claude-nomad 0.56.1 → 0.57.0

package/dist/nomad.mjs

@@ -198,6 +198,13 @@ function gitCaptureRaw(args, cwd) {
     maxBuffer: 64 * 1024 * 1024
   }).toString();
 }
+function gitCaptureBuffer(args, cwd) {
+  return execFileSync("git", args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 64 * 1024 * 1024
+  });
+}
 function gitOrFatal(args, context, cwd) {
   try {
     execFileSync("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
@@ -207,12 +214,13 @@ function gitOrFatal(args, context, cwd) {
     throw new NomadFatal(`${context} failed`);
   }
 }
-var log, warn, fail, item, NomadFatal, die, gitStatusPorcelainZ;
+var log, ok, warn, fail, item, NomadFatal, die, gitStatusPorcelainZ;
 var init_utils = __esm({
   "src/utils.ts"() {
     "use strict";
     init_color();
     log = (msg) => console.log(`${dim(infoGlyph)} ${msg}`);
+    ok = (msg) => console.log(`${green(okGlyph)} ${msg}`);
     warn = (msg) => {
       console.error(`${yellow(warnGlyph)} ${msg}`);
     };
@@ -461,7 +469,7 @@ var init_config = __esm({
       "hosts/",
       "path-map.json",
       ".gitleaksignore",
-      // written by nomad push Allow action (D-04)
+      // written by nomad push Allow action
       ".gitleaks.overlay.toml"
       // user-owned gitleaks allowlist overlay layered on the bundled base
     ];
@@ -2110,8 +2118,8 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync31 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { join as join38 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
@@ -2551,28 +2559,42 @@ init_config();
 // src/extras-sync.diff.ts
 init_utils();
 import { execFileSync as execFileSync2 } from "node:child_process";
-function labelDiffLine(line) {
-  const tab = line.indexOf("	");
-  if (tab === -1) return line;
-  const status = line.slice(0, tab);
-  const path = line.slice(tab + 1);
-  if (status === "D") return `${path} (local only)`;
-  if (status === "A") return `${path} (repo only)`;
-  return path;
+import { relative as relative2 } from "node:path";
+function parseNameStatus(stdout) {
+  const entries = [];
+  for (const line of stdout.split("\n")) {
+    if (line.length === 0) continue;
+    const tab = line.indexOf("	");
+    if (tab === -1) continue;
+    entries.push({ status: line.slice(0, tab), path: line.slice(tab + 1) });
+  }
+  return entries;
+}
+function labelEntry(entry) {
+  if (entry.status === "D") return `${entry.path} (local only)`;
+  if (entry.status === "A") return `${entry.path} (repo only)`;
+  return entry.path;
 }
 function parseDiffOutput(stdout) {
-  return stdout.split("\n").filter((line) => line.length > 0).map(labelDiffLine);
+  return parseNameStatus(stdout).map(labelEntry);
 }
-function listDivergingFiles(a, b) {
+function parseModifiedPaths(stdout, a) {
+  return parseNameStatus(stdout).filter((entry) => entry.status === "M").map((entry) => relative2(a, entry.path));
+}
+function runNameStatusDiff(a, b, parse) {
   try {
-    const stdout = execFileSync2("git", ["diff", "--no-index", "--name-status", a, b], {
-      stdio: ["ignore", "pipe", "pipe"]
-    }).toString();
-    return parseDiffOutput(stdout);
+    const stdout = execFileSync2(
+      "git",
+      ["diff", "--no-index", "--no-renames", "--name-status", a, b],
+      {
+        stdio: ["ignore", "pipe", "pipe"]
+      }
+    ).toString();
+    return parse(stdout);
   } catch (err) {
     const e = err;
     if (e.status === 1 && e.stdout !== void 0) {
-      return parseDiffOutput(e.stdout.toString());
+      return parse(e.stdout.toString());
     }
     if (e.code === "ENOENT") {
       warn(`git not on PATH; divergence check skipped for ${a}`);
@@ -2582,6 +2604,12 @@ function listDivergingFiles(a, b) {
     return [];
   }
 }
+function listDivergingFiles(a, b) {
+  return runNameStatusDiff(a, b, parseDiffOutput);
+}
+function listDivergingModified(a, b) {
+  return runNameStatusDiff(a, b, (stdout) => parseModifiedPaths(stdout, a));
+}
 
 // src/commands.doctor.checks.skills.ts
 function stripSideIndicator(line) {
@@ -2591,15 +2619,15 @@ function stripSideIndicator(line) {
 }
 function isGsdDiffLine(line, localBase, sharedBase) {
   const bare = stripSideIndicator(line);
-  let relative7;
+  let relative9;
   if (bare.startsWith(localBase + "/")) {
-    relative7 = bare.slice(localBase.length + 1);
+    relative9 = bare.slice(localBase.length + 1);
   } else if (bare.startsWith(sharedBase + "/")) {
-    relative7 = bare.slice(sharedBase.length + 1);
+    relative9 = bare.slice(sharedBase.length + 1);
   } else {
-    relative7 = bare;
+    relative9 = bare;
   }
-  return relative7.split("/")[0].startsWith(GSD_PREFIX);
+  return relative9.split("/")[0].startsWith(GSD_PREFIX);
 }
 function reportSkillsDivergence(section2) {
   const sharedSkills = join14(repoHome(), "shared", "skills");
@@ -2632,7 +2660,7 @@ init_color();
 init_config();
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync15 } from "node:fs";
-import { join as join18, relative as relative2 } from "node:path";
+import { join as join18, relative as relative3 } from "node:path";
 init_commands_pull_wedge();
 init_push_checks();
 init_utils();
@@ -2659,7 +2687,7 @@ function reportGitlinks(section2) {
   if (existsSync15(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
-      const rel = relative2(repo, p);
+      const rel = relative3(repo, p);
       addItem(
         section2,
         `${red(failGlyph)} gitlink: ${blue(rel)} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`
@@ -2936,9 +2964,9 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync9, rmSync as rmSync8 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync10, rmSync as rmSync9 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
@@ -3035,8 +3063,22 @@ init_config();
 
 // src/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync4, existsSync as existsSync19, mkdirSync as mkdirSync5, readdirSync as readdirSync8, renameSync as renameSync3, rmSync as rmSync7, statSync as statSync5 } from "node:fs";
-import { dirname as dirname4, join as join24, relative as relative3, sep as sep3 } from "node:path";
+import {
+  cpSync as cpSync5,
+  existsSync as existsSync20,
+  lstatSync as lstatSync9,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync9,
+  renameSync as renameSync3,
+  rmSync as rmSync8,
+  statSync as statSync5
+} from "node:fs";
+import { dirname as dirname4, join as join25, relative as relative5, sep as sep3 } from "node:path";
+
+// src/extras-sync.core.ts
+init_config();
+import { cpSync as cpSync4, existsSync as existsSync18, lstatSync as lstatSync8, readdirSync as readdirSync7, readFileSync as readFileSync6, rmSync as rmSync7 } from "node:fs";
+import { basename, join as join23, relative as relative4 } from "node:path";
 
 // src/extras-sync.guards.ts
 init_utils();
@@ -3055,6 +3097,180 @@ function assertSafeLocalRoot(localRoot, logical) {
   }
 }
 
+// src/extras-sync.core.ts
+init_utils();
+init_utils_json();
+function loadValidatedExtras(opts) {
+  const repo = repoHome();
+  const mapPath = join23(repo, "path-map.json");
+  const repoExtras = join23(repo, "shared", "extras");
+  if (!existsSync18(mapPath) || opts.requireRepoExtras === true && !existsSync18(repoExtras)) {
+    if (opts.missingMsg !== void 0) log(opts.missingMsg);
+    return null;
+  }
+  const map = readPathMap(mapPath);
+  const extrasMap = map.extras ?? {};
+  if (Object.keys(extrasMap).length === 0) return null;
+  for (const logical of Object.keys(extrasMap)) {
+    assertSafeLogical(logical);
+    const localRoot = map.projects[logical]?.[HOST];
+    if (localRoot && localRoot !== "TBD") assertSafeLocalRoot(localRoot, logical);
+  }
+  return { map, extrasMap };
+}
+function* eachExtrasTarget(v, counts) {
+  const whitelist = SUPPORTED_EXTRAS;
+  for (const [logical, dirnames] of Object.entries(v.extrasMap)) {
+    const localRoot = v.map.projects[logical]?.[HOST];
+    if (!localRoot || localRoot === "TBD") {
+      counts.unmapped++;
+      continue;
+    }
+    for (const dirname10 of dirnames) {
+      if (!whitelist.includes(dirname10)) {
+        counts.skipped++;
+        continue;
+      }
+      yield { logical, localRoot, dirname: dirname10 };
+    }
+  }
+}
+function stripCollidingDstSymlinks(src, dst, isExcluded) {
+  if (!existsSync18(dst)) return;
+  for (const name of readdirSync7(src)) {
+    if (isExcluded(name)) continue;
+    const dstPath = join23(dst, name);
+    const dstStat = lstatSync8(dstPath, { throwIfNoEntry: false });
+    if (dstStat === void 0) continue;
+    if (dstStat.isSymbolicLink()) {
+      rmSync7(dstPath, { recursive: true, force: true });
+    } else if (dstStat.isDirectory() && lstatSync8(join23(src, name)).isDirectory()) {
+      stripCollidingDstSymlinks(join23(src, name), dstPath, isExcluded);
+    }
+  }
+}
+function cpSyncGuarded(src, dst, filter, label) {
+  try {
+    cpSync4(src, dst, { recursive: true, force: true, verbatimSymlinks: true, filter });
+  } catch (err) {
+    const e = err;
+    if (e.code === "EINVAL" || e.code === "ENOTEMPTY" || e.code === "ERR_FS_CP_NON_DIR_TO_DIR" || e.code === "ERR_FS_CP_DIR_TO_NON_DIR") {
+      throw new NomadFatal(
+        `${label}: type collision copying ${JSON.stringify(src)} -> ${JSON.stringify(dst)} (${e.path ?? "unknown path"}): a file/directory type changed upstream; run nomad pull --force-remote to recover`
+      );
+    }
+    throw err;
+  }
+}
+function copyExtrasOverlayFiltered(src, dst, blockSet) {
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSyncGuarded(
+    src,
+    dst,
+    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry)),
+    "copyExtrasOverlayFiltered"
+  );
+}
+function copyExtrasOverlaySkipDiverged(src, dst, blockSet, divergedSet) {
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSyncGuarded(
+    src,
+    dst,
+    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry)) && !divergedSet.has(relative4(src, srcEntry)),
+    "copyExtrasOverlaySkipDiverged"
+  );
+}
+function copyExtras(src, dst) {
+  rmSync7(dst, { recursive: true, force: true });
+  cpSync4(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
+}
+function copyExtrasFileSkipDiverged(src, dst) {
+  if (existsSync18(dst)) {
+    let dstBuf;
+    try {
+      dstBuf = readFileSync6(dst);
+    } catch {
+      return;
+    }
+    if (!readFileSync6(src).equals(dstBuf)) return;
+  }
+  copyExtras(src, dst);
+}
+function extrasDenySet(dirname10) {
+  return dirname10 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+}
+function copyExtrasFiltered(src, dst, blockSet) {
+  rmSync7(dst, { recursive: true, force: true });
+  cpSync4(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry))
+  });
+}
+function prunePreservingDenied(src, dst, blockSet) {
+  for (const name of readdirSync7(dst)) {
+    if (isDeniedName(blockSet, name)) continue;
+    const dstPath = join23(dst, name);
+    const srcStat = lstatSync8(join23(src, name), { throwIfNoEntry: false });
+    if (srcStat === void 0) {
+      rmSync7(dstPath, { recursive: true, force: true });
+      continue;
+    }
+    const dstStat = lstatSync8(dstPath);
+    if (srcStat.isDirectory() && dstStat.isDirectory()) {
+      prunePreservingDenied(join23(src, name), dstPath, blockSet);
+    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
+      rmSync7(dstPath, { recursive: true, force: true });
+    }
+  }
+}
+function copyExtrasFilteredPreserving(src, dst, blockSet) {
+  const dstStat = lstatSync8(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0) {
+    if (dstStat.isDirectory()) prunePreservingDenied(src, dst, blockSet);
+    else rmSync7(dst, { recursive: true, force: true });
+  }
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSync4(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry))
+  });
+}
+function prunePreservingBy(src, dst, isPreserved) {
+  for (const name of readdirSync7(dst)) {
+    if (isPreserved(name)) continue;
+    const dstPath = join23(dst, name);
+    const srcStat = lstatSync8(join23(src, name), { throwIfNoEntry: false });
+    if (srcStat === void 0) {
+      rmSync7(dstPath, { recursive: true, force: true });
+      continue;
+    }
+    const dstStat = lstatSync8(dstPath);
+    if (srcStat.isDirectory() && dstStat.isDirectory()) {
+      prunePreservingBy(join23(src, name), dstPath, isPreserved);
+    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
+      rmSync7(dstPath, { recursive: true, force: true });
+    }
+  }
+}
+function copyExtrasFilteredPreservingBy(src, dst, isPreserved) {
+  const dstStat = lstatSync8(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0) {
+    if (dstStat.isDirectory()) prunePreservingBy(src, dst, isPreserved);
+    else rmSync7(dst, { recursive: true, force: true });
+  }
+  stripCollidingDstSymlinks(src, dst, isPreserved);
+  cpSync4(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isPreserved(basename(srcEntry))
+  });
+}
+
 // src/remap.ts
 init_config();
 
@@ -3063,8 +3279,8 @@ init_config();
 init_push_gitleaks_config();
 init_utils_fs();
 import { createHash } from "node:crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync7, readFileSync as readFileSync6, statSync as statSync4 } from "node:fs";
-import { dirname as dirname3, join as join23 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync4, readdirSync as readdirSync8, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import { dirname as dirname3, join as join24 } from "node:path";
 function isChanged(prev, cur, hash) {
   if (prev === void 0) return true;
   if (prev.size !== cur.size) return true;
@@ -3101,11 +3317,11 @@ function shouldFullRescan(old, scannerVersion, configHash, forceFlag) {
   return false;
 }
 function hashFile(absPath) {
-  return createHash("sha256").update(readFileSync6(absPath)).digest("hex");
+  return createHash("sha256").update(readFileSync7(absPath)).digest("hex");
 }
 function enumerateDir(dir, results) {
-  for (const entry of readdirSync7(dir)) {
-    const fullPath = join23(dir, entry);
+  for (const entry of readdirSync8(dir)) {
+    const fullPath = join24(dir, entry);
     const st = statSync4(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -3116,8 +3332,8 @@ function enumerateDir(dir, results) {
 }
 function enumerateSourceFiles(projectDir) {
   const results = [];
-  for (const entry of readdirSync7(projectDir)) {
-    const fullPath = join23(projectDir, entry);
+  for (const entry of readdirSync8(projectDir)) {
+    const fullPath = join24(projectDir, entry);
     const st = statSync4(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -3129,15 +3345,15 @@ function enumerateSourceFiles(projectDir) {
 }
 function fileIdentity(p) {
   if (p === null) return "none::absent";
-  if (!existsSync18(p)) return `${p}::absent`;
-  return `${p}::${createHash("sha256").update(readFileSync6(p)).digest("hex")}`;
+  if (!existsSync19(p)) return `${p}::absent`;
+  return `${p}::${createHash("sha256").update(readFileSync7(p)).digest("hex")}`;
 }
 function computeConfigHash() {
   const repo = repoHome();
   const parts = [
     fileIdentity(resolveTomlPath(repo)),
-    fileIdentity(join23(repo, ".gitleaks.overlay.toml")),
-    fileIdentity(join23(repo, ".gitleaksignore"))
+    fileIdentity(join24(repo, ".gitleaks.overlay.toml")),
+    fileIdentity(join24(repo, ".gitleaksignore"))
   ];
   return createHash("sha256").update(parts.join("\n")).digest("hex");
 }
@@ -3148,7 +3364,7 @@ function isManifestShape(raw) {
 }
 function readManifest(path) {
   try {
-    const raw = readFileSync6(path, "utf8");
+    const raw = readFileSync7(path, "utf8");
     const parsed = JSON.parse(raw);
     if (!isManifestShape(parsed)) return null;
     return parsed;
@@ -3171,18 +3387,19 @@ init_utils_json();
 var TMP_SUFFIX = ".nomad-tmp";
 function atomicMirror(src, dst, options) {
   const tmp = `${dst}${TMP_SUFFIX}`;
-  rmSync7(tmp, { recursive: true, force: true });
-  cpSync4(src, tmp, options);
-  rmSync7(dst, { recursive: true, force: true });
+  rmSync8(tmp, { recursive: true, force: true });
+  cpSync5(src, tmp, options);
+  rmSync8(dst, { recursive: true, force: true });
   renameSync3(tmp, dst);
 }
-function copyDir(src, dst) {
-  atomicMirror(src, dst, { recursive: true, force: true });
+function overlaySessionDir(src, dst) {
+  stripCollidingDstSymlinks(src, dst, () => false);
+  cpSyncGuarded(src, dst, void 0, "overlaySessionDir");
 }
 function copyFileAtomic(src, dst) {
   mkdirSync5(dirname4(dst), { recursive: true });
   const tmp = `${dst}.tmp.${process.pid}`;
-  cpSync4(src, tmp, { force: true, preserveTimestamps: true });
+  cpSync5(src, tmp, { force: true, preserveTimestamps: true });
   renameSync3(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
@@ -3198,12 +3415,12 @@ function applySelective(sel, localDir, repoDst) {
   const prefix = `${localDir}${sep3}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
-    copyFileAtomic(src, join24(repoDst, relative3(localDir, src)));
+    copyFileAtomic(src, join25(repoDst, relative5(localDir, src)));
   }
   for (const src of sel.deleted) {
     if (!src.startsWith(prefix)) continue;
-    const dst = join24(repoDst, relative3(localDir, src));
-    if (existsSync19(dst)) rmSync7(dst);
+    const dst = join25(repoDst, relative5(localDir, src));
+    if (existsSync20(dst)) rmSync8(dst);
   }
 }
 function copyDirJsonlOnly(src, dst) {
@@ -3211,7 +3428,7 @@ function copyDirJsonlOnly(src, dst) {
     recursive: true,
     force: true,
     filter: (srcPath) => {
-      const rel = relative3(src, srcPath);
+      const rel = relative5(src, srcPath);
       if (rel === "") return true;
       if (rel.split(sep3).length > 1) return true;
       if (statSync5(srcPath).isDirectory()) return true;
@@ -3232,15 +3449,15 @@ function remapPull(ts, opts = {}) {
   const wouldPull = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join24(repo, "path-map.json");
-  const repoProjects = join24(repo, "shared", "projects");
-  if (!existsSync19(mapPath) || !existsSync19(repoProjects)) {
+  const mapPath = join25(repo, "path-map.json");
+  const repoProjects = join25(repo, "shared", "projects");
+  if (!existsSync20(mapPath) || !existsSync20(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join24(claude, "projects");
+  const localProjects = join25(claude, "projects");
   if (!dryRun) mkdirSync5(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -3250,9 +3467,9 @@ function remapPull(ts, opts = {}) {
       continue;
     }
     assertSafeLocalRoot(localPath, logical);
-    const src = join24(repoProjects, logical);
-    if (!existsSync19(src)) continue;
-    const dst = join24(localProjects, encodePath(localPath));
+    const src = join25(repoProjects, logical);
+    if (!existsSync20(src)) continue;
+    const dst = join25(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -3263,11 +3480,44 @@ function remapPull(ts, opts = {}) {
       continue;
     }
     backupBeforeWrite(dst, ts);
-    copyDir(src, dst);
+    overlaySessionDir(src, dst);
     pulled.push(logical);
   }
   return { unmapped, pulled, wouldPull };
 }
+function countLocalOnly(src, dst) {
+  let count = 0;
+  for (const name of readdirSync9(dst)) {
+    const dstPath = join25(dst, name);
+    const srcPath = join25(src, name);
+    if (lstatSync9(dstPath).isDirectory()) {
+      count += countLocalOnly(srcPath, dstPath);
+    } else if (lstatSync9(srcPath, { throwIfNoEntry: false }) === void 0) {
+      count++;
+    }
+  }
+  return count;
+}
+function scanLocalOnly() {
+  const repo = repoHome();
+  const claude = claudeHome();
+  const mapPath = join25(repo, "path-map.json");
+  const repoProjects = join25(repo, "shared", "projects");
+  if (!existsSync20(mapPath) || !existsSync20(repoProjects)) return 0;
+  const map = readPathMap(mapPath);
+  const localProjects = join25(claude, "projects");
+  let count = 0;
+  for (const [logical, hosts] of Object.entries(map.projects)) {
+    assertSafeLogical(logical);
+    const localPath = hosts[HOST];
+    if (!localPath || localPath === "TBD") continue;
+    assertSafeLocalRoot(localPath, logical);
+    const dst = join25(localProjects, encodePath(localPath));
+    if (!existsSync20(dst)) continue;
+    count += countLocalOnly(join25(repoProjects, logical), dst);
+  }
+  return count;
+}
 function buildReverseMap(map) {
   const reverse = /* @__PURE__ */ new Map();
   const encodedPaths = /* @__PURE__ */ new Map();
@@ -3299,26 +3549,26 @@ function remapPush(ts, opts = {}) {
   const wouldPush = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join24(repo, "path-map.json");
-  if (!existsSync19(mapPath)) {
+  const mapPath = join25(repo, "path-map.json");
+  if (!existsSync20(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join24(claude, "projects");
-  const repoProjects = join24(repo, "shared", "projects");
+  const localProjects = join25(claude, "projects");
+  const repoProjects = join25(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync19(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync20(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync5(repoProjects, { recursive: true });
-  for (const dir of readdirSync8(localProjects)) {
+  for (const dir of readdirSync9(localProjects)) {
     if (dir.endsWith(TMP_SUFFIX)) continue;
     const logical = reverse.get(dir);
     if (!logical) {
       unmapped++;
       continue;
     }
-    const localDir = join24(localProjects, dir);
-    const repoDst = join24(repoProjects, logical);
+    const localDir = join25(localProjects, dir);
+    const repoDst = join25(repoProjects, logical);
     if (skipForSelection(opts.selection, localDir)) continue;
     if (dryRun) {
       wouldPush.push(logical);
@@ -3342,8 +3592,8 @@ function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
   const repo = repoHome();
-  const mapPath = join25(repo, "path-map.json");
-  if (!existsSync20(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join26(repo, "path-map.json");
+  if (!existsSync21(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -3360,12 +3610,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join25(claudeHome(), "projects");
-  if (!existsSync20(localProjects)) return { logicalToEncoded, staged, malformed: false };
-  for (const dir of readdirSync9(localProjects)) {
+  const localProjects = join26(claudeHome(), "projects");
+  if (!existsSync21(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  for (const dir of readdirSync10(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join25(localProjects, dir), join25(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join26(localProjects, dir), join26(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -3396,11 +3646,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
 }
 function reportCheckShared(section2, gitleaksReady) {
   if (!ensureGitleaksReady(section2, gitleaksReady)) return;
-  const cacheDir = join25(homedir4(), ".cache", "claude-nomad");
+  const cacheDir = join26(homedir4(), ".cache", "claude-nomad");
   mkdirSync6(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const reportPath = join25(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join25(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join26(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join26(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -3414,19 +3664,19 @@ function reportCheckShared(section2, gitleaksReady) {
     }
     scanAndReport(section2, tmpRoot, staged, logicalToEncoded);
   } finally {
-    rmSync8(reportPath, { force: true });
-    rmSync8(tmpRoot, { recursive: true, force: true });
+    rmSync9(reportPath, { force: true });
+    rmSync9(tmpRoot, { recursive: true, force: true });
   }
 }
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync21, readFileSync as readFileSync7, readdirSync as readdirSync10, realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname5, extname, join as join26 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync8, readdirSync as readdirSync11, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname5, extname, join as join27 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
-    const parsed = JSON.parse(readFileSync7(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(pkgPath, "utf8"));
     return parsed.type === "module" ? "esm" : "cjs";
   } catch {
     return "cjs";
@@ -3444,8 +3694,8 @@ function effectiveType(hookPath) {
   }
   let dir = dirname5(real);
   for (; ; ) {
-    const pkg = join26(dir, "package.json");
-    if (existsSync21(pkg)) return typeFromPackageJson(pkg);
+    const pkg = join27(dir, "package.json");
+    if (existsSync22(pkg)) return typeFromPackageJson(pkg);
     const parent = dirname5(dir);
     if (parent === dir) return "cjs";
     dir = parent;
@@ -3474,28 +3724,28 @@ function remedy(family) {
 }
 function safeReaddir2(dir) {
   try {
-    return readdirSync10(dir);
+    return readdirSync11(dir);
   } catch {
     return [];
   }
 }
 function safeRead(path) {
   try {
-    return readFileSync7(path, "utf8");
+    return readFileSync8(path, "utf8");
   } catch {
     return null;
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join26(claudeHome(), "hooks");
-  if (!existsSync21(hooksDir)) {
+  const hooksDir = join27(claudeHome(), "hooks");
+  if (!existsSync22(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join26(hooksDir, name);
+    const abs = join27(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -3515,8 +3765,8 @@ function reportHookScopeCheck(section2) {
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync22 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { join as join28 } from "node:path";
 init_config();
 function expandHome(token) {
   const h2 = home();
@@ -3559,7 +3809,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync22(resolved)) continue;
+        if (existsSync23(resolved)) continue;
         addItem(
           section2,
           `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
@@ -3572,8 +3822,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join27(claudeHome(), "settings.json");
-  if (!existsSync22(settingsPath)) {
+  const settingsPath = join28(claudeHome(), "settings.json");
+  if (!existsSync23(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -3596,12 +3846,12 @@ function reportHooksTargetCheck(section2) {
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.ts
 init_color();
-import { existsSync as existsSync24, readFileSync as readFileSync8 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync9 } from "node:fs";
+import { join as join30 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync23, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname6, join as join28, resolve as resolve2 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync24, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname6, join as join29, resolve as resolve2 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
   const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
@@ -3633,12 +3883,12 @@ function topRelativeSpecifiers(src) {
 }
 function specifierIsMissing(specifier, baseDir) {
   const base = resolve2(baseDir, specifier);
-  if (existsSync23(base)) return false;
+  if (existsSync24(base)) return false;
   for (const ext of [".js", ".cjs", ".mjs"]) {
-    if (existsSync23(base + ext)) return false;
+    if (existsSync24(base + ext)) return false;
   }
   for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
-    if (existsSync23(join28(base, idx))) return false;
+    if (existsSync24(join29(base, idx))) return false;
   }
   return true;
 }
@@ -3693,10 +3943,10 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join29(repoHome(), "path-map.json");
-  if (!existsSync24(mapPath)) return { projects: {} };
+  const mapPath = join30(repoHome(), "path-map.json");
+  if (!existsSync25(mapPath)) return { projects: {} };
   try {
-    return JSON.parse(readFileSync8(mapPath, "utf8"));
+    return JSON.parse(readFileSync9(mapPath, "utf8"));
   } catch {
     return { projects: {} };
   }
@@ -3767,8 +4017,8 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join29(claudeHome(), "settings.json");
-  if (!existsSync24(settingsPath)) {
+  const settingsPath = join30(claudeHome(), "settings.json");
+  if (!existsSync25(settingsPath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
@@ -3777,7 +4027,7 @@ function reportPreserveSymlinksCheck(section2) {
   }
   let settings;
   try {
-    settings = JSON.parse(readFileSync8(settingsPath, "utf8"));
+    settings = JSON.parse(readFileSync9(settingsPath, "utf8"));
   } catch {
     return;
   }
@@ -3801,8 +4051,8 @@ function reportPreserveSymlinksCheck(section2) {
 
 // src/commands.doctor.checks.settings-drift.ts
 init_color();
-import { existsSync as existsSync25, readFileSync as readFileSync9 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync10 } from "node:fs";
+import { join as join31 } from "node:path";
 init_config();
 init_utils_json();
 function diffMergedSettings(merged, settings) {
@@ -3811,7 +4061,7 @@ function diffMergedSettings(merged, settings) {
 }
 function tryReadJson(filePath) {
   try {
-    const raw = readFileSync9(filePath, "utf8");
+    const raw = readFileSync10(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
@@ -3820,7 +4070,7 @@ function tryReadJson(filePath) {
   }
 }
 function reportHooksBaseSelfCleanNote(section2) {
-  const basePath = join30(repoHome(), "shared", "settings.base.json");
+  const basePath = join31(repoHome(), "shared", "settings.base.json");
   const base = tryReadJson(basePath);
   if (base === null) return;
   if (!baseHasGsdHookEntries(base)) return;
@@ -3833,14 +4083,14 @@ function reportSettingsDriftCheck(section2) {
   const claude = claudeHome();
   const repo = repoHome();
   const host = HOST;
-  const settingsPath = join30(claude, "settings.json");
-  const basePath = join30(repo, "shared", "settings.base.json");
-  const hostPath = join30(repo, "hosts", `${host}.json`);
-  if (!existsSync25(settingsPath)) {
+  const settingsPath = join31(claude, "settings.json");
+  const basePath = join31(repo, "shared", "settings.base.json");
+  const hostPath = join31(repo, "hosts", `${host}.json`);
+  if (!existsSync26(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
     return;
   }
-  if (!existsSync25(basePath)) {
+  if (!existsSync26(basePath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
@@ -3859,7 +4109,7 @@ function reportSettingsDriftCheck(section2) {
   if (settings === null) {
     return;
   }
-  const hostExists = existsSync25(hostPath);
+  const hostExists = existsSync26(hostPath);
   const hostObj = hostExists ? tryReadJson(hostPath) : null;
   if (hostExists && hostObj === null) {
     addItem(
@@ -3908,12 +4158,12 @@ init_config();
 
 // src/commands.doctor.engine.ts
 init_color();
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/commands.doctor.version.ts
 init_color();
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_config();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -3930,7 +4180,7 @@ function compareSemver(a, b) {
 function readLocalVersion() {
   try {
     const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync10(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync11(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
     }
@@ -3989,7 +4239,7 @@ function parseMinVersion(spec) {
 function readEnginesNode() {
   try {
     const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
-    const parsed = JSON.parse(readFileSync11(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync12(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
     return null;
@@ -4017,44 +4267,44 @@ function reportNodeEngineCheck(section2) {
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync29 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
-import { readFileSync as readFileSync14, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join35 } from "node:path";
+import { readFileSync as readFileSync15, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join36 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/commands.push.recovery.actions.ts
 init_config();
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep5 } from "node:path";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync5, existsSync as existsSync28, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
-import { dirname as dirname8, join as join33, sep as sep4 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync29, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
+import { dirname as dirname8, join as join34, sep as sep4 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync27, statSync as statSync7 } from "node:fs";
-import { dirname as dirname7, join as join32 } from "node:path";
+import { existsSync as existsSync28, statSync as statSync7 } from "node:fs";
+import { dirname as dirname7, join as join33 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync26, lstatSync as lstatSync8, readFileSync as readFileSync12, readdirSync as readdirSync11, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync27, lstatSync as lstatSync10, readFileSync as readFileSync13, readdirSync as readdirSync12, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join32 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
-  if (!existsSync26(dir)) return;
-  const st = lstatSync8(dir);
+  if (!existsSync27(dir)) return;
+  const st = lstatSync10(dir);
   if (!st.isDirectory()) return;
-  for (const entry of readdirSync11(dir)) {
-    const abs = join31(dir, entry);
-    const lst = lstatSync8(abs);
+  for (const entry of readdirSync12(dir)) {
+    const abs = join32(dir, entry);
+    const lst = lstatSync10(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -4090,7 +4340,7 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   if (!dryRun && total > 0) {
     for (const { path: filePath, findings } of dirty) {
       backupBeforeWrite(filePath, ts);
-      const before = readFileSync12(filePath, "utf8");
+      const before = readFileSync13(filePath, "utf8");
       const after = applyRedactions(before, findings);
       if (after === before) {
         log(
@@ -4158,15 +4408,15 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript(id) {
   try {
-    const mapPath = join32(repoHome(), "path-map.json");
-    if (!existsSync27(mapPath)) return null;
+    const mapPath = join33(repoHome(), "path-map.json");
+    if (!existsSync28(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join32(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync27(live)) return live;
+      const live = join33(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync28(live)) return live;
     }
     return null;
   } catch {
@@ -4186,17 +4436,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync27(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync28(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync27(localPath)) {
+    if (localPath === null || !existsSync28(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join32(dirname7(localPath), id);
+    const sessionDir = join33(dirname7(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4312,8 +4562,8 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join33(claude, "projects", encodePath(abs)) + sep4)) {
-      return join33(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join34(claude, "projects", encodePath(abs)) + sep4)) {
+      return join34(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -4323,7 +4573,7 @@ function preflightRedactable(f, map, nowMs) {
   if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
   const localPath = resolveLiveTranscript(sid);
   if (localPath === null) return `session ${sid}: local transcript not found`;
-  const sessionDir = join33(dirname8(localPath), sid);
+  const sessionDir = join34(dirname8(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4353,7 +4603,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join33(dirname8(localPath), sid);
+  const sessionDir = join34(dirname8(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4387,26 +4637,26 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync7(stagedProjectDir, { recursive: true });
-  cpSync5(localPath, join33(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync28(sessionDir)) {
-    cpSync5(sessionDir, join33(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync6(localPath, join34(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync29(sessionDir)) {
+    cpSync6(sessionDir, join34(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
 
 // src/commands.push.recovery.drop.ts
 init_config();
-import { rmSync as rmSync9 } from "node:fs";
-import { join as join34 } from "node:path";
+import { rmSync as rmSync10 } from "node:fs";
+import { join as join35 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join34(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join34(repo, "shared", "projects", logical, sid);
-    rmSync9(jsonl, { force: true });
-    rmSync9(dir, { recursive: true, force: true });
+    const jsonl = join35(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join35(repo, "shared", "projects", logical, sid);
+    rmSync10(jsonl, { force: true });
+    rmSync10(dir, { recursive: true, force: true });
   }
   return true;
 }
@@ -4440,7 +4690,7 @@ function makeDefaultReadLine(repo) {
       if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep5)) {
         return null;
       }
-      const content = readFileSync13(target, "utf8");
+      const content = readFileSync14(target, "utf8");
       const lines = content.split(/\r?\n/);
       const idx = line - 1;
       if (idx < 0 || idx >= lines.length) return null;
@@ -4561,10 +4811,10 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join35(repoHome2, ".gitleaksignore");
+  const ignPath = join36(repoHome2, ".gitleaksignore");
   let before;
   try {
-    before = readFileSync14(ignPath, "utf8");
+    before = readFileSync15(ignPath, "utf8");
   } catch {
     before = null;
   }
@@ -4572,7 +4822,7 @@ function allowThenRescan(append, scanVerdict, repoHome2) {
   try {
     return applyThenRescan(scanVerdict, repoHome2);
   } catch (err) {
-    if (before === null) rmSync10(ignPath, { force: true });
+    if (before === null) rmSync11(ignPath, { force: true });
     else writeFileSync5(ignPath, before, "utf8");
     throw err;
   }
@@ -4660,7 +4910,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync29;
+  const check = deps.existsSyncFn ?? existsSync30;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -4727,8 +4977,8 @@ function withSpinner(label, fn, deps) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync30 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync31 } from "node:fs";
+import { join as join37 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -4737,7 +4987,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join36(repoHome(), ".gitleaks.toml");
+  const tomlPath = join37(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -4749,7 +4999,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync11, tomlExists = existsSync30) {
+function reportGitleaksVersionCheck(section2, run = execFileSync11, tomlExists = existsSync31) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -4972,8 +5222,8 @@ function gatherDoctorSections(opts) {
   reportHostKeyAlignment(host);
   reportRepoState(host);
   const links = section("Shared links");
-  const mapPath = join37(repoHome(), "path-map.json");
-  const rawMap = existsSync31(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join38(repoHome(), "path-map.json");
+  const rawMap = existsSync32(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   reportDroppedNamesMigration(links);
@@ -5070,8 +5320,8 @@ function parseDoctorArgs(args) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync33, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
-import { join as join39, relative as relative4 } from "node:path";
+import { existsSync as existsSync34, readdirSync as readdirSync13, statSync as statSync9 } from "node:fs";
+import { join as join40, relative as relative6 } from "node:path";
 
 // src/commands.drop-session.git.ts
 import { execFileSync as execFileSync15 } from "node:child_process";
@@ -5113,8 +5363,8 @@ function isInIndex(rel, repo) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync32 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync33 } from "node:fs";
+import { join as join39 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript2(id, matches);
@@ -5130,8 +5380,8 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript2(id, matches) {
   try {
-    const mapPath = join38(repoHome(), "path-map.json");
-    if (!existsSync32(mapPath)) return null;
+    const mapPath = join39(repoHome(), "path-map.json");
+    if (!existsSync33(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
@@ -5139,8 +5389,8 @@ function resolveLiveTranscript2(id, matches) {
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join38(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync32(live)) return live;
+      const live = join39(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync33(live)) return live;
     }
     return null;
   } catch {
@@ -5156,12 +5406,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync33(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync34(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join39(repo, "shared", "projects");
-    if (!existsSync33(repoProjects)) {
+    const repoProjects = join40(repo, "shared", "projects");
+    if (!existsSync34(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -5183,14 +5433,14 @@ function cmdDropSession(id) {
 }
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
-  for (const logical of readdirSync12(repoProjects)) {
-    const candidate = join39(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync33(candidate)) {
-      matches.push(relative4(repo, candidate));
-    }
-    const dir = join39(repoProjects, logical, id);
-    if (existsSync33(dir) && statSync9(dir).isDirectory()) {
-      const dirRel = relative4(repo, dir);
+  for (const logical of readdirSync13(repoProjects)) {
+    const candidate = join40(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync34(candidate)) {
+      matches.push(relative6(repo, candidate));
+    }
+    const dir = join40(repoProjects, logical, id);
+    if (existsSync34(dir) && statSync9(dir).isDirectory()) {
+      const dirRel = relative6(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
       else matches.push(dirRel);
@@ -5232,7 +5482,7 @@ init_color();
 
 // src/summary.ts
 init_utils();
-function summaryText(verb, unmapped, collisions = 0, extrasSkipped = 0) {
+function summaryText(verb, unmapped, collisions = 0, extrasSkipped = 0, localOnly = 0) {
   const extras = extrasSkipped > 0 ? `, ${extrasSkipped} extras skipped` : "";
   if (verb === "push") {
     if (unmapped === 0 && collisions === 0 && extrasSkipped === 0) {
@@ -5241,16 +5491,17 @@ function summaryText(verb, unmapped, collisions = 0, extrasSkipped = 0) {
     const base = `summary: ${unmapped} unmapped on push, ${collisions} collisions`;
     return { text: `${base}${extras} (run nomad doctor to list)`, clean: false };
   }
-  if (unmapped === 0 && extrasSkipped === 0) {
+  if (unmapped === 0 && extrasSkipped === 0 && localOnly === 0) {
     return { text: "summary: clean", clean: true };
   }
+  const localOnlyPhrase = localOnly > 0 ? `, ${localOnly} local-only present (push to reconcile)` : "";
   return {
-    text: `summary: ${unmapped} unmapped on ${verb}${extras} (run nomad doctor to list)`,
+    text: `summary: ${unmapped} unmapped on ${verb}${extras} (run nomad doctor to list)${localOnlyPhrase}`,
     clean: false
   };
 }
-function summaryRow(verb, unmapped, collisions = 0, extrasSkipped = 0) {
-  const { text } = summaryText(verb, unmapped, collisions, extrasSkipped);
+function summaryRow(verb, unmapped, collisions = 0, extrasSkipped = 0, localOnly = 0) {
+  const { text } = summaryText(verb, unmapped, collisions, extrasSkipped, localOnly);
   return text.replace(/^summary: /, "");
 }
 
@@ -5264,11 +5515,17 @@ function buildSettingsSection(label) {
   addItem(s, `${green(okGlyph)} settings.json (base + ${label})`);
   return s;
 }
-function buildSessionsSection(items, unmapped) {
+function buildSessionsSection(items, unmapped, localOnly = 0) {
   const s = section("Sessions");
   for (const logical of items) addItem(s, `${green(okGlyph)} ${logical}`);
   const skip = collapsedSkipRow(unmapped, "not in path-map (run nomad doctor to list)");
   if (skip !== null) addItem(s, skip);
+  if (localOnly > 0) {
+    addItem(
+      s,
+      `${yellow(warnGlyph)} ${localOnly} local-only present, not in repo (push to reconcile)`
+    );
+  }
   return s;
 }
 function buildExtrasSection(items, extrasSkipped) {
@@ -5322,167 +5579,12 @@ init_config();
 init_config();
 import { existsSync as existsSync36, statSync as statSync10 } from "node:fs";
 import { join as join43 } from "node:path";
-
-// src/extras-sync.core.ts
-init_config();
-import { cpSync as cpSync6, existsSync as existsSync34, lstatSync as lstatSync9, readdirSync as readdirSync13, rmSync as rmSync11 } from "node:fs";
-import { basename, join as join40 } from "node:path";
-init_utils();
-init_utils_json();
-function loadValidatedExtras(opts) {
-  const repo = repoHome();
-  const mapPath = join40(repo, "path-map.json");
-  const repoExtras = join40(repo, "shared", "extras");
-  if (!existsSync34(mapPath) || opts.requireRepoExtras === true && !existsSync34(repoExtras)) {
-    if (opts.missingMsg !== void 0) log(opts.missingMsg);
-    return null;
-  }
-  const map = readPathMap(mapPath);
-  const extrasMap = map.extras ?? {};
-  if (Object.keys(extrasMap).length === 0) return null;
-  for (const logical of Object.keys(extrasMap)) {
-    assertSafeLogical(logical);
-    const localRoot = map.projects[logical]?.[HOST];
-    if (localRoot && localRoot !== "TBD") assertSafeLocalRoot(localRoot, logical);
-  }
-  return { map, extrasMap };
-}
-function* eachExtrasTarget(v, counts) {
-  const whitelist = SUPPORTED_EXTRAS;
-  for (const [logical, dirnames] of Object.entries(v.extrasMap)) {
-    const localRoot = v.map.projects[logical]?.[HOST];
-    if (!localRoot || localRoot === "TBD") {
-      counts.unmapped++;
-      continue;
-    }
-    for (const dirname10 of dirnames) {
-      if (!whitelist.includes(dirname10)) {
-        counts.skipped++;
-        continue;
-      }
-      yield { logical, localRoot, dirname: dirname10 };
-    }
-  }
-}
-function stripCollidingDstSymlinks(src, dst, isExcluded) {
-  if (!existsSync34(dst)) return;
-  for (const name of readdirSync13(src)) {
-    if (isExcluded(name)) continue;
-    const dstPath = join40(dst, name);
-    const dstStat = lstatSync9(dstPath, { throwIfNoEntry: false });
-    if (dstStat === void 0) continue;
-    if (dstStat.isSymbolicLink()) {
-      rmSync11(dstPath, { recursive: true, force: true });
-    } else if (dstStat.isDirectory() && lstatSync9(join40(src, name)).isDirectory()) {
-      stripCollidingDstSymlinks(join40(src, name), dstPath, isExcluded);
-    }
-  }
-}
-function copyExtrasOverlayFiltered(src, dst, blockSet) {
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  try {
-    cpSync6(src, dst, {
-      recursive: true,
-      force: true,
-      verbatimSymlinks: true,
-      filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry))
-    });
-  } catch (err) {
-    const e = err;
-    if (e.code === "EINVAL" || e.code === "ENOTEMPTY" || e.code === "ERR_FS_CP_NON_DIR_TO_DIR" || e.code === "ERR_FS_CP_DIR_TO_NON_DIR") {
-      throw new NomadFatal(
-        `copyExtrasOverlayFiltered: type collision copying ${JSON.stringify(src)} -> ${JSON.stringify(dst)} (${e.path ?? "unknown path"}): a file/directory type changed upstream; run nomad pull --force-remote to recover`
-      );
-    }
-    throw err;
-  }
-}
-function copyExtras(src, dst) {
-  rmSync11(dst, { recursive: true, force: true });
-  cpSync6(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
-}
-function extrasDenySet(dirname10) {
-  return dirname10 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
-}
-function copyExtrasFiltered(src, dst, blockSet) {
-  rmSync11(dst, { recursive: true, force: true });
-  cpSync6(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry))
-  });
-}
-function prunePreservingDenied(src, dst, blockSet) {
-  for (const name of readdirSync13(dst)) {
-    if (isDeniedName(blockSet, name)) continue;
-    const dstPath = join40(dst, name);
-    const srcStat = lstatSync9(join40(src, name), { throwIfNoEntry: false });
-    if (srcStat === void 0) {
-      rmSync11(dstPath, { recursive: true, force: true });
-      continue;
-    }
-    const dstStat = lstatSync9(dstPath);
-    if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingDenied(join40(src, name), dstPath, blockSet);
-    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync11(dstPath, { recursive: true, force: true });
-    }
-  }
-}
-function copyExtrasFilteredPreserving(src, dst, blockSet) {
-  const dstStat = lstatSync9(dst, { throwIfNoEntry: false });
-  if (dstStat !== void 0) {
-    if (dstStat.isDirectory()) prunePreservingDenied(src, dst, blockSet);
-    else rmSync11(dst, { recursive: true, force: true });
-  }
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  cpSync6(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry))
-  });
-}
-function prunePreservingBy(src, dst, isPreserved) {
-  for (const name of readdirSync13(dst)) {
-    if (isPreserved(name)) continue;
-    const dstPath = join40(dst, name);
-    const srcStat = lstatSync9(join40(src, name), { throwIfNoEntry: false });
-    if (srcStat === void 0) {
-      rmSync11(dstPath, { recursive: true, force: true });
-      continue;
-    }
-    const dstStat = lstatSync9(dstPath);
-    if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingBy(join40(src, name), dstPath, isPreserved);
-    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync11(dstPath, { recursive: true, force: true });
-    }
-  }
-}
-function copyExtrasFilteredPreservingBy(src, dst, isPreserved) {
-  const dstStat = lstatSync9(dst, { throwIfNoEntry: false });
-  if (dstStat !== void 0) {
-    if (dstStat.isDirectory()) prunePreservingBy(src, dst, isPreserved);
-    else rmSync11(dst, { recursive: true, force: true });
-  }
-  stripCollidingDstSymlinks(src, dst, isPreserved);
-  cpSync6(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isPreserved(basename(srcEntry))
-  });
-}
-
-// src/extras-sync.ts
 init_utils();
 init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync35, mkdirSync as mkdirSync8, readdirSync as readdirSync14, realpathSync as realpathSync4, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync8, readdirSync as readdirSync14, readFileSync as readFileSync16, realpathSync as realpathSync4, rmSync as rmSync12 } from "node:fs";
 import { dirname as dirname9, join as join42, sep as sep7 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
@@ -5611,24 +5713,58 @@ function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   rmSync12(target, { recursive: true, force: true });
   pruneEmptyAncestors(target, planningRoot);
 }
+function localDivergesFromPreDelete(target, pre, repoRel, repo) {
+  if (!existsSync35(target)) return false;
+  try {
+    const preBlob = gitCaptureBuffer(["show", `${pre}:${repoRel}`], repo);
+    return !readFileSync16(target).equals(preBlob);
+  } catch {
+    return true;
+  }
+}
+function planningDiffArgs(pre, post, logical) {
+  return ["diff", "--name-status", "-z", pre, post, "--", `shared/extras/${logical}/.planning/`];
+}
+function deletePairsFor(t, raw) {
+  return planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot }).map(
+    (target) => {
+      const relToLocal = target.slice(t.localRoot.length + sep7.length);
+      return {
+        target,
+        relToLocal,
+        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep7).join("/")}`
+      };
+    }
+  );
+}
+function keptDeleteWarnLine(logical, relToLocal) {
+  return `keeping locally-edited ${relToLocal} in ${logical}: deleted upstream but changed locally (push to reconcile; your copy is backed up)`;
+}
+function keptDeletePreview(v, prePostHeads, repo) {
+  const kept = [];
+  for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
+    if (t.dirname !== ".planning") continue;
+    let raw;
+    try {
+      raw = gitCaptureRaw(planningDiffArgs(prePostHeads.pre, prePostHeads.post, t.logical), repo);
+    } catch {
+      continue;
+    }
+    for (const { target, relToLocal, repoRel } of deletePairsFor(t, raw)) {
+      if (localDivergesFromPreDelete(target, prePostHeads.pre, repoRel, repo)) {
+        kept.push({ logical: t.logical, relToLocal });
+      }
+    }
+  }
+  return kept;
+}
 function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
   const repoExtras = join42(repo, "shared", "extras");
   for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
     if (t.dirname !== ".planning") continue;
     let raw;
     try {
-      raw = gitCaptureRaw(
-        [
-          "diff",
-          "--name-status",
-          "-z",
-          prePostHeads.pre,
-          prePostHeads.post,
-          "--",
-          `shared/extras/${t.logical}/.planning/`
-        ],
-        repo
-      );
+      raw = gitCaptureRaw(planningDiffArgs(prePostHeads.pre, prePostHeads.post, t.logical), repo);
     } catch (err) {
       const e = err;
       if (e.stderr) process.stderr.write(e.stderr);
@@ -5636,12 +5772,15 @@ function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
         `git diff failed while propagating .planning deletes for ${t.logical}; run nomad pull --force-remote to recover`
       );
     }
-    const targets = planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot });
-    if (targets.length === 0) continue;
+    const pairs = deletePairsFor(t, raw);
+    if (pairs.length === 0) continue;
     backupExtrasWrite(join42(t.localRoot, t.dirname), ts, t.localRoot);
     const planningRoot = join42(t.localRoot, ".planning");
-    for (const target of targets) {
-      const relToLocal = target.slice(t.localRoot.length + sep7.length);
+    for (const { target, relToLocal, repoRel } of pairs) {
+      if (localDivergesFromPreDelete(target, prePostHeads.pre, repoRel, repo)) {
+        warn(keptDeleteWarnLine(t.logical, relToLocal));
+        continue;
+      }
       deletePlanningTarget(target, planningRoot, join42(repoExtras, t.logical, relToLocal));
     }
   }
@@ -5666,7 +5805,7 @@ function remapExtrasPush(ts, opts = {}) {
     //     Repo-only files survive; local edits propagate (overlay overwrites).
     //     The filter prevents ALWAYS_NEVER_SYNC files from landing in the repo
     //     working tree before the allow-list gate fires, eliminating the
-    //     "residue wedges repeat push" regression (WR-02). The allow-list gate
+    //     "residue wedges repeat push" regression. The allow-list gate
     //     (enforceAllowList / blockSetFor in commands.push.allowlist.ts)
     //     remains the hard security boundary.
     //   All others: copyExtrasFiltered with per-extra denylist.
@@ -5690,23 +5829,30 @@ function remapExtrasPull(ts, opts = {}) {
       src: join42(repo, "shared", "extras", logical, dirname10),
       dst: join42(localRoot, dirname10)
     }),
-    // Snapshot the host-side dst BEFORE copyExtras clobbers it. Anchor on
+    // Snapshot the host-side dst BEFORE the copy step touches it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
     (dst, localRoot) => backupExtrasWrite(dst, ts, localRoot),
     // Pull routing per extra type:
     //   `.claude`: copyExtrasFilteredPreserving preserves host-local deny-set
     //     files (e.g. settings.local.json) while mirror-pruning synced entries.
-    //   `.planning`: copyExtrasOverlayFiltered (no rmSync; deny-set filtered)
-    //     keeps local-only files; the delete pass below propagates upstream
-    //     removals via the git-diff D set. The filter is defense-in-depth
-    //     against a repo poisoned out-of-band.
-    //   All others: copyExtras (exact mirror; rarely carry host-local files).
+    //   `.planning`: copyExtrasOverlaySkipDiverged (no rmSync; deny-set filtered)
+    //     keeps local-only files AND skips any file whose local copy diverges
+    //     from the repo copy (content hash differs), so a local hand-edit wins
+    //     on conflict; the delete pass below still propagates
+    //     upstream removals via the git-diff D set. The filter is defense-in-
+    //     depth against a repo poisoned out-of-band.
+    //   All others (a single root-level file, e.g. CLAUDE.md):
+    //     copyExtrasFileSkipDiverged keeps a locally-edited file rather than
+    //     clobbering it, so the divergence WARN's keep-local promise holds for
+    //     every extra, not just `.planning`.
     (src, dst, dirname10) => {
       if (dirname10 === ".claude")
         return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname10));
-      if (dirname10 === ".planning")
-        return copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname10));
-      return copyExtras(src, dst);
+      if (dirname10 === ".planning") {
+        const divergedSet = new Set(listDivergingModified(dst, src));
+        return copyExtrasOverlaySkipDiverged(src, dst, extrasDenySet(dirname10), divergedSet);
+      }
+      return copyExtrasFileSkipDiverged(src, dst);
     }
   );
   if (!dryRun && prePostHeads !== void 0) {
@@ -5721,39 +5867,46 @@ function divergenceWarnLine(o) {
   const name = o.isDir ? `${o.dirname}/` : o.dirname;
   const one = o.count === 1;
   const fileCount = one ? "1 file" : `${o.count} files`;
-  const them = one ? "it" : "them";
   const yours = one ? "your current file is" : "your current files are";
-  return `local ${kind} ${name} in repo ${o.logical} differs from the synced copy in ${fileCount}; the next pull step will overwrite ${them} with the synced version (${yours} backed up to ${o.projectBackupRoot}/)`;
+  return `local ${kind} ${name} in repo ${o.logical} differs from the synced copy in ${fileCount}; the next pull step will keep your local copy (push to reconcile; ${yours} backed up to ${o.projectBackupRoot}/)`;
 }
-function divergenceCheckExtras(ts) {
+function divergenceCheckExtras(ts, prePostHeads) {
   const v = loadValidatedExtras({});
-  if (v === null) return;
+  if (v === null) return 0;
   const counts = { unmapped: 0, skipped: 0 };
   const backupRoot = join43(backupBase(), ts, "extras");
   const repo = repoHome();
+  let divergedCount = 0;
   for (const { logical, localRoot, dirname: dirname10 } of eachExtrasTarget(v, counts)) {
     const local = join43(localRoot, dirname10);
     const repoEntry = join43(repo, "shared", "extras", logical, dirname10);
     if (!existsSync36(local) || !existsSync36(repoEntry)) continue;
-    const diff = listDivergingFiles(local, repoEntry);
-    if (diff.length === 0) continue;
+    const modified = listDivergingModified(local, repoEntry);
+    if (modified.length === 0) continue;
+    divergedCount += modified.length;
     const projectBackupRoot = join43(backupRoot, encodePath(localRoot));
     warn(
       divergenceWarnLine({
         dirname: dirname10,
         logical,
         isDir: statSync10(local).isDirectory(),
-        count: diff.length,
+        count: modified.length,
         projectBackupRoot
       })
     );
-    for (const f of diff) warn(`  ${f}`);
+    for (const f of modified) warn(`  ${f}`);
   }
+  if (prePostHeads !== void 0) {
+    for (const { logical, relToLocal } of keptDeletePreview(v, prePostHeads, repo)) {
+      warn(keptDeleteWarnLine(logical, relToLocal));
+    }
+  }
+  return divergedCount;
 }
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync37, lstatSync as lstatSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync15, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync37, lstatSync as lstatSync11, mkdirSync as mkdirSync9, readdirSync as readdirSync15, rmSync as rmSync13 } from "node:fs";
 import { join as join44 } from "node:path";
 init_utils_fs();
 function isGsdOwned(name) {
@@ -5777,7 +5930,7 @@ function syncSkillsPull(ts) {
   const sharedSkills = join44(repoHome(), "shared", "skills");
   if (!existsSync37(sharedSkills)) return;
   const localSkills = join44(claudeHome(), "skills");
-  const dstStat = lstatSync10(localSkills, { throwIfNoEntry: false });
+  const dstStat = lstatSync11(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     backupBeforeWrite(localSkills, ts);
     rmSync13(localSkills, { recursive: true, force: true });
@@ -5787,7 +5940,7 @@ function syncSkillsPull(ts) {
 }
 function syncSkillsPush() {
   const localSkills = join44(claudeHome(), "skills");
-  const stat = lstatSync10(localSkills, { throwIfNoEntry: false });
+  const stat = lstatSync11(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
   const sharedSkills = join44(repoHome(), "shared", "skills");
@@ -6153,10 +6306,14 @@ function computePreview(ts, map, verb = "pull") {
     dryRun: true,
     onPreview: (e) => addItem(sessions, formatSessionRow(e))
   });
+  const localOnly = scanLocalOnly();
+  if (localOnly > 0) {
+    addItem(sessions, `${localOnly} local-only present, not in repo (push to reconcile)`);
+  }
   const summary = section("Summary");
-  addItem(summary, summaryRow(verb, remapResult.unmapped));
+  addItem(summary, summaryRow(verb, remapResult.unmapped, 0, 0, localOnly));
   renderTree([links, settingsSection, sessions, summary]);
-  return { unmapped: remapResult.unmapped, collisions: 0 };
+  return { unmapped: remapResult.unmapped, collisions: 0, localOnly };
 }
 
 // src/commands.pull.ts
@@ -6305,23 +6462,33 @@ function capturePrePostHeads(repo, rebase) {
   if (pre === void 0 || post === void 0) return void 0;
   return { pre, post };
 }
-function applyWetPull(ts, map, prePostHeads) {
+function buildWetPullSections(ts, map, prePostHeads) {
   applySharedLinks(ts, map);
   const { label } = regenerateSettings(ts);
   syncSkillsPull(ts);
   const remapResult = withSpinner("Syncing sessions", () => remapPull(ts));
   const extrasResult = remapExtrasPull(ts, { prePostHeads });
+  const localOnly = scanLocalOnly();
   const summary = section("Summary");
   addItem(
     summary,
-    summaryRow("pull", remapResult.unmapped + extrasResult.unmapped, 0, extrasResult.skipped)
+    summaryRow(
+      "pull",
+      remapResult.unmapped + extrasResult.unmapped,
+      0,
+      extrasResult.skipped,
+      localOnly
+    )
   );
-  renderTree([
-    buildSettingsSection(label),
-    buildSessionsSection(remapResult.pulled, remapResult.unmapped),
-    buildExtrasSection(extrasResult.pulled, extrasResult.skipped),
-    summary
-  ]);
+  return {
+    sections: [
+      buildSettingsSection(label),
+      buildSessionsSection(remapResult.pulled, remapResult.unmapped, localOnly),
+      buildExtrasSection(extrasResult.pulled, extrasResult.skipped),
+      summary
+    ],
+    localOnly
+  };
 }
 function handleWedge(repo, forceRemote) {
   const wedge = classifyWedge(repo);
@@ -6341,11 +6508,40 @@ function handleWedge(repo, forceRemote) {
   const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
   die(wedgeMarkerRunbookText(state));
 }
-function cmdPull(opts = {}) {
+function runPullCore(opts = {}) {
   const dryRun = opts.dryRun === true;
   const forceRemote = opts.forceRemote === true;
   const repo = repoHome();
   const backup = backupBase();
+  const ts = freshBackupTs(backup);
+  handleWedge(repo, forceRemote);
+  if (!dryRun) {
+    const backupRoot = join46(backup, ts);
+    try {
+      mkdirSync10(backupRoot, { recursive: true });
+    } catch (err) {
+      die(`could not create backup dir: ${err.message}`);
+    }
+  }
+  log(
+    dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
+  );
+  const prePostHeads = capturePrePostHeads(repo, () => {
+    gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
+  });
+  const mapPath = join46(repo, "path-map.json");
+  const map = existsSync39(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
+  if (dryRun) {
+    computePreview(ts, map, "pull");
+    log("dry-run complete; no mutation");
+    return { tag: "dry" };
+  }
+  const { sections, localOnly } = buildWetPullSections(ts, map, prePostHeads);
+  return { tag: "wet", sections, localOnly, divergedKeptLocal };
+}
+function cmdPull(opts = {}) {
+  const repo = repoHome();
   if (!existsSync39(repo)) die(`repo not cloned at ${repo}`);
   if (!existsSync39(join46(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
@@ -6353,31 +6549,8 @@ function cmdPull(opts = {}) {
   const handle = acquireLock("pull");
   if (handle === null) process.exit(0);
   try {
-    const ts = freshBackupTs(backup);
-    handleWedge(repo, forceRemote);
-    if (!dryRun) {
-      const backupRoot = join46(backup, ts);
-      try {
-        mkdirSync10(backupRoot, { recursive: true });
-      } catch (err) {
-        die(`could not create backup dir: ${err.message}`);
-      }
-    }
-    log(
-      dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
-    );
-    const prePostHeads = capturePrePostHeads(repo, () => {
-      gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
-    });
-    const mapPath = join46(repo, "path-map.json");
-    const map = existsSync39(mapPath) ? readPathMap(mapPath) : { projects: {} };
-    divergenceCheckExtras(ts);
-    if (dryRun) {
-      computePreview(ts, map, "pull");
-      log("dry-run complete; no mutation");
-    } else {
-      applyWetPull(ts, map, prePostHeads);
-    }
+    const result = runPullCore(opts);
+    if (result.tag === "wet") renderTree(result.sections);
   } catch (err) {
     if (err instanceof NomadFatal) {
       fail(err.message);
@@ -6586,12 +6759,12 @@ function reportSettingsAheadDrift(repo) {
 // src/commands.push.guards.ts
 init_push_checks();
 init_utils();
-import { join as join49, relative as relative5 } from "node:path";
+import { join as join49, relative as relative7 } from "node:path";
 function guardGitlinks(repo) {
   const gitlinks = findGitlinks(join49(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
-    const rel = relative5(repo, p);
+    const rel = relative7(repo, p);
     fail(`gitlink: ${rel} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`);
   }
   const noun = gitlinks.length === 1 ? "entry" : "entries";
@@ -6700,7 +6873,7 @@ init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { copyFileSync, existsSync as existsSync42, mkdirSync as mkdirSync11, readdirSync as readdirSync16, rmSync as rmSync14 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join50, relative as relative6, sep as sep8 } from "node:path";
+import { join as join50, relative as relative8, sep as sep8 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -6712,7 +6885,7 @@ function stageSessionDir(localDir, dstDir, changed) {
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
-      copyFileAtomic(src, join50(dstDir, relative6(localDir, src)));
+      copyFileAtomic(src, join50(dstDir, relative8(localDir, src)));
     }
     return true;
   }
@@ -6802,7 +6975,7 @@ async function commitAndPush(st, ts, map, resolution, repo, newManifest) {
   if (staged.length === toDrop.length) {
     log("nothing to commit");
     renderNoScanTree(st);
-    return;
+    return "nothing";
   }
   st.globalConfig = collectGlobalConfigChanges(repo, HOST, { staged: true });
   let verdict = withSpinner("Scanning for secrets", () => scanPushVerdict(repo));
@@ -6818,6 +6991,7 @@ async function commitAndPush(st, ts, map, resolution, repo, newManifest) {
     warn(`could not write push manifest (next push will full-rescan): ${String(err)}`);
   }
   renderPushTree(st, verdict);
+  return "pushed";
 }
 function runDryRunPreview(st, map, repo, selection) {
   st.globalConfig = collectGlobalConfigChanges(repo, HOST, { staged: false });
@@ -6834,55 +7008,181 @@ function runDryRunPreview(st, map, repo, selection) {
 init_push_checks();
 init_utils();
 init_utils_fs();
-async function cmdPush(opts = {}) {
+async function runPushCore(opts = {}) {
   const dryRun = opts.dryRun === true;
   const redactAll = opts.redactAll === true;
   const allowAll = opts.allowAll === true;
   const allowRule = opts.allowRule;
   const fullScan = opts.fullScan === true;
-  guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
   const repo = repoHome();
   const backup = backupBase();
+  console.log(dryRun ? `push on host=${HOST} (dry-run)` : `push on host=${HOST}`);
+  reportSettingsAheadDrift(repo);
+  const scannerVersion = probeGitleaks();
+  const configHash = computeConfigHash();
+  const old = readManifest(manifestPath());
+  const mapPath = join51(repo, "path-map.json");
+  const { map, selection, newManifest } = loadSelectionForPush(
+    mapPath,
+    old,
+    scannerVersion,
+    configHash,
+    fullScan
+  );
+  withSpinner("Rebasing onto origin", () => rebaseBeforePush(repo));
+  const ts = freshBackupTs(backup);
+  const remap = withSpinner("Syncing sessions", () => remapPush(ts, { dryRun, selection }));
+  const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
+  if (!dryRun) {
+    syncSkillsPush();
+    stripGsdHooksFromBase(repo, backup);
+  }
+  const st = { dryRun, remap, extras, globalConfig: [] };
+  guardGitlinks(repo);
+  const status = gitStatusPorcelainZ(repo, { untrackedAll: true });
+  if (!dryRun && !status) {
+    log("nothing to commit");
+    renderNoScanTree(st);
+    return { tag: "nothing" };
+  }
+  if (map === null) {
+    if (dryRun) {
+      runDryRunPreview(st, null, repo, selection);
+      return { tag: "dry" };
+    }
+    return die("path-map.json missing, cannot enforce push allow-list");
+  }
+  if (status) enforceAllowList(status, map);
+  if (dryRun) {
+    runDryRunPreview(st, map, repo, selection);
+    return { tag: "dry" };
+  }
+  const outcome = await commitAndPush(
+    st,
+    ts,
+    map,
+    { redactAll, allowAll, allowRule },
+    repo,
+    newManifest
+  );
+  return outcome === "nothing" ? { tag: "nothing" } : { tag: "pushed" };
+}
+async function cmdPush(opts = {}) {
+  const dryRun = opts.dryRun === true;
+  const redactAll = opts.redactAll === true;
+  const allowAll = opts.allowAll === true;
+  const allowRule = opts.allowRule;
+  guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
+  const repo = repoHome();
   if (!existsSync43(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
-    console.log(dryRun ? `push on host=${HOST} (dry-run)` : `push on host=${HOST}`);
-    reportSettingsAheadDrift(repo);
-    const scannerVersion = probeGitleaks();
-    const configHash = computeConfigHash();
-    const old = readManifest(manifestPath());
-    const mapPath = join51(repo, "path-map.json");
-    const { map, selection, newManifest } = loadSelectionForPush(
-      mapPath,
-      old,
-      scannerVersion,
-      configHash,
-      fullScan
-    );
-    withSpinner("Rebasing onto origin", () => rebaseBeforePush(repo));
-    const ts = freshBackupTs(backup);
-    const remap = withSpinner("Syncing sessions", () => remapPush(ts, { dryRun, selection }));
-    const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
-    if (!dryRun) {
-      syncSkillsPush();
-      stripGsdHooksFromBase(repo, backup);
-    }
-    const st = { dryRun, remap, extras, globalConfig: [] };
-    guardGitlinks(repo);
-    const status = gitStatusPorcelainZ(repo, { untrackedAll: true });
-    if (!dryRun && !status) {
-      log("nothing to commit");
-      renderNoScanTree(st);
-      return;
+    await runPushCore(opts);
+  } catch (err) {
+    if (err instanceof NomadFatal) {
+      fail(err.message);
+      process.exitCode = 1;
+    } else {
+      throw err;
+    }
+  } finally {
+    releaseLock(handle);
+  }
+}
+
+// src/commands.sync.ts
+import { existsSync as existsSync44 } from "node:fs";
+import { join as join52 } from "node:path";
+init_config();
+init_utils();
+init_utils_fs();
+init_utils_json();
+function pullHasNoSyncedItems(sections) {
+  return sections.every(
+    (s) => s.header === "Settings" || s.header === "Summary" || s.items.length === 0
+  );
+}
+function isNoopSync(pull, pushOutcome) {
+  if (!pushOutcome.ok) return false;
+  if (pull.localOnly !== 0 || pull.divergedKeptLocal !== 0) return false;
+  if (pushOutcome.result.tag !== "nothing") return false;
+  return pullHasNoSyncedItems(pull.sections);
+}
+function pullPhrase(pull) {
+  const summary = pull.sections.find((s) => s.header === "Summary");
+  return summary?.items[0] ?? "applied";
+}
+function reconciledNotes(pull) {
+  const notes = [];
+  if (pull.divergedKeptLocal > 0) {
+    notes.push(`${pull.divergedKeptLocal} diverged files kept local and pushed`);
+  }
+  if (pull.localOnly > 0) {
+    notes.push(`${pull.localOnly} local-only sessions pushed`);
+  }
+  return notes;
+}
+function buildSyncSummarySection(pull, pushOutcome) {
+  const s = section("Summary");
+  if (!pushOutcome.ok) {
+    addItem(s, `pull: applied, push: failed (${pushOutcome.message})`);
+    return s;
+  }
+  addItem(s, `pull: ${pullPhrase(pull)}`);
+  addItem(s, `push: ${pushOutcome.result.tag === "pushed" ? "pushed" : "nothing to push"}`);
+  for (const note of reconciledNotes(pull)) addItem(s, note);
+  return s;
+}
+function renderWetSync(pull, pushOutcome) {
+  if (isNoopSync(pull, pushOutcome)) {
+    ok("already in sync");
+    return;
+  }
+  renderTree(pull.sections);
+  renderTree([buildSyncSummarySection(pull, pushOutcome)]);
+}
+async function runSyncPushHalf() {
+  try {
+    const result = await runPushCore();
+    return { ok: true, result };
+  } catch (err) {
+    if (err instanceof NomadFatal) {
+      process.exitCode = 1;
+      return { ok: false, message: err.message };
     }
-    if (map === null) {
-      if (dryRun) return runDryRunPreview(st, null, repo, selection);
-      return die("path-map.json missing, cannot enforce push allow-list");
+    throw err;
+  }
+}
+async function runSyncWet() {
+  const pull = runPullCore();
+  const pushOutcome = await runSyncPushHalf();
+  renderWetSync(pull, pushOutcome);
+}
+async function runSyncDryRun(repo, backup) {
+  const ts = freshBackupTs(backup);
+  const mapPath = join52(repo, "path-map.json");
+  const map = existsSync44(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  computePreview(ts, map, "pull");
+  log("push preview below is computed against pre-pull state (a real sync pushes after pull)");
+  await runPushCore({ dryRun: true });
+}
+async function cmdSync(opts = {}) {
+  const dryRun = opts.dryRun === true;
+  const repo = repoHome();
+  const backup = backupBase();
+  if (!existsSync44(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync44(join52(repo, "shared", "settings.base.json"))) {
+    die("repo not initialized; run 'nomad init' to scaffold");
+  }
+  const handle = acquireLock("sync");
+  if (handle === null) process.exit(0);
+  try {
+    if (dryRun) {
+      await runSyncDryRun(repo, backup);
+    } else {
+      await runSyncWet();
     }
-    if (status) enforceAllowList(status, map);
-    if (dryRun) return runDryRunPreview(st, map, repo, selection);
-    await commitAndPush(st, ts, map, { redactAll, allowAll, allowRule }, repo, newManifest);
   } catch (err) {
     if (err instanceof NomadFatal) {
       fail(err.message);
@@ -6939,18 +7239,19 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join52 } from "node:path";
+import { existsSync as existsSync45 } from "node:fs";
+import { join as join53 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync44(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync45(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join52(repo, "path-map.json");
-    const map = existsSync44(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join53(repo, "path-map.json");
+    const map = existsSync45(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    divergenceCheckExtras(ts);
     computePreview(ts, map, "diff");
   } catch (err) {
     if (err instanceof NomadFatal) {
@@ -6964,8 +7265,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync46, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join54 } from "node:path";
+import { existsSync as existsSync47, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join55 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -7047,33 +7348,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync45, rmSync as rmSync15, statSync as statSync12 } from "node:fs";
-import { join as join53 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync46, rmSync as rmSync15, statSync as statSync12 } from "node:fs";
+import { join as join54 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join53(claude, name);
-    if (!existsSync45(src)) continue;
-    const dst = join53(repo, "shared", name);
+    const src = join54(claude, name);
+    if (!existsSync46(src)) continue;
+    const dst = join54(repo, "shared", name);
     if (statSync12(src).isDirectory()) {
-      const gk = join53(dst, ".gitkeep");
-      if (existsSync45(gk)) rmSync15(gk);
+      const gk = join54(dst, ".gitkeep");
+      if (existsSync46(gk)) rmSync15(gk);
       cpSync7(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join53(claude, "settings.json");
-  if (existsSync45(userSettings)) {
+  const userSettings = join54(claude, "settings.json");
+  if (existsSync46(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join53(repo, "hosts", `${HOST}.json`);
+    const hostFile = join54(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -7086,14 +7387,14 @@ var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.cl
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join54(repoHome2, "shared", "settings.base.json"),
-    join54(repoHome2, "shared", "CLAUDE.md"),
-    join54(repoHome2, "path-map.json"),
-    join54(repoHome2, "hosts"),
-    join54(repoHome2, "shared")
+    join55(repoHome2, "shared", "settings.base.json"),
+    join55(repoHome2, "shared", "CLAUDE.md"),
+    join55(repoHome2, "path-map.json"),
+    join55(repoHome2, "hosts"),
+    join55(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync46(c)) return c;
+    if (existsSync47(c)) return c;
   }
   return null;
 }
@@ -7111,25 +7412,25 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync12(join54(repo, "shared"), { recursive: true });
-  mkdirSync12(join54(repo, "hosts"), { recursive: true });
+  mkdirSync12(join55(repo, "shared"), { recursive: true });
+  mkdirSync12(join55(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync12(join54(repo, "shared", name), { recursive: true });
+    mkdirSync12(join55(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join54(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync46(userClaudeMd)) {
-    writeFileSync6(join54(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join55(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync47(userClaudeMd)) {
+    writeFileSync6(join55(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join54(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join55(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync6(join54(repo, "hosts", ".gitkeep"), "");
+  writeFileSync6(join55(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join54(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join55(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join54(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join55(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -7195,11 +7496,11 @@ function maybeDisableRepoActions(repoHome2, run) {
 // src/init.prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync47, readdirSync as readdirSync17, statSync as statSync13 } from "node:fs";
-import { join as join55 } from "node:path";
+import { existsSync as existsSync48, readdirSync as readdirSync17, statSync as statSync13 } from "node:fs";
+import { join as join56 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync47(path)) return false;
+  if (!existsSync48(path)) return false;
   try {
     if (statSync13(path).isDirectory()) return readdirSync17(path).length > 0;
     return true;
@@ -7208,8 +7509,8 @@ function nonEmptyExists(path) {
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync47(join55(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join55(claudeHome2, name)));
+  if (existsSync48(join56(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join56(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -7493,10 +7794,27 @@ function parsePushArgs(argv) {
   };
 }
 
+// src/nomad.dispatch.sync.ts
+function parseSyncArgs(argv) {
+  let dryRun = false;
+  let i = 3;
+  while (i < argv.length) {
+    const token = argv[i];
+    if (token === "--dry-run") {
+      if (dryRun) return null;
+      dryRun = true;
+    } else {
+      return null;
+    }
+    i++;
+  }
+  return { dryRun };
+}
+
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.56.1",
+  version: "0.57.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -7625,6 +7943,12 @@ var DEFAULT_HELP = [
   cont("when no finding survives. No TTY required. Never skips the scan."),
   cont("Mutually exclusive with --redact-all/--allow. Cannot combine with --dry-run."),
   "",
+  row("  sync", "Pull (retain-merge), then push, under one lock. One-shot; hides ordering."),
+  row("       --dry-run", "Stack the pull preview then the push preview; mutates nothing."),
+  cont("Fails fast on a pull-half error; a wedged repo hints at nomad pull --force-remote"),
+  cont("(sync itself takes no --force-remote). Mid-push leak recovery behaves exactly"),
+  cont("like nomad push."),
+  "",
   row("  diff", "Offline preview of what `pull` would change against local repo state."),
   cont("No git pull, no lock acquired."),
   "",
@@ -7721,15 +8045,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync48, readFileSync as readFileSync15, readdirSync as readdirSync18 } from "node:fs";
-import { join as join56 } from "node:path";
+import { existsSync as existsSync49, readFileSync as readFileSync17, readdirSync as readdirSync18 } from "node:fs";
+import { join as join57 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join56(claudeHome(), "projects");
-  if (!existsSync48(projectsRoot)) {
+  const projectsRoot = join57(claudeHome(), "projects");
+  if (!existsSync49(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -7743,8 +8067,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join56(repoHome(), "path-map.json");
-  if (!existsSync48(mapPath)) {
+  const mapPath = join57(repoHome(), "path-map.json");
+  if (!existsSync49(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -7767,13 +8091,13 @@ function resumeCmd(sessionId) {
 }
 function findTranscriptPath(projectsRoot, sessionId) {
   for (const dir of readdirSync18(projectsRoot)) {
-    const candidate = join56(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync48(candidate)) return candidate;
+    const candidate = join57(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync49(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync15(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync17(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);
@@ -7846,6 +8170,15 @@ try {
       });
       break;
     }
+    case "sync": {
+      const syncArgs = parseSyncArgs(process.argv);
+      if (syncArgs === null) {
+        console.error("usage: nomad sync [--dry-run]");
+        process.exit(1);
+      }
+      await cmdSync({ dryRun: syncArgs.dryRun });
+      break;
+    }
     case "init": {
       const initArgs = parseInitArgs(process.argv);
       if (initArgs === null) {