claude-nomad 0.58.1 → 0.59.0

package/dist/nomad.mjs

@@ -445,6 +445,9 @@ var init_settings_keys = __esm({
 import { homedir, hostname } from "node:os";
 import { join, resolve } from "node:path";
 function home() {
+  if (process.platform === "win32") {
+    return process.env.USERPROFILE || process.env.HOME || homedir();
+  }
   return process.env.HOME || homedir();
 }
 function claudeHome() {
@@ -508,8 +511,10 @@ var init_config = __esm({
       "path-map.json",
       ".gitleaksignore",
       // written by nomad push Allow action
-      ".gitleaks.overlay.toml"
+      ".gitleaks.overlay.toml",
       // user-owned gitleaks allowlist overlay layered on the bundled base
+      ".gitattributes"
+      // scaffolded by nomad init as the CRLF guard doctor recommends adding
     ];
   }
 });
@@ -596,10 +601,10 @@ var init_utils_json = __esm({
 // src/utils.fs.ts
 import {
   closeSync,
-  cpSync,
-  existsSync,
+  cpSync as cpSync3,
+  existsSync as existsSync3,
   fsyncSync,
-  lstatSync,
+  lstatSync as lstatSync3,
   mkdirSync,
   openSync,
   renameSync,
@@ -607,9 +612,32 @@ import {
   symlinkSync,
   writeFileSync
 } from "node:fs";
-import { dirname, join as join2, relative, sep } from "node:path";
+import { dirname, join as join4, relative as relative2, sep as sep2 } from "node:path";
+function isRetryableRenameCode(code) {
+  return code === "EPERM" || code === "EBUSY";
+}
+function sleepSyncMs(ms) {
+  const view = new Int32Array(new SharedArrayBuffer(4));
+  Atomics.wait(view, 0, 0, ms);
+}
+function renameAtomicRetry(tmp, dst, renameFn = renameSync) {
+  if (process.platform !== "win32") {
+    renameFn(tmp, dst);
+    return;
+  }
+  for (let attempt = 1; attempt <= RENAME_RETRY_MAX_ATTEMPTS; attempt++) {
+    try {
+      renameFn(tmp, dst);
+      return;
+    } catch (e) {
+      const code = e.code;
+      if (!isRetryableRenameCode(code) || attempt === RENAME_RETRY_MAX_ATTEMPTS) throw e;
+      sleepSyncMs(RENAME_RETRY_BACKOFF_MS);
+    }
+  }
+}
 function writeJsonAtomic(path, data) {
-  const mode = existsSync(path) ? statSync(path).mode & 511 : 384;
+  const mode = existsSync3(path) ? statSync(path).mode & 511 : 384;
   const tmp = `${path}.tmp.${process.pid}`;
   const fd = openSync(tmp, "w", mode);
   try {
@@ -618,7 +646,7 @@ function writeJsonAtomic(path, data) {
   } finally {
     closeSync(fd);
   }
-  renameSync(tmp, path);
+  renameAtomicRetry(tmp, path);
   const dirFd = openSync(dirname(path), "r");
   try {
     fsyncSync(dirFd);
@@ -635,14 +663,14 @@ function nowTimestamp() {
 }
 function freshBackupTs(backupRoot) {
   const base = nowTimestamp();
-  if (!existsSync(join2(backupRoot, base))) return base;
+  if (!existsSync3(join4(backupRoot, base))) return base;
   let n = 1;
-  while (existsSync(join2(backupRoot, `${base}-${n}`))) n++;
+  while (existsSync3(join4(backupRoot, `${base}-${n}`))) n++;
   return `${base}-${n}`;
 }
 function ensureSymlink(linkPath, target) {
-  if (existsSync(linkPath)) {
-    if (lstatSync(linkPath).isSymbolicLink()) return;
+  if (existsSync3(linkPath)) {
+    if (lstatSync3(linkPath).isSymbolicLink()) return;
     die(`${linkPath} exists and is not a symlink. Move it aside first.`);
   }
   mkdirSync(dirname(linkPath), { recursive: true });
@@ -650,39 +678,42 @@ function ensureSymlink(linkPath, target) {
   log(`linked ${linkPath} -> ${target}`);
 }
 function backupUnder(absPath, anchor, destRoot) {
-  if (!existsSync(absPath)) return;
-  const rel = relative(anchor, absPath);
-  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`)) return;
-  const dst = join2(destRoot, rel);
+  if (!existsSync3(absPath)) return;
+  const rel = relative2(anchor, absPath);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep2}`)) return;
+  const dst = join4(destRoot, rel);
   mkdirSync(dirname(dst), { recursive: true });
-  cpSync(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
 }
 function backupBeforeWrite(absPath, ts) {
-  backupUnder(absPath, claudeHome(), join2(backupBase(), ts));
+  backupUnder(absPath, claudeHome(), join4(backupBase(), ts));
 }
 function backupRepoWrite(absPath, ts, repoHome2) {
-  backupUnder(absPath, repoHome2, join2(backupBase(), ts, "repo"));
+  backupUnder(absPath, repoHome2, join4(backupBase(), ts, "repo"));
 }
 function backupExtrasWrite(absPath, ts, projectRoot) {
-  backupUnder(absPath, projectRoot, join2(backupBase(), ts, "extras", encodePath(projectRoot)));
+  backupUnder(absPath, projectRoot, join4(backupBase(), ts, "extras", encodePath(projectRoot)));
 }
+var RENAME_RETRY_MAX_ATTEMPTS, RENAME_RETRY_BACKOFF_MS;
 var init_utils_fs = __esm({
   "src/utils.fs.ts"() {
     "use strict";
     init_config();
     init_utils_json();
     init_utils();
+    RENAME_RETRY_MAX_ATTEMPTS = 5;
+    RENAME_RETRY_BACKOFF_MS = 10;
   }
 });
 
 // src/commands.pull.wedge.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join17 } from "node:path";
 function detectWedge(repo) {
-  const g = join15(repo, ".git");
-  if (existsSync13(join15(g, "rebase-merge")) || existsSync13(join15(g, "rebase-apply"))) return "rebase";
-  if (existsSync13(join15(g, "MERGE_HEAD"))) return "merge";
+  const g = join17(repo, ".git");
+  if (existsSync15(join17(g, "rebase-merge")) || existsSync15(join17(g, "rebase-apply"))) return "rebase";
+  if (existsSync15(join17(g, "MERGE_HEAD"))) return "merge";
   return null;
 }
 function unmergedIndexPresent(repo) {
@@ -739,15 +770,15 @@ var init_commands_pull_wedge = __esm({
 });
 
 // src/push-gitleaks.config.ts
-import { existsSync as existsSync14, mkdtempSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync16, mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveTomlPath(repo = repoHome()) {
-  const repoToml = join16(repo, ".gitleaks.toml");
-  if (existsSync14(repoToml)) return repoToml;
+  const repoToml = join18(repo, ".gitleaks.toml");
+  if (existsSync16(repoToml)) return repoToml;
   const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync14(bundled) ? bundled : null;
+  return existsSync16(bundled) ? bundled : null;
 }
 function assertOverlayAllowlistsScoped(overlayBody) {
   if (OVERLAY_INLINE_ALLOWLIST_RE.test(overlayBody)) {
@@ -785,17 +816,17 @@ function buildOverlayTempConfig(overlayBody, bundled) {
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join16(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join16(tempPath, "config.toml");
+  const tempPath = mkdtempSync(join18(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join18(tempPath, "config.toml");
   writeFileSync3(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
   const repo = repoHome();
-  const overlayPath = join16(repo, ".gitleaks.overlay.toml");
-  const repoToml = join16(repo, ".gitleaks.toml");
+  const overlayPath = join18(repo, ".gitleaks.overlay.toml");
+  const repoToml = join18(repo, ".gitleaks.toml");
   const bundled = resolveTomlPath(repo);
-  if (!existsSync14(overlayPath)) {
+  if (!existsSync16(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -808,7 +839,7 @@ function resolveTomlConfig() {
     return { path: null, tempPath: null };
   }
   try {
-    const overlayBody = readFileSync4(overlayPath, "utf8");
+    const overlayBody = readFileSync5(overlayPath, "utf8");
     if (OVERLAY_EXTEND_RE.test(overlayBody)) {
       throw new NomadFatal(
         ".gitleaks.overlay.toml must not contain an [extend] block; it is generated automatically. Remove the [extend] section and retry."
@@ -842,9 +873,9 @@ var init_push_gitleaks_config = __esm({
 
 // src/push-checks.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { readdirSync as readdirSync5, rmSync as rmSync5 } from "node:fs";
+import { readdirSync as readdirSync7, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { join as join17 } from "node:path";
+import { delimiter, join as join19 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -852,6 +883,11 @@ function gitleaksInstallHint() {
     return `${head}
   brew install gitleaks`;
   }
+  if (plat === "win32") {
+    return `${head}
+  winget install gitleaks.gitleaks
+  (or: scoop install gitleaks)`;
+  }
   if (plat === "linux") {
     const archMap = { x64: "x64", arm64: "arm64", arm: "armv7" };
     const arch = archMap[process.arch];
@@ -865,7 +901,7 @@ function gitleaksInstallHint() {
       "       ~/.local/bin/gitleaks version   # verify"
     ];
     const localBin = `${homedir2()}/.local/bin`;
-    const paths = (process.env.PATH ?? "").split(":");
+    const paths = (process.env.PATH ?? "").split(delimiter);
     if (!paths.includes(localBin)) {
       lines.push(
         "  3. ~/.local/bin is not on PATH; add to your shell rc:",
@@ -882,12 +918,12 @@ function findGitlinks(dir) {
   function walk(current) {
     let entries;
     try {
-      entries = readdirSync5(current, { withFileTypes: true });
+      entries = readdirSync7(current, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = join17(current, e.name);
+      const p = join19(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
@@ -909,7 +945,7 @@ function probeGitleaks() {
     if (e.code === "ENOENT") throw new NomadFatal(gitleaksInstallHint());
     throw new NomadFatal(`gitleaks --version failed: ${e.message}`);
   } finally {
-    if (tempPath !== null) rmSync5(tempPath, { recursive: true, force: true });
+    if (tempPath !== null) rmSync7(tempPath, { recursive: true, force: true });
   }
 }
 function wedgePreflight(wedge) {
@@ -946,12 +982,12 @@ var init_push_checks = __esm({
 
 // src/push-gitleaks.scan.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync6 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 function readGitleaksReport(reportPath) {
   try {
-    const raw = readFileSync5(reportPath, "utf8");
+    const raw = readFileSync6(reportPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return null;
     return parsed;
@@ -960,9 +996,9 @@ function readGitleaksReport(reportPath) {
   }
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join21(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join23(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
-  const reportPath = join21(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join23(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -990,14 +1026,14 @@ function scanStagedTree(repoDir, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync6(tempPath, { recursive: true, force: true });
-    rmSync6(reportPath, { force: true });
+    if (tempPath !== null) rmSync8(tempPath, { recursive: true, force: true });
+    rmSync8(reportPath, { force: true });
   }
 }
 function scanFile(filePath, forwardStreams = false) {
-  const cacheDir = join21(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join23(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
-  const reportPath = join21(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join23(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "detect",
@@ -1025,8 +1061,8 @@ function scanFile(filePath, forwardStreams = false) {
     }
     return report;
   } finally {
-    if (tempPath !== null) rmSync6(tempPath, { recursive: true, force: true });
-    rmSync6(reportPath, { force: true });
+    if (tempPath !== null) rmSync8(tempPath, { recursive: true, force: true });
+    rmSync8(reportPath, { force: true });
   }
 }
 var init_push_gitleaks_scan = __esm({
@@ -1228,189 +1264,13 @@ var init_push_leak_verdict = __esm({
 // src/commands.adopt.ts
 init_config();
 init_config_sharedDirs_guard();
-init_utils();
-init_utils_fs();
-init_utils_json();
-import { cpSync as cpSync2, existsSync as existsSync2, lstatSync as lstatSync2, rmSync } from "node:fs";
-import { join as join3 } from "node:path";
-var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
-function lexists(p) {
-  try {
-    lstatSync2(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function readMapIfPresent(repoHome2) {
-  const mapPath = join3(repoHome2, "path-map.json");
-  return existsSync2(mapPath) ? readPathMap(mapPath) : { projects: {} };
-}
-function isConfiguredTarget(name, map) {
-  return SHARED_LINKS.includes(name) || (map.sharedDirs?.includes(name) ?? false);
-}
-function isValidAdoptName(name) {
-  if (SHARED_LINKS.includes(name)) return true;
-  return isValidSharedDir(name);
-}
-function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
-  const ts = freshBackupTs(backup);
-  backupBeforeWrite(linkPath, ts);
-  cpSync2(linkPath, sharedTarget, { recursive: true, force: true, preserveTimestamps: true });
-  rmSync(linkPath, { recursive: true, force: true });
-  ensureSymlink(linkPath, sharedTarget);
-  const rel = join3("shared", name);
-  gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
-  log(`adopted ${name}; ${ADOPT_PUSH_HINT}`);
-}
-function cmdAdopt(name, opts = {}) {
-  const dryRun = opts.dryRun === true;
-  if (!isValidAdoptName(name)) {
-    fail(`invalid name: ${JSON.stringify(name)}`);
-    process.exit(1);
-  }
-  const repo = repoHome();
-  const claude = claudeHome();
-  const backup = backupBase();
-  const map = readMapIfPresent(repo);
-  if (!isConfiguredTarget(name, map)) {
-    fail(
-      `${name}: not a configured shared target. Add it to sharedDirs in path-map.json first, then re-run adopt.`
-    );
-    process.exit(1);
-  }
-  const linkPath = join3(claude, name);
-  const sharedTarget = join3(repo, "shared", name);
-  if (!existsSync2(linkPath)) {
-    log(`${name}: nothing to adopt (not present in ~/.claude/)`);
-    return;
-  }
-  if (lstatSync2(linkPath).isSymbolicLink()) {
-    log(`${name}: already adopted (already a symlink)`);
-    return;
-  }
-  if (lexists(sharedTarget)) {
-    fail(`${name}: shared/${name} already exists; would clobber. Remove it first.`);
-    process.exit(1);
-  }
-  if (dryRun) {
-    const ts = freshBackupTs(backup);
-    log(`would backup: ${linkPath} -> backup/${ts}/${name}`);
-    log(`would move: ${linkPath} -> shared/${name}`);
-    log(`would stage: shared/${name}`);
-    return;
-  }
-  try {
-    performAdoptMove(name, linkPath, sharedTarget, repo, backup);
-  } catch (err) {
-    if (!(err instanceof NomadFatal)) throw err;
-    fail(err.message);
-    process.exitCode = 1;
-  }
-}
-
-// src/commands.allow.ts
-init_config();
-import { existsSync as existsSync3 } from "node:fs";
-
-// src/commands.redact.core.ts
-import { appendFileSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join4 } from "node:path";
-function collectMatchIntervals(content, findings) {
-  const intervals = [];
-  for (const f of findings) {
-    const match = f.Match;
-    if (match === "") continue;
-    let from = 0;
-    let pos = content.indexOf(match, from);
-    while (pos !== -1) {
-      intervals.push({ start: pos, end: pos + match.length, ruleId: f.RuleID });
-      from = pos + match.length;
-      pos = content.indexOf(match, from);
-    }
-  }
-  return intervals;
-}
-function mergeIntervals(intervals) {
-  if (intervals.length === 0) return [];
-  const sorted = [...intervals].sort((a, b) => a.start - b.start || b.end - a.end);
-  let last = { ...sorted[0] };
-  const merged = [last];
-  for (let i = 1; i < sorted.length; i++) {
-    const cur = sorted[i];
-    if (cur.start <= last.end) {
-      if (cur.end > last.end) last.end = cur.end;
-    } else {
-      last = { ...cur };
-      merged.push(last);
-    }
-  }
-  return merged;
-}
-function applyRedactions(content, findings) {
-  const raw = collectMatchIntervals(content, findings);
-  if (raw.length === 0) return content;
-  const merged = mergeIntervals(raw);
-  let result = content;
-  for (let i = merged.length - 1; i >= 0; i--) {
-    const { start, end, ruleId } = merged[i];
-    result = result.slice(0, start) + `[REDACTED:${ruleId}]` + result.slice(end);
-  }
-  return result;
-}
-function formatFingerprint(fingerprint) {
-  return fingerprint.replace(/[\r\n]/g, "") + "\n";
-}
-function isRecentlyModified(mtimeMs, nowMs, thresholdMs = 5 * 60 * 1e3) {
-  return nowMs - mtimeMs < thresholdMs;
-}
-function isValidFingerprint(fingerprint) {
-  return fingerprint.trim().length > 0 && fingerprint.length <= 512 && /^[^\r\n]+$/.test(fingerprint);
-}
-function isAlreadyPresent(line, lines) {
-  return lines.includes(line);
-}
-function appendGitleaksIgnore(fingerprint, repo) {
-  const sanitized = fingerprint.replace(/[\r\n]/g, "").trim();
-  if (sanitized.length === 0) return;
-  const ignPath = join4(repo, ".gitleaksignore");
-  let raw;
-  try {
-    raw = readFileSync2(ignPath, "utf8");
-  } catch {
-    raw = "";
-  }
-  const existing = raw.split("\n").filter((l) => l.length > 0);
-  if (isAlreadyPresent(sanitized, existing)) return;
-  const needsLeadingNewline = raw.length > 0 && !raw.endsWith("\n");
-  const prefix = needsLeadingNewline ? "\n" : "";
-  appendFileSync(ignPath, prefix + formatFingerprint(sanitized), "utf8");
-}
-
-// src/commands.allow.ts
-init_utils();
-function cmdAllow(fingerprints) {
-  const repo = repoHome();
-  if (!existsSync3(repo)) die(`repo not cloned at ${repo}`);
-  for (const fp of fingerprints) {
-    if (!isValidFingerprint(fp)) {
-      const shown = fp.replaceAll("\r", String.raw`\r`).replaceAll("\n", String.raw`\n`);
-      fail(`invalid fingerprint: ${shown}`);
-      process.exit(1);
-    }
-  }
-  for (const fp of fingerprints) {
-    appendGitleaksIgnore(fp, repo);
-    item(`allowed: ${fp}`);
-  }
-  log(`allowed ${fingerprints.length} fingerprint(s)`);
-}
+import { cpSync as cpSync4, existsSync as existsSync5, lstatSync as lstatSync5, rmSync as rmSync4 } from "node:fs";
+import { join as join6 } from "node:path";
 
-// src/commands.capture-settings.ts
+// src/links.ts
 init_config();
-import { existsSync as existsSync5 } from "node:fs";
-import { join as join7 } from "node:path";
-import { createInterface } from "node:readline/promises";
+import { existsSync as existsSync4, lstatSync as lstatSync4, rmSync as rmSync3 } from "node:fs";
+import { join as join5 } from "node:path";
 
 // src/hooks-filter.ts
 init_config();
@@ -1630,120 +1490,569 @@ function buildCaptureSubset(merged, settings, opts) {
   return out;
 }
 
-// src/links.ts
+// src/extras-sync.core.ts
 init_config();
-import { existsSync as existsSync4, lstatSync as lstatSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { cpSync as cpSync2, existsSync as existsSync2, lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
+import { basename as basename2, join as join3, relative } from "node:path";
+
+// src/extras-sync.collision.ts
 init_utils();
-init_utils_fs();
-init_utils_json();
-function emitAutoMove(onPreview, linkPath, ts, name) {
-  if (onPreview) {
-    onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
-  } else {
-    log(`would auto-move non-symlink: ${linkPath} -> backup/${ts}/${name}`);
-  }
+import { cpSync, existsSync, lstatSync, readdirSync, rmSync } from "node:fs";
+import { basename, join as join2 } from "node:path";
+function quoted(p) {
+  return `"${p}"`;
 }
-function emitCreate(onPreview, from, to) {
-  if (onPreview) {
-    onPreview({ kind: "create", from, to });
-  } else {
-    log(`would create symlink: ${from} -> ${to}`);
+function stripCollidingDstSymlinks(src, dst, isExcluded) {
+  if (!existsSync(dst)) return;
+  for (const name of readdirSync(src)) {
+    if (isExcluded(name)) continue;
+    const dstPath = join2(dst, name);
+    const dstStat = lstatSync(dstPath, { throwIfNoEntry: false });
+    if (dstStat === void 0) continue;
+    if (dstStat.isSymbolicLink()) {
+      rmSync(dstPath, { recursive: true, force: true });
+    } else if (dstStat.isDirectory() && lstatSync(join2(src, name)).isDirectory()) {
+      stripCollidingDstSymlinks(join2(src, name), dstPath, isExcluded);
+    }
   }
 }
-function isAlreadySymlink(linkPath) {
-  return existsSync4(linkPath) && lstatSync3(linkPath).isSymbolicLink();
+function cpSyncGuarded(src, dst, filter, label) {
+  try {
+    cpSync(src, dst, { recursive: true, force: true, verbatimSymlinks: true, filter });
+  } catch (err) {
+    const e = err;
+    if (e.code === "EINVAL" || e.code === "ENOTEMPTY" || e.code === "ERR_FS_CP_NON_DIR_TO_DIR" || e.code === "ERR_FS_CP_DIR_TO_NON_DIR" || process.platform === "win32" && e.errno === 145) {
+      throw new NomadFatal(
+        `${label}: type collision copying ${quoted(src)} -> ${quoted(dst)} (${e.path ?? "unknown path"}): a file/directory type changed upstream; run nomad pull --force-remote to recover`
+      );
+    }
+    throw err;
+  }
 }
-function runAutoMovePasses(linkNames, claude, repo, ts, dryRun, onPreview) {
-  for (const name of linkNames) {
-    const linkPath = join5(claude, name);
-    const target = join5(repo, "shared", name);
-    if (!existsSync4(linkPath)) continue;
-    if (lstatSync3(linkPath).isSymbolicLink()) continue;
-    if (!existsSync4(target)) continue;
-    if (dryRun) {
-      emitAutoMove(onPreview, linkPath, ts, name);
+function prunePreservingBy(src, dst, isPreserved) {
+  for (const name of readdirSync(dst)) {
+    if (isPreserved(name)) continue;
+    const dstPath = join2(dst, name);
+    const srcStat = lstatSync(join2(src, name), { throwIfNoEntry: false });
+    if (srcStat === void 0) {
+      rmSync(dstPath, { recursive: true, force: true });
       continue;
     }
-    backupBeforeWrite(linkPath, ts);
-    rmSync2(linkPath, { recursive: true, force: true });
+    const dstStat = lstatSync(dstPath);
+    if (srcStat.isDirectory() && dstStat.isDirectory()) {
+      prunePreservingBy(join2(src, name), dstPath, isPreserved);
+    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
+      rmSync(dstPath, { recursive: true, force: true });
+    }
+  }
+}
+function copyExtrasFilteredPreservingBy(src, dst, isPreserved) {
+  const dstStat = lstatSync(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0) {
+    if (dstStat.isDirectory()) {
+      const srcStat = lstatSync(src, { throwIfNoEntry: false });
+      if (srcStat !== void 0 && !srcStat.isDirectory()) {
+        throw new NomadFatal(
+          `copyExtrasFilteredPreservingBy: type mismatch copying ${quoted(src)} -> ${quoted(dst)}: the repo entry is a file but the local entry is a directory; run nomad pull --force-remote to recover`
+        );
+      }
+      prunePreservingBy(src, dst, isPreserved);
+    } else {
+      rmSync(dst, { recursive: true, force: true });
+    }
+  }
+  stripCollidingDstSymlinks(src, dst, isPreserved);
+  cpSync(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isPreserved(basename(srcEntry))
+  });
+}
+
+// src/extras-sync.guards.ts
+init_utils();
+init_config_sharedDirs_guard();
+import { isAbsolute, normalize, sep } from "node:path";
+function assertSafeLocalRoot(localRoot, logical) {
+  if (!isAbsolute(localRoot)) {
+    throw new NomadFatal(
+      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be absolute)`
+    );
   }
+  const canonical = process.platform === "win32" ? localRoot.split("/").join(sep) : localRoot;
+  if (canonical !== normalize(canonical)) {
+    throw new NomadFatal(
+      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be already-normalized; no '..' or redundant segments)`
+    );
+  }
+}
+
+// src/extras-sync.core.ts
+init_utils();
+init_utils_json();
+function loadValidatedExtras(opts) {
+  const repo = repoHome();
+  const mapPath = join3(repo, "path-map.json");
+  const repoExtras = join3(repo, "shared", "extras");
+  if (!existsSync2(mapPath) || opts.requireRepoExtras === true && !existsSync2(repoExtras)) {
+    if (opts.missingMsg !== void 0) log(opts.missingMsg);
+    return null;
+  }
+  const map = readPathMap(mapPath);
+  const extrasMap = map.extras ?? {};
+  if (Object.keys(extrasMap).length === 0) return null;
+  for (const logical of Object.keys(extrasMap)) {
+    assertSafeLogical(logical);
+    const localRoot = map.projects[logical]?.[HOST];
+    if (localRoot && localRoot !== "TBD") assertSafeLocalRoot(localRoot, logical);
+  }
+  return { map, extrasMap };
+}
+function* eachExtrasTarget(v, counts) {
+  const whitelist = SUPPORTED_EXTRAS;
+  for (const [logical, dirnames] of Object.entries(v.extrasMap)) {
+    const localRoot = v.map.projects[logical]?.[HOST];
+    if (!localRoot || localRoot === "TBD") {
+      counts.unmapped++;
+      continue;
+    }
+    for (const dirname10 of dirnames) {
+      if (!whitelist.includes(dirname10)) {
+        counts.skipped++;
+        continue;
+      }
+      yield { logical, localRoot, dirname: dirname10 };
+    }
+  }
+}
+function copyExtrasOverlayFiltered(src, dst, blockSet) {
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSyncGuarded(
+    src,
+    dst,
+    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry)),
+    "copyExtrasOverlayFiltered"
+  );
+}
+function copyExtrasOverlaySkipDiverged(src, dst, blockSet, divergedSet) {
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSyncGuarded(
+    src,
+    dst,
+    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry)) && !divergedSet.has(relative(src, srcEntry)),
+    "copyExtrasOverlaySkipDiverged"
+  );
+}
+function copyExtras(src, dst) {
+  rmSync2(dst, { recursive: true, force: true });
+  cpSync2(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
+}
+function copyExtrasFileSkipDiverged(src, dst) {
+  if (existsSync2(dst)) {
+    let dstBuf;
+    try {
+      dstBuf = readFileSync2(dst);
+    } catch {
+      return;
+    }
+    if (!readFileSync2(src).equals(dstBuf)) return;
+  }
+  copyExtras(src, dst);
+}
+function extrasDenySet(dirname10) {
+  return dirname10 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+}
+function copyExtrasFiltered(src, dst, blockSet) {
+  rmSync2(dst, { recursive: true, force: true });
+  cpSync2(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry))
+  });
+}
+function prunePreservingDenied(src, dst, blockSet) {
+  for (const name of readdirSync2(dst)) {
+    if (isDeniedName(blockSet, name)) continue;
+    const dstPath = join3(dst, name);
+    const srcStat = lstatSync2(join3(src, name), { throwIfNoEntry: false });
+    if (srcStat === void 0) {
+      rmSync2(dstPath, { recursive: true, force: true });
+      continue;
+    }
+    const dstStat = lstatSync2(dstPath);
+    if (srcStat.isDirectory() && dstStat.isDirectory()) {
+      prunePreservingDenied(join3(src, name), dstPath, blockSet);
+    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
+      rmSync2(dstPath, { recursive: true, force: true });
+    }
+  }
+}
+function copyExtrasFilteredPreserving(src, dst, blockSet) {
+  const dstStat = lstatSync2(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0) {
+    if (dstStat.isDirectory()) prunePreservingDenied(src, dst, blockSet);
+    else rmSync2(dst, { recursive: true, force: true });
+  }
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSync2(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry))
+  });
+}
+
+// src/links.ts
+init_utils();
+init_utils_fs();
+init_utils_json();
+function emitAutoMove(onPreview, linkPath, ts, name) {
+  if (onPreview) {
+    onPreview({ kind: "auto-move", from: linkPath, to: `backup/${ts}/${name}` });
+  } else {
+    log(`would auto-move non-symlink: ${linkPath} -> backup/${ts}/${name}`);
+  }
+}
+function emitCreate(onPreview, from, to) {
+  if (onPreview) {
+    onPreview({ kind: "create", from, to });
+  } else {
+    log(`would create symlink: ${from} -> ${to}`);
+  }
+}
+function emitCopy(onPreview, from, to) {
+  if (onPreview) {
+    onPreview({ kind: "copy", from, to });
+  } else {
+    log(`would copy: ${from} -> ${to}`);
+  }
+}
+function isAlreadySymlink(linkPath) {
+  return existsSync4(linkPath) && lstatSync4(linkPath).isSymbolicLink();
+}
+function runAutoMovePasses(linkNames, claude, repo, ts, dryRun, onPreview) {
+  for (const name of linkNames) {
+    const linkPath = join5(claude, name);
+    const target = join5(repo, "shared", name);
+    if (!existsSync4(linkPath)) continue;
+    if (lstatSync4(linkPath).isSymbolicLink()) continue;
+    if (!existsSync4(target)) continue;
+    if (dryRun) {
+      emitAutoMove(onPreview, linkPath, ts, name);
+      continue;
+    }
+    backupBeforeWrite(linkPath, ts);
+    rmSync3(linkPath, { recursive: true, force: true });
+  }
+}
+function copySharedLinkPull(src, dst) {
+  copyExtrasFilteredPreservingBy(src, dst, (name) => isDeniedName(ALWAYS_NEVER_SYNC, name));
+}
+function applySharedLinksWin32(linkNames, claude, repo, ts, dryRun, onPreview) {
+  for (const name of linkNames) {
+    const target = join5(repo, "shared", name);
+    if (!existsSync4(target)) continue;
+    const linkPath = join5(claude, name);
+    if (dryRun) {
+      emitCopy(onPreview, linkPath, target);
+      continue;
+    }
+    const stat = lstatSync4(linkPath, { throwIfNoEntry: false });
+    if (stat !== void 0) {
+      backupBeforeWrite(linkPath, ts);
+      if (stat.isSymbolicLink()) {
+        rmSync3(linkPath, { recursive: true, force: true });
+      }
+    }
+    copySharedLinkPull(target, linkPath);
+  }
+}
+function applySharedLinks(ts, map, opts = {}) {
+  const dryRun = opts.dryRun === true;
+  const claude = claudeHome();
+  const repo = repoHome();
+  const linkNames = allSharedLinks(map);
+  if (process.platform === "win32") {
+    applySharedLinksWin32(linkNames, claude, repo, ts, dryRun, opts.onPreview);
+    return;
+  }
+  runAutoMovePasses(linkNames, claude, repo, ts, dryRun, opts.onPreview);
+  for (const name of linkNames) {
+    const target = join5(repo, "shared", name);
+    if (!existsSync4(target)) continue;
+    const linkPath = join5(claude, name);
+    if (isAlreadySymlink(linkPath)) continue;
+    if (dryRun) {
+      emitCreate(opts.onPreview, linkPath, target);
+      continue;
+    }
+    ensureSymlink(linkPath, target);
+  }
+}
+function syncSharedLinksPush(map) {
+  if (process.platform !== "win32") return;
+  if (map === null) return;
+  const claude = claudeHome();
+  const repo = repoHome();
+  for (const name of allSharedLinks(map)) {
+    const localPath = join5(claude, name);
+    const stat = lstatSync4(localPath, { throwIfNoEntry: false });
+    if (stat === void 0) continue;
+    if (stat.isSymbolicLink()) continue;
+    copyExtrasFiltered(localPath, join5(repo, "shared", name), ALWAYS_NEVER_SYNC);
+  }
+}
+function regenerateSettings(ts, opts = {}) {
+  const dryRun = opts.dryRun === true;
+  const suppressDriftWarn = opts.suppressDriftWarn === true;
+  const repo = repoHome();
+  const claude = claudeHome();
+  const basePath = join5(repo, "shared", "settings.base.json");
+  const hostPath = join5(repo, "hosts", `${HOST}.json`);
+  if (!existsSync4(basePath)) {
+    die("repo not initialized; run 'nomad init' to scaffold");
+  }
+  const base = readJson(basePath);
+  const hasOverrides = existsSync4(hostPath);
+  const overrides = hasOverrides ? readJson(hostPath) : {};
+  const merged = deepMerge(base, overrides);
+  const settingsPath = join5(claude, "settings.json");
+  if (!suppressDriftWarn && existsSync4(settingsPath)) {
+    try {
+      const existing = readJson(settingsPath);
+      const drift = classifySettingsDrift(merged, existing);
+      if (drift.behind.length > 0) {
+        const { phrase, pronoun } = describeSettings(drift.behind);
+        warn(
+          `your settings.json is missing ${phrase} that the synced copy has; run 'nomad pull' to restore ${pronoun}.`
+        );
+      }
+      const { promotable } = partitionByCaptureExclusion(drift.ahead);
+      if (promotable.length > 0) {
+        const { phrase, pronoun, verb } = describeSettings(promotable);
+        warn(
+          `your settings.json has ${phrase} that ${verb} not yet synced; run 'nomad capture-settings' to save ${pronoun} to the repo before the next pull overwrites ${pronoun}.`
+        );
+      }
+    } catch {
+      warn("existing settings.json is malformed; skipping drift-check and regenerating.");
+    }
+  }
+  const overrideLabel = hasOverrides ? `${HOST}.json` : "no host overrides";
+  if (dryRun) {
+    log(`would write settings.json (base + ${overrideLabel})`);
+    return { label: overrideLabel };
+  }
+  backupBeforeWrite(settingsPath, ts);
+  writeJsonAtomic(settingsPath, stripGsdHookEntries(merged));
+  return { label: overrideLabel };
+}
+
+// src/commands.adopt.ts
+init_utils();
+init_utils_fs();
+init_utils_json();
+var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
+function lexists(p) {
+  try {
+    lstatSync5(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readMapIfPresent(repoHome2) {
+  const mapPath = join6(repoHome2, "path-map.json");
+  return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
+}
+function isConfiguredTarget(name, map) {
+  return SHARED_LINKS.includes(name) || (map.sharedDirs?.includes(name) ?? false);
+}
+function isValidAdoptName(name) {
+  if (SHARED_LINKS.includes(name)) return true;
+  return isValidSharedDir(name);
+}
+function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
+  const ts = freshBackupTs(backup);
+  backupBeforeWrite(linkPath, ts);
+  cpSync4(linkPath, sharedTarget, { recursive: true, force: true, preserveTimestamps: true });
+  rmSync4(linkPath, { recursive: true, force: true });
+  if (process.platform === "win32") {
+    copySharedLinkPull(sharedTarget, linkPath);
+  } else {
+    ensureSymlink(linkPath, sharedTarget);
+  }
+  const rel = join6("shared", name);
+  gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
+  log(`adopted ${name}; ${ADOPT_PUSH_HINT}`);
+}
+function cmdAdopt(name, opts = {}) {
+  const dryRun = opts.dryRun === true;
+  if (!isValidAdoptName(name)) {
+    fail(`invalid name: ${JSON.stringify(name)}`);
+    process.exit(1);
+  }
+  const repo = repoHome();
+  const claude = claudeHome();
+  const backup = backupBase();
+  const map = readMapIfPresent(repo);
+  if (!isConfiguredTarget(name, map)) {
+    fail(
+      `${name}: not a configured shared target. Add it to sharedDirs in path-map.json first, then re-run adopt.`
+    );
+    process.exit(1);
+  }
+  const linkPath = join6(claude, name);
+  const sharedTarget = join6(repo, "shared", name);
+  if (!existsSync5(linkPath)) {
+    log(`${name}: nothing to adopt (not present in ~/.claude/)`);
+    return;
+  }
+  if (lstatSync5(linkPath).isSymbolicLink()) {
+    log(`${name}: already adopted (already a symlink)`);
+    return;
+  }
+  if (process.platform === "win32" && lexists(sharedTarget)) {
+    log(`${name}: already adopted (win32 copy-sync); run \`nomad pull\` to refresh the local copy`);
+    return;
+  }
+  if (lexists(sharedTarget)) {
+    fail(`${name}: shared/${name} already exists; would clobber. Remove it first.`);
+    process.exit(1);
+  }
+  if (dryRun) {
+    const ts = freshBackupTs(backup);
+    log(`would backup: ${linkPath} -> backup/${ts}/${name}`);
+    log(`would move: ${linkPath} -> shared/${name}`);
+    log(
+      process.platform === "win32" ? `would copy back: shared/${name} -> ${linkPath} (win32 copy-sync)` : `would relink: ${linkPath} -> shared/${name}`
+    );
+    log(`would stage: shared/${name}`);
+    return;
+  }
+  try {
+    performAdoptMove(name, linkPath, sharedTarget, repo, backup);
+  } catch (err) {
+    if (!(err instanceof NomadFatal)) throw err;
+    fail(err.message);
+    process.exitCode = 1;
+  }
+}
+
+// src/commands.allow.ts
+init_config();
+import { existsSync as existsSync6 } from "node:fs";
+
+// src/commands.redact.core.ts
+import { appendFileSync, readFileSync as readFileSync3 } from "node:fs";
+import { join as join7 } from "node:path";
+function collectMatchIntervals(content, findings) {
+  const intervals = [];
+  for (const f of findings) {
+    const match = f.Match;
+    if (match === "") continue;
+    let from = 0;
+    let pos = content.indexOf(match, from);
+    while (pos !== -1) {
+      intervals.push({ start: pos, end: pos + match.length, ruleId: f.RuleID });
+      from = pos + match.length;
+      pos = content.indexOf(match, from);
+    }
+  }
+  return intervals;
+}
+function mergeIntervals(intervals) {
+  if (intervals.length === 0) return [];
+  const sorted = [...intervals].sort((a, b) => a.start - b.start || b.end - a.end);
+  let last = { ...sorted[0] };
+  const merged = [last];
+  for (let i = 1; i < sorted.length; i++) {
+    const cur = sorted[i];
+    if (cur.start <= last.end) {
+      if (cur.end > last.end) last.end = cur.end;
+    } else {
+      last = { ...cur };
+      merged.push(last);
+    }
+  }
+  return merged;
+}
+function applyRedactions(content, findings) {
+  const raw = collectMatchIntervals(content, findings);
+  if (raw.length === 0) return content;
+  const merged = mergeIntervals(raw);
+  let result = content;
+  for (let i = merged.length - 1; i >= 0; i--) {
+    const { start, end, ruleId } = merged[i];
+    result = result.slice(0, start) + `[REDACTED:${ruleId}]` + result.slice(end);
+  }
+  return result;
+}
+function formatFingerprint(fingerprint) {
+  return fingerprint.replace(/[\r\n]/g, "") + "\n";
 }
-function applySharedLinks(ts, map, opts = {}) {
-  const dryRun = opts.dryRun === true;
-  const claude = claudeHome();
-  const repo = repoHome();
-  const linkNames = allSharedLinks(map);
-  runAutoMovePasses(linkNames, claude, repo, ts, dryRun, opts.onPreview);
-  for (const name of linkNames) {
-    const target = join5(repo, "shared", name);
-    if (!existsSync4(target)) continue;
-    const linkPath = join5(claude, name);
-    if (isAlreadySymlink(linkPath)) continue;
-    if (dryRun) {
-      emitCreate(opts.onPreview, linkPath, target);
-      continue;
-    }
-    ensureSymlink(linkPath, target);
+function isRecentlyModified(mtimeMs, nowMs, thresholdMs = 5 * 60 * 1e3) {
+  return nowMs - mtimeMs < thresholdMs;
+}
+function isValidFingerprint(fingerprint) {
+  return fingerprint.trim().length > 0 && fingerprint.length <= 512 && /^[^\r\n]+$/.test(fingerprint);
+}
+function isAlreadyPresent(line, lines) {
+  return lines.includes(line);
+}
+function appendGitleaksIgnore(fingerprint, repo) {
+  const sanitized = fingerprint.replace(/[\r\n]/g, "").trim();
+  if (sanitized.length === 0) return;
+  const ignPath = join7(repo, ".gitleaksignore");
+  let raw;
+  try {
+    raw = readFileSync3(ignPath, "utf8");
+  } catch {
+    raw = "";
   }
+  const existing = raw.split("\n").filter((l) => l.length > 0);
+  if (isAlreadyPresent(sanitized, existing)) return;
+  const needsLeadingNewline = raw.length > 0 && !raw.endsWith("\n");
+  const prefix = needsLeadingNewline ? "\n" : "";
+  appendFileSync(ignPath, prefix + formatFingerprint(sanitized), "utf8");
 }
-function regenerateSettings(ts, opts = {}) {
-  const dryRun = opts.dryRun === true;
-  const suppressDriftWarn = opts.suppressDriftWarn === true;
+
+// src/commands.allow.ts
+init_utils();
+function cmdAllow(fingerprints) {
   const repo = repoHome();
-  const claude = claudeHome();
-  const basePath = join5(repo, "shared", "settings.base.json");
-  const hostPath = join5(repo, "hosts", `${HOST}.json`);
-  if (!existsSync4(basePath)) {
-    die("repo not initialized; run 'nomad init' to scaffold");
-  }
-  const base = readJson(basePath);
-  const hasOverrides = existsSync4(hostPath);
-  const overrides = hasOverrides ? readJson(hostPath) : {};
-  const merged = deepMerge(base, overrides);
-  const settingsPath = join5(claude, "settings.json");
-  if (!suppressDriftWarn && existsSync4(settingsPath)) {
-    try {
-      const existing = readJson(settingsPath);
-      const drift = classifySettingsDrift(merged, existing);
-      if (drift.behind.length > 0) {
-        const { phrase, pronoun } = describeSettings(drift.behind);
-        warn(
-          `your settings.json is missing ${phrase} that the synced copy has; run 'nomad pull' to restore ${pronoun}.`
-        );
-      }
-      const { promotable } = partitionByCaptureExclusion(drift.ahead);
-      if (promotable.length > 0) {
-        const { phrase, pronoun, verb } = describeSettings(promotable);
-        warn(
-          `your settings.json has ${phrase} that ${verb} not yet synced; run 'nomad capture-settings' to save ${pronoun} to the repo before the next pull overwrites ${pronoun}.`
-        );
-      }
-    } catch {
-      warn("existing settings.json is malformed; skipping drift-check and regenerating.");
+  if (!existsSync6(repo)) die(`repo not cloned at ${repo}`);
+  for (const fp of fingerprints) {
+    if (!isValidFingerprint(fp)) {
+      const shown = fp.replaceAll("\r", String.raw`\r`).replaceAll("\n", String.raw`\n`);
+      fail(`invalid fingerprint: ${shown}`);
+      process.exit(1);
     }
   }
-  const overrideLabel = hasOverrides ? `${HOST}.json` : "no host overrides";
-  if (dryRun) {
-    log(`would write settings.json (base + ${overrideLabel})`);
-    return { label: overrideLabel };
+  for (const fp of fingerprints) {
+    appendGitleaksIgnore(fp, repo);
+    item(`allowed: ${fp}`);
   }
-  backupBeforeWrite(settingsPath, ts);
-  writeJsonAtomic(settingsPath, stripGsdHookEntries(merged));
-  return { label: overrideLabel };
+  log(`allowed ${fingerprints.length} fingerprint(s)`);
 }
 
 // src/commands.capture-settings.ts
+init_config();
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join9 } from "node:path";
+import { createInterface } from "node:readline/promises";
 init_utils_fs();
 init_utils_json();
 
 // src/utils.lockfile.ts
 init_config();
 init_utils();
-import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join8 } from "node:path";
 function lockFilePath() {
-  return join6(home(), ".cache", "claude-nomad", "nomad.lock");
+  return join8(home(), ".cache", "claude-nomad", "nomad.lock");
 }
 function acquireLock(verb) {
   const lp = lockFilePath();
@@ -1786,7 +2095,7 @@ function releaseLock(handle) {
 function unlinkIfSamePid(expectedPidStr, lp) {
   let current;
   try {
-    current = readFileSync3(lp, "utf8").trim();
+    current = readFileSync4(lp, "utf8").trim();
   } catch {
     return false;
   }
@@ -1801,7 +2110,7 @@ function unlinkIfSamePid(expectedPidStr, lp) {
 function checkStaleAndRetry(verb, lp) {
   let pidStr;
   try {
-    pidStr = readFileSync3(lp, "utf8").trim();
+    pidStr = readFileSync4(lp, "utf8").trim();
   } catch {
     pidStr = "";
   }
@@ -1869,30 +2178,30 @@ async function confirmCapture(destLabel, keys) {
   }
 }
 function resolveCaptureDestination(repo, useHost) {
-  const destPath = useHost ? join7(repo, "hosts", `${HOST}.json`) : join7(repo, "shared", "settings.base.json");
-  const existing = existsSync5(destPath) ? readJson(destPath) : {};
+  const destPath = useHost ? join9(repo, "hosts", `${HOST}.json`) : join9(repo, "shared", "settings.base.json");
+  const existing = existsSync7(destPath) ? readJson(destPath) : {};
   return { destPath, existing };
 }
 async function cmdCaptureSettings(opts) {
   const { host: useHost, dryRun } = opts;
   const repo = repoHome();
-  if (!existsSync5(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync7(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("capture-settings");
   if (handle === null) process.exit(0);
   try {
     const claude = claudeHome();
-    const basePath = join7(repo, "shared", "settings.base.json");
-    if (!existsSync5(basePath)) {
+    const basePath = join9(repo, "shared", "settings.base.json");
+    if (!existsSync7(basePath)) {
       die("repo not initialized; run 'nomad init' to scaffold");
     }
-    const settingsPath = join7(claude, "settings.json");
-    if (!existsSync5(settingsPath)) {
+    const settingsPath = join9(claude, "settings.json");
+    if (!existsSync7(settingsPath)) {
       log("no ~/.claude/settings.json found; nothing to capture");
       return;
     }
     const base = readJson(basePath);
-    const hostPath = join7(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync5(hostPath) ? readJson(hostPath) : {};
+    const hostPath = join9(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync7(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
     const subset = buildCaptureSubset(merged, settings, { normalizeNodePath: !useHost });
@@ -1929,8 +2238,8 @@ async function cmdCaptureSettings(opts) {
 // src/commands.clean.ts
 init_config();
 init_utils();
-import { existsSync as existsSync6, lstatSync as lstatSync4, readdirSync, rmSync as rmSync3, statSync as statSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync8, lstatSync as lstatSync6, readdirSync as readdirSync3, rmSync as rmSync5, statSync as statSync2 } from "node:fs";
+import { join as join10 } from "node:path";
 var TS_SHAPE = /^\d{8}-\d{6}(-\d+)?$/;
 var DURATION_RE = /^(\d+)([dhm])$/;
 var UNIT_MS = { d: 864e5, h: 36e5, m: 6e4 };
@@ -1944,8 +2253,8 @@ function parseDuration(s) {
   return Number(m[1]) * UNIT_MS[m[2]];
 }
 function listBackupDirs(backupBase2) {
-  if (!existsSync6(backupBase2)) return [];
-  return readdirSync(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join8(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
+  if (!existsSync8(backupBase2)) return [];
+  return readdirSync3(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join10(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
 function prunableByAge(dirs, olderThanMs, nowMs) {
   return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
@@ -1955,10 +2264,10 @@ function prunableByCount(dirs, keep) {
 }
 function safeDelete(backupBase2, name) {
   if (!isTsDir(name)) return;
-  const full = join8(backupBase2, name);
-  const st = lstatSync4(full, { throwIfNoEntry: false });
+  const full = join10(backupBase2, name);
+  const st = lstatSync6(full, { throwIfNoEntry: false });
   if (!st || st.isSymbolicLink() || !st.isDirectory()) return;
-  rmSync3(full, { recursive: true, force: true });
+  rmSync5(full, { recursive: true, force: true });
 }
 function resolveTargets(dirs, olderThanMs, keep) {
   if (keep !== void 0) return prunableByCount(dirs, keep);
@@ -1993,9 +2302,10 @@ function cmdClean(opts, backupBase2 = backupBase()) {
 // src/commands.eject.ts
 init_config();
 init_utils();
+init_utils_fs();
 init_utils_json();
-import { cpSync as cpSync3, existsSync as existsSync7, lstatSync as lstatSync5, realpathSync, renameSync as renameSync2, rmSync as rmSync4 } from "node:fs";
-import { join as join9, sep as sep2 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync9, lstatSync as lstatSync7, realpathSync, rmSync as rmSync6 } from "node:fs";
+import { join as join11, sep as sep3 } from "node:path";
 function ejectChecklist() {
   return [
     "Manual steps remaining to finish leaving claude-nomad on this host:",
@@ -2011,33 +2321,33 @@ function errMessage(err) {
 }
 function lexists2(p) {
   try {
-    lstatSync5(p);
+    lstatSync7(p);
     return true;
   } catch {
     return false;
   }
 }
 function readMapIfPresent2(repoHome2) {
-  const mapPath = join9(repoHome2, "path-map.json");
-  return existsSync7(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join11(repoHome2, "path-map.json");
+  return existsSync9(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function classifyName(linkPath) {
   if (!lexists2(linkPath)) return "absent";
-  if (!lstatSync5(linkPath).isSymbolicLink()) return "skip-real";
-  if (!existsSync7(linkPath)) return "dangling";
+  if (!lstatSync7(linkPath).isSymbolicLink()) return "skip-real";
+  if (!existsSync9(linkPath)) return "dangling";
   return "materialize";
 }
 function resolveSharedRoot(repoHome2) {
   try {
-    return realpathSync(join9(repoHome2, "shared"));
+    return realpathSync(join11(repoHome2, "shared"));
   } catch {
     return die(
-      `cannot resolve ${join9(repoHome2, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
+      `cannot resolve ${join11(repoHome2, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
     );
   }
 }
 function isManagedTarget(target, sharedRoot) {
-  return target.startsWith(sharedRoot + sep2);
+  return target.startsWith(sharedRoot + sep3);
 }
 function materializeOne(name, linkPath, sharedRoot) {
   const target = realpathSync(linkPath);
@@ -2047,33 +2357,36 @@ function materializeOne(name, linkPath, sharedRoot) {
   }
   const tmp = `${linkPath}.eject.tmp.${process.pid}.${Date.now()}`;
   try {
-    rmSync4(tmp, { recursive: true, force: true });
-    cpSync3(target, tmp, {
+    rmSync6(tmp, { recursive: true, force: true });
+    cpSync5(target, tmp, {
       recursive: true,
       force: true,
       dereference: true,
       preserveTimestamps: true
     });
-    rmSync4(linkPath, { force: true });
-    renameSync2(tmp, linkPath);
+    rmSync6(linkPath, { force: true });
+    renameAtomicRetry(tmp, linkPath);
     item(`ejected: ${name}`);
     return true;
   } catch (err) {
     try {
-      rmSync4(tmp, { recursive: true, force: true });
+      rmSync6(tmp, { recursive: true, force: true });
     } catch {
     }
     throw err;
   }
 }
+function skipRealMessage(name) {
+  return process.platform === "win32" ? `already a real copy (win32 copy-sync): ${name}` : `skipped (not a symlink): ${name}`;
+}
 function previewDryRun(names, classifications, claudeHome2, sharedRoot) {
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join9(claudeHome2, name);
+    const linkPath = join11(claudeHome2, name);
     if (cls === "absent") {
       item(`skipped (absent): ${name}`);
     } else if (cls === "skip-real") {
-      item(`skipped (not a symlink): ${name}`);
+      item(skipRealMessage(name));
     } else {
       previewMaterialize(name, linkPath, sharedRoot);
     }
@@ -2099,12 +2412,12 @@ function runLiveEject(names, classifications, claudeHome2, sharedRoot) {
   let skipped = 0;
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join9(claudeHome2, name);
+    const linkPath = join11(claudeHome2, name);
     if (cls === "absent") {
       item(`skipped (absent): ${name}`);
       skipped++;
     } else if (cls === "skip-real") {
-      item(`skipped (not a symlink): ${name}`);
+      item(skipRealMessage(name));
       skipped++;
     } else if (materializeOneOrDie(name, linkPath, sharedRoot, done)) {
       done.push(name);
@@ -2135,7 +2448,7 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   const names = allSharedLinks(map);
   const classifications = /* @__PURE__ */ new Map();
   for (const name of names) {
-    classifications.set(name, classifyName(join9(claudeHome2, name)));
+    classifications.set(name, classifyName(join11(claudeHome2, name)));
   }
   const dangling = names.filter((n) => classifications.get(n) === "dangling");
   if (dangling.length > 0) {
@@ -2158,14 +2471,14 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync32 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync34 } from "node:fs";
+import { join as join40 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
 init_config();
-import { existsSync as existsSync9, lstatSync as lstatSync6, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync11, lstatSync as lstatSync8, readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
+import { join as join13 } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -2243,15 +2556,15 @@ function readJsonSafe(path, label, section2) {
 // src/init.classify.ts
 init_config();
 init_utils_json();
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join12 } from "node:path";
 function classifyRepoState(repoHome2, host) {
-  const basePath = join10(repoHome2, "shared", "settings.base.json");
-  const mapPath = join10(repoHome2, "path-map.json");
-  const hostPath = join10(repoHome2, "hosts", `${host}.json`);
-  const hasBase = existsSync8(basePath);
-  const hasMap = existsSync8(mapPath);
-  const hasHost = existsSync8(hostPath);
+  const basePath = join12(repoHome2, "shared", "settings.base.json");
+  const mapPath = join12(repoHome2, "path-map.json");
+  const hostPath = join12(repoHome2, "hosts", `${host}.json`);
+  const hasBase = existsSync10(basePath);
+  const hasMap = existsSync10(mapPath);
+  const hasHost = existsSync10(hostPath);
   let mapEntryCount = 0;
   if (hasMap) {
     try {
@@ -2266,11 +2579,11 @@ function classifyRepoState(repoHome2, host) {
   return "partial";
 }
 function reasonForPartial(repoHome2, host) {
-  const basePath = join10(repoHome2, "shared", "settings.base.json");
-  const mapPath = join10(repoHome2, "path-map.json");
-  const hostPath = join10(repoHome2, "hosts", `${host}.json`);
-  if (!existsSync8(basePath)) return "- shared/settings.base.json missing";
-  if (!existsSync8(mapPath)) return "- path-map.json missing";
+  const basePath = join12(repoHome2, "shared", "settings.base.json");
+  const mapPath = join12(repoHome2, "path-map.json");
+  const hostPath = join12(repoHome2, "hosts", `${host}.json`);
+  if (!existsSync10(basePath)) return "- shared/settings.base.json missing";
+  if (!existsSync10(mapPath)) return "- path-map.json missing";
   let mapEntryCount;
   try {
     const map = readJson(mapPath);
@@ -2279,7 +2592,7 @@ function reasonForPartial(repoHome2, host) {
     mapEntryCount = 0;
   }
   if (mapEntryCount === 0) return "- path-map.json.projects has no entries";
-  if (!existsSync8(hostPath)) return `- hosts/${host}.json missing`;
+  if (!existsSync10(hostPath)) return `- hosts/${host}.json missing`;
   return "- partial state (unknown gap)";
 }
 
@@ -2296,15 +2609,15 @@ function reportHostAndPaths(section2) {
   if (isOverrideActive()) {
     addItem(section2, `${dim(infoGlyph)} NOMAD_REPO: ${blue(repo)}`);
   }
-  addItem(section2, `${existsSync9(repo) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(repo)}`);
+  addItem(section2, `${existsSync11(repo) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(repo)}`);
   addItem(
     section2,
-    `${existsSync9(claude) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(claude)}`
+    `${existsSync11(claude) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(claude)}`
   );
 }
 function pathMapHostKeys() {
-  const mapPath = join11(repoHome(), "path-map.json");
-  if (!existsSync9(mapPath)) return /* @__PURE__ */ new Set();
+  const mapPath = join13(repoHome(), "path-map.json");
+  if (!existsSync11(mapPath)) return /* @__PURE__ */ new Set();
   let raw;
   try {
     raw = readJson(mapPath);
@@ -2321,7 +2634,7 @@ function pathMapHostKeys() {
 function hostOverrideLabels() {
   let entries;
   try {
-    entries = readdirSync2(join11(repoHome(), "hosts"));
+    entries = readdirSync4(join13(repoHome(), "hosts"));
   } catch {
     return /* @__PURE__ */ new Set();
   }
@@ -2362,12 +2675,12 @@ function reportRepoState(section2) {
   }
 }
 function repoHasSharedSource(name) {
-  return existsSync9(join11(repoHome(), "shared", name));
+  return existsSync11(join13(repoHome(), "shared", name));
 }
 function classifySharedLink(name, p) {
   let stat;
   try {
-    stat = lstatSync6(p);
+    stat = lstatSync8(p);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -2379,6 +2692,12 @@ function classifySharedLink(name, p) {
     return { line: `${red(failGlyph)} ${name}: could not stat (${String(code)})`, fail: true };
   }
   if (!stat.isSymbolicLink()) {
+    if (process.platform === "win32") {
+      return {
+        line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)`,
+        fail: false
+      };
+    }
     return {
       line: `${red(failGlyph)} ${name}: NOT a symlink (blocks sync); run \`nomad adopt ${name}\` to fix`,
       fail: true
@@ -2410,7 +2729,7 @@ function classifySymlinkTarget(name, p) {
 function reportSharedLinks(section2, map) {
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const p = join11(claude, name);
+    const p = join13(claude, name);
     const { line, fail: fail2 } = classifySharedLink(name, p);
     addItem(section2, line);
     if (fail2) process.exitCode = 1;
@@ -2419,10 +2738,10 @@ function reportSharedLinks(section2, map) {
 function reportDroppedNamesMigration(section2) {
   const claude = claudeHome();
   for (const name of GSD_DROPPED_NAMES) {
-    const p = join11(claude, name);
+    const p = join13(claude, name);
     let stat;
     try {
-      stat = lstatSync6(p);
+      stat = lstatSync8(p);
     } catch {
       continue;
     }
@@ -2437,11 +2756,11 @@ function reportDroppedNamesMigration(section2) {
 // src/commands.doctor.checks.settings.ts
 init_color();
 init_config();
-import { existsSync as existsSync10, readdirSync as readdirSync3 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync5 } from "node:fs";
+import { join as join14 } from "node:path";
 function loadBaseSettings(section2) {
-  const basePath = join12(repoHome(), "shared", "settings.base.json");
-  if (!existsSync10(basePath)) {
+  const basePath = join14(repoHome(), "shared", "settings.base.json");
+  if (!existsSync12(basePath)) {
     addItem(section2, `${red(failGlyph)} shared/settings.base.json missing at ${blue(basePath)}`);
     process.exitCode = 1;
     return null;
@@ -2449,8 +2768,8 @@ function loadBaseSettings(section2) {
   return readJsonSafe(basePath, basePath, section2);
 }
 function loadAndReportSettings(section2) {
-  const settingsPath = join12(claudeHome(), "settings.json");
-  if (!existsSync10(settingsPath)) return null;
+  const settingsPath = join14(claudeHome(), "settings.json");
+  if (!existsSync12(settingsPath)) return null;
   const settings = readJsonSafe(settingsPath, settingsPath, section2);
   if (settings === null) return null;
   const unknownKeys = Object.keys(settings).filter((k) => !KNOWN_SETTINGS_KEYS.has(k));
@@ -2466,13 +2785,13 @@ function loadAndReportSettings(section2) {
 }
 function reportHostOverrides(section2, base, settings) {
   const repo = repoHome();
-  const hostFile = join12(repo, "hosts", `${HOST}.json`);
+  const hostFile = join14(repo, "hosts", `${HOST}.json`);
   let drift = [];
   if (base !== null && settings !== null) {
     const baseKeys = new Set(Object.keys(base));
     drift = Object.keys(settings).filter((k) => !baseKeys.has(k));
   }
-  if (existsSync10(hostFile)) {
+  if (existsSync12(hostFile)) {
     if (readJsonSafe(hostFile, hostFile, section2) !== null) {
       addItem(section2, `${green(okGlyph)} host overrides: ${blue(hostFile)}`);
     }
@@ -2481,9 +2800,9 @@ function reportHostOverrides(section2, base, settings) {
       section2,
       `${red(failGlyph)} no hosts/${HOST}.json AND settings.json has unbased keys ${JSON.stringify(drift)}`
     );
-    const hostsDir = join12(repo, "hosts");
-    if (existsSync10(hostsDir)) {
-      const cands = readdirSync3(hostsDir).filter((f) => f.endsWith(".json"));
+    const hostsDir = join14(repo, "hosts");
+    if (existsSync12(hostsDir)) {
+      const cands = readdirSync5(hostsDir).filter((f) => f.endsWith(".json"));
       if (cands.length > 0) addItem(section2, `${dim(infoGlyph)} candidates: ${cands.join(", ")}`);
     }
     process.exitCode = 1;
@@ -2498,8 +2817,8 @@ function reportHostOverrides(section2, base, settings) {
 // src/commands.doctor.checks.pathmap.ts
 init_color();
 init_config();
-import { existsSync as existsSync11, readdirSync as readdirSync4 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
+import { join as join15 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
@@ -2509,11 +2828,11 @@ function reportMappedProjects(section2, map) {
   }
 }
 function reportUnmappedProjects(section2, map) {
-  const localProjects = join13(claudeHome(), "projects");
-  if (!existsSync11(localProjects)) return;
+  const localProjects = join15(claudeHome(), "projects");
+  if (!existsSync13(localProjects)) return;
   let localDirs;
   try {
-    localDirs = readdirSync4(localProjects);
+    localDirs = readdirSync6(localProjects);
   } catch {
     return;
   }
@@ -2531,7 +2850,7 @@ function reportCurrentHostPathsMissing(section2, map) {
   for (const [name, hosts] of Object.entries(map.projects)) {
     const abspath = hosts[HOST];
     if (!abspath || abspath === "TBD") continue;
-    if (!existsSync11(abspath)) {
+    if (!existsSync13(abspath)) {
       addItem(
         section2,
         `${yellow(warnGlyph)} path-map: ${name} local path missing on ${HOST}: ${blue(abspath)}`
@@ -2562,8 +2881,8 @@ function reportPathCollisions(section2, map) {
   else addItem(section2, `${green(okGlyph)} path-encoding: no collisions`);
 }
 function reportPathMap(section2) {
-  const mapPath = join13(repoHome(), "path-map.json");
-  if (!existsSync11(mapPath)) {
+  const mapPath = join15(repoHome(), "path-map.json");
+  if (!existsSync13(mapPath)) {
     addItem(section2, `${red(failGlyph)} path-map.json missing at ${blue(mapPath)}`);
     process.exitCode = 1;
     return;
@@ -2592,21 +2911,19 @@ function reportNeverSync(section2) {
 
 // src/commands.doctor.checks.skills.ts
 init_color();
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { join as join16 } from "node:path";
 init_config();
 
 // src/extras-sync.diff.ts
 init_utils();
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { relative as relative2 } from "node:path";
+import { relative as relative3 } from "node:path";
 function parseNameStatus(stdout) {
+  const fields = stdout.split("\0").filter((f) => f.length > 0);
   const entries = [];
-  for (const line of stdout.split("\n")) {
-    if (line.length === 0) continue;
-    const tab = line.indexOf("	");
-    if (tab === -1) continue;
-    entries.push({ status: line.slice(0, tab), path: line.slice(tab + 1) });
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    entries.push({ status: fields[i], path: fields[i + 1] });
   }
   return entries;
 }
@@ -2619,13 +2936,13 @@ function parseDiffOutput(stdout) {
   return parseNameStatus(stdout).map(labelEntry);
 }
 function parseModifiedPaths(stdout, a) {
-  return parseNameStatus(stdout).filter((entry) => entry.status === "M").map((entry) => relative2(a, entry.path));
+  return parseNameStatus(stdout).filter((entry) => entry.status === "M").map((entry) => relative3(a, entry.path));
 }
 function runNameStatusDiff(a, b, parse) {
   try {
     const stdout = execFileSync2(
       "git",
-      ["diff", "--no-index", "--no-renames", "--name-status", a, b],
+      ["diff", "--no-index", "--no-renames", "-z", "--name-status", a, b],
       {
         stdio: ["ignore", "pipe", "pipe"]
       }
@@ -2670,13 +2987,13 @@ function isGsdDiffLine(line, localBase, sharedBase) {
   return relative9.split("/")[0].startsWith(GSD_PREFIX);
 }
 function reportSkillsDivergence(section2) {
-  const sharedSkills = join14(repoHome(), "shared", "skills");
-  const localSkills = join14(claudeHome(), "skills");
-  if (!existsSync12(sharedSkills)) {
+  const sharedSkills = join16(repoHome(), "shared", "skills");
+  const localSkills = join16(claudeHome(), "skills");
+  if (!existsSync14(sharedSkills)) {
     addItem(section2, `${dim(infoGlyph)} skills: no shared/skills/ to compare`);
     return;
   }
-  if (!existsSync12(localSkills)) {
+  if (!existsSync14(localSkills)) {
     addItem(section2, `${dim(infoGlyph)} skills: no local skills/ to compare`);
     return;
   }
@@ -2699,8 +3016,8 @@ function reportSkillsDivergence(section2) {
 init_color();
 init_config();
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join18, relative as relative3 } from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join20, relative as relative4 } from "node:path";
 init_commands_pull_wedge();
 init_push_checks();
 init_utils();
@@ -2723,11 +3040,11 @@ function reportGitleaksProbe(section2) {
 }
 function reportGitlinks(section2) {
   const repo = repoHome();
-  const sharedDir = join18(repo, "shared");
-  if (existsSync15(sharedDir)) {
+  const sharedDir = join20(repo, "shared");
+  if (existsSync17(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
-      const rel = relative3(repo, p);
+      const rel = relative4(repo, p).replaceAll("\\", "/");
       addItem(
         section2,
         `${red(failGlyph)} gitlink: ${blue(rel)} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`
@@ -2822,13 +3139,13 @@ function reportGitIdentity(section2) {
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync16, lstatSync as lstatSync7, readdirSync as readdirSync6 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync18, lstatSync as lstatSync9, readdirSync as readdirSync8 } from "node:fs";
+import { join as join21 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
 function safeReaddir(dir) {
   try {
-    return readdirSync6(dir);
+    return readdirSync8(dir);
   } catch {
     return [];
   }
@@ -2839,8 +3156,8 @@ var BYTES_PER_MB = 1024 * 1024;
 function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
-    const full = join19(dir, entry);
-    const st = lstatSync7(full, { throwIfNoEntry: false });
+    const full = join21(dir, entry);
+    const st = lstatSync9(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) bytes += dirSizeBytes(full);
@@ -2850,11 +3167,11 @@ function dirSizeBytes(dir) {
 }
 function totalSizeMb(backupBase2, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join19(backupBase2, name));
+  for (const name of dirs) bytes += dirSizeBytes(join21(backupBase2, name));
   return bytes / BYTES_PER_MB;
 }
 function reportBackupsCheck(section2, backupBase2 = backupBase()) {
-  if (!existsSync16(backupBase2)) return;
+  if (!existsSync18(backupBase2)) return;
   const dirs = safeReaddir(backupBase2).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
   const sizeMb = totalSizeMb(backupBase2, dirs);
@@ -2935,8 +3252,8 @@ function reportCheckRemote(section2) {
 
 // src/commands.doctor.check-schema.ts
 init_color();
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join22 } from "node:path";
 init_config();
 
 // src/http-fetch.ts
@@ -2973,8 +3290,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join20(claudeHome(), "settings.json");
-  if (!existsSync17(settingsPath)) {
+  const settingsPath = join22(claudeHome(), "settings.json");
+  if (!existsSync19(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -3004,314 +3321,107 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync10, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync6, readdirSync as readdirSync11, rmSync as rmSync10 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
-import { join as join22 } from "node:path";
+import { join as join24 } from "node:path";
 init_config();
 init_push_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join22(claudeHome(), "projects", encoded, `${sid}.jsonl`);
+  return join24(claudeHome(), "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
     const summary = [...counts.entries()].map(([rule, n]) => `${rule} (${n})`).join(", ");
     addItem(section2, `${red(failGlyph)} ${red(summary)} in session ${sid}`);
   }
-  process.exitCode = 1;
-}
-function reportOtherFindings(section2, other) {
-  for (const f of other) {
-    addItem(section2, `${red(failGlyph)} ${red(f.RuleID)} leak in ${f.File}`);
-  }
-  process.exitCode = 1;
-}
-function reportRemediation(section2, bySession, logicalBySession, logicalToEncoded) {
-  addItem(section2, "");
-  addItem(section2, bold("Remediation"));
-  for (const [sid] of bySession) {
-    const logical = logicalBySession.get(sid);
-    if (logical !== void 0) {
-      const rotateLine = dim(
-        `- rotate the credential, then scrub ${scrubPath(logical, sid, logicalToEncoded)}`
-      );
-      addItem(section2, `  ${rotateLine}`);
-    }
-  }
-  addItem(section2, `  ${dim("- false positive? add a pattern to .gitleaks.toml")}`);
-}
-var SESSION_PATH_LOGICAL = /^shared\/projects\/([^/]+)\/([^/]+)\.jsonl$/;
-function emitClean(section2, staged) {
-  addItem(section2, `${green(okGlyph)} ${staged} project(s) scanned, no leaks`);
-}
-function buildLogicalBySession(findings) {
-  const logicalBySession = /* @__PURE__ */ new Map();
-  for (const f of findings) {
-    const m = SESSION_PATH_LOGICAL.exec(f.File);
-    if (m?.[2] !== void 0 && !logicalBySession.has(m[2])) {
-      logicalBySession.set(m[2], m[1] ?? "");
-    }
-  }
-  return logicalBySession;
-}
-function emitDescriptionLegend(section2, findings) {
-  const descByRule = /* @__PURE__ */ new Map();
-  for (const f of findings) {
-    if (f.Description && !descByRule.has(f.RuleID)) descByRule.set(f.RuleID, f.Description);
-  }
-  if (descByRule.size === 0) return;
-  addItem(section2, "");
-  addItem(section2, bold("Finding types"));
-  for (const [rule, desc] of descByRule) {
-    const ruleLabel = red(`- [${rule}]`);
-    addItem(section2, `  ${ruleLabel}: ${dim(desc)}`);
-  }
-}
-function scanAndReport(section2, tmpRoot, staged, logicalToEncoded) {
-  let findings;
-  try {
-    findings = scanStagedTree(tmpRoot);
-  } catch (err) {
-    addItem(section2, `${red(failGlyph)} scan failed: ${err.message}`);
-    process.exitCode = 1;
-    return;
-  }
-  if (findings === null) {
-    addItem(section2, `${red(failGlyph)} scan failed: no parseable gitleaks report`);
-    process.exitCode = 1;
-    return;
-  }
-  const { bySession, other } = partitionFindings(findings);
-  if (bySession.size === 0 && other.length === 0) {
-    emitClean(section2, staged);
-    return;
-  }
-  if (other.length > 0) reportOtherFindings(section2, other);
-  if (bySession.size > 0) reportSessionFindings(section2, bySession);
-  if (bySession.size > 0) {
-    reportRemediation(section2, bySession, buildLogicalBySession(findings), logicalToEncoded);
-  }
-  emitDescriptionLegend(section2, findings);
-}
-
-// src/commands.doctor.check-shared.ts
-init_config();
-
-// src/remap.ts
-init_config_sharedDirs_guard();
-import {
-  cpSync as cpSync5,
-  existsSync as existsSync20,
-  lstatSync as lstatSync9,
-  mkdirSync as mkdirSync5,
-  readdirSync as readdirSync9,
-  renameSync as renameSync3,
-  rmSync as rmSync8,
-  statSync as statSync5
-} from "node:fs";
-import { dirname as dirname4, join as join25, relative as relative5, sep as sep3 } from "node:path";
-
-// src/extras-sync.core.ts
-init_config();
-import { cpSync as cpSync4, existsSync as existsSync18, lstatSync as lstatSync8, readdirSync as readdirSync7, readFileSync as readFileSync6, rmSync as rmSync7 } from "node:fs";
-import { basename, join as join23, relative as relative4 } from "node:path";
-
-// src/extras-sync.guards.ts
-init_utils();
-init_config_sharedDirs_guard();
-import { isAbsolute, normalize } from "node:path";
-function assertSafeLocalRoot(localRoot, logical) {
-  if (!isAbsolute(localRoot)) {
-    throw new NomadFatal(
-      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be absolute)`
-    );
-  }
-  if (localRoot !== normalize(localRoot)) {
-    throw new NomadFatal(
-      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be already-normalized; no '..' or redundant segments)`
-    );
-  }
-}
-
-// src/extras-sync.core.ts
-init_utils();
-init_utils_json();
-function loadValidatedExtras(opts) {
-  const repo = repoHome();
-  const mapPath = join23(repo, "path-map.json");
-  const repoExtras = join23(repo, "shared", "extras");
-  if (!existsSync18(mapPath) || opts.requireRepoExtras === true && !existsSync18(repoExtras)) {
-    if (opts.missingMsg !== void 0) log(opts.missingMsg);
-    return null;
-  }
-  const map = readPathMap(mapPath);
-  const extrasMap = map.extras ?? {};
-  if (Object.keys(extrasMap).length === 0) return null;
-  for (const logical of Object.keys(extrasMap)) {
-    assertSafeLogical(logical);
-    const localRoot = map.projects[logical]?.[HOST];
-    if (localRoot && localRoot !== "TBD") assertSafeLocalRoot(localRoot, logical);
-  }
-  return { map, extrasMap };
-}
-function* eachExtrasTarget(v, counts) {
-  const whitelist = SUPPORTED_EXTRAS;
-  for (const [logical, dirnames] of Object.entries(v.extrasMap)) {
-    const localRoot = v.map.projects[logical]?.[HOST];
-    if (!localRoot || localRoot === "TBD") {
-      counts.unmapped++;
-      continue;
-    }
-    for (const dirname10 of dirnames) {
-      if (!whitelist.includes(dirname10)) {
-        counts.skipped++;
-        continue;
-      }
-      yield { logical, localRoot, dirname: dirname10 };
-    }
-  }
+  process.exitCode = 1;
 }
-function stripCollidingDstSymlinks(src, dst, isExcluded) {
-  if (!existsSync18(dst)) return;
-  for (const name of readdirSync7(src)) {
-    if (isExcluded(name)) continue;
-    const dstPath = join23(dst, name);
-    const dstStat = lstatSync8(dstPath, { throwIfNoEntry: false });
-    if (dstStat === void 0) continue;
-    if (dstStat.isSymbolicLink()) {
-      rmSync7(dstPath, { recursive: true, force: true });
-    } else if (dstStat.isDirectory() && lstatSync8(join23(src, name)).isDirectory()) {
-      stripCollidingDstSymlinks(join23(src, name), dstPath, isExcluded);
-    }
+function reportOtherFindings(section2, other) {
+  for (const f of other) {
+    addItem(section2, `${red(failGlyph)} ${red(f.RuleID)} leak in ${f.File}`);
   }
+  process.exitCode = 1;
 }
-function cpSyncGuarded(src, dst, filter, label) {
-  try {
-    cpSync4(src, dst, { recursive: true, force: true, verbatimSymlinks: true, filter });
-  } catch (err) {
-    const e = err;
-    if (e.code === "EINVAL" || e.code === "ENOTEMPTY" || e.code === "ERR_FS_CP_NON_DIR_TO_DIR" || e.code === "ERR_FS_CP_DIR_TO_NON_DIR") {
-      throw new NomadFatal(
-        `${label}: type collision copying ${JSON.stringify(src)} -> ${JSON.stringify(dst)} (${e.path ?? "unknown path"}): a file/directory type changed upstream; run nomad pull --force-remote to recover`
+function reportRemediation(section2, bySession, logicalBySession, logicalToEncoded) {
+  addItem(section2, "");
+  addItem(section2, bold("Remediation"));
+  for (const [sid] of bySession) {
+    const logical = logicalBySession.get(sid);
+    if (logical !== void 0) {
+      const rotateLine = dim(
+        `- rotate the credential, then scrub ${scrubPath(logical, sid, logicalToEncoded)}`
       );
+      addItem(section2, `  ${rotateLine}`);
     }
-    throw err;
   }
+  addItem(section2, `  ${dim("- false positive? add a pattern to .gitleaks.toml")}`);
 }
-function copyExtrasOverlayFiltered(src, dst, blockSet) {
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  cpSyncGuarded(
-    src,
-    dst,
-    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry)),
-    "copyExtrasOverlayFiltered"
-  );
-}
-function copyExtrasOverlaySkipDiverged(src, dst, blockSet, divergedSet) {
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  cpSyncGuarded(
-    src,
-    dst,
-    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry)) && !divergedSet.has(relative4(src, srcEntry)),
-    "copyExtrasOverlaySkipDiverged"
-  );
-}
-function copyExtras(src, dst) {
-  rmSync7(dst, { recursive: true, force: true });
-  cpSync4(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
+var SESSION_PATH_LOGICAL = /^shared\/projects\/([^/]+)\/([^/]+)\.jsonl$/;
+function emitClean(section2, staged) {
+  addItem(section2, `${green(okGlyph)} ${staged} project(s) scanned, no leaks`);
 }
-function copyExtrasFileSkipDiverged(src, dst) {
-  if (existsSync18(dst)) {
-    let dstBuf;
-    try {
-      dstBuf = readFileSync6(dst);
-    } catch {
-      return;
+function buildLogicalBySession(findings) {
+  const logicalBySession = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const m = SESSION_PATH_LOGICAL.exec(f.File);
+    if (m?.[2] !== void 0 && !logicalBySession.has(m[2])) {
+      logicalBySession.set(m[2], m[1] ?? "");
     }
-    if (!readFileSync6(src).equals(dstBuf)) return;
   }
-  copyExtras(src, dst);
-}
-function extrasDenySet(dirname10) {
-  return dirname10 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
-}
-function copyExtrasFiltered(src, dst, blockSet) {
-  rmSync7(dst, { recursive: true, force: true });
-  cpSync4(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry))
-  });
+  return logicalBySession;
 }
-function prunePreservingDenied(src, dst, blockSet) {
-  for (const name of readdirSync7(dst)) {
-    if (isDeniedName(blockSet, name)) continue;
-    const dstPath = join23(dst, name);
-    const srcStat = lstatSync8(join23(src, name), { throwIfNoEntry: false });
-    if (srcStat === void 0) {
-      rmSync7(dstPath, { recursive: true, force: true });
-      continue;
-    }
-    const dstStat = lstatSync8(dstPath);
-    if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingDenied(join23(src, name), dstPath, blockSet);
-    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync7(dstPath, { recursive: true, force: true });
-    }
+function emitDescriptionLegend(section2, findings) {
+  const descByRule = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    if (f.Description && !descByRule.has(f.RuleID)) descByRule.set(f.RuleID, f.Description);
   }
-}
-function copyExtrasFilteredPreserving(src, dst, blockSet) {
-  const dstStat = lstatSync8(dst, { throwIfNoEntry: false });
-  if (dstStat !== void 0) {
-    if (dstStat.isDirectory()) prunePreservingDenied(src, dst, blockSet);
-    else rmSync7(dst, { recursive: true, force: true });
+  if (descByRule.size === 0) return;
+  addItem(section2, "");
+  addItem(section2, bold("Finding types"));
+  for (const [rule, desc] of descByRule) {
+    const ruleLabel = red(`- [${rule}]`);
+    addItem(section2, `  ${ruleLabel}: ${dim(desc)}`);
   }
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  cpSync4(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename(srcEntry))
-  });
 }
-function prunePreservingBy(src, dst, isPreserved) {
-  for (const name of readdirSync7(dst)) {
-    if (isPreserved(name)) continue;
-    const dstPath = join23(dst, name);
-    const srcStat = lstatSync8(join23(src, name), { throwIfNoEntry: false });
-    if (srcStat === void 0) {
-      rmSync7(dstPath, { recursive: true, force: true });
-      continue;
-    }
-    const dstStat = lstatSync8(dstPath);
-    if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingBy(join23(src, name), dstPath, isPreserved);
-    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync7(dstPath, { recursive: true, force: true });
-    }
+function scanAndReport(section2, tmpRoot, staged, logicalToEncoded) {
+  let findings;
+  try {
+    findings = scanStagedTree(tmpRoot);
+  } catch (err) {
+    addItem(section2, `${red(failGlyph)} scan failed: ${err.message}`);
+    process.exitCode = 1;
+    return;
   }
-}
-function copyExtrasFilteredPreservingBy(src, dst, isPreserved) {
-  const dstStat = lstatSync8(dst, { throwIfNoEntry: false });
-  if (dstStat !== void 0) {
-    if (dstStat.isDirectory()) prunePreservingBy(src, dst, isPreserved);
-    else rmSync7(dst, { recursive: true, force: true });
+  if (findings === null) {
+    addItem(section2, `${red(failGlyph)} scan failed: no parseable gitleaks report`);
+    process.exitCode = 1;
+    return;
   }
-  stripCollidingDstSymlinks(src, dst, isPreserved);
-  cpSync4(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isPreserved(basename(srcEntry))
-  });
+  const { bySession, other } = partitionFindings(findings);
+  if (bySession.size === 0 && other.length === 0) {
+    emitClean(section2, staged);
+    return;
+  }
+  if (other.length > 0) reportOtherFindings(section2, other);
+  if (bySession.size > 0) reportSessionFindings(section2, bySession);
+  if (bySession.size > 0) {
+    reportRemediation(section2, bySession, buildLogicalBySession(findings), logicalToEncoded);
+  }
+  emitDescriptionLegend(section2, findings);
 }
 
+// src/commands.doctor.check-shared.ts
+init_config();
+
 // src/remap.ts
+init_config_sharedDirs_guard();
+import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync10, mkdirSync as mkdirSync5, readdirSync as readdirSync10, rmSync as rmSync9, statSync as statSync5 } from "node:fs";
+import { dirname as dirname4, join as join26, relative as relative5, sep as sep4 } from "node:path";
 init_config();
 
 // src/push-manifest.ts
@@ -3319,8 +3429,8 @@ init_config();
 init_push_gitleaks_config();
 init_utils_fs();
 import { createHash } from "node:crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync4, readdirSync as readdirSync8, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
-import { dirname as dirname3, join as join24 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync4, readdirSync as readdirSync9, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import { dirname as dirname3, join as join25 } from "node:path";
 function isChanged(prev, cur, hash) {
   if (prev === void 0) return true;
   if (prev.size !== cur.size) return true;
@@ -3360,8 +3470,8 @@ function hashFile(absPath) {
   return createHash("sha256").update(readFileSync7(absPath)).digest("hex");
 }
 function enumerateDir(dir, results) {
-  for (const entry of readdirSync8(dir)) {
-    const fullPath = join24(dir, entry);
+  for (const entry of readdirSync9(dir)) {
+    const fullPath = join25(dir, entry);
     const st = statSync4(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -3372,8 +3482,8 @@ function enumerateDir(dir, results) {
 }
 function enumerateSourceFiles(projectDir) {
   const results = [];
-  for (const entry of readdirSync8(projectDir)) {
-    const fullPath = join24(projectDir, entry);
+  for (const entry of readdirSync9(projectDir)) {
+    const fullPath = join25(projectDir, entry);
     const st = statSync4(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -3385,15 +3495,15 @@ function enumerateSourceFiles(projectDir) {
 }
 function fileIdentity(p) {
   if (p === null) return "none::absent";
-  if (!existsSync19(p)) return `${p}::absent`;
+  if (!existsSync20(p)) return `${p}::absent`;
   return `${p}::${createHash("sha256").update(readFileSync7(p)).digest("hex")}`;
 }
 function computeConfigHash() {
   const repo = repoHome();
   const parts = [
     fileIdentity(resolveTomlPath(repo)),
-    fileIdentity(join24(repo, ".gitleaks.overlay.toml")),
-    fileIdentity(join24(repo, ".gitleaksignore"))
+    fileIdentity(join25(repo, ".gitleaks.overlay.toml")),
+    fileIdentity(join25(repo, ".gitleaksignore"))
   ];
   return createHash("sha256").update(parts.join("\n")).digest("hex");
 }
@@ -3427,10 +3537,10 @@ init_utils_json();
 var TMP_SUFFIX = ".nomad-tmp";
 function atomicMirror(src, dst, options) {
   const tmp = `${dst}${TMP_SUFFIX}`;
-  rmSync8(tmp, { recursive: true, force: true });
-  cpSync5(src, tmp, options);
-  rmSync8(dst, { recursive: true, force: true });
-  renameSync3(tmp, dst);
+  rmSync9(tmp, { recursive: true, force: true });
+  cpSync6(src, tmp, options);
+  rmSync9(dst, { recursive: true, force: true });
+  renameAtomicRetry(tmp, dst);
 }
 function overlaySessionDir(src, dst) {
   stripCollidingDstSymlinks(src, dst, () => false);
@@ -3439,11 +3549,11 @@ function overlaySessionDir(src, dst) {
 function copyFileAtomic(src, dst) {
   mkdirSync5(dirname4(dst), { recursive: true });
   const tmp = `${dst}.tmp.${process.pid}`;
-  cpSync5(src, tmp, { force: true, preserveTimestamps: true });
-  renameSync3(tmp, dst);
+  cpSync6(src, tmp, { force: true, preserveTimestamps: true });
+  renameAtomicRetry(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
-  const prefix = `${localDir}${sep3}`;
+  const prefix = `${localDir}${sep4}`;
   for (const p of sel.changed) if (p.startsWith(prefix)) return true;
   for (const p of sel.deleted) if (p.startsWith(prefix)) return true;
   return false;
@@ -3452,15 +3562,15 @@ function skipForSelection(sel, localDir) {
   return sel !== void 0 && !hasDeltaForDir(sel, localDir);
 }
 function applySelective(sel, localDir, repoDst) {
-  const prefix = `${localDir}${sep3}`;
+  const prefix = `${localDir}${sep4}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
-    copyFileAtomic(src, join25(repoDst, relative5(localDir, src)));
+    copyFileAtomic(src, join26(repoDst, relative5(localDir, src)));
   }
   for (const src of sel.deleted) {
     if (!src.startsWith(prefix)) continue;
-    const dst = join25(repoDst, relative5(localDir, src));
-    if (existsSync20(dst)) rmSync8(dst);
+    const dst = join26(repoDst, relative5(localDir, src));
+    if (existsSync21(dst)) rmSync9(dst);
   }
 }
 function copyDirJsonlOnly(src, dst) {
@@ -3470,7 +3580,7 @@ function copyDirJsonlOnly(src, dst) {
     filter: (srcPath) => {
       const rel = relative5(src, srcPath);
       if (rel === "") return true;
-      if (rel.split(sep3).length > 1) return true;
+      if (rel.split(sep4).length > 1) return true;
       if (statSync5(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       item(`skip ${rel}: extension not in allowlist`);
@@ -3489,15 +3599,15 @@ function remapPull(ts, opts = {}) {
   const wouldPull = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join25(repo, "path-map.json");
-  const repoProjects = join25(repo, "shared", "projects");
-  if (!existsSync20(mapPath) || !existsSync20(repoProjects)) {
+  const mapPath = join26(repo, "path-map.json");
+  const repoProjects = join26(repo, "shared", "projects");
+  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join25(claude, "projects");
+  const localProjects = join26(claude, "projects");
   if (!dryRun) mkdirSync5(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -3507,9 +3617,9 @@ function remapPull(ts, opts = {}) {
       continue;
     }
     assertSafeLocalRoot(localPath, logical);
-    const src = join25(repoProjects, logical);
-    if (!existsSync20(src)) continue;
-    const dst = join25(localProjects, encodePath(localPath));
+    const src = join26(repoProjects, logical);
+    if (!existsSync21(src)) continue;
+    const dst = join26(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -3527,12 +3637,12 @@ function remapPull(ts, opts = {}) {
 }
 function countLocalOnly(src, dst) {
   let count = 0;
-  for (const name of readdirSync9(dst)) {
-    const dstPath = join25(dst, name);
-    const srcPath = join25(src, name);
-    if (lstatSync9(dstPath).isDirectory()) {
+  for (const name of readdirSync10(dst)) {
+    const dstPath = join26(dst, name);
+    const srcPath = join26(src, name);
+    if (lstatSync10(dstPath).isDirectory()) {
       count += countLocalOnly(srcPath, dstPath);
-    } else if (lstatSync9(srcPath, { throwIfNoEntry: false }) === void 0) {
+    } else if (lstatSync10(srcPath, { throwIfNoEntry: false }) === void 0) {
       count++;
     }
   }
@@ -3541,20 +3651,20 @@ function countLocalOnly(src, dst) {
 function scanLocalOnly() {
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join25(repo, "path-map.json");
-  const repoProjects = join25(repo, "shared", "projects");
-  if (!existsSync20(mapPath) || !existsSync20(repoProjects)) return 0;
+  const mapPath = join26(repo, "path-map.json");
+  const repoProjects = join26(repo, "shared", "projects");
+  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) return 0;
   const map = readPathMap(mapPath);
-  const localProjects = join25(claude, "projects");
+  const localProjects = join26(claude, "projects");
   let count = 0;
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const localPath = hosts[HOST];
     if (!localPath || localPath === "TBD") continue;
     assertSafeLocalRoot(localPath, logical);
-    const dst = join25(localProjects, encodePath(localPath));
-    if (!existsSync20(dst)) continue;
-    count += countLocalOnly(join25(repoProjects, logical), dst);
+    const dst = join26(localProjects, encodePath(localPath));
+    if (!existsSync21(dst)) continue;
+    count += countLocalOnly(join26(repoProjects, logical), dst);
   }
   return count;
 }
@@ -3589,26 +3699,26 @@ function remapPush(ts, opts = {}) {
   const wouldPush = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join25(repo, "path-map.json");
-  if (!existsSync20(mapPath)) {
+  const mapPath = join26(repo, "path-map.json");
+  if (!existsSync21(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join25(claude, "projects");
-  const repoProjects = join25(repo, "shared", "projects");
+  const localProjects = join26(claude, "projects");
+  const repoProjects = join26(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync20(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync21(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync5(repoProjects, { recursive: true });
-  for (const dir of readdirSync9(localProjects)) {
+  for (const dir of readdirSync10(localProjects)) {
     if (dir.endsWith(TMP_SUFFIX)) continue;
     const logical = reverse.get(dir);
     if (!logical) {
       unmapped++;
       continue;
     }
-    const localDir = join25(localProjects, dir);
-    const repoDst = join25(repoProjects, logical);
+    const localDir = join26(localProjects, dir);
+    const repoDst = join26(repoProjects, logical);
     if (skipForSelection(opts.selection, localDir)) continue;
     if (dryRun) {
       wouldPush.push(logical);
@@ -3632,8 +3742,8 @@ function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
   const repo = repoHome();
-  const mapPath = join26(repo, "path-map.json");
-  if (!existsSync21(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join27(repo, "path-map.json");
+  if (!existsSync22(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -3650,12 +3760,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join26(claudeHome(), "projects");
-  if (!existsSync21(localProjects)) return { logicalToEncoded, staged, malformed: false };
-  for (const dir of readdirSync10(localProjects)) {
+  const localProjects = join27(claudeHome(), "projects");
+  if (!existsSync22(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  for (const dir of readdirSync11(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join26(localProjects, dir), join26(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join27(localProjects, dir), join27(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -3686,11 +3796,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
 }
 function reportCheckShared(section2, gitleaksReady) {
   if (!ensureGitleaksReady(section2, gitleaksReady)) return;
-  const cacheDir = join26(homedir4(), ".cache", "claude-nomad");
+  const cacheDir = join27(homedir4(), ".cache", "claude-nomad");
   mkdirSync6(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const reportPath = join26(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join26(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join27(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join27(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -3704,15 +3814,15 @@ function reportCheckShared(section2, gitleaksReady) {
     }
     scanAndReport(section2, tmpRoot, staged, logicalToEncoded);
   } finally {
-    rmSync9(reportPath, { force: true });
-    rmSync9(tmpRoot, { recursive: true, force: true });
+    rmSync10(reportPath, { force: true });
+    rmSync10(tmpRoot, { recursive: true, force: true });
   }
 }
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync22, readFileSync as readFileSync8, readdirSync as readdirSync11, realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname5, extname, join as join27 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname5, extname, join as join28 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
@@ -3734,8 +3844,8 @@ function effectiveType(hookPath) {
   }
   let dir = dirname5(real);
   for (; ; ) {
-    const pkg = join27(dir, "package.json");
-    if (existsSync22(pkg)) return typeFromPackageJson(pkg);
+    const pkg = join28(dir, "package.json");
+    if (existsSync23(pkg)) return typeFromPackageJson(pkg);
     const parent = dirname5(dir);
     if (parent === dir) return "cjs";
     dir = parent;
@@ -3764,7 +3874,7 @@ function remedy(family) {
 }
 function safeReaddir2(dir) {
   try {
-    return readdirSync11(dir);
+    return readdirSync12(dir);
   } catch {
     return [];
   }
@@ -3777,15 +3887,15 @@ function safeRead(path) {
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join27(claudeHome(), "hooks");
-  if (!existsSync22(hooksDir)) {
+  const hooksDir = join28(claudeHome(), "hooks");
+  if (!existsSync23(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join27(hooksDir, name);
+    const abs = join28(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -3805,8 +3915,8 @@ function reportHookScopeCheck(section2) {
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync23 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { join as join29 } from "node:path";
 init_config();
 function expandHome(token) {
   const h2 = home();
@@ -3820,11 +3930,11 @@ function stripShellPunctuation(token) {
   return stripped.slice(0, end);
 }
 function* claudePathsIn(command) {
-  const claudePrefix = `${claudeHome()}/`;
+  const claudePrefix = `${claudeHome().replaceAll("\\", "/")}/`;
   for (const segment of command.split(/&&|\|\||;|\|/)) {
     for (const raw of segment.trim().split(/\s+/).filter(Boolean)) {
       const expanded = expandHome(stripShellPunctuation(raw));
-      if (expanded.startsWith(claudePrefix)) yield expanded;
+      if (expanded.replaceAll("\\", "/").startsWith(claudePrefix)) yield expanded;
     }
   }
 }
@@ -3849,7 +3959,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync23(resolved)) continue;
+        if (existsSync24(resolved)) continue;
         addItem(
           section2,
           `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
@@ -3862,8 +3972,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join28(claudeHome(), "settings.json");
-  if (!existsSync23(settingsPath)) {
+  const settingsPath = join29(claudeHome(), "settings.json");
+  if (!existsSync24(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -3886,12 +3996,12 @@ function reportHooksTargetCheck(section2) {
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.ts
 init_color();
-import { existsSync as existsSync25, readFileSync as readFileSync9 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:fs";
+import { join as join31 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync24, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname6, join as join29, resolve as resolve2 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname6, join as join30, resolve as resolve2 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
   const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
@@ -3923,12 +4033,12 @@ function topRelativeSpecifiers(src) {
 }
 function specifierIsMissing(specifier, baseDir) {
   const base = resolve2(baseDir, specifier);
-  if (existsSync24(base)) return false;
+  if (existsSync25(base)) return false;
   for (const ext of [".js", ".cjs", ".mjs"]) {
-    if (existsSync24(base + ext)) return false;
+    if (existsSync25(base + ext)) return false;
   }
   for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
-    if (existsSync24(join29(base, idx))) return false;
+    if (existsSync25(join30(base, idx))) return false;
   }
   return true;
 }
@@ -3983,8 +4093,8 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join30(repoHome(), "path-map.json");
-  if (!existsSync25(mapPath)) return { projects: {} };
+  const mapPath = join31(repoHome(), "path-map.json");
+  if (!existsSync26(mapPath)) return { projects: {} };
   try {
     return JSON.parse(readFileSync9(mapPath, "utf8"));
   } catch {
@@ -3992,9 +4102,10 @@ function readPathMapSafe() {
   }
 }
 function resolvesUnderSymlinkedShared(scriptPath, sharedLinkNames) {
+  const normalizedScript = scriptPath.replaceAll("\\", "/");
   for (const name of sharedLinkNames) {
-    const prefix = `${claudeHome()}/${name}/`;
-    if (scriptPath.startsWith(prefix)) return true;
+    const prefix = `${claudeHome().replaceAll("\\", "/")}/${name}/`;
+    if (normalizedScript.startsWith(prefix)) return true;
   }
   return false;
 }
@@ -4057,8 +4168,8 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join30(claudeHome(), "settings.json");
-  if (!existsSync25(settingsPath)) {
+  const settingsPath = join31(claudeHome(), "settings.json");
+  if (!existsSync26(settingsPath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
@@ -4091,8 +4202,8 @@ function reportPreserveSymlinksCheck(section2) {
 
 // src/commands.doctor.checks.settings-drift.ts
 init_color();
-import { existsSync as existsSync26, readFileSync as readFileSync10 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync10 } from "node:fs";
+import { join as join32 } from "node:path";
 init_config();
 init_utils_json();
 function diffMergedSettings(merged, settings) {
@@ -4110,7 +4221,7 @@ function tryReadJson(filePath) {
   }
 }
 function reportHooksBaseSelfCleanNote(section2) {
-  const basePath = join31(repoHome(), "shared", "settings.base.json");
+  const basePath = join32(repoHome(), "shared", "settings.base.json");
   const base = tryReadJson(basePath);
   if (base === null) return;
   if (!baseHasGsdHookEntries(base)) return;
@@ -4123,14 +4234,14 @@ function reportSettingsDriftCheck(section2) {
   const claude = claudeHome();
   const repo = repoHome();
   const host = HOST;
-  const settingsPath = join31(claude, "settings.json");
-  const basePath = join31(repo, "shared", "settings.base.json");
-  const hostPath = join31(repo, "hosts", `${host}.json`);
-  if (!existsSync26(settingsPath)) {
+  const settingsPath = join32(claude, "settings.json");
+  const basePath = join32(repo, "shared", "settings.base.json");
+  const hostPath = join32(repo, "hosts", `${host}.json`);
+  if (!existsSync27(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
     return;
   }
-  if (!existsSync26(basePath)) {
+  if (!existsSync27(basePath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
@@ -4149,7 +4260,7 @@ function reportSettingsDriftCheck(section2) {
   if (settings === null) {
     return;
   }
-  const hostExists = existsSync26(hostPath);
+  const hostExists = existsSync27(hostPath);
   const hostObj = hostExists ? tryReadJson(hostPath) : null;
   if (hostExists && hostObj === null) {
     addItem(
@@ -4305,46 +4416,152 @@ function reportNodeEngineCheck(section2) {
   addItem(section2, `${green(okGlyph)} node: ${process.version}`);
 }
 
+// src/commands.doctor.checks.longpaths.ts
+init_color();
+import { execFileSync as execFileSync10 } from "node:child_process";
+init_config();
+var PROBE_TIMEOUT_MS = 3e3;
+var LONGPATHS_REG_KEY = String.raw`HKLM\SYSTEM\CurrentControlSet\Control\FileSystem`;
+var LONGPATHS_REG_VALUE = "LongPathsEnabled";
+function probeGitLongpaths(run) {
+  try {
+    const out = run("git", ["-C", repoHome(), "config", "--get", "core.longpaths"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: PROBE_TIMEOUT_MS
+    }).toString().trim();
+    return out === "true" || out === "1";
+  } catch {
+    return false;
+  }
+}
+function probeRegistryLongpaths(run) {
+  try {
+    const out = run("reg", ["query", LONGPATHS_REG_KEY, "/v", LONGPATHS_REG_VALUE], {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: PROBE_TIMEOUT_MS
+    }).toString();
+    return /0x1\b/.test(out);
+  } catch {
+    return false;
+  }
+}
+function addLongpathsRow(section2, label, enabled2, remediation) {
+  if (enabled2) {
+    addItem(section2, `${green(okGlyph)} ${label}: enabled`);
+    return;
+  }
+  addItem(section2, `${yellow(warnGlyph)} ${label}: not enabled (${remediation})`);
+}
+function reportLongPathsCheck(section2, run = execFileSync10) {
+  if (process.platform !== "win32") return;
+  addLongpathsRow(
+    section2,
+    "git core.longpaths",
+    probeGitLongpaths(run),
+    "run `git config --global core.longpaths true`"
+  );
+  addLongpathsRow(
+    section2,
+    "OS long paths",
+    probeRegistryLongpaths(run),
+    "enable LongPathsEnabled in Local Group Policy or the registry (admin required)"
+  );
+}
+function reportSyncModality(section2) {
+  const modality = process.platform === "win32" ? "copy-sync (win32)" : "symlink (posix)";
+  addItem(section2, `${dim(infoGlyph)} sync modality: ${modality}`);
+}
+
+// src/commands.doctor.checks.crlf.ts
+init_color();
+import { execFileSync as execFileSync11 } from "node:child_process";
+import { existsSync as existsSync28, readFileSync as readFileSync13 } from "node:fs";
+import { join as join33 } from "node:path";
+init_config();
+var PROBE_TIMEOUT_MS2 = 3e3;
+var GUARD_LINE = /^\*\s+-text\b/;
+function hasGitattributesGuard(repo) {
+  try {
+    const path = join33(repo, ".gitattributes");
+    if (!existsSync28(path)) return false;
+    const content = readFileSync13(path, "utf8");
+    return content.split("\n").map((line) => line.trim()).some((line) => line !== "" && !line.startsWith("#") && GUARD_LINE.test(line));
+  } catch {
+    return false;
+  }
+}
+function probeAutocrlf(repo, run) {
+  try {
+    const out = run("git", ["-C", repo, "config", "core.autocrlf"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: PROBE_TIMEOUT_MS2
+    }).toString().trim();
+    if (out === "true" || out === "input") return "active";
+    if (out === "false") return "disabled";
+    return "unset";
+  } catch {
+    return "unset";
+  }
+}
+var AUTOCRLF_RISK = {
+  active: "core.autocrlf is actively converting line endings on checkout",
+  disabled: "guarded on this host by core.autocrlf=false, but no .gitattributes to protect other hosts",
+  unset: "no .gitattributes guard and core.autocrlf is unset (latent risk)"
+};
+function addExposedRow(section2, repo, verdict) {
+  const risk = AUTOCRLF_RISK[verdict];
+  const remediation = `add a .gitattributes with a \`* -text\` line, or run \`git config core.autocrlf false\`, in ${repo}`;
+  addItem(section2, `${yellow(warnGlyph)} CRLF guard: ${risk}; ${remediation}`);
+}
+function reportCrlfGuardCheck(section2, run = execFileSync11) {
+  const repo = repoHome();
+  if (hasGitattributesGuard(repo)) {
+    addItem(section2, `${green(okGlyph)} CRLF guard: .gitattributes (* -text) present`);
+    return;
+  }
+  addExposedRow(section2, repo, probeAutocrlf(repo, run));
+}
+
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync30 } from "node:fs";
+import { existsSync as existsSync32 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
-import { readFileSync as readFileSync15, rmSync as rmSync11, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join36 } from "node:path";
+import { readFileSync as readFileSync16, rmSync as rmSync12, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join38 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/commands.push.recovery.actions.ts
 init_config();
-import { readFileSync as readFileSync14 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep5 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep6 } from "node:path";
 
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync6, existsSync as existsSync29, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
-import { dirname as dirname8, join as join34, sep as sep4 } from "node:path";
+import { cpSync as cpSync7, existsSync as existsSync31, mkdirSync as mkdirSync7, statSync as statSync8 } from "node:fs";
+import { dirname as dirname8, join as join36, sep as sep5 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync28, statSync as statSync7 } from "node:fs";
-import { dirname as dirname7, join as join33 } from "node:path";
+import { existsSync as existsSync30, statSync as statSync7 } from "node:fs";
+import { dirname as dirname7, join as join35 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync27, lstatSync as lstatSync10, readFileSync as readFileSync13, readdirSync as readdirSync12, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join32 } from "node:path";
+import { existsSync as existsSync29, lstatSync as lstatSync11, readFileSync as readFileSync14, readdirSync as readdirSync13, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join34 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
-  if (!existsSync27(dir)) return;
-  const st = lstatSync10(dir);
+  if (!existsSync29(dir)) return;
+  const st = lstatSync11(dir);
   if (!st.isDirectory()) return;
-  for (const entry of readdirSync12(dir)) {
-    const abs = join32(dir, entry);
-    const lst = lstatSync10(abs);
+  for (const entry of readdirSync13(dir)) {
+    const abs = join34(dir, entry);
+    const lst = lstatSync11(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -4380,7 +4597,7 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   if (!dryRun && total > 0) {
     for (const { path: filePath, findings } of dirty) {
       backupBeforeWrite(filePath, ts);
-      const before = readFileSync13(filePath, "utf8");
+      const before = readFileSync14(filePath, "utf8");
       const after = applyRedactions(before, findings);
       if (after === before) {
         log(
@@ -4395,10 +4612,10 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
 
 // src/commands.pushed-history.ts
 init_utils();
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 function pushedRef(repo) {
   try {
-    const ref = execFileSync10("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+    const ref = execFileSync12("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
@@ -4411,7 +4628,7 @@ function sessionInPushedHistory(id, repo) {
   const ref = pushedRef(repo);
   if (ref === null) return false;
   try {
-    const out = execFileSync10(
+    const out = execFileSync12(
       "git",
       [
         "log",
@@ -4448,15 +4665,15 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript(id) {
   try {
-    const mapPath = join33(repoHome(), "path-map.json");
-    if (!existsSync28(mapPath)) return null;
+    const mapPath = join35(repoHome(), "path-map.json");
+    if (!existsSync30(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join33(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync28(live)) return live;
+      const live = join35(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync30(live)) return live;
     }
     return null;
   } catch {
@@ -4476,17 +4693,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync28(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync30(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync28(localPath)) {
+    if (localPath === null || !existsSync30(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join33(dirname7(localPath), id);
+    const sessionDir = join35(dirname7(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
     if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4602,8 +4819,8 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join34(claude, "projects", encodePath(abs)) + sep4)) {
-      return join34(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join36(claude, "projects", encodePath(abs)) + sep5)) {
+      return join36(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -4613,7 +4830,7 @@ function preflightRedactable(f, map, nowMs) {
   if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
   const localPath = resolveLiveTranscript(sid);
   if (localPath === null) return `session ${sid}: local transcript not found`;
-  const sessionDir = join34(dirname8(localPath), sid);
+  const sessionDir = join36(dirname8(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4643,7 +4860,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join34(dirname8(localPath), sid);
+  const sessionDir = join36(dirname8(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
   if (isRecentlyModified(subtreeMtime, nowMs())) {
@@ -4677,26 +4894,26 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync7(stagedProjectDir, { recursive: true });
-  cpSync6(localPath, join34(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync29(sessionDir)) {
-    cpSync6(sessionDir, join34(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync7(localPath, join36(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync31(sessionDir)) {
+    cpSync7(sessionDir, join36(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
 
 // src/commands.push.recovery.drop.ts
 init_config();
-import { rmSync as rmSync10 } from "node:fs";
-import { join as join35 } from "node:path";
+import { rmSync as rmSync11 } from "node:fs";
+import { join as join37 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join35(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join35(repo, "shared", "projects", logical, sid);
-    rmSync10(jsonl, { force: true });
-    rmSync10(dir, { recursive: true, force: true });
+    const jsonl = join37(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join37(repo, "shared", "projects", logical, sid);
+    rmSync11(jsonl, { force: true });
+    rmSync11(dir, { recursive: true, force: true });
   }
   return true;
 }
@@ -4727,10 +4944,10 @@ function makeDefaultReadLine(repo) {
     try {
       const repoRoot = resolve3(repo);
       const target = resolve3(repoRoot, file);
-      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep5)) {
+      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep6)) {
         return null;
       }
-      const content = readFileSync14(target, "utf8");
+      const content = readFileSync15(target, "utf8");
       const lines = content.split(/\r?\n/);
       const idx = line - 1;
       if (idx < 0 || idx >= lines.length) return null;
@@ -4851,10 +5068,10 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join36(repoHome2, ".gitleaksignore");
+  const ignPath = join38(repoHome2, ".gitleaksignore");
   let before;
   try {
-    before = readFileSync15(ignPath, "utf8");
+    before = readFileSync16(ignPath, "utf8");
   } catch {
     before = null;
   }
@@ -4862,7 +5079,7 @@ function allowThenRescan(append, scanVerdict, repoHome2) {
   try {
     return applyThenRescan(scanVerdict, repoHome2);
   } catch (err) {
-    if (before === null) rmSync11(ignPath, { force: true });
+    if (before === null) rmSync12(ignPath, { force: true });
     else writeFileSync5(ignPath, before, "utf8");
     throw err;
   }
@@ -4950,7 +5167,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync30;
+  const check = deps.existsSyncFn ?? existsSync32;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -5016,9 +5233,9 @@ function withSpinner(label, fn, deps) {
 
 // src/commands.doctor.gitleaks-version.ts
 init_color();
-import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync31 } from "node:fs";
-import { join as join37 } from "node:path";
+import { execFileSync as execFileSync13 } from "node:child_process";
+import { existsSync as existsSync33 } from "node:fs";
+import { join as join39 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -5027,7 +5244,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join37(repoHome(), ".gitleaks.toml");
+  const tomlPath = join39(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -5039,7 +5256,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync11, tomlExists = existsSync31) {
+function reportGitleaksVersionCheck(section2, run = execFileSync13, tomlExists = existsSync33) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -5059,9 +5276,9 @@ function reportGitleaksVersionCheck(section2, run = execFileSync11, tomlExists =
 
 // src/commands.doctor.checks.deps.ts
 init_color();
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync14 } from "node:child_process";
 var VERSION_TOKEN = /(\d{1,9}\.\d{1,9}\.\d{1,9})/;
-var PROBE_TIMEOUT_MS = 3e3;
+var PROBE_TIMEOUT_MS3 = 3e3;
 var FETCHER_BASE = "HTTP fetcher";
 function parseFirstVersion(line) {
   const m = VERSION_TOKEN.exec(line);
@@ -5071,7 +5288,7 @@ function probeOptionalDep(bin, run) {
   try {
     const firstLine = run(bin, ["--version"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS
+      timeout: PROBE_TIMEOUT_MS3
     }).toString().split("\n")[0].trim();
     const version = parseFirstVersion(firstLine);
     return { status: "present", version };
@@ -5096,7 +5313,7 @@ function reportFetcherRow(section2, run) {
     );
   }
 }
-function reportOptionalDeps(section2, run = execFileSync12) {
+function reportOptionalDeps(section2, run = execFileSync14) {
   const gh = probeOptionalDep("gh", run);
   if (gh.status === "present") {
     addItem(section2, `${green(okGlyph)} gh: ${gh.version ?? "present"}`);
@@ -5111,11 +5328,11 @@ function reportOptionalDeps(section2, run = execFileSync12) {
 
 // src/commands.doctor.actions-drift.ts
 init_color();
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 init_config();
 
 // src/gh-actions.ts
-import { execFileSync as execFileSync13 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 var GH_TIMEOUT_MS = 5e3;
 function parseGitHubRemote(remoteUrl) {
   const normalized = remoteUrl.trim().replace(/\/$/, "");
@@ -5123,7 +5340,7 @@ function parseGitHubRemote(remoteUrl) {
   if (m === null) return null;
   return { owner: m[1], repo: m[2] };
 }
-function ghAuthStatus(run = execFileSync13) {
+function ghAuthStatus(run = execFileSync15) {
   try {
     run("gh", ["auth", "status"], {
       stdio: ["ignore", "ignore", "ignore"],
@@ -5137,7 +5354,7 @@ function ghAuthStatus(run = execFileSync13) {
     return "gh-probe-error";
   }
 }
-function isRepoPrivate(ref, run = execFileSync13) {
+function isRepoPrivate(ref, run = execFileSync15) {
   const out = run("gh", ["repo", "view", `${ref.owner}/${ref.repo}`, "--json", "isPrivate"], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: GH_TIMEOUT_MS
@@ -5145,7 +5362,7 @@ function isRepoPrivate(ref, run = execFileSync13) {
   const parsed = JSON.parse(out);
   return parsed.isPrivate === true;
 }
-function isActionsEnabled(ref, run = execFileSync13) {
+function isActionsEnabled(ref, run = execFileSync15) {
   const out = run(
     "gh",
     ["api", `repos/${ref.owner}/${ref.repo}/actions/permissions`, "--jq", ".enabled"],
@@ -5153,7 +5370,7 @@ function isActionsEnabled(ref, run = execFileSync13) {
   ).toString().trim();
   return out === "true";
 }
-function disableActions(ref, run = execFileSync13) {
+function disableActions(ref, run = execFileSync15) {
   run(
     "gh",
     [
@@ -5167,7 +5384,7 @@ function disableActions(ref, run = execFileSync13) {
     { stdio: ["ignore", "ignore", "pipe"], timeout: GH_TIMEOUT_MS }
   );
 }
-function readOriginRemote(cwd, run = execFileSync13) {
+function readOriginRemote(cwd, run = execFileSync15) {
   return run("git", ["remote", "get-url", "origin"], {
     cwd,
     stdio: ["ignore", "pipe", "ignore"]
@@ -5175,7 +5392,7 @@ function readOriginRemote(cwd, run = execFileSync13) {
 }
 
 // src/commands.doctor.actions-drift.ts
-function reportActionsDrift(section2, run = execFileSync14) {
+function reportActionsDrift(section2, run = execFileSync16) {
   let remote;
   try {
     remote = readOriginRemote(repoHome(), run);
@@ -5261,9 +5478,12 @@ function gatherDoctorSections(opts) {
   reportHostAndPaths(host);
   reportHostKeyAlignment(host);
   reportRepoState(host);
+  reportSyncModality(host);
+  reportLongPathsCheck(host);
+  reportCrlfGuardCheck(host);
   const links = section("Shared links");
-  const mapPath = join38(repoHome(), "path-map.json");
-  const rawMap = existsSync32(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join40(repoHome(), "path-map.json");
+  const rawMap = existsSync34(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   reportDroppedNamesMigration(links);
@@ -5359,15 +5579,15 @@ function parseDoctorArgs(args) {
 
 // src/commands.drop-session.ts
 init_config();
-import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync34, readdirSync as readdirSync13, statSync as statSync9 } from "node:fs";
-import { join as join40, relative as relative6 } from "node:path";
+import { execFileSync as execFileSync18 } from "node:child_process";
+import { existsSync as existsSync36, readdirSync as readdirSync14, statSync as statSync9 } from "node:fs";
+import { join as join42, relative as relative6 } from "node:path";
 
 // src/commands.drop-session.git.ts
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync17 } from "node:child_process";
 function expandStagedDir(dirRel, repo) {
   try {
-    const out = execFileSync15("git", ["ls-files", "-z", "--", dirRel], {
+    const out = execFileSync17("git", ["ls-files", "-z", "--", dirRel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5378,7 +5598,8 @@ function expandStagedDir(dirRel, repo) {
 }
 function isTrackedInHead(rel, repo) {
   try {
-    execFileSync15("git", ["cat-file", "-e", `HEAD:${rel}`], {
+    const treePath = process.platform === "win32" ? rel.replaceAll("\\", "/") : rel;
+    execFileSync17("git", ["cat-file", "-e", `HEAD:${treePath}`], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5389,7 +5610,7 @@ function isTrackedInHead(rel, repo) {
 }
 function isInIndex(rel, repo) {
   try {
-    const out = execFileSync15("git", ["ls-files", "--", rel], {
+    const out = execFileSync17("git", ["ls-files", "--", rel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5403,8 +5624,8 @@ function isInIndex(rel, repo) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync33 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync35 } from "node:fs";
+import { join as join41 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript2(id, matches);
@@ -5420,17 +5641,17 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript2(id, matches) {
   try {
-    const mapPath = join39(repoHome(), "path-map.json");
-    if (!existsSync33(mapPath)) return null;
+    const mapPath = join41(repoHome(), "path-map.json");
+    if (!existsSync35(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
-      const logical = SHARED_PROJECT_LOGICAL.exec(rel)?.[1];
+      const logical = SHARED_PROJECT_LOGICAL.exec(rel.replaceAll("\\", "/"))?.[1];
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join39(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync33(live)) return live;
+      const live = join41(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync35(live)) return live;
     }
     return null;
   } catch {
@@ -5446,12 +5667,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync34(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync36(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join40(repo, "shared", "projects");
-    if (!existsSync34(repoProjects)) {
+    const repoProjects = join42(repo, "shared", "projects");
+    if (!existsSync36(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -5473,13 +5694,13 @@ function cmdDropSession(id) {
 }
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
-  for (const logical of readdirSync13(repoProjects)) {
-    const candidate = join40(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync34(candidate)) {
+  for (const logical of readdirSync14(repoProjects)) {
+    const candidate = join42(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync36(candidate)) {
       matches.push(relative6(repo, candidate));
     }
-    const dir = join40(repoProjects, logical, id);
-    if (existsSync34(dir) && statSync9(dir).isDirectory()) {
+    const dir = join42(repoProjects, logical, id);
+    if (existsSync36(dir) && statSync9(dir).isDirectory()) {
       const dirRel = relative6(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
@@ -5495,12 +5716,12 @@ function unstageOne(rel, repo) {
   }
   try {
     if (isTrackedInHead(rel, repo)) {
-      execFileSync16("git", ["restore", "--staged", "--worktree", "--", rel], {
+      execFileSync18("git", ["restore", "--staged", "--worktree", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
     } else {
-      execFileSync16("git", ["rm", "--cached", "-f", "--", rel], {
+      execFileSync18("git", ["rm", "--cached", "-f", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -5514,8 +5735,8 @@ function unstageOne(rel, repo) {
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync41, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join48 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -5617,18 +5838,18 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync36, statSync as statSync10 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync38, statSync as statSync10 } from "node:fs";
+import { join as join45 } from "node:path";
 init_utils();
 init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync35, mkdirSync as mkdirSync8, readdirSync as readdirSync14, readFileSync as readFileSync16, realpathSync as realpathSync4, rmSync as rmSync12 } from "node:fs";
-import { dirname as dirname9, join as join42, sep as sep7 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync8, readdirSync as readdirSync15, readFileSync as readFileSync17, realpathSync as realpathSync4, rmSync as rmSync13 } from "node:fs";
+import { dirname as dirname9, join as join44, sep as sep8 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
-import { join as join41, normalize as normalize2, sep as sep6 } from "node:path";
+import { join as join43, normalize as normalize2, sep as sep7 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -5680,15 +5901,15 @@ function planningDeleteTargets(opts) {
   const { deleted } = parsePlanningDiff(raw);
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
-  const planningRoot = join41(localRoot, ".planning");
-  const planningRootBoundary = planningRoot + sep6;
+  const planningRoot = join43(localRoot, ".planning");
+  const planningRootBoundary = planningRoot + sep7;
   const targets = [];
   for (const repoPath of deleted) {
     if (!repoPath.startsWith(prefix)) {
       continue;
     }
     const remainder = repoPath.slice(logicalPrefix.length);
-    const candidate = join41(localRoot, remainder);
+    const candidate = join43(localRoot, remainder);
     const resolved = normalize2(candidate);
     if (!resolved.startsWith(planningRootBoundary)) {
       throw new NomadFatal(
@@ -5709,7 +5930,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync35(src)) continue;
+    if (!existsSync37(src)) continue;
     const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item2);
@@ -5723,10 +5944,10 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
 }
 function pruneEmptyAncestors(target, planningRoot) {
   let dir = dirname9(target);
-  while (dir !== planningRoot && dir.startsWith(planningRoot + sep7)) {
+  while (dir !== planningRoot && dir.startsWith(planningRoot + sep8)) {
     try {
-      if (readdirSync14(dir).length > 0) break;
-      rmSync12(dir, { recursive: true, force: true });
+      if (readdirSync15(dir).length > 0) break;
+      rmSync13(dir, { recursive: true, force: true });
     } catch {
       break;
     }
@@ -5741,23 +5962,23 @@ function tryRealpath(dir) {
   }
 }
 function isInsidePlanningRoot(parentReal, rootReal) {
-  return parentReal === rootReal || parentReal.startsWith(rootReal + sep7);
+  return parentReal === rootReal || parentReal.startsWith(rootReal + sep8);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
-  if (existsSync35(repoCounterpart)) return;
+  if (existsSync37(repoCounterpart)) return;
   const parentReal = tryRealpath(dirname9(target));
   if (parentReal === void 0) return;
   const rootReal = tryRealpath(planningRoot);
   if (rootReal === void 0) return;
   if (!isInsidePlanningRoot(parentReal, rootReal)) return;
-  rmSync12(target, { recursive: true, force: true });
+  rmSync13(target, { recursive: true, force: true });
   pruneEmptyAncestors(target, planningRoot);
 }
 function localDivergesFromPreDelete(target, pre, repoRel, repo) {
-  if (!existsSync35(target)) return false;
+  if (!existsSync37(target)) return false;
   try {
     const preBlob = gitCaptureBuffer(["show", `${pre}:${repoRel}`], repo);
-    return !readFileSync16(target).equals(preBlob);
+    return !readFileSync17(target).equals(preBlob);
   } catch {
     return true;
   }
@@ -5768,11 +5989,11 @@ function planningDiffArgs(pre, post, logical) {
 function deletePairsFor(t, raw) {
   return planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot }).map(
     (target) => {
-      const relToLocal = target.slice(t.localRoot.length + sep7.length);
+      const relToLocal = target.slice(t.localRoot.length + sep8.length);
       return {
         target,
         relToLocal,
-        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep7).join("/")}`
+        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep8).join("/")}`
       };
     }
   );
@@ -5799,7 +6020,7 @@ function keptDeletePreview(v, prePostHeads, repo) {
   return kept;
 }
 function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
-  const repoExtras = join42(repo, "shared", "extras");
+  const repoExtras = join44(repo, "shared", "extras");
   for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
     if (t.dirname !== ".planning") continue;
     let raw;
@@ -5814,14 +6035,14 @@ function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
     }
     const pairs = deletePairsFor(t, raw);
     if (pairs.length === 0) continue;
-    backupExtrasWrite(join42(t.localRoot, t.dirname), ts, t.localRoot);
-    const planningRoot = join42(t.localRoot, ".planning");
+    backupExtrasWrite(join44(t.localRoot, t.dirname), ts, t.localRoot);
+    const planningRoot = join44(t.localRoot, ".planning");
     for (const { target, relToLocal, repoRel } of pairs) {
       if (localDivergesFromPreDelete(target, prePostHeads.pre, repoRel, repo)) {
         warn(keptDeleteWarnLine(t.logical, relToLocal));
         continue;
       }
-      deletePlanningTarget(target, planningRoot, join42(repoExtras, t.logical, relToLocal));
+      deletePlanningTarget(target, planningRoot, join44(repoExtras, t.logical, relToLocal));
     }
   }
 }
@@ -5830,14 +6051,14 @@ function remapExtrasPush(ts, opts = {}) {
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
   const repo = repoHome();
-  const repoExtras = join42(repo, "shared", "extras");
+  const repoExtras = join44(repo, "shared", "extras");
   if (!dryRun) mkdirSync8(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname10 }) => ({
-      src: join42(localRoot, dirname10),
-      dst: join42(repoExtras, logical, dirname10)
+      src: join44(localRoot, dirname10),
+      dst: join44(repoExtras, logical, dirname10)
     }),
     (dst) => backupRepoWrite(dst, ts, repo),
     // Push copy routing per extra type:
@@ -5866,8 +6087,8 @@ function remapExtrasPull(ts, opts = {}) {
     v,
     dryRun,
     ({ localRoot, logical, dirname: dirname10 }) => ({
-      src: join42(repo, "shared", "extras", logical, dirname10),
-      dst: join42(localRoot, dirname10)
+      src: join44(repo, "shared", "extras", logical, dirname10),
+      dst: join44(localRoot, dirname10)
     }),
     // Snapshot the host-side dst BEFORE the copy step touches it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -5914,17 +6135,17 @@ function divergenceCheckExtras(ts, prePostHeads) {
   const v = loadValidatedExtras({});
   if (v === null) return 0;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join43(backupBase(), ts, "extras");
+  const backupRoot = join45(backupBase(), ts, "extras");
   const repo = repoHome();
   let divergedCount = 0;
   for (const { logical, localRoot, dirname: dirname10 } of eachExtrasTarget(v, counts)) {
-    const local = join43(localRoot, dirname10);
-    const repoEntry = join43(repo, "shared", "extras", logical, dirname10);
-    if (!existsSync36(local) || !existsSync36(repoEntry)) continue;
+    const local = join45(localRoot, dirname10);
+    const repoEntry = join45(repo, "shared", "extras", logical, dirname10);
+    if (!existsSync38(local) || !existsSync38(repoEntry)) continue;
     const modified = listDivergingModified(local, repoEntry);
     if (modified.length === 0) continue;
     divergedCount += modified.length;
-    const projectBackupRoot = join43(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join45(backupRoot, encodePath(localRoot));
     warn(
       divergenceWarnLine({
         dirname: dirname10,
@@ -5946,8 +6167,8 @@ function divergenceCheckExtras(ts, prePostHeads) {
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync37, lstatSync as lstatSync11, mkdirSync as mkdirSync9, readdirSync as readdirSync15, rmSync as rmSync13 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync39, lstatSync as lstatSync12, mkdirSync as mkdirSync9, readdirSync as readdirSync16, rmSync as rmSync14 } from "node:fs";
+import { join as join46 } from "node:path";
 init_utils_fs();
 function isGsdOwned(name) {
   return name.startsWith(GSD_PREFIX);
@@ -5956,7 +6177,7 @@ function isSkillExcluded(name) {
   return isGsdOwned(name) || isDeniedName(ALWAYS_NEVER_SYNC, name);
 }
 function copySkillsPush(src, dst) {
-  const srcNames = readdirSync15(src, { encoding: "utf8" });
+  const srcNames = readdirSync16(src, { encoding: "utf8" });
   const blockSet = /* @__PURE__ */ new Set([
     ...srcNames.filter((n) => isGsdOwned(n)),
     ...ALWAYS_NEVER_SYNC
@@ -5967,30 +6188,30 @@ function copySkillsPull(src, dst) {
   copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded);
 }
 function syncSkillsPull(ts) {
-  const sharedSkills = join44(repoHome(), "shared", "skills");
-  if (!existsSync37(sharedSkills)) return;
-  const localSkills = join44(claudeHome(), "skills");
-  const dstStat = lstatSync11(localSkills, { throwIfNoEntry: false });
+  const sharedSkills = join46(repoHome(), "shared", "skills");
+  if (!existsSync39(sharedSkills)) return;
+  const localSkills = join46(claudeHome(), "skills");
+  const dstStat = lstatSync12(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     backupBeforeWrite(localSkills, ts);
-    rmSync13(localSkills, { recursive: true, force: true });
+    rmSync14(localSkills, { recursive: true, force: true });
     mkdirSync9(localSkills, { recursive: true });
   }
   copySkillsPull(sharedSkills, localSkills);
 }
 function syncSkillsPush() {
-  const localSkills = join44(claudeHome(), "skills");
-  const stat = lstatSync11(localSkills, { throwIfNoEntry: false });
+  const localSkills = join46(claudeHome(), "skills");
+  const stat = lstatSync12(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
-  const sharedSkills = join44(repoHome(), "shared", "skills");
+  const sharedSkills = join46(repoHome(), "shared", "skills");
   copySkillsPush(localSkills, sharedSkills);
 }
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync38 } from "node:fs";
-import { join as join45 } from "node:path";
+import { existsSync as existsSync40 } from "node:fs";
+import { join as join47 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -6276,7 +6497,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync38(path)) return null;
+  if (!existsSync40(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -6290,12 +6511,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync38(hostPath)) {
+  if (hostOverrides === null && existsSync40(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = stripGsdHookEntries(deepMerge(base, hostOverrides ?? {}));
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync38(settingsPath)) {
+  if (current === null && existsSync40(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const strippedCurrent = stripGsdHookEntries(current ?? {});
@@ -6308,6 +6529,7 @@ function previewSettings(basePath, hostPath, settingsPath) {
   return { diff, notes };
 }
 function formatLinkRow(e) {
+  if (e.kind === "copy") return `would copy  ${e.from} -> ${e.to}`;
   return `${e.kind}  ${e.from} -> ${e.to}`;
 }
 function formatSessionRow(e) {
@@ -6336,9 +6558,9 @@ function computePreview(ts, map, verb = "pull") {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join45(repo, "shared", "settings.base.json"),
-    join45(repo, "hosts", `${HOST}.json`),
-    join45(claude, "settings.json")
+    join47(repo, "shared", "settings.base.json"),
+    join47(repo, "hosts", `${HOST}.json`),
+    join47(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -6353,7 +6575,7 @@ function computePreview(ts, map, verb = "pull") {
   const extras = section("Extras");
   let extrasSkipped = 0;
   let extrasUnmapped = 0;
-  if (existsSync38(join45(repo, "path-map.json")) && existsSync38(join45(repo, "shared", "extras"))) {
+  if (existsSync40(join47(repo, "path-map.json")) && existsSync40(join47(repo, "shared", "extras"))) {
     const extrasResult = remapExtrasPull(ts, { dryRun: true });
     for (const entry of extrasResult.wouldPull) {
       addItem(extras, entry);
@@ -6378,9 +6600,9 @@ init_config();
 init_commands_pull_wedge();
 init_utils();
 init_utils_fs();
-import { execFileSync as execFileSync17 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 function gitCapture(args, cwd) {
-  return execFileSync17("git", args, {
+  return execFileSync19("git", args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     maxBuffer: 64 * 1024 * 1024
@@ -6571,7 +6793,7 @@ function runPullCore(opts = {}) {
   const ts = freshBackupTs(backup);
   handleWedge(repo, forceRemote);
   if (!dryRun) {
-    const backupRoot = join46(backup, ts);
+    const backupRoot = join48(backup, ts);
     try {
       mkdirSync10(backupRoot, { recursive: true });
     } catch (err) {
@@ -6584,8 +6806,8 @@ function runPullCore(opts = {}) {
   const prePostHeads = capturePrePostHeads(repo, () => {
     gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
   });
-  const mapPath = join46(repo, "path-map.json");
-  const map = existsSync39(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join48(repo, "path-map.json");
+  const map = existsSync41(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
     computePreview(ts, map, "pull");
@@ -6597,8 +6819,8 @@ function runPullCore(opts = {}) {
 }
 function cmdPull(opts = {}) {
   const repo = repoHome();
-  if (!existsSync39(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync39(join46(repo, "shared", "settings.base.json"))) {
+  if (!existsSync41(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync41(join48(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -6620,13 +6842,13 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync43 } from "node:fs";
-import { join as join51 } from "node:path";
+import { existsSync as existsSync45 } from "node:fs";
+import { join as join53 } from "node:path";
 
 // src/commands.push.selection.ts
 init_config();
-import { existsSync as existsSync40, statSync as statSync11 } from "node:fs";
-import { join as join47 } from "node:path";
+import { existsSync as existsSync42, statSync as statSync11 } from "node:fs";
+import { join as join49 } from "node:path";
 init_utils_json();
 function buildCurrentMap(map) {
   const current = {};
@@ -6635,8 +6857,8 @@ function buildCurrentMap(map) {
   for (const [, hostMap] of Object.entries(map.projects)) {
     const localPath = hostMap[HOST];
     if (!localPath) continue;
-    const localDir = join47(claude, "projects", encodePath(localPath));
-    if (!existsSync40(localDir)) continue;
+    const localDir = join49(claude, "projects", encodePath(localPath));
+    if (!existsSync42(localDir)) continue;
     for (const f of enumerateSourceFiles(localDir)) {
       const st = statSync11(f);
       current[f] = { size: st.size, mtime: st.mtimeMs };
@@ -6667,7 +6889,7 @@ function computePushSelection(map, old, scannerVersion, configHash, fullScan) {
   };
 }
 function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan) {
-  const map = existsSync40(mapPath) ? readPathMap(mapPath) : null;
+  const map = existsSync42(mapPath) ? readPathMap(mapPath) : null;
   const { selection, newManifest } = computePushSelection(
     map,
     old,
@@ -6769,14 +6991,14 @@ function enforceAllowList(statusPorcelain, map) {
 
 // src/commands.push.settings.ts
 init_config();
-import { existsSync as existsSync41 } from "node:fs";
-import { join as join48 } from "node:path";
+import { existsSync as existsSync43 } from "node:fs";
+import { join as join50 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function stripGsdHooksFromBase(repo, backup) {
-  const basePath = join48(repo, "shared", "settings.base.json");
-  if (!existsSync41(basePath)) return;
+  const basePath = join50(repo, "shared", "settings.base.json");
+  if (!existsSync43(basePath)) return;
   let base;
   try {
     base = readJson(basePath);
@@ -6790,14 +7012,14 @@ function stripGsdHooksFromBase(repo, backup) {
   writeJsonAtomic(basePath, stripped);
 }
 function reportSettingsAheadDrift(repo) {
-  const basePath = join48(repo, "shared", "settings.base.json");
-  if (!existsSync41(basePath)) return;
-  const settingsPath = join48(claudeHome(), "settings.json");
-  if (!existsSync41(settingsPath)) return;
+  const basePath = join50(repo, "shared", "settings.base.json");
+  if (!existsSync43(basePath)) return;
+  const settingsPath = join50(claudeHome(), "settings.json");
+  if (!existsSync43(settingsPath)) return;
   try {
     const base = readJson(basePath);
-    const hostPath = join48(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync41(hostPath) ? readJson(hostPath) : {};
+    const hostPath = join50(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync43(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
     const { ahead } = classifySettingsDrift(merged, settings);
@@ -6814,12 +7036,12 @@ function reportSettingsAheadDrift(repo) {
 // src/commands.push.guards.ts
 init_push_checks();
 init_utils();
-import { join as join49, relative as relative7 } from "node:path";
+import { join as join51, relative as relative7 } from "node:path";
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join49(repo, "shared"));
+  const gitlinks = findGitlinks(join51(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
-    const rel = relative7(repo, p);
+    const rel = relative7(repo, p).replaceAll("\\", "/");
     fail(`gitlink: ${rel} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`);
   }
   const noun = gitlinks.length === 1 ? "entry" : "entries";
@@ -6848,7 +7070,7 @@ init_config();
 
 // src/push-global-config.ts
 init_config();
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 var STATUS_LABELS = {
   A: "add",
   M: "modify",
@@ -6888,7 +7110,7 @@ function isInScope(filePath, exactPrefixes, dirPrefixes) {
 }
 function collectGlobalConfigChanges(repoHome2, hostname2, opts) {
   const args = opts.staged ? ["diff", "--cached", "--name-status", "-z"] : ["diff", "HEAD", "--name-status", "-z"];
-  const raw = execFileSync18("git", args, {
+  const raw = execFileSync20("git", args, {
     cwd: repoHome2,
     stdio: ["ignore", "pipe", "pipe"]
   }).toString();
@@ -6926,9 +7148,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync42, mkdirSync as mkdirSync11, readdirSync as readdirSync16, rmSync as rmSync14 } from "node:fs";
+import { copyFileSync, existsSync as existsSync44, mkdirSync as mkdirSync11, readdirSync as readdirSync17, rmSync as rmSync15 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join50, relative as relative8, sep as sep8 } from "node:path";
+import { join as join52, relative as relative8, sep as sep9 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -6936,11 +7158,11 @@ init_utils_json();
 var NOTHING_TO_SCAN_ROW = `${dim(infoGlyph)} nothing to scan, no leaks`;
 function stageSessionDir(localDir, dstDir, changed) {
   if (changed !== void 0) {
-    const prefix = `${localDir}${sep8}`;
+    const prefix = `${localDir}${sep9}`;
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
-      copyFileAtomic(src, join50(dstDir, relative8(localDir, src)));
+      copyFileAtomic(src, join52(dstDir, relative8(localDir, src)));
     }
     return true;
   }
@@ -6956,14 +7178,14 @@ function stageSessions(tmpRoot, map, changed) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join50(claudeHome(), "projects");
-  if (!existsSync42(localProjects)) return 0;
+  const localProjects = join52(claudeHome(), "projects");
+  if (!existsSync44(localProjects)) return 0;
   let staged = 0;
-  for (const dir of readdirSync16(localProjects)) {
+  for (const dir of readdirSync17(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    const localDir = join50(localProjects, dir);
-    const dstDir = join50(tmpRoot, "shared", "projects", logical);
+    const localDir = join52(localProjects, dir);
+    const dstDir = join52(tmpRoot, "shared", "projects", logical);
     if (stageSessionDir(localDir, dstDir, changed)) staged++;
   }
   return staged;
@@ -6979,9 +7201,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname10 of dirnames) {
       if (!whitelist.includes(dirname10)) continue;
-      const src = join50(localRoot, dirname10);
-      if (!existsSync42(src)) continue;
-      const dst = join50(tmpRoot, "shared", "extras", logical, dirname10);
+      const src = join52(localRoot, dirname10);
+      if (!existsSync44(src)) continue;
+      const dst = join52(tmpRoot, "shared", "extras", logical, dirname10);
       copyExtras(src, dst);
       staged++;
     }
@@ -6989,19 +7211,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map, opts = {}) {
-  const cacheDir = join50(homedir5(), ".cache", "claude-nomad");
+  const cacheDir = join52(homedir5(), ".cache", "claude-nomad");
   mkdirSync11(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  const tmpRoot = join50(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join52(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map, opts.selection?.changed);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join50(repoHome(), ".gitleaksignore");
-    if (existsSync42(ignoreFile)) {
-      copyFileSync(ignoreFile, join50(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join52(repoHome(), ".gitleaksignore");
+    if (existsSync44(ignoreFile)) {
+      copyFileSync(ignoreFile, join52(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -7014,7 +7236,7 @@ function previewPushLeaks(map, opts = {}) {
     }
     return verdictFromFindings(findings);
   } finally {
-    rmSync14(tmpRoot, { recursive: true, force: true });
+    rmSync15(tmpRoot, { recursive: true, force: true });
   }
 }
 
@@ -7076,7 +7298,7 @@ async function runPushCore(opts = {}) {
   const scannerVersion = probeGitleaks();
   const configHash = computeConfigHash();
   const old = readManifest(manifestPath());
-  const mapPath = join51(repo, "path-map.json");
+  const mapPath = join53(repo, "path-map.json");
   const { map, selection, newManifest } = loadSelectionForPush(
     mapPath,
     old,
@@ -7090,6 +7312,7 @@ async function runPushCore(opts = {}) {
   const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
   if (!dryRun) {
     syncSkillsPush();
+    syncSharedLinksPush(map);
     stripGsdHooksFromBase(repo, backup);
   }
   const st = { dryRun, remap, extras, globalConfig: [] };
@@ -7129,7 +7352,7 @@ async function cmdPush(opts = {}) {
   const allowRule = opts.allowRule;
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
   const repo = repoHome();
-  if (!existsSync43(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync45(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -7147,8 +7370,8 @@ async function cmdPush(opts = {}) {
 }
 
 // src/commands.sync.ts
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join52 } from "node:path";
+import { existsSync as existsSync46 } from "node:fs";
+import { join as join54 } from "node:path";
 init_config();
 init_utils();
 init_utils_fs();
@@ -7216,8 +7439,8 @@ async function runSyncWet() {
 }
 async function runSyncDryRun(repo, backup) {
   const ts = freshBackupTs(backup);
-  const mapPath = join52(repo, "path-map.json");
-  const map = existsSync44(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join54(repo, "path-map.json");
+  const map = existsSync46(mapPath) ? readPathMap(mapPath) : { projects: {} };
   computePreview(ts, map, "pull");
   log("push preview below is computed against pre-pull state (a real sync pushes after pull)");
   await runPushCore({ dryRun: true });
@@ -7226,8 +7449,8 @@ async function cmdSync(opts = {}) {
   const dryRun = opts.dryRun === true;
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync44(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync44(join52(repo, "shared", "settings.base.json"))) {
+  if (!existsSync46(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync46(join54(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("sync");
@@ -7251,25 +7474,31 @@ async function cmdSync(opts = {}) {
 }
 
 // src/commands.update.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync21 } from "node:child_process";
 init_utils();
-function readInstalledVersion(run = execFileSync19) {
+function readInstalledVersion(run = execFileSync21) {
+  const isWin = process.platform === "win32";
   try {
-    return run("nomad", ["--version"], { encoding: "utf8" }).toString().trim() || null;
+    return run(isWin ? "nomad.cmd" : "nomad", ["--version"], {
+      encoding: "utf8",
+      ...isWin ? { shell: true } : {}
+    }).toString().trim() || null;
   } catch {
     return null;
   }
 }
-function cmdUpdate(currentVersion, run = execFileSync19) {
+function cmdUpdate(currentVersion, run = execFileSync21) {
   console.log(`Updating claude-nomad v${currentVersion}...`);
+  const isWin = process.platform === "win32";
   try {
-    run("npm", ["update", "-g", "claude-nomad"], {
+    run(isWin ? "npm.cmd" : "npm", ["update", "-g", "claude-nomad"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       // Now that output is captured rather than inherited, execFileSync buffers
       // it; lift the default 1 MiB ceiling so a noisy-but-successful npm run
       // (deprecation/funding spam) cannot throw ENOBUFS.
-      maxBuffer: 64 * 1024 * 1024
+      maxBuffer: 64 * 1024 * 1024,
+      ...isWin ? { shell: true } : {}
     });
   } catch (err) {
     const e = err;
@@ -7294,18 +7523,18 @@ init_config();
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync45 } from "node:fs";
-import { join as join53 } from "node:path";
+import { existsSync as existsSync47 } from "node:fs";
+import { join as join55 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync45(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync47(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join53(repo, "path-map.json");
-    const map = existsSync45(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join55(repo, "path-map.json");
+    const map = existsSync47(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     computePreview(ts, map, "diff");
   } catch (err) {
@@ -7320,19 +7549,19 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync47, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join55 } from "node:path";
+import { existsSync as existsSync49, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join57 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
-import { execFileSync as execFileSync20 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 init_utils();
 var DEFAULT_REPO_NAME = "claude-nomad-config";
 function isValidRepoName(name) {
   return /^[A-Za-z0-9._-]{1,100}$/.test(name);
 }
 var GH_NETWORK_TIMEOUT_MS = 3e4;
-function ensureOriginRepo(repoName, run = execFileSync20) {
+function ensureOriginRepo(repoName, run = execFileSync22) {
   if (!isValidRepoName(repoName)) {
     die(
       `invalid repo name: ${JSON.stringify(repoName)}. Use only letters, digits, hyphens, underscores, and dots (1-100 chars).`
@@ -7403,33 +7632,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync7, existsSync as existsSync46, rmSync as rmSync15, statSync as statSync12 } from "node:fs";
-import { join as join54 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync8, existsSync as existsSync48, rmSync as rmSync16, statSync as statSync12 } from "node:fs";
+import { join as join56 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join54(claude, name);
-    if (!existsSync46(src)) continue;
-    const dst = join54(repo, "shared", name);
+    const src = join56(claude, name);
+    if (!existsSync48(src)) continue;
+    const dst = join56(repo, "shared", name);
     if (statSync12(src).isDirectory()) {
-      const gk = join54(dst, ".gitkeep");
-      if (existsSync46(gk)) rmSync15(gk);
-      cpSync7(src, dst, { recursive: true, force: false, errorOnExist: true });
+      const gk = join56(dst, ".gitkeep");
+      if (existsSync48(gk)) rmSync16(gk);
+      cpSync8(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join54(claude, "settings.json");
-  if (existsSync46(userSettings)) {
+  const userSettings = join56(claude, "settings.json");
+  if (existsSync48(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join54(repo, "hosts", `${HOST}.json`);
+    const hostFile = join56(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -7439,17 +7668,18 @@ function snapshotIntoShared(map) {
 init_utils();
 init_utils_fs();
 var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.claude/CLAUDE.md by nomad pull -->\n";
+var GITATTRIBUTES = "# nomad: sync content is byte-managed, disable all line-ending conversion\n* -text\n";
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join55(repoHome2, "shared", "settings.base.json"),
-    join55(repoHome2, "shared", "CLAUDE.md"),
-    join55(repoHome2, "path-map.json"),
-    join55(repoHome2, "hosts"),
-    join55(repoHome2, "shared")
+    join57(repoHome2, "shared", "settings.base.json"),
+    join57(repoHome2, "shared", "CLAUDE.md"),
+    join57(repoHome2, "path-map.json"),
+    join57(repoHome2, "hosts"),
+    join57(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync47(c)) return c;
+    if (existsSync49(c)) return c;
   }
   return null;
 }
@@ -7467,26 +7697,28 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync12(join55(repo, "shared"), { recursive: true });
-  mkdirSync12(join55(repo, "hosts"), { recursive: true });
+  mkdirSync12(join57(repo, "shared"), { recursive: true });
+  mkdirSync12(join57(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync12(join55(repo, "shared", name), { recursive: true });
+    mkdirSync12(join57(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join55(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync47(userClaudeMd)) {
-    writeFileSync6(join55(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join57(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync49(userClaudeMd)) {
+    writeFileSync6(join57(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync6(join55(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync6(join57(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync6(join55(repo, "hosts", ".gitkeep"), "");
+  writeFileSync6(join57(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join55(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join57(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join55(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join57(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
+  writeFileSync6(join57(repo, ".gitattributes"), GITATTRIBUTES);
+  item("created .gitattributes");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
     log(`snapshot staged in shared/; review, then 'nomad push' to share with other hosts.`);
@@ -7551,21 +7783,21 @@ function maybeDisableRepoActions(repoHome2, run) {
 // src/init.prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync48, readdirSync as readdirSync17, statSync as statSync13 } from "node:fs";
-import { join as join56 } from "node:path";
+import { existsSync as existsSync50, readdirSync as readdirSync18, statSync as statSync13 } from "node:fs";
+import { join as join58 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync48(path)) return false;
+  if (!existsSync50(path)) return false;
   try {
-    if (statSync13(path).isDirectory()) return readdirSync17(path).length > 0;
+    if (statSync13(path).isDirectory()) return readdirSync18(path).length > 0;
     return true;
   } catch {
     return false;
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync48(join56(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join56(claudeHome2, name)));
+  if (existsSync50(join58(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join58(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -7869,7 +8101,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.58.1",
+  version: "0.59.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -8105,15 +8337,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync49, readFileSync as readFileSync17, readdirSync as readdirSync18 } from "node:fs";
-import { join as join57 } from "node:path";
+import { existsSync as existsSync51, readFileSync as readFileSync18, readdirSync as readdirSync19 } from "node:fs";
+import { join as join59 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join57(claudeHome(), "projects");
-  if (!existsSync49(projectsRoot)) {
+  const projectsRoot = join59(claudeHome(), "projects");
+  if (!existsSync51(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -8127,8 +8359,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join57(repoHome(), "path-map.json");
-  if (!existsSync49(mapPath)) {
+  const mapPath = join59(repoHome(), "path-map.json");
+  if (!existsSync51(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -8150,14 +8382,14 @@ function resumeCmd(sessionId) {
   console.log(`cd ${shQuote(hit.localPath)} && claude --resume ${shQuote(sessionId)}`);
 }
 function findTranscriptPath(projectsRoot, sessionId) {
-  for (const dir of readdirSync18(projectsRoot)) {
-    const candidate = join57(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync49(candidate)) return candidate;
+  for (const dir of readdirSync19(projectsRoot)) {
+    const candidate = join59(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync51(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync17(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync18(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);