claude-nomad 0.59.0 → 0.61.0

package/.gitleaks.toml

@@ -41,7 +41,11 @@ condition = "AND"
 # false-positive handler is a narrow allowlist scoped to synced session
 # paths. `condition = "AND"` requires BOTH a known literal AND a
 # `shared/projects/<logical>/.../*.jsonl` path; a real PAT in the same
-# file (different 36-char body) still fires.
+# file (different 36-char body) still fires. Also scoped to
+# `shared/projects/<logical>/memory/*.md`: these exact literals legitimately
+# appear in curated memory prose that discusses the fixture pattern itself
+# (e.g. a memory note documenting this allowlist), and the exact-literal match
+# carries no false-negative risk there either.
 [[allowlists]]
 description = "claude-nomad: documented test-fixture github-pat literals + scrub placeholders in synced session transcripts"
 regexes = [
@@ -52,6 +56,7 @@ regexes = [
 ]
 paths = [
     '''^shared/projects/[^/]+/.*\.jsonl$''',
+    '''^shared/projects/[^/]+/memory/[^/]+\.md$''',
 ]
 condition = "AND"
 
@@ -64,7 +69,10 @@ condition = "AND"
 # regexTarget = "line") keeps this from whitelisting a bare token: a real
 # secret is never preceded by an SSH key-type label and the SHA256: scheme
 # prefix. `condition = "AND"` plus the session-jsonl path scope double-locks
-# it to synced transcripts.
+# it to synced transcripts. Also scoped to `shared/projects/<logical>/memory/*.md`:
+# this is plausible content in a curated memory note documenting a commit
+# signature-verification procedure, and the structural `with <keytype> key
+# SHA256:` anchor keeps the false-negative risk low there too.
 [[allowlists]]
 description = "claude-nomad: SSH public-key fingerprints (with <keytype> key SHA256:<b64>) in git signature output in synced session transcripts"
 regexTarget = "line"
@@ -73,6 +81,7 @@ regexes = [
 ]
 paths = [
     '''^shared/projects/[^/]+/.*\.jsonl$''',
+    '''^shared/projects/[^/]+/memory/[^/]+\.md$''',
 ]
 condition = "AND"
 

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## [0.61.0](https://github.com/funkadelic/claude-nomad/compare/v0.60.0...v0.61.0) (2026-07-17)
+
+
+### Added
+
+* **push:** handle memory/*.md secrets at parity with session transcripts ([#427](https://github.com/funkadelic/claude-nomad/issues/427)) ([d1e544c](https://github.com/funkadelic/claude-nomad/commit/d1e544c4f402dae80e319c62ed1fae903fef6e4b))
+
+
+### Changed
+
+* **publish:** checkout in smoke-test so setup-node can read .nvmrc ([#424](https://github.com/funkadelic/claude-nomad/issues/424)) ([3d8fd2c](https://github.com/funkadelic/claude-nomad/commit/3d8fd2c66ba7947a9326c46f997c336793786efc))
+
+
+### Documentation
+
+* correct release-bump, Stryker HOME, and offboarding details ([#429](https://github.com/funkadelic/claude-nomad/issues/429)) ([bb5f0fe](https://github.com/funkadelic/claude-nomad/commit/bb5f0fede4cafb848609134bbd1581ac62d42f2c))
+* drop redundant overview file tree in how-it-works ([#428](https://github.com/funkadelic/claude-nomad/issues/428)) ([dd795c8](https://github.com/funkadelic/claude-nomad/commit/dd795c831b876be3ed6bfe1b1313c8ce8f108715))
+* **site:** show claude-nomad version badge in the header ([#430](https://github.com/funkadelic/claude-nomad/issues/430)) ([18d5e86](https://github.com/funkadelic/claude-nomad/commit/18d5e864cd5579d79a79fdd8060352afedcc32fe))
+
+
+### Testing
+
+* **integration:** cover recovery, sync, dry-run, manifest, and eject flows ([#426](https://github.com/funkadelic/claude-nomad/issues/426)) ([c9c5223](https://github.com/funkadelic/claude-nomad/commit/c9c5223117426439ad57e2442137891c379af1f7))
+
+## [0.60.0](https://github.com/funkadelic/claude-nomad/compare/v0.59.0...v0.60.0) (2026-07-15)
+
+
+### Added
+
+* **links:** preserve live gsd hook entries across regenerateSettings ([#421](https://github.com/funkadelic/claude-nomad/issues/421)) ([10a18ca](https://github.com/funkadelic/claude-nomad/commit/10a18ca7ed6c1851cdc43e46ad616527d41a1f92))
+* **sync:** compact output with merged tree and no-op collapse ([#415](https://github.com/funkadelic/claude-nomad/issues/415)) ([9bb9cdd](https://github.com/funkadelic/claude-nomad/commit/9bb9cdd7e901ea463d5c1fb5b66ffc39b2864f8a))
+* **sync:** compact summary-only output by default, add --verbose ([#420](https://github.com/funkadelic/claude-nomad/issues/420)) ([b5b95b3](https://github.com/funkadelic/claude-nomad/commit/b5b95b372634a0b372023b399e7f16bb0063ff74))
+
+
+### Changed
+
+* **lint:** enable sonarjs recommended ruleset with triaged exclusions ([#422](https://github.com/funkadelic/claude-nomad/issues/422)) ([f92fce8](https://github.com/funkadelic/claude-nomad/commit/f92fce8533e06814d5e3f58c1f120adf3e00ded7))
+* **tests:** make Defender exclusion step non-fatal ([#419](https://github.com/funkadelic/claude-nomad/issues/419)) ([413a906](https://github.com/funkadelic/claude-nomad/commit/413a9065ef152dfaedd76b325de749070e2165ab))
+
+
+### Testing
+
+* **integration:** cover extras deny-set, host overrides, and skills sync in round-trip ([#418](https://github.com/funkadelic/claude-nomad/issues/418)) ([70074b5](https://github.com/funkadelic/claude-nomad/commit/70074b5c5a8831a93726576e346e7e89ac511ffa))
+* **pull:** fix flaky incomingChanges tests via shared mock instance ([#417](https://github.com/funkadelic/claude-nomad/issues/417)) ([6589887](https://github.com/funkadelic/claude-nomad/commit/6589887d0ac1c77f7696b89a1a518e469e913dae))
+* **vitest:** raise subprocess project maxWorkers to 2 ([#423](https://github.com/funkadelic/claude-nomad/issues/423)) ([8fa28b5](https://github.com/funkadelic/claude-nomad/commit/8fa28b5a2ef4cae4816f5b6ad23bf90189a611d1))
+
 ## [0.59.0](https://github.com/funkadelic/claude-nomad/compare/v0.58.1...v0.59.0) (2026-07-14)
 
 

package/README.md

@@ -45,6 +45,9 @@ survives different file paths and your secrets never ride along.
   entirely and can leak a secret that `nomad push` would have caught. Steady-state pushes scan only
   the transcripts that changed since the last successful push (incremental); a cold start, a
   gitleaks version change, a config file change, or `--full-scan` forces a full rescan.
+  `nomad doctor --check-shared` also runs a read-only advisory over memory notes already synced to
+  the repo, flagging (but never blocking on) a secret that already made it through in a past push;
+  the fix is the same interactive Redact step `nomad push` offers.
 - **Preview before you trust it.** `nomad diff` shows offline what a pull would change (gsd-owned
   hook churn is filtered the same as on pull, so the preview matches what a real pull writes), and
   `--dry-run` on pull and push prints the plan without writing anything.
@@ -174,12 +177,13 @@ $ nomad sync     # pull config, then publish local changes, in one step
 
 `nomad sync` is the command to reach for day to day: it always pulls first (so changes from your
 other machines land before anything is pushed, and work that exists only on this machine is kept,
-not deleted) and then pushes, under one lock, so there is no ordering to remember. `nomad pull` and
-`nomad push` are still available as lower-level commands for cases `sync` does not cover: recovering
-a wedged repo with `nomad pull --force-remote`, or resolving a detected secret without the
-interactive menu via `nomad push --redact-all` / `--allow` / `--allow-all` (see
-[Changing settings](#changing-settings) and
-[Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/)). The
+not deleted) and then pushes, under one lock, so there is no ordering to remember. Output is compact
+by default: a run prints only a short Sync summary, not the full status tree; pass
+`nomad sync --verbose` (or `--all` / `-v`) to see the full tree. `nomad pull` and `nomad push` are
+still available as lower-level commands for cases `sync` does not cover: recovering a wedged repo
+with `nomad pull --force-remote`, or resolving a detected secret without the interactive menu via
+`nomad push --redact-all` / `--allow` / `--allow-all` (see [Changing settings](#changing-settings)
+and [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/)). The
 [FAQ](https://funkadelic.github.io/claude-nomad/faq/) covers what `sync` does under the hood and the
 push/pull order it enforces.