claude-nomad 0.60.0 → 0.61.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/.gitleaks.toml +11 -2
  2. package/CHANGELOG.md +24 -0
  3. package/README.md +3 -0
  4. package/dist/nomad.mjs +569 -344
  5. package/package.json +1 -1
package/.gitleaks.toml CHANGED
@@ -41,7 +41,11 @@ condition = "AND"
41
41
  # false-positive handler is a narrow allowlist scoped to synced session
42
42
  # paths. `condition = "AND"` requires BOTH a known literal AND a
43
43
  # `shared/projects/<logical>/.../*.jsonl` path; a real PAT in the same
44
- # file (different 36-char body) still fires.
44
+ # file (different 36-char body) still fires. Also scoped to
45
+ # `shared/projects/<logical>/memory/*.md`: these exact literals legitimately
46
+ # appear in curated memory prose that discusses the fixture pattern itself
47
+ # (e.g. a memory note documenting this allowlist), and the exact-literal match
48
+ # carries no false-negative risk there either.
45
49
  [[allowlists]]
46
50
  description = "claude-nomad: documented test-fixture github-pat literals + scrub placeholders in synced session transcripts"
47
51
  regexes = [
@@ -52,6 +56,7 @@ regexes = [
52
56
  ]
53
57
  paths = [
54
58
  '''^shared/projects/[^/]+/.*\.jsonl$''',
59
+ '''^shared/projects/[^/]+/memory/[^/]+\.md$''',
55
60
  ]
56
61
  condition = "AND"
57
62
 
@@ -64,7 +69,10 @@ condition = "AND"
64
69
  # regexTarget = "line") keeps this from whitelisting a bare token: a real
65
70
  # secret is never preceded by an SSH key-type label and the SHA256: scheme
66
71
  # prefix. `condition = "AND"` plus the session-jsonl path scope double-locks
67
- # it to synced transcripts.
72
+ # it to synced transcripts. Also scoped to `shared/projects/<logical>/memory/*.md`:
73
+ # this is plausible content in a curated memory note documenting a commit
74
+ # signature-verification procedure, and the structural `with <keytype> key
75
+ # SHA256:` anchor keeps the false-negative risk low there too.
68
76
  [[allowlists]]
69
77
  description = "claude-nomad: SSH public-key fingerprints (with <keytype> key SHA256:<b64>) in git signature output in synced session transcripts"
70
78
  regexTarget = "line"
@@ -73,6 +81,7 @@ regexes = [
73
81
  ]
74
82
  paths = [
75
83
  '''^shared/projects/[^/]+/.*\.jsonl$''',
84
+ '''^shared/projects/[^/]+/memory/[^/]+\.md$''',
76
85
  ]
77
86
  condition = "AND"
78
87
 
package/CHANGELOG.md CHANGED
@@ -1,5 +1,29 @@
1
1
  # Changelog
2
2
 
3
+ ## [0.61.0](https://github.com/funkadelic/claude-nomad/compare/v0.60.0...v0.61.0) (2026-07-17)
4
+
5
+
6
+ ### Added
7
+
8
+ * **push:** handle memory/*.md secrets at parity with session transcripts ([#427](https://github.com/funkadelic/claude-nomad/issues/427)) ([d1e544c](https://github.com/funkadelic/claude-nomad/commit/d1e544c4f402dae80e319c62ed1fae903fef6e4b))
9
+
10
+
11
+ ### Changed
12
+
13
+ * **publish:** checkout in smoke-test so setup-node can read .nvmrc ([#424](https://github.com/funkadelic/claude-nomad/issues/424)) ([3d8fd2c](https://github.com/funkadelic/claude-nomad/commit/3d8fd2c66ba7947a9326c46f997c336793786efc))
14
+
15
+
16
+ ### Documentation
17
+
18
+ * correct release-bump, Stryker HOME, and offboarding details ([#429](https://github.com/funkadelic/claude-nomad/issues/429)) ([bb5f0fe](https://github.com/funkadelic/claude-nomad/commit/bb5f0fede4cafb848609134bbd1581ac62d42f2c))
19
+ * drop redundant overview file tree in how-it-works ([#428](https://github.com/funkadelic/claude-nomad/issues/428)) ([dd795c8](https://github.com/funkadelic/claude-nomad/commit/dd795c831b876be3ed6bfe1b1313c8ce8f108715))
20
+ * **site:** show claude-nomad version badge in the header ([#430](https://github.com/funkadelic/claude-nomad/issues/430)) ([18d5e86](https://github.com/funkadelic/claude-nomad/commit/18d5e864cd5579d79a79fdd8060352afedcc32fe))
21
+
22
+
23
+ ### Testing
24
+
25
+ * **integration:** cover recovery, sync, dry-run, manifest, and eject flows ([#426](https://github.com/funkadelic/claude-nomad/issues/426)) ([c9c5223](https://github.com/funkadelic/claude-nomad/commit/c9c5223117426439ad57e2442137891c379af1f7))
26
+
3
27
  ## [0.60.0](https://github.com/funkadelic/claude-nomad/compare/v0.59.0...v0.60.0) (2026-07-15)
4
28
 
5
29
 
package/README.md CHANGED
@@ -45,6 +45,9 @@ survives different file paths and your secrets never ride along.
45
45
  entirely and can leak a secret that `nomad push` would have caught. Steady-state pushes scan only
46
46
  the transcripts that changed since the last successful push (incremental); a cold start, a
47
47
  gitleaks version change, a config file change, or `--full-scan` forces a full rescan.
48
+ `nomad doctor --check-shared` also runs a read-only advisory over memory notes already synced to
49
+ the repo, flagging (but never blocking on) a secret that already made it through in a past push;
50
+ the fix is the same interactive Redact step `nomad push` offers.
48
51
  - **Preview before you trust it.** `nomad diff` shows offline what a pull would change (gsd-owned
49
52
  hook churn is filtered the same as on pull, so the preview matches what a real pull writes), and
50
53
  `--dry-run` on pull and push prints the plan without writing anything.