
   }
   return value;
 }
-var encodePath;
+var ENCODE_MAX, hashPath, encodePath;
 var init_utils_json = __esm({
   "src/utils.json.ts"() {
     "use strict";
     init_config();
     init_utils();
-    encodePath = (absPath) => absPath.replaceAll("/", "-");
+    ENCODE_MAX = 200;
+    hashPath = (s) => {
+      let h2 = 0;
+      for (let i = 0; i < s.length; i++) h2 = (h2 << 5) - h2 + s.charCodeAt(i) | 0;
+      return h2;
+    };
+    encodePath = (absPath) => {
+      const enc = absPath.replace(/[^a-zA-Z0-9]/g, "-");
+      if (enc.length <= ENCODE_MAX) return enc;
+      return `${enc.slice(0, ENCODE_MAX)}-${Math.abs(hashPath(absPath)).toString(36)}`;
+    };
   }
 });
 
@@ -769,7 +783,7 @@ var init_push_gitleaks_config = __esm({
     "use strict";
     init_config();
     init_utils();
-    OVERLAY_EXTEND_RE = /^\s*(?:\[\s*extend\s*\]|extend\s*[.=])/m;
+    OVERLAY_EXTEND_RE = /^[ \t]*(?:\[[ \t]*extend[ \t]*\]|extend[ \t]*[.=])/m;
     TABLE_HEADER_RE = /^\s*\[/;
     OVERLAY_ALLOWLIST_HEADER_RE = /^\s*\[\[?\s*allowlists?\s*\]\]?/;
     OVERLAY_INLINE_ALLOWLIST_RE = /^[ \t]*allowlists?[ \t]*[.=]/m;
@@ -912,10 +926,11 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   ];
   if (toml !== null) args.push("--config", toml);
   const opts = { cwd: repoDir, stdio: ["ignore", "pipe", "pipe"] };
+  const gitleaksOpts = { ...opts, timeout: GITLEAKS_SCAN_TIMEOUT_MS };
   try {
     execFileSync8("git", ["init", "-q"], opts);
     execFileSync8("git", ["add", "-A"], opts);
-    execFileSync8("gitleaks", args, opts);
+    execFileSync8("gitleaks", args, gitleaksOpts);
     return [];
   } catch (err) {
     const e = err;
@@ -945,7 +960,10 @@ function scanFile(filePath, forwardStreams = false) {
     `--report-path=${reportPath}`
   ];
   if (toml !== null) args.push("--config", toml);
-  const opts = { stdio: ["ignore", "pipe", "pipe"] };
+  const opts = {
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: GITLEAKS_SCAN_TIMEOUT_MS
+  };
   try {
     execFileSync8("gitleaks", args, opts);
     return [];
@@ -966,6 +984,7 @@ function scanFile(filePath, forwardStreams = false) {
 var init_push_gitleaks_scan = __esm({
   "src/push-gitleaks.scan.ts"() {
     "use strict";
+    init_config();
     init_push_gitleaks_config();
     init_utils_fs();
   }
@@ -2073,8 +2092,8 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync30 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync31 } from "node:fs";
+import { join as join37 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
@@ -2554,15 +2573,15 @@ function stripSideIndicator(line) {
 }
 function isGsdDiffLine(line, localBase, sharedBase) {
   const bare = stripSideIndicator(line);
-  let relative6;
+  let relative7;
   if (bare.startsWith(localBase + "/")) {
-    relative6 = bare.slice(localBase.length + 1);
+    relative7 = bare.slice(localBase.length + 1);
   } else if (bare.startsWith(sharedBase + "/")) {
-    relative6 = bare.slice(sharedBase.length + 1);
+    relative7 = bare.slice(sharedBase.length + 1);
   } else {
-    relative6 = bare;
+    relative7 = bare;
   }
-  return relative6.split("/")[0].startsWith(GSD_PREFIX);
+  return relative7.split("/")[0].startsWith(GSD_PREFIX);
 }
 function reportSkillsDivergence(section2) {
   const sharedSkills = join14(repoHome(), "shared", "skills");
@@ -2899,9 +2918,9 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync19, mkdirSync as mkdirSync5, readdirSync as readdirSync8, rmSync as rmSync8 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync9, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
@@ -2998,8 +3017,8 @@ init_config();
 
 // src/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync4, existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync7, renameSync as renameSync3, rmSync as rmSync7, statSync as statSync4 } from "node:fs";
-import { join as join23, relative as relative3, sep as sep3 } from "node:path";
+import { cpSync as cpSync4, existsSync as existsSync19, mkdirSync as mkdirSync5, readdirSync as readdirSync8, renameSync as renameSync3, rmSync as rmSync7, statSync as statSync5 } from "node:fs";
+import { dirname as dirname4, join as join24, relative as relative3, sep as sep3 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -3020,6 +3039,114 @@ function assertSafeLocalRoot(localRoot, logical) {
 
 // src/remap.ts
 init_config();
+
+// src/push-manifest.ts
+init_config();
+init_push_gitleaks_config();
+init_utils_fs();
+import { createHash } from "node:crypto";
+import { existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync7, readFileSync as readFileSync6, statSync as statSync4 } from "node:fs";
+import { dirname as dirname3, join as join23 } from "node:path";
+function isChanged(prev, cur, hash) {
+  if (prev === void 0) return true;
+  if (prev.size !== cur.size) return true;
+  if (prev.mtime === cur.mtime) return false;
+  return prev.hash !== hash();
+}
+function diffManifest(old, current, hashFor) {
+  const changed = /* @__PURE__ */ new Set();
+  const deleted = [];
+  if (old === null) {
+    for (const key of Object.keys(current)) {
+      changed.add(key);
+    }
+    return { changed, deleted };
+  }
+  for (const [key, cur] of Object.entries(current)) {
+    const prev = old.files[key];
+    if (isChanged(prev, cur, () => hashFor(key))) {
+      changed.add(key);
+    }
+  }
+  for (const key of Object.keys(old.files)) {
+    if (!(key in current)) {
+      deleted.push(key);
+    }
+  }
+  return { changed, deleted };
+}
+function shouldFullRescan(old, scannerVersion, configHash, forceFlag) {
+  if (forceFlag) return true;
+  if (old === null) return true;
+  if (old.scannerVersion !== scannerVersion) return true;
+  if (old.configHash !== configHash) return true;
+  return false;
+}
+function hashFile(absPath) {
+  return createHash("sha256").update(readFileSync6(absPath)).digest("hex");
+}
+function enumerateDir(dir, results) {
+  for (const entry of readdirSync7(dir)) {
+    const fullPath = join23(dir, entry);
+    const st = statSync4(fullPath);
+    if (st.isDirectory()) {
+      enumerateDir(fullPath, results);
+    } else {
+      results.push(fullPath);
+    }
+  }
+}
+function enumerateSourceFiles(projectDir) {
+  const results = [];
+  for (const entry of readdirSync7(projectDir)) {
+    const fullPath = join23(projectDir, entry);
+    const st = statSync4(fullPath);
+    if (st.isDirectory()) {
+      enumerateDir(fullPath, results);
+    } else if (fullPath.endsWith(".jsonl")) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+function fileIdentity(p) {
+  if (p === null) return "none::absent";
+  if (!existsSync18(p)) return `${p}::absent`;
+  return `${p}::${createHash("sha256").update(readFileSync6(p)).digest("hex")}`;
+}
+function computeConfigHash() {
+  const repo = repoHome();
+  const parts = [
+    fileIdentity(resolveTomlPath(repo)),
+    fileIdentity(join23(repo, ".gitleaks.overlay.toml")),
+    fileIdentity(join23(repo, ".gitleaksignore"))
+  ];
+  return createHash("sha256").update(parts.join("\n")).digest("hex");
+}
+function isManifestShape(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return false;
+  const m = raw;
+  return m.schema === 1 && typeof m.scannerVersion === "string" && typeof m.configHash === "string" && m.files !== null && typeof m.files === "object" && !Array.isArray(m.files);
+}
+function readManifest(path) {
+  try {
+    const raw = readFileSync6(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!isManifestShape(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeManifest(path, manifest) {
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeJsonAtomic(path, manifest);
+}
+function buildManifest(files, scannerVersion, configHash) {
+  return { schema: 1, scannerVersion, configHash, files };
+}
+
+// src/remap.ts
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -3034,6 +3161,33 @@ function atomicMirror(src, dst, options) {
 function copyDir(src, dst) {
   atomicMirror(src, dst, { recursive: true, force: true });
 }
+function copyFileAtomic(src, dst) {
+  mkdirSync5(dirname4(dst), { recursive: true });
+  const tmp = `${dst}.tmp.${process.pid}`;
+  cpSync4(src, tmp, { force: true, preserveTimestamps: true });
+  renameSync3(tmp, dst);
+}
+function hasDeltaForDir(sel, localDir) {
+  const prefix = `${localDir}${sep3}`;
+  for (const p of sel.changed) if (p.startsWith(prefix)) return true;
+  for (const p of sel.deleted) if (p.startsWith(prefix)) return true;
+  return false;
+}
+function skipForSelection(sel, localDir) {
+  return sel !== void 0 && !hasDeltaForDir(sel, localDir);
+}
+function applySelective(sel, localDir, repoDst) {
+  const prefix = `${localDir}${sep3}`;
+  for (const src of sel.changed) {
+    if (!src.startsWith(prefix)) continue;
+    copyFileAtomic(src, join24(repoDst, relative3(localDir, src)));
+  }
+  for (const src of sel.deleted) {
+    if (!src.startsWith(prefix)) continue;
+    const dst = join24(repoDst, relative3(localDir, src));
+    if (existsSync19(dst)) rmSync7(dst);
+  }
+}
 function copyDirJsonlOnly(src, dst) {
   atomicMirror(src, dst, {
     recursive: true,
@@ -3042,7 +3196,7 @@ function copyDirJsonlOnly(src, dst) {
       const rel = relative3(src, srcPath);
       if (rel === "") return true;
       if (rel.split(sep3).length > 1) return true;
-      if (statSync4(srcPath).isDirectory()) return true;
+      if (statSync5(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       item(`skip ${rel}: extension not in allowlist`);
       return false;
@@ -3060,16 +3214,16 @@ function remapPull(ts, opts = {}) {
   const wouldPull = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join23(repo, "path-map.json");
-  const repoProjects = join23(repo, "shared", "projects");
-  if (!existsSync18(mapPath) || !existsSync18(repoProjects)) {
+  const mapPath = join24(repo, "path-map.json");
+  const repoProjects = join24(repo, "shared", "projects");
+  if (!existsSync19(mapPath) || !existsSync19(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join23(claude, "projects");
-  if (!dryRun) mkdirSync4(localProjects, { recursive: true });
+  const localProjects = join24(claude, "projects");
+  if (!dryRun) mkdirSync5(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const localPath = hosts[HOST];
@@ -3078,9 +3232,9 @@ function remapPull(ts, opts = {}) {
       continue;
     }
     assertSafeLocalRoot(localPath, logical);
-    const src = join23(repoProjects, logical);
-    if (!existsSync18(src)) continue;
-    const dst = join23(localProjects, encodePath(localPath));
+    const src = join24(repoProjects, logical);
+    if (!existsSync19(src)) continue;
+    const dst = join24(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -3127,31 +3281,37 @@ function remapPush(ts, opts = {}) {
   const wouldPush = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join23(repo, "path-map.json");
-  if (!existsSync18(mapPath)) {
+  const mapPath = join24(repo, "path-map.json");
+  if (!existsSync19(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join23(claude, "projects");
-  const repoProjects = join23(repo, "shared", "projects");
+  const localProjects = join24(claude, "projects");
+  const repoProjects = join24(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync18(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
-  if (!dryRun) mkdirSync4(repoProjects, { recursive: true });
-  for (const dir of readdirSync7(localProjects)) {
+  if (!existsSync19(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!dryRun) mkdirSync5(repoProjects, { recursive: true });
+  for (const dir of readdirSync8(localProjects)) {
     if (dir.endsWith(TMP_SUFFIX)) continue;
     const logical = reverse.get(dir);
     if (!logical) {
       unmapped++;
       continue;
     }
-    const repoDst = join23(repoProjects, logical);
+    const localDir = join24(localProjects, dir);
+    const repoDst = join24(repoProjects, logical);
+    if (skipForSelection(opts.selection, localDir)) continue;
     if (dryRun) {
       wouldPush.push(logical);
       continue;
     }
     backupRepoWrite(repoDst, ts, repo);
-    copyDirJsonlOnly(join23(localProjects, dir), repoDst);
+    if (opts.selection) {
+      applySelective(opts.selection, localDir, repoDst);
+    } else {
+      copyDirJsonlOnly(localDir, repoDst);
+    }
     pushed.push(logical);
   }
   return { unmapped, collisions: 0, pushed, wouldPush };
@@ -3164,8 +3324,8 @@ function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
   const repo = repoHome();
-  const mapPath = join24(repo, "path-map.json");
-  if (!existsSync19(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join25(repo, "path-map.json");
+  if (!existsSync20(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -3182,12 +3342,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join24(claudeHome(), "projects");
-  if (!existsSync19(localProjects)) return { logicalToEncoded, staged, malformed: false };
-  for (const dir of readdirSync8(localProjects)) {
+  const localProjects = join25(claudeHome(), "projects");
+  if (!existsSync20(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  for (const dir of readdirSync9(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join24(localProjects, dir), join24(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join25(localProjects, dir), join25(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -3218,11 +3378,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
 }
 function reportCheckShared(section2, gitleaksReady) {
   if (!ensureGitleaksReady(section2, gitleaksReady)) return;
-  const cacheDir = join24(homedir4(), ".cache", "claude-nomad");
-  mkdirSync5(cacheDir, { recursive: true });
+  const cacheDir = join25(homedir4(), ".cache", "claude-nomad");
+  mkdirSync6(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const reportPath = join24(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join24(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join25(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join25(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -3243,12 +3403,12 @@ function reportCheckShared(section2, gitleaksReady) {
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync20, readFileSync as readFileSync6, readdirSync as readdirSync9, realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname3, extname, join as join25 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync7, readdirSync as readdirSync10, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname5, extname, join as join26 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
-    const parsed = JSON.parse(readFileSync6(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync7(pkgPath, "utf8"));
     return parsed.type === "module" ? "esm" : "cjs";
   } catch {
     return "cjs";
@@ -3264,11 +3424,11 @@ function effectiveType(hookPath) {
   } catch {
     return null;
   }
-  let dir = dirname3(real);
+  let dir = dirname5(real);
   for (; ; ) {
-    const pkg = join25(dir, "package.json");
-    if (existsSync20(pkg)) return typeFromPackageJson(pkg);
-    const parent = dirname3(dir);
+    const pkg = join26(dir, "package.json");
+    if (existsSync21(pkg)) return typeFromPackageJson(pkg);
+    const parent = dirname5(dir);
     if (parent === dir) return "cjs";
     dir = parent;
   }
@@ -3285,7 +3445,7 @@ function stripCommentsAndStrings(src) {
 function classifySource(src) {
   const code = stripCommentsAndStrings(src);
   const cjs = /\brequire\s*\(/.test(code) || /\bmodule\.exports\b/.test(code) || /\bexports\.\w/.test(code);
-  const esm = /^[^\S\r\n]*import\s/m.test(code) || /^[^\S\r\n]*export\s/m.test(code) || /\bimport\.meta\b/.test(code);
+  const esm = /^[ \t]*import\s/m.test(code) || /^[ \t]*export\s/m.test(code) || /\bimport\.meta\b/.test(code);
   if (cjs && !esm) return "cjs";
   if (esm && !cjs) return "esm";
   if (cjs && esm) return "cjs";
@@ -3296,28 +3456,28 @@ function remedy(family) {
 }
 function safeReaddir2(dir) {
   try {
-    return readdirSync9(dir);
+    return readdirSync10(dir);
   } catch {
     return [];
   }
 }
 function safeRead(path) {
   try {
-    return readFileSync6(path, "utf8");
+    return readFileSync7(path, "utf8");
   } catch {
     return null;
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join25(claudeHome(), "hooks");
-  if (!existsSync20(hooksDir)) {
+  const hooksDir = join26(claudeHome(), "hooks");
+  if (!existsSync21(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join25(hooksDir, name);
+    const abs = join26(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -3337,15 +3497,19 @@ function reportHookScopeCheck(section2) {
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync21 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { join as join27 } from "node:path";
 init_config();
 function expandHome(token) {
   const h2 = home();
   return token.replace(/^\$\{HOME\}/, h2).replace(/^\$HOME/, h2).replace(/^~/, h2);
 }
+var TRAILING_SHELL_PUNCT = /* @__PURE__ */ new Set(["'", '"', "`", ";", ")", "|", "&", ">"]);
 function stripShellPunctuation(token) {
-  return token.replace(/^['"]+/, "").replace(/['"`;)|&>]+$/, "");
+  const stripped = token.replace(/^['"]+/, "");
+  let end = stripped.length;
+  while (end > 0 && TRAILING_SHELL_PUNCT.has(stripped[end - 1])) end--;
+  return stripped.slice(0, end);
 }
 function* claudePathsIn(command) {
   const claudePrefix = `${claudeHome()}/`;
@@ -3377,7 +3541,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync21(resolved)) continue;
+        if (existsSync22(resolved)) continue;
         addItem(
           section2,
           `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
@@ -3390,8 +3554,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join26(claudeHome(), "settings.json");
-  if (!existsSync21(settingsPath)) {
+  const settingsPath = join27(claudeHome(), "settings.json");
+  if (!existsSync22(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -3414,12 +3578,12 @@ function reportHooksTargetCheck(section2) {
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.ts
 init_color();
-import { existsSync as existsSync23, readFileSync as readFileSync7 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync8 } from "node:fs";
+import { join as join29 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync22, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname4, join as join27, resolve as resolve2 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync23, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname6, join as join28, resolve as resolve2 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
   const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
@@ -3451,12 +3615,12 @@ function topRelativeSpecifiers(src) {
 }
 function specifierIsMissing(specifier, baseDir) {
   const base = resolve2(baseDir, specifier);
-  if (existsSync22(base)) return false;
+  if (existsSync23(base)) return false;
   for (const ext of [".js", ".cjs", ".mjs"]) {
-    if (existsSync22(base + ext)) return false;
+    if (existsSync23(base + ext)) return false;
   }
   for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
-    if (existsSync22(join27(base, idx))) return false;
+    if (existsSync23(join28(base, idx))) return false;
   }
   return true;
 }
@@ -3482,7 +3646,7 @@ function relativeRequireTargetsBroken(scriptPath) {
   }
   const specifiers = topRelativeSpecifiers(raw);
   if (specifiers.length === 0) return false;
-  const baseDir = dirname4(realPath);
+  const baseDir = dirname6(realPath);
   for (const spec of specifiers) {
     if (specifierIsMissing(spec, baseDir)) return true;
   }
@@ -3511,10 +3675,10 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join28(repoHome(), "path-map.json");
-  if (!existsSync23(mapPath)) return { projects: {} };
+  const mapPath = join29(repoHome(), "path-map.json");
+  if (!existsSync24(mapPath)) return { projects: {} };
   try {
-    return JSON.parse(readFileSync7(mapPath, "utf8"));
+    return JSON.parse(readFileSync8(mapPath, "utf8"));
   } catch {
     return { projects: {} };
   }
@@ -3585,8 +3749,8 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join28(claudeHome(), "settings.json");
-  if (!existsSync23(settingsPath)) {
+  const settingsPath = join29(claudeHome(), "settings.json");
+  if (!existsSync24(settingsPath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
@@ -3595,7 +3759,7 @@ function reportPreserveSymlinksCheck(section2) {
   }
   let settings;
   try {
-    settings = JSON.parse(readFileSync7(settingsPath, "utf8"));
+    settings = JSON.parse(readFileSync8(settingsPath, "utf8"));
   } catch {
     return;
   }
@@ -3619,8 +3783,8 @@ function reportPreserveSymlinksCheck(section2) {
 
 // src/commands.doctor.checks.settings-drift.ts
 init_color();
-import { existsSync as existsSync24, readFileSync as readFileSync8 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync9 } from "node:fs";
+import { join as join30 } from "node:path";
 init_config();
 init_utils_json();
 function diffMergedSettings(merged, settings) {
@@ -3629,7 +3793,7 @@ function diffMergedSettings(merged, settings) {
 }
 function tryReadJson(filePath) {
   try {
-    const raw = readFileSync8(filePath, "utf8");
+    const raw = readFileSync9(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
@@ -3638,7 +3802,7 @@ function tryReadJson(filePath) {
   }
 }
 function reportHooksBaseSelfCleanNote(section2) {
-  const basePath = join29(repoHome(), "shared", "settings.base.json");
+  const basePath = join30(repoHome(), "shared", "settings.base.json");
   const base = tryReadJson(basePath);
   if (base === null) return;
   if (!baseHasGsdHookEntries(base)) return;
@@ -3651,14 +3815,14 @@ function reportSettingsDriftCheck(section2) {
   const claude = claudeHome();
   const repo = repoHome();
   const host = HOST;
-  const settingsPath = join29(claude, "settings.json");
-  const basePath = join29(repo, "shared", "settings.base.json");
-  const hostPath = join29(repo, "hosts", `${host}.json`);
-  if (!existsSync24(settingsPath)) {
+  const settingsPath = join30(claude, "settings.json");
+  const basePath = join30(repo, "shared", "settings.base.json");
+  const hostPath = join30(repo, "hosts", `${host}.json`);
+  if (!existsSync25(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
     return;
   }
-  if (!existsSync24(basePath)) {
+  if (!existsSync25(basePath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
@@ -3677,7 +3841,7 @@ function reportSettingsDriftCheck(section2) {
   if (settings === null) {
     return;
   }
-  const hostExists = existsSync24(hostPath);
+  const hostExists = existsSync25(hostPath);
   const hostObj = hostExists ? tryReadJson(hostPath) : null;
   if (hostExists && hostObj === null) {
     addItem(
@@ -3726,12 +3890,12 @@ init_config();
 
 // src/commands.doctor.engine.ts
 init_color();
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/commands.doctor.version.ts
 init_color();
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_config();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -3748,7 +3912,7 @@ function compareSemver(a, b) {
 function readLocalVersion() {
   try {
     const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync9(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync10(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
     }
@@ -3807,7 +3971,7 @@ function parseMinVersion(spec) {
 function readEnginesNode() {
   try {
     const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync10(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync11(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
     return null;
@@ -3835,43 +3999,43 @@ function reportNodeEngineCheck(section2) {
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync29 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
-import { readFileSync as readFileSync13, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join34 } from "node:path";
+import { readFileSync as readFileSync14, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join35 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/commands.push.recovery.actions.ts
 init_config();
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep5 } from "node:path";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync5, existsSync as existsSync27, mkdirSync as mkdirSync6, statSync as statSync7 } from "node:fs";
-import { dirname as dirname6, join as join32, sep as sep4 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync28, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
+import { dirname as dirname8, join as join33, sep as sep4 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync26, statSync as statSync6 } from "node:fs";
-import { dirname as dirname5, join as join31 } from "node:path";
+import { existsSync as existsSync27, statSync as statSync7 } from "node:fs";
+import { dirname as dirname7, join as join32 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync25, lstatSync as lstatSync8, readFileSync as readFileSync11, readdirSync as readdirSync10, statSync as statSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync26, lstatSync as lstatSync8, readFileSync as readFileSync12, readdirSync as readdirSync11, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join31 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
-  if (!existsSync25(dir)) return;
+  if (!existsSync26(dir)) return;
   const st = lstatSync8(dir);
   if (!st.isDirectory()) return;
-  for (const entry of readdirSync10(dir)) {
-    const abs = join30(dir, entry);
+  for (const entry of readdirSync11(dir)) {
+    const abs = join31(dir, entry);
     const lst = lstatSync8(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
@@ -3886,7 +4050,7 @@ function listSubtreeFiles(sessionDir) {
   collectFiles(sessionDir, out);
   return out.sort((a, b) => a.localeCompare(b));
 }
-function newestSubtreeMtimeMs(mainPath, subtreeFiles, statMtime = (p) => statSync5(p).mtimeMs) {
+function newestSubtreeMtimeMs(mainPath, subtreeFiles, statMtime = (p) => statSync6(p).mtimeMs) {
   let newest = statMtime(mainPath);
   for (const filePath of subtreeFiles) {
     const t = statMtime(filePath);
@@ -3908,7 +4072,7 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   if (!dryRun && total > 0) {
     for (const { path: filePath, findings } of dirty) {
       backupBeforeWrite(filePath, ts);
-      const before = readFileSync11(filePath, "utf8");
+      const before = readFileSync12(filePath, "utf8");
       const after = applyRedactions(before, findings);
       if (after === before) {
         log(
@@ -3976,15 +4140,15 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript(id) {
   try {
-    const mapPath = join31(repoHome(), "path-map.json");
-    if (!existsSync26(mapPath)) return null;
+    const mapPath = join32(repoHome(), "path-map.json");
+    if (!existsSync27(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join31(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync26(live)) return live;
+      const live = join32(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync27(live)) return live;
     }
     return null;
   } catch {
@@ -4004,19 +4168,19 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync26(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync27(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync26(localPath)) {
+    if (localPath === null || !existsSync27(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join31(dirname5(localPath), id);
+    const sessionDir = join32(dirname7(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
-    const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync6(p).mtimeMs);
+    const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
       log(
         `session ${id} was modified recently and may be active.
@@ -4130,8 +4294,8 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join32(claude, "projects", encodePath(abs)) + sep4)) {
-      return join32(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join33(claude, "projects", encodePath(abs)) + sep4)) {
+      return join33(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -4141,9 +4305,9 @@ function preflightRedactable(f, map, nowMs) {
   if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
   const localPath = resolveLiveTranscript(sid);
   if (localPath === null) return `session ${sid}: local transcript not found`;
-  const sessionDir = join32(dirname6(localPath), sid);
+  const sessionDir = join33(dirname8(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
-  const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
+  const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
     return `session ${sid}: looks active (modified within the last 5 minutes)`;
   }
@@ -4171,9 +4335,9 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join32(dirname6(localPath), sid);
+  const sessionDir = join33(dirname8(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
-  const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
+  const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
     return refuse(
       `session ${sid} looks active (modified within the last 5 minutes); refusing to redact, no changes made.
@@ -4204,10 +4368,10 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `nothing to redact in the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  mkdirSync6(stagedProjectDir, { recursive: true });
-  cpSync5(localPath, join32(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync27(sessionDir)) {
-    cpSync5(sessionDir, join32(stagedProjectDir, sid), { force: true, recursive: true });
+  mkdirSync7(stagedProjectDir, { recursive: true });
+  cpSync5(localPath, join33(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync28(sessionDir)) {
+    cpSync5(sessionDir, join33(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
@@ -4215,14 +4379,14 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
 // src/commands.push.recovery.drop.ts
 init_config();
 import { rmSync as rmSync9 } from "node:fs";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join33(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join33(repo, "shared", "projects", logical, sid);
+    const jsonl = join34(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join34(repo, "shared", "projects", logical, sid);
     rmSync9(jsonl, { force: true });
     rmSync9(dir, { recursive: true, force: true });
   }
@@ -4258,7 +4422,7 @@ function makeDefaultReadLine(repo) {
       if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep5)) {
         return null;
       }
-      const content = readFileSync12(target, "utf8");
+      const content = readFileSync13(target, "utf8");
       const lines = content.split(/\r?\n/);
       const idx = line - 1;
       if (idx < 0 || idx >= lines.length) return null;
@@ -4379,10 +4543,10 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join34(repoHome2, ".gitleaksignore");
+  const ignPath = join35(repoHome2, ".gitleaksignore");
   let before;
   try {
-    before = readFileSync13(ignPath, "utf8");
+    before = readFileSync14(ignPath, "utf8");
   } catch {
     before = null;
   }
@@ -4478,7 +4642,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync28;
+  const check = deps.existsSyncFn ?? existsSync29;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -4545,8 +4709,8 @@ function withSpinner(label, fn, deps) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync29 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+import { join as join36 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -4555,7 +4719,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join35(repoHome(), ".gitleaks.toml");
+  const tomlPath = join36(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -4567,7 +4731,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync11, tomlExists = existsSync29) {
+function reportGitleaksVersionCheck(section2, run = execFileSync11, tomlExists = existsSync30) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -4790,8 +4954,8 @@ function gatherDoctorSections(opts) {
   reportHostKeyAlignment(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join36(repoHome(), "path-map.json");
-  const rawMap = existsSync30(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join37(repoHome(), "path-map.json");
+  const rawMap = existsSync31(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   reportDroppedNamesMigration(links);
@@ -4888,8 +5052,8 @@ function parseDoctorArgs(args) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync32, readdirSync as readdirSync11, statSync as statSync8 } from "node:fs";
-import { join as join38, relative as relative4 } from "node:path";
+import { existsSync as existsSync33, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
+import { join as join39, relative as relative4 } from "node:path";
 
 // src/commands.drop-session.git.ts
 import { execFileSync as execFileSync15 } from "node:child_process";
@@ -4931,8 +5095,8 @@ function isInIndex(rel, repo) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync31 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { join as join38 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript2(id, matches);
@@ -4948,8 +5112,8 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript2(id, matches) {
   try {
-    const mapPath = join37(repoHome(), "path-map.json");
-    if (!existsSync31(mapPath)) return null;
+    const mapPath = join38(repoHome(), "path-map.json");
+    if (!existsSync32(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
@@ -4957,8 +5121,8 @@ function resolveLiveTranscript2(id, matches) {
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join37(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync31(live)) return live;
+      const live = join38(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync32(live)) return live;
     }
     return null;
   } catch {
@@ -4974,12 +5138,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync32(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync33(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join38(repo, "shared", "projects");
-    if (!existsSync32(repoProjects)) {
+    const repoProjects = join39(repo, "shared", "projects");
+    if (!existsSync33(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -5001,13 +5165,13 @@ function cmdDropSession(id) {
 }
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
-  for (const logical of readdirSync11(repoProjects)) {
-    const candidate = join38(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync32(candidate)) {
+  for (const logical of readdirSync12(repoProjects)) {
+    const candidate = join39(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync33(candidate)) {
       matches.push(relative4(repo, candidate));
     }
-    const dir = join38(repoProjects, logical, id);
-    if (existsSync32(dir) && statSync8(dir).isDirectory()) {
+    const dir = join39(repoProjects, logical, id);
+    if (existsSync33(dir) && statSync9(dir).isDirectory()) {
       const dirRel = relative4(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
@@ -5042,8 +5206,8 @@ function unstageOne(rel, repo) {
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync9 } from "node:fs";
-import { join as join45 } from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join46 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -5138,20 +5302,20 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync35, statSync as statSync9 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync36, statSync as statSync10 } from "node:fs";
+import { join as join43 } from "node:path";
 
 // src/extras-sync.core.ts
 init_config();
-import { cpSync as cpSync6, existsSync as existsSync33, lstatSync as lstatSync9, readdirSync as readdirSync12, rmSync as rmSync11 } from "node:fs";
-import { basename, join as join39 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync34, lstatSync as lstatSync9, readdirSync as readdirSync13, rmSync as rmSync11 } from "node:fs";
+import { basename, join as join40 } from "node:path";
 init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
   const repo = repoHome();
-  const mapPath = join39(repo, "path-map.json");
-  const repoExtras = join39(repo, "shared", "extras");
-  if (!existsSync33(mapPath) || opts.requireRepoExtras === true && !existsSync33(repoExtras)) {
+  const mapPath = join40(repo, "path-map.json");
+  const repoExtras = join40(repo, "shared", "extras");
+  if (!existsSync34(mapPath) || opts.requireRepoExtras === true && !existsSync34(repoExtras)) {
     if (opts.missingMsg !== void 0) log(opts.missingMsg);
     return null;
   }
@@ -5173,26 +5337,26 @@ function* eachExtrasTarget(v, counts) {
       counts.unmapped++;
       continue;
     }
-    for (const dirname8 of dirnames) {
-      if (!whitelist.includes(dirname8)) {
+    for (const dirname10 of dirnames) {
+      if (!whitelist.includes(dirname10)) {
         counts.skipped++;
         continue;
       }
-      yield { logical, localRoot, dirname: dirname8 };
+      yield { logical, localRoot, dirname: dirname10 };
     }
   }
 }
 function stripCollidingDstSymlinks(src, dst, isExcluded) {
-  if (!existsSync33(dst)) return;
-  for (const name of readdirSync12(src)) {
+  if (!existsSync34(dst)) return;
+  for (const name of readdirSync13(src)) {
     if (isExcluded(name)) continue;
-    const dstPath = join39(dst, name);
+    const dstPath = join40(dst, name);
     const dstStat = lstatSync9(dstPath, { throwIfNoEntry: false });
     if (dstStat === void 0) continue;
     if (dstStat.isSymbolicLink()) {
       rmSync11(dstPath, { recursive: true, force: true });
-    } else if (dstStat.isDirectory() && lstatSync9(join39(src, name)).isDirectory()) {
-      stripCollidingDstSymlinks(join39(src, name), dstPath, isExcluded);
+    } else if (dstStat.isDirectory() && lstatSync9(join40(src, name)).isDirectory()) {
+      stripCollidingDstSymlinks(join40(src, name), dstPath, isExcluded);
     }
   }
 }
@@ -5219,8 +5383,8 @@ function copyExtras(src, dst) {
   rmSync11(dst, { recursive: true, force: true });
   cpSync6(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
 }
-function extrasDenySet(dirname8) {
-  return dirname8 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+function extrasDenySet(dirname10) {
+  return dirname10 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function copyExtrasFiltered(src, dst, blockSet) {
   rmSync11(dst, { recursive: true, force: true });
@@ -5232,17 +5396,17 @@ function copyExtrasFiltered(src, dst, blockSet) {
   });
 }
 function prunePreservingDenied(src, dst, blockSet) {
-  for (const name of readdirSync12(dst)) {
+  for (const name of readdirSync13(dst)) {
     if (isDeniedName(blockSet, name)) continue;
-    const dstPath = join39(dst, name);
-    const srcStat = lstatSync9(join39(src, name), { throwIfNoEntry: false });
+    const dstPath = join40(dst, name);
+    const srcStat = lstatSync9(join40(src, name), { throwIfNoEntry: false });
     if (srcStat === void 0) {
       rmSync11(dstPath, { recursive: true, force: true });
       continue;
     }
     const dstStat = lstatSync9(dstPath);
     if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingDenied(join39(src, name), dstPath, blockSet);
+      prunePreservingDenied(join40(src, name), dstPath, blockSet);
     } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
       rmSync11(dstPath, { recursive: true, force: true });
     }
@@ -5263,17 +5427,17 @@ function copyExtrasFilteredPreserving(src, dst, blockSet) {
   });
 }
 function prunePreservingBy(src, dst, isPreserved) {
-  for (const name of readdirSync12(dst)) {
+  for (const name of readdirSync13(dst)) {
     if (isPreserved(name)) continue;
-    const dstPath = join39(dst, name);
-    const srcStat = lstatSync9(join39(src, name), { throwIfNoEntry: false });
+    const dstPath = join40(dst, name);
+    const srcStat = lstatSync9(join40(src, name), { throwIfNoEntry: false });
     if (srcStat === void 0) {
       rmSync11(dstPath, { recursive: true, force: true });
       continue;
     }
     const dstStat = lstatSync9(dstPath);
     if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingBy(join39(src, name), dstPath, isPreserved);
+      prunePreservingBy(join40(src, name), dstPath, isPreserved);
     } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
       rmSync11(dstPath, { recursive: true, force: true });
     }
@@ -5300,11 +5464,11 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync34, mkdirSync as mkdirSync7, readdirSync as readdirSync13, realpathSync as realpathSync4, rmSync as rmSync12 } from "node:fs";
-import { dirname as dirname7, join as join41, sep as sep7 } from "node:path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync8, readdirSync as readdirSync14, realpathSync as realpathSync4, rmSync as rmSync12 } from "node:fs";
+import { dirname as dirname9, join as join42, sep as sep7 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
-import { join as join40, normalize as normalize2, sep as sep6 } from "node:path";
+import { join as join41, normalize as normalize2, sep as sep6 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -5356,7 +5520,7 @@ function planningDeleteTargets(opts) {
   const { deleted } = parsePlanningDiff(raw);
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
-  const planningRoot = join40(localRoot, ".planning");
+  const planningRoot = join41(localRoot, ".planning");
   const planningRootBoundary = planningRoot + sep6;
   const targets = [];
   for (const repoPath of deleted) {
@@ -5364,7 +5528,7 @@ function planningDeleteTargets(opts) {
       continue;
     }
     const remainder = repoPath.slice(logicalPrefix.length);
-    const candidate = join40(localRoot, remainder);
+    const candidate = join41(localRoot, remainder);
     const resolved = normalize2(candidate);
     if (!resolved.startsWith(planningRootBoundary)) {
       throw new NomadFatal(
@@ -5385,7 +5549,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync34(src)) continue;
+    if (!existsSync35(src)) continue;
     const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item2);
@@ -5398,15 +5562,15 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   return { ...counts, done, would };
 }
 function pruneEmptyAncestors(target, planningRoot) {
-  let dir = dirname7(target);
+  let dir = dirname9(target);
   while (dir !== planningRoot && dir.startsWith(planningRoot + sep7)) {
     try {
-      if (readdirSync13(dir).length > 0) break;
+      if (readdirSync14(dir).length > 0) break;
       rmSync12(dir, { recursive: true, force: true });
     } catch {
       break;
     }
-    dir = dirname7(dir);
+    dir = dirname9(dir);
   }
 }
 function tryRealpath(dir) {
@@ -5420,8 +5584,8 @@ function isInsidePlanningRoot(parentReal, rootReal) {
   return parentReal === rootReal || parentReal.startsWith(rootReal + sep7);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
-  if (existsSync34(repoCounterpart)) return;
-  const parentReal = tryRealpath(dirname7(target));
+  if (existsSync35(repoCounterpart)) return;
+  const parentReal = tryRealpath(dirname9(target));
   if (parentReal === void 0) return;
   const rootReal = tryRealpath(planningRoot);
   if (rootReal === void 0) return;
@@ -5430,7 +5594,7 @@ function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   pruneEmptyAncestors(target, planningRoot);
 }
 function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
-  const repoExtras = join41(repo, "shared", "extras");
+  const repoExtras = join42(repo, "shared", "extras");
   for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
     if (t.dirname !== ".planning") continue;
     let raw;
@@ -5456,11 +5620,11 @@ function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
     }
     const targets = planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot });
     if (targets.length === 0) continue;
-    backupExtrasWrite(join41(t.localRoot, t.dirname), ts, t.localRoot);
-    const planningRoot = join41(t.localRoot, ".planning");
+    backupExtrasWrite(join42(t.localRoot, t.dirname), ts, t.localRoot);
+    const planningRoot = join42(t.localRoot, ".planning");
     for (const target of targets) {
       const relToLocal = target.slice(t.localRoot.length + sep7.length);
-      deletePlanningTarget(target, planningRoot, join41(repoExtras, t.logical, relToLocal));
+      deletePlanningTarget(target, planningRoot, join42(repoExtras, t.logical, relToLocal));
     }
   }
 }
@@ -5469,14 +5633,14 @@ function remapExtrasPush(ts, opts = {}) {
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
   const repo = repoHome();
-  const repoExtras = join41(repo, "shared", "extras");
-  if (!dryRun) mkdirSync7(repoExtras, { recursive: true });
+  const repoExtras = join42(repo, "shared", "extras");
+  if (!dryRun) mkdirSync8(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname8 }) => ({
-      src: join41(localRoot, dirname8),
-      dst: join41(repoExtras, logical, dirname8)
+    ({ localRoot, logical, dirname: dirname10 }) => ({
+      src: join42(localRoot, dirname10),
+      dst: join42(repoExtras, logical, dirname10)
     }),
     (dst) => backupRepoWrite(dst, ts, repo),
     // Push copy routing per extra type:
@@ -5488,7 +5652,7 @@ function remapExtrasPush(ts, opts = {}) {
     //     (enforceAllowList / blockSetFor in commands.push.allowlist.ts)
     //     remains the hard security boundary.
     //   All others: copyExtrasFiltered with per-extra denylist.
-    (src, dst, dirname8) => dirname8 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname8)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname8))
+    (src, dst, dirname10) => dirname10 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname10)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname10))
   );
   return { unmapped, skipped, pushed: done, wouldPush: would };
 }
@@ -5504,9 +5668,9 @@ function remapExtrasPull(ts, opts = {}) {
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname8 }) => ({
-      src: join41(repo, "shared", "extras", logical, dirname8),
-      dst: join41(localRoot, dirname8)
+    ({ localRoot, logical, dirname: dirname10 }) => ({
+      src: join42(repo, "shared", "extras", logical, dirname10),
+      dst: join42(localRoot, dirname10)
     }),
     // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -5519,11 +5683,11 @@ function remapExtrasPull(ts, opts = {}) {
     //     removals via the git-diff D set. The filter is defense-in-depth
     //     against a repo poisoned out-of-band.
     //   All others: copyExtras (exact mirror; rarely carry host-local files).
-    (src, dst, dirname8) => {
-      if (dirname8 === ".claude")
-        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname8));
-      if (dirname8 === ".planning")
-        return copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname8));
+    (src, dst, dirname10) => {
+      if (dirname10 === ".claude")
+        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname10));
+      if (dirname10 === ".planning")
+        return copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname10));
       return copyExtras(src, dst);
     }
   );
@@ -5547,20 +5711,20 @@ function divergenceCheckExtras(ts) {
   const v = loadValidatedExtras({});
   if (v === null) return;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join42(backupBase(), ts, "extras");
+  const backupRoot = join43(backupBase(), ts, "extras");
   const repo = repoHome();
-  for (const { logical, localRoot, dirname: dirname8 } of eachExtrasTarget(v, counts)) {
-    const local = join42(localRoot, dirname8);
-    const repoEntry = join42(repo, "shared", "extras", logical, dirname8);
-    if (!existsSync35(local) || !existsSync35(repoEntry)) continue;
+  for (const { logical, localRoot, dirname: dirname10 } of eachExtrasTarget(v, counts)) {
+    const local = join43(localRoot, dirname10);
+    const repoEntry = join43(repo, "shared", "extras", logical, dirname10);
+    if (!existsSync36(local) || !existsSync36(repoEntry)) continue;
     const diff = listDivergingFiles(local, repoEntry);
     if (diff.length === 0) continue;
-    const projectBackupRoot = join42(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join43(backupRoot, encodePath(localRoot));
     warn(
       divergenceWarnLine({
-        dirname: dirname8,
+        dirname: dirname10,
         logical,
-        isDir: statSync9(local).isDirectory(),
+        isDir: statSync10(local).isDirectory(),
         count: diff.length,
         projectBackupRoot
       })
@@ -5571,8 +5735,8 @@ function divergenceCheckExtras(ts) {
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync36, lstatSync as lstatSync10, mkdirSync as mkdirSync8, readdirSync as readdirSync14, rmSync as rmSync13 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync37, lstatSync as lstatSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync15, rmSync as rmSync13 } from "node:fs";
+import { join as join44 } from "node:path";
 init_utils_fs();
 function isGsdOwned(name) {
   return name.startsWith(GSD_PREFIX);
@@ -5581,7 +5745,7 @@ function isSkillExcluded(name) {
   return isGsdOwned(name) || isDeniedName(ALWAYS_NEVER_SYNC, name);
 }
 function copySkillsPush(src, dst) {
-  const srcNames = readdirSync14(src, { encoding: "utf8" });
+  const srcNames = readdirSync15(src, { encoding: "utf8" });
   const blockSet = /* @__PURE__ */ new Set([
     ...srcNames.filter((n) => isGsdOwned(n)),
     ...ALWAYS_NEVER_SYNC
@@ -5592,30 +5756,30 @@ function copySkillsPull(src, dst) {
   copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded);
 }
 function syncSkillsPull(ts) {
-  const sharedSkills = join43(repoHome(), "shared", "skills");
-  if (!existsSync36(sharedSkills)) return;
-  const localSkills = join43(claudeHome(), "skills");
+  const sharedSkills = join44(repoHome(), "shared", "skills");
+  if (!existsSync37(sharedSkills)) return;
+  const localSkills = join44(claudeHome(), "skills");
   const dstStat = lstatSync10(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     backupBeforeWrite(localSkills, ts);
     rmSync13(localSkills, { recursive: true, force: true });
-    mkdirSync8(localSkills, { recursive: true });
+    mkdirSync9(localSkills, { recursive: true });
   }
   copySkillsPull(sharedSkills, localSkills);
 }
 function syncSkillsPush() {
-  const localSkills = join43(claudeHome(), "skills");
+  const localSkills = join44(claudeHome(), "skills");
   const stat = lstatSync10(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
-  const sharedSkills = join43(repoHome(), "shared", "skills");
+  const sharedSkills = join44(repoHome(), "shared", "skills");
   copySkillsPush(localSkills, sharedSkills);
 }
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync37 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync38 } from "node:fs";
+import { join as join45 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -5901,7 +6065,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync37(path)) return null;
+  if (!existsSync38(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -5915,12 +6079,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync37(hostPath)) {
+  if (hostOverrides === null && existsSync38(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = stripGsdHookEntries(deepMerge(base, hostOverrides ?? {}));
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync37(settingsPath)) {
+  if (current === null && existsSync38(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const strippedCurrent = stripGsdHookEntries(current ?? {});
@@ -5961,9 +6125,9 @@ function computePreview(ts, map, verb = "pull") {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join44(repo, "shared", "settings.base.json"),
-    join44(repo, "hosts", `${HOST}.json`),
-    join44(claude, "settings.json")
+    join45(repo, "shared", "settings.base.json"),
+    join45(repo, "hosts", `${HOST}.json`),
+    join45(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -6164,8 +6328,8 @@ function cmdPull(opts = {}) {
   const forceRemote = opts.forceRemote === true;
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync38(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync38(join45(repo, "shared", "settings.base.json"))) {
+  if (!existsSync39(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync39(join46(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -6174,9 +6338,9 @@ function cmdPull(opts = {}) {
     const ts = freshBackupTs(backup);
     handleWedge(repo, forceRemote);
     if (!dryRun) {
-      const backupRoot = join45(backup, ts);
+      const backupRoot = join46(backup, ts);
       try {
-        mkdirSync9(backupRoot, { recursive: true });
+        mkdirSync10(backupRoot, { recursive: true });
       } catch (err) {
         die(`could not create backup dir: ${err.message}`);
       }
@@ -6187,8 +6351,8 @@ function cmdPull(opts = {}) {
     const prePostHeads = capturePrePostHeads(repo, () => {
       gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
     });
-    const mapPath = join45(repo, "path-map.json");
-    const map = existsSync38(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join46(repo, "path-map.json");
+    const map = existsSync39(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     if (dryRun) {
       computePreview(ts, map, "pull");
@@ -6210,8 +6374,63 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync40 } from "node:fs";
-import { join as join47, relative as relative5 } from "node:path";
+import { existsSync as existsSync43 } from "node:fs";
+import { join as join51 } from "node:path";
+
+// src/commands.push.selection.ts
+init_config();
+import { existsSync as existsSync40, statSync as statSync11 } from "node:fs";
+import { join as join47 } from "node:path";
+init_utils_json();
+function buildCurrentMap(map) {
+  const current = {};
+  if (map === null) return current;
+  const claude = claudeHome();
+  for (const [, hostMap] of Object.entries(map.projects)) {
+    const localPath = hostMap[HOST];
+    if (!localPath) continue;
+    const localDir = join47(claude, "projects", encodePath(localPath));
+    if (!existsSync40(localDir)) continue;
+    for (const f of enumerateSourceFiles(localDir)) {
+      const st = statSync11(f);
+      current[f] = { size: st.size, mtime: st.mtimeMs };
+    }
+  }
+  return current;
+}
+function computePushSelection(map, old, scannerVersion, configHash, fullScan) {
+  const current = buildCurrentMap(map);
+  const fullRescan = shouldFullRescan(old, scannerVersion, configHash, fullScan);
+  const hashCache = /* @__PURE__ */ new Map();
+  const cachedHash = (p) => {
+    const hit = hashCache.get(p);
+    if (hit !== void 0) return hit;
+    const h2 = hashFile(p);
+    hashCache.set(p, h2);
+    return h2;
+  };
+  const delta = fullRescan ? { changed: new Set(Object.keys(current)), deleted: [] } : diffManifest(old, current, cachedHash);
+  const files = {};
+  for (const [key, meta] of Object.entries(current)) {
+    const hash = delta.changed.has(key) ? cachedHash(key) : old.files[key].hash;
+    files[key] = { size: meta.size, mtime: meta.mtime, hash };
+  }
+  return {
+    selection: fullRescan ? void 0 : delta,
+    newManifest: buildManifest(files, scannerVersion, configHash)
+  };
+}
+function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan) {
+  const map = existsSync40(mapPath) ? readPathMap(mapPath) : null;
+  const { selection, newManifest } = computePushSelection(
+    map,
+    old,
+    scannerVersion,
+    configHash,
+    fullScan
+  );
+  return { map, selection, newManifest };
+}
 
 // src/commands.push.allowlist.ts
 init_config();
@@ -6302,6 +6521,85 @@ function enforceAllowList(statusPorcelain, map) {
   throw new NomadFatal("push allow-list violations");
 }
 
+// src/commands.push.settings.ts
+init_config();
+import { existsSync as existsSync41 } from "node:fs";
+import { join as join48 } from "node:path";
+init_utils();
+init_utils_fs();
+init_utils_json();
+function stripGsdHooksFromBase(repo, backup) {
+  const basePath = join48(repo, "shared", "settings.base.json");
+  if (!existsSync41(basePath)) return;
+  let base;
+  try {
+    base = readJson(basePath);
+  } catch {
+    return;
+  }
+  if (!baseHasGsdHookEntries(base)) return;
+  const stripped = stripGsdHookEntries(base);
+  const ts = freshBackupTs(backup);
+  backupRepoWrite(basePath, ts, repo);
+  writeJsonAtomic(basePath, stripped);
+}
+function reportSettingsAheadDrift(repo) {
+  const basePath = join48(repo, "shared", "settings.base.json");
+  if (!existsSync41(basePath)) return;
+  const settingsPath = join48(claudeHome(), "settings.json");
+  if (!existsSync41(settingsPath)) return;
+  try {
+    const base = readJson(basePath);
+    const hostPath = join48(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync41(hostPath) ? readJson(hostPath) : {};
+    const merged = deepMerge(base, overrides);
+    const settings = readJson(settingsPath);
+    const { ahead } = classifySettingsDrift(merged, settings);
+    const { promotable } = partitionByCaptureExclusion(ahead);
+    if (promotable.length === 0) return;
+    const { phrase, pronoun, verb } = describeSettings(promotable);
+    warn(
+      `your settings.json has ${phrase} that ${verb} not yet in the repo; run 'nomad capture-settings' to save ${pronoun} (or 'nomad capture-settings --host' for host-specific values).`
+    );
+  } catch {
+  }
+}
+
+// src/commands.push.guards.ts
+init_push_checks();
+init_utils();
+import { join as join49, relative as relative5 } from "node:path";
+function guardGitlinks(repo) {
+  const gitlinks = findGitlinks(join49(repo, "shared"));
+  if (gitlinks.length === 0) return;
+  for (const p of gitlinks) {
+    const rel = relative5(repo, p);
+    fail(`gitlink: ${rel} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`);
+  }
+  const noun = gitlinks.length === 1 ? "entry" : "entries";
+  throw new NomadFatal(
+    `gitlink trap: ${gitlinks.length} nested .git ${noun} in shared/; remove before retry`
+  );
+}
+function guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule) {
+  const hasAllow = allowAll || allowRule !== void 0;
+  const wantsResolution = redactAll || hasAllow;
+  if (redactAll && hasAllow) {
+    die("--redact-all, --allow-all, and --allow are mutually exclusive resolution modes");
+  }
+  if (allowAll && allowRule !== void 0) {
+    die("--redact-all, --allow-all, and --allow are mutually exclusive resolution modes");
+  }
+  if (dryRun && wantsResolution) {
+    die(
+      "--redact-all, --allow-all, and --allow cannot be combined with --dry-run (dry-run resolves nothing)"
+    );
+  }
+}
+
+// src/commands.push.steps.ts
+init_config();
+
 // src/push-global-config.ts
 init_config();
 import { execFileSync as execFileSync18 } from "node:child_process";
@@ -6374,24 +6672,36 @@ function collectGlobalConfigChanges(repoHome2, hostname2, opts) {
   return changes;
 }
 
-// src/commands.push.ts
+// src/commands.push.steps.ts
 init_push_leak_verdict();
-init_push_checks();
 
 // src/push-preview.ts
 init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync39, mkdirSync as mkdirSync10, readdirSync as readdirSync15, rmSync as rmSync14 } from "node:fs";
+import { copyFileSync, existsSync as existsSync42, mkdirSync as mkdirSync11, readdirSync as readdirSync16, rmSync as rmSync14 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join46 } from "node:path";
+import { join as join50, relative as relative6, sep as sep8 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
 init_utils_json();
 var NOTHING_TO_SCAN_ROW = `${dim(infoGlyph)} nothing to scan, no leaks`;
-function stageSessions(tmpRoot, map) {
+function stageSessionDir(localDir, dstDir, changed) {
+  if (changed !== void 0) {
+    const prefix = `${localDir}${sep8}`;
+    const matching = [...changed].filter((p) => p.startsWith(prefix));
+    if (matching.length === 0) return false;
+    for (const src of matching) {
+      copyFileAtomic(src, join50(dstDir, relative6(localDir, src)));
+    }
+    return true;
+  }
+  copyDirJsonlOnly(localDir, dstDir);
+  return true;
+}
+function stageSessions(tmpRoot, map, changed) {
   if (typeof map.projects !== "object" || map.projects === null) return 0;
   const reverse = /* @__PURE__ */ new Map();
   for (const [logical, hosts] of Object.entries(map.projects)) {
@@ -6400,14 +6710,15 @@ function stageSessions(tmpRoot, map) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join46(claudeHome(), "projects");
-  if (!existsSync39(localProjects)) return 0;
+  const localProjects = join50(claudeHome(), "projects");
+  if (!existsSync42(localProjects)) return 0;
   let staged = 0;
-  for (const dir of readdirSync15(localProjects)) {
+  for (const dir of readdirSync16(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join46(localProjects, dir), join46(tmpRoot, "shared", "projects", logical));
-    staged++;
+    const localDir = join50(localProjects, dir);
+    const dstDir = join50(tmpRoot, "shared", "projects", logical);
+    if (stageSessionDir(localDir, dstDir, changed)) staged++;
   }
   return staged;
 }
@@ -6420,31 +6731,31 @@ function stageExtras(tmpRoot, map) {
     assertSafeLogical(logical);
     const localRoot = map.projects[logical]?.[HOST];
     if (!localRoot || localRoot === "TBD") continue;
-    for (const dirname8 of dirnames) {
-      if (!whitelist.includes(dirname8)) continue;
-      const src = join46(localRoot, dirname8);
-      if (!existsSync39(src)) continue;
-      const dst = join46(tmpRoot, "shared", "extras", logical, dirname8);
+    for (const dirname10 of dirnames) {
+      if (!whitelist.includes(dirname10)) continue;
+      const src = join50(localRoot, dirname10);
+      if (!existsSync42(src)) continue;
+      const dst = join50(tmpRoot, "shared", "extras", logical, dirname10);
       copyExtras(src, dst);
       staged++;
     }
   }
   return staged;
 }
-function previewPushLeaks(map) {
-  const cacheDir = join46(homedir5(), ".cache", "claude-nomad");
-  mkdirSync10(cacheDir, { recursive: true });
+function previewPushLeaks(map, opts = {}) {
+  const cacheDir = join50(homedir5(), ".cache", "claude-nomad");
+  mkdirSync11(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join46(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join50(cacheDir, `push-preview-tree-${stamp}`);
   try {
-    const sessionCount = stageSessions(tmpRoot, map);
+    const sessionCount = stageSessions(tmpRoot, map, opts.selection?.changed);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join46(repoHome(), ".gitleaksignore");
-    if (existsSync39(ignoreFile)) {
-      copyFileSync(ignoreFile, join46(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join50(repoHome(), ".gitleaksignore");
+    if (existsSync42(ignoreFile)) {
+      copyFileSync(ignoreFile, join50(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -6461,59 +6772,9 @@ function previewPushLeaks(map) {
   }
 }
 
-// src/commands.push.ts
+// src/commands.push.steps.ts
 init_utils();
-init_utils_fs();
-init_utils_json();
-function stripGsdHooksFromBase(repo, backup) {
-  const basePath = join47(repo, "shared", "settings.base.json");
-  if (!existsSync40(basePath)) return;
-  let base;
-  try {
-    base = readJson(basePath);
-  } catch {
-    return;
-  }
-  if (!baseHasGsdHookEntries(base)) return;
-  const stripped = stripGsdHookEntries(base);
-  const ts = freshBackupTs(backup);
-  backupRepoWrite(basePath, ts, repo);
-  writeJsonAtomic(basePath, stripped);
-}
-function reportSettingsAheadDrift(repo) {
-  const basePath = join47(repo, "shared", "settings.base.json");
-  if (!existsSync40(basePath)) return;
-  const settingsPath = join47(claudeHome(), "settings.json");
-  if (!existsSync40(settingsPath)) return;
-  try {
-    const base = readJson(basePath);
-    const hostPath = join47(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync40(hostPath) ? readJson(hostPath) : {};
-    const merged = deepMerge(base, overrides);
-    const settings = readJson(settingsPath);
-    const { ahead } = classifySettingsDrift(merged, settings);
-    const { promotable } = partitionByCaptureExclusion(ahead);
-    if (promotable.length === 0) return;
-    const { phrase, pronoun, verb } = describeSettings(promotable);
-    warn(
-      `your settings.json has ${phrase} that ${verb} not yet in the repo; run 'nomad capture-settings' to save ${pronoun} (or 'nomad capture-settings --host' for host-specific values).`
-    );
-  } catch {
-  }
-}
-function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join47(repo, "shared"));
-  if (gitlinks.length === 0) return;
-  for (const p of gitlinks) {
-    const rel = relative5(repo, p);
-    fail(`gitlink: ${rel} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`);
-  }
-  const noun = gitlinks.length === 1 ? "entry" : "entries";
-  throw new NomadFatal(
-    `gitlink trap: ${gitlinks.length} nested .git ${noun} in shared/; remove before retry`
-  );
-}
-async function commitAndPush(st, ts, map, redactAll, allowAll, allowRule, repo) {
+async function commitAndPush(st, ts, map, resolution, repo, newManifest) {
   gitOrFatal(["add", "-A"], "git add", repo);
   const staged = parsePorcelainZ2(gitStatusPorcelainZ(repo));
   const toDrop = staged.filter((p) => isGsdDropped(p));
@@ -6529,55 +6790,61 @@ async function commitAndPush(st, ts, map, redactAll, allowAll, allowRule, repo)
   let verdict = withSpinner("Scanning for secrets", () => scanPushVerdict(repo));
   if (verdict.leak) {
     renderPushTree(st, verdict);
-    verdict = await resolveLeakFindings(verdict, ts, map, { redactAll, allowAll, allowRule });
+    verdict = await resolveLeakFindings(verdict, ts, map, resolution);
   }
   gitOrFatal(["commit", "-m", `chore: sync from ${HOST}`], "git commit", repo);
   withSpinner("Pushing", () => gitOrFatal(["push"], "git push", repo));
+  try {
+    writeManifest(manifestPath(), newManifest);
+  } catch (err) {
+    warn(`could not write push manifest (next push will full-rescan): ${String(err)}`);
+  }
   renderPushTree(st, verdict);
 }
-function runDryRunPreview(st, map, repo) {
+function runDryRunPreview(st, map, repo, selection) {
   st.globalConfig = collectGlobalConfigChanges(repo, HOST, { staged: false });
   if (map === null) {
     renderNoScanTree(st, { noMapHint: true });
     return;
   }
-  const verdict = previewPushLeaks(map);
+  const verdict = withSpinner("Scanning for secrets", () => previewPushLeaks(map, { selection }));
   renderPushTree(st, verdict);
   if (verdict.recovery !== null) fail(verdict.recovery);
 }
-function guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule) {
-  const hasAllow = allowAll || allowRule !== void 0;
-  const wantsResolution = redactAll || hasAllow;
-  if (redactAll && hasAllow) {
-    die("--redact-all, --allow-all, and --allow are mutually exclusive resolution modes");
-  }
-  if (allowAll && allowRule !== void 0) {
-    die("--redact-all, --allow-all, and --allow are mutually exclusive resolution modes");
-  }
-  if (dryRun && wantsResolution) {
-    die(
-      "--redact-all, --allow-all, and --allow cannot be combined with --dry-run (dry-run resolves nothing)"
-    );
-  }
-}
+
+// src/commands.push.ts
+init_push_checks();
+init_utils();
+init_utils_fs();
 async function cmdPush(opts = {}) {
   const dryRun = opts.dryRun === true;
   const redactAll = opts.redactAll === true;
   const allowAll = opts.allowAll === true;
   const allowRule = opts.allowRule;
+  const fullScan = opts.fullScan === true;
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync40(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync43(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
     console.log(dryRun ? `push on host=${HOST} (dry-run)` : `push on host=${HOST}`);
     reportSettingsAheadDrift(repo);
-    probeGitleaks();
+    const scannerVersion = probeGitleaks();
+    const configHash = computeConfigHash();
+    const old = readManifest(manifestPath());
+    const mapPath = join51(repo, "path-map.json");
+    const { map, selection, newManifest } = loadSelectionForPush(
+      mapPath,
+      old,
+      scannerVersion,
+      configHash,
+      fullScan
+    );
     withSpinner("Rebasing onto origin", () => rebaseBeforePush(repo));
     const ts = freshBackupTs(backup);
-    const remap = withSpinner("Syncing sessions", () => remapPush(ts, { dryRun }));
+    const remap = withSpinner("Syncing sessions", () => remapPush(ts, { dryRun, selection }));
     const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
     if (!dryRun) {
       syncSkillsPush();
@@ -6591,15 +6858,13 @@ async function cmdPush(opts = {}) {
       renderNoScanTree(st);
       return;
     }
-    const mapPath = join47(repo, "path-map.json");
-    if (!existsSync40(mapPath)) {
-      if (dryRun) return runDryRunPreview(st, null, repo);
-      die("path-map.json missing, cannot enforce push allow-list");
+    if (map === null) {
+      if (dryRun) return runDryRunPreview(st, null, repo, selection);
+      return die("path-map.json missing, cannot enforce push allow-list");
     }
-    const map = readPathMap(mapPath);
     if (status) enforceAllowList(status, map);
-    if (dryRun) return runDryRunPreview(st, map, repo);
-    await commitAndPush(st, ts, map, redactAll, allowAll, allowRule, repo);
+    if (dryRun) return runDryRunPreview(st, map, repo, selection);
+    await commitAndPush(st, ts, map, { redactAll, allowAll, allowRule }, repo, newManifest);
   } catch (err) {
     if (err instanceof NomadFatal) {
       fail(err.message);
@@ -6656,18 +6921,18 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync41 } from "node:fs";
-import { join as join48 } from "node:path";
+import { existsSync as existsSync44 } from "node:fs";
+import { join as join52 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync41(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync44(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join48(repo, "path-map.json");
-    const map = existsSync41(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join52(repo, "path-map.json");
+    const map = existsSync44(mapPath) ? readPathMap(mapPath) : { projects: {} };
     computePreview(ts, map, "diff");
   } catch (err) {
     if (err instanceof NomadFatal) {
@@ -6681,8 +6946,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync43, mkdirSync as mkdirSync11, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join50 } from "node:path";
+import { existsSync as existsSync46, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join54 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -6764,33 +7029,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync42, rmSync as rmSync15, statSync as statSync10 } from "node:fs";
-import { join as join49 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync45, rmSync as rmSync15, statSync as statSync12 } from "node:fs";
+import { join as join53 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join49(claude, name);
-    if (!existsSync42(src)) continue;
-    const dst = join49(repo, "shared", name);
-    if (statSync10(src).isDirectory()) {
-      const gk = join49(dst, ".gitkeep");
-      if (existsSync42(gk)) rmSync15(gk);
+    const src = join53(claude, name);
+    if (!existsSync45(src)) continue;
+    const dst = join53(repo, "shared", name);
+    if (statSync12(src).isDirectory()) {
+      const gk = join53(dst, ".gitkeep");
+      if (existsSync45(gk)) rmSync15(gk);
       cpSync7(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join49(claude, "settings.json");
-  if (existsSync42(userSettings)) {
+  const userSettings = join53(claude, "settings.json");
+  if (existsSync45(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join49(repo, "hosts", `${HOST}.json`);
+    const hostFile = join53(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -6803,14 +7068,14 @@ var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.cl
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join50(repoHome2, "shared", "settings.base.json"),
-    join50(repoHome2, "shared", "CLAUDE.md"),
-    join50(repoHome2, "path-map.json"),
-    join50(repoHome2, "hosts"),
-    join50(repoHome2, "shared")
+    join54(repoHome2, "shared", "settings.base.json"),
+    join54(repoHome2, "shared", "CLAUDE.md"),
+    join54(repoHome2, "path-map.json"),
+    join54(repoHome2, "hosts"),
+    join54(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync43(c)) return c;
+    if (existsSync46(c)) return c;
   }
   return null;
 }
@@ -6822,31 +7087,31 @@ function cmdInit(opts = {}) {
   const keepActions = opts.keepActions === true;
   const repo = repoHome();
   const claude = claudeHome();
-  mkdirSync11(repo, { recursive: true });
+  mkdirSync12(repo, { recursive: true });
   const conflict = preflightConflict(repo);
   if (conflict !== null) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync11(join50(repo, "shared"), { recursive: true });
-  mkdirSync11(join50(repo, "hosts"), { recursive: true });
+  mkdirSync12(join54(repo, "shared"), { recursive: true });
+  mkdirSync12(join54(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync11(join50(repo, "shared", name), { recursive: true });
+    mkdirSync12(join54(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join50(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync43(userClaudeMd)) {
-    writeFileSync6(join50(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join54(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync46(userClaudeMd)) {
+    writeFileSync6(join54(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join50(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join54(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync6(join50(repo, "hosts", ".gitkeep"), "");
+  writeFileSync6(join54(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join50(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join54(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join50(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join54(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -6912,21 +7177,21 @@ function maybeDisableRepoActions(repoHome2, run) {
 // src/init.prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync44, readdirSync as readdirSync16, statSync as statSync11 } from "node:fs";
-import { join as join51 } from "node:path";
+import { existsSync as existsSync47, readdirSync as readdirSync17, statSync as statSync13 } from "node:fs";
+import { join as join55 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync44(path)) return false;
+  if (!existsSync47(path)) return false;
   try {
-    if (statSync11(path).isDirectory()) return readdirSync16(path).length > 0;
+    if (statSync13(path).isDirectory()) return readdirSync17(path).length > 0;
     return true;
   } catch {
     return false;
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync44(join51(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join51(claudeHome2, name)));
+  if (existsSync47(join55(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join55(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -7176,6 +7441,8 @@ function applyPushToken(argv, i, st) {
       return applyBool(st.allowAll, () => st.allowAll = true);
     case "--allow":
       return applyAllow2(argv, i, st);
+    case "--full-scan":
+      return applyBool(st.fullScan, () => st.fullScan = true);
     default:
       return REJECT;
   }
@@ -7185,7 +7452,8 @@ function parsePushArgs(argv) {
     dryRun: false,
     redactAll: false,
     allowAll: false,
-    allowRule: void 0
+    allowRule: void 0,
+    fullScan: false
   };
   let i = 3;
   while (i < argv.length) {
@@ -7202,14 +7470,15 @@ function parsePushArgs(argv) {
     dryRun: st.dryRun,
     redactAll: st.redactAll,
     allowAll: st.allowAll,
-    allowRule: st.allowRule
+    allowRule: st.allowRule,
+    fullScan: st.fullScan
   };
 }
 
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.55.0",
+  version: "0.56.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -7317,6 +7586,10 @@ var DEFAULT_HELP = [
   row("  push", "Rebase, run safety checks (gitleaks, gitlinks, allow-list), commit, push."),
   row("       --dry-run", "Run pre-checks (rebase, gitleaks probe, gitlink scan) and preview"),
   cont("remap, without staging or pushing."),
+  row("       --full-scan", "Ignore the per-host push manifest and rescan all transcripts."),
+  cont("On a successful non-dry-run push, rewrite the manifest from that full"),
+  cont("rescan. Use after a gitleaks upgrade or when in doubt. Composes freely"),
+  cont("with --dry-run and all resolution modes."),
   row("       --redact-all", "Redact all findings non-interactively (backup, no prompt); no TTY"),
   cont("required. Does not auto-Allow. Mutually exclusive with --allow*."),
   cont("Cannot combine with --dry-run."),
@@ -7430,15 +7703,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync45, readFileSync as readFileSync14, readdirSync as readdirSync17 } from "node:fs";
-import { join as join52 } from "node:path";
+import { existsSync as existsSync48, readFileSync as readFileSync15, readdirSync as readdirSync18 } from "node:fs";
+import { join as join56 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join52(claudeHome(), "projects");
-  if (!existsSync45(projectsRoot)) {
+  const projectsRoot = join56(claudeHome(), "projects");
+  if (!existsSync48(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -7452,8 +7725,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join52(repoHome(), "path-map.json");
-  if (!existsSync45(mapPath)) {
+  const mapPath = join56(repoHome(), "path-map.json");
+  if (!existsSync48(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -7475,14 +7748,14 @@ function resumeCmd(sessionId) {
   console.log(`cd ${shQuote(hit.localPath)} && claude --resume ${shQuote(sessionId)}`);
 }
 function findTranscriptPath(projectsRoot, sessionId) {
-  for (const dir of readdirSync17(projectsRoot)) {
-    const candidate = join52(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync45(candidate)) return candidate;
+  for (const dir of readdirSync18(projectsRoot)) {
+    const candidate = join56(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync48(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync14(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync15(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);
@@ -7542,7 +7815,7 @@ try {
       const pushArgs = parsePushArgs(process.argv);
       if (pushArgs === null) {
         console.error(
-          "usage: nomad push [--dry-run] [--redact-all] [--allow <rule>] [--allow-all]"
+          "usage: nomad push [--dry-run] [--full-scan] [--redact-all] [--allow <rule>] [--allow-all]"
         );
         process.exit(1);
       }
@@ -7550,7 +7823,8 @@ try {
         dryRun: pushArgs.dryRun,
         redactAll: pushArgs.redactAll,
         allowAll: pushArgs.allowAll,
-        allowRule: pushArgs.allowRule
+        allowRule: pushArgs.allowRule,
+        fullScan: pushArgs.fullScan
       });
       break;
     }