claude-nomad 0.55.1 → 0.56.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.56.0](https://github.com/funkadelic/claude-nomad/compare/v0.55.1...v0.56.0) (2026-06-30)
+
+
+### Added
+
+* **push:** incremental leak scan (scan only new or changed transcripts) ([#368](https://github.com/funkadelic/claude-nomad/issues/368)) ([02c771a](https://github.com/funkadelic/claude-nomad/commit/02c771a680642ca3248a2f0d8e4196f6421dd967))
+
+
+### Changed
+
+* **push:** extract manifest selection into its own module ([#370](https://github.com/funkadelic/claude-nomad/issues/370)) ([a6960dc](https://github.com/funkadelic/claude-nomad/commit/a6960dcf1d9489791a6810d083021e74a48eec79))
+* **push:** split commands.push.ts settings, guards, and steps into modules ([#371](https://github.com/funkadelic/claude-nomad/issues/371)) ([2b5a0a9](https://github.com/funkadelic/claude-nomad/commit/2b5a0a9f53d7af460bd74166018f3011f7b67392))
+
+
+### Testing
+
+* raise vitest timeouts and cap worker oversubscription to reduce flake ([#372](https://github.com/funkadelic/claude-nomad/issues/372)) ([51083d7](https://github.com/funkadelic/claude-nomad/commit/51083d73c3e581a61a17b0eea6f00f22eb2c176b))
+
 ## [0.55.1](https://github.com/funkadelic/claude-nomad/compare/v0.55.0...v0.55.1) (2026-06-29)
 
 

package/README.md

@@ -41,7 +41,9 @@ survives different file paths and your secrets never ride along.
   credentials never sync, and gitleaks scans the exact files about to be published. The push aborts
   on any hit, with an interactive menu to redact, allow, or drop the finding. Always publish through
   `nomad push`: the sync repo is an ordinary Git repo, so a manual `git push` from it skips the scan
-  entirely and can leak a secret that `nomad push` would have caught.
+  entirely and can leak a secret that `nomad push` would have caught. Steady-state pushes scan only
+  the transcripts that changed since the last successful push (incremental); a cold start, a
+  gitleaks version change, a config file change, or `--full-scan` forces a full rescan.
 - **Preview before you trust it.** `nomad diff` shows offline what a pull would change (gsd-owned
   hook churn is filtered the same as on pull, so the preview matches what a real pull writes), and
   `--dry-run` on pull and push prints the plan without writing anything.
@@ -166,6 +168,10 @@ log output remains grep-stable.
 When `nomad push` detects a potential secret, it drops into an interactive menu (TTY) or aborts with
 a recovery hint (non-TTY/CI). Three non-interactive recovery paths are available without the menu:
 
+- `nomad push --full-scan` -- ignore the per-host push manifest and rescan all transcripts, then
+  rewrite the manifest on success. Use this after upgrading gitleaks, after editing a gitleaks
+  config file, or whenever you want to be certain nothing slipped through an incremental scan.
+  Composes freely with `--dry-run` and all resolution modes.
 - `nomad push --redact-all` -- scrub every finding from the local transcript in place, then push.
   All-or-nothing: if any finding cannot be redacted (an active session, or one that does not map to
   a synced transcript), nothing is changed and the push stops so you can handle those sessions.