claude-nomad 0.60.0 → 0.62.0

package/.gitleaks.toml

@@ -6,28 +6,53 @@
 [extend]
 useDefault = true
 
-# Path-scoped: this tool-output noise (gitleaks fingerprints, coverage
-# line-keys, npm audit JSON id hashes, Sonar issue keys) accumulates in Claude
-# Code session transcripts when a conversation runs those tools. Two of these
-# regexes are structurally generic enough that, left global, they could suppress
-# a real credential that happened to sit in a `path:word:digit` or hex-`id`
-# context anywhere in the repo. Scoping to `shared/projects/<logical>/.../*.jsonl`
-# with `condition = "AND"` (matching every other block below) confines the
-# suppression to synced transcripts: a real secret in a source file still fires.
-# The Sonar-issue-key regex is length-bounded to the real key shape (`AY` + 17-22
-# base64url chars = 19-24 total, matching the sibling `key:`/`rule:` block) and
-# token-anchored with `\b` on both ends, so it cannot suppress a longer or
-# embedded `AY`-prefixed credential as a substring (an unbounded `{20,}` could).
+# Path-scoped: the bare Sonar-issue-key shape (`AY` + 17-22 base64url chars) is
+# a CONTEXT-FREE token pattern. Unlike the three structural noise shapes below
+# it carries no surrounding structure (no `:rule:line`, no `"id":`, no `key=`
+# prefix), so it cannot be distinguished from a real `AY`-prefixed high-entropy
+# credential of the same length. It is therefore scoped to synced session
+# transcripts ONLY (`shared/projects/<logical>/.../*.jsonl`), NOT to
+# `shared/skills/**`: a skill file is executable, curated content a user pastes
+# real values into, so an `AY`-shaped credential dropped into a skill MUST still
+# fire. `condition = "AND"` confines the suppression to transcripts: a real
+# secret in a source file still fires. The regex is length-bounded to the real
+# key shape and token-anchored with `\b` on both ends, so even inside a
+# transcript it cannot suppress a longer or embedded `AY`-prefixed credential as
+# a substring (an unbounded `{20,}` could).
 [[allowlists]]
-description = "claude-nomad: structurally-distinguishable tool-output noise in synced session transcripts"
+description = "claude-nomad: Sonar issue-key token shape (AY-prefixed) in synced session transcripts only, NOT skills"
 regexes = [
     '''\bAY[A-Za-z0-9_-]{17,22}\b''',
+]
+paths = [
+    '''^shared/projects/[^/]+/.*\.jsonl$''',
+]
+condition = "AND"
+
+# Path-scoped: this tool-output noise (gitleaks fingerprints, coverage
+# line-keys, npm audit JSON id hashes) accumulates in Claude Code session
+# transcripts when a conversation runs those tools. Each of these three regexes
+# carries structural context (`<path>.<ext>:<rule>:<line>`, `"id":"<hex>"`, or
+# `key=<hex> <path>:<line>`) that a bare credential does not, so widening them
+# to skill content cannot mask a context-free secret token. Scoping to
+# `shared/projects/<logical>/.../*.jsonl` with `condition = "AND"` (matching
+# every other block below) confines the suppression to synced transcripts: a
+# real secret in a source file still fires. Also scoped (recursively) to
+# `shared/skills/<name>/**`: curated, portable skill content can legitimately
+# embed the same structured tool-output noise shapes (e.g. a skill doc pasting
+# an example npm-audit or coverage dump), and the structural anchor keeps the
+# false-negative risk low in that tree too. The bare `AY` shape is deliberately
+# NOT in this block (see the transcript-only block above).
+[[allowlists]]
+description = "claude-nomad: structurally-anchored tool-output noise in synced session transcripts and skills"
+regexes = [
     '''[\w./-]+\.[A-Za-z0-9]+:[\w-]+:\d+''',
     '''"id"\s*:\s*"[a-f0-9]{40,64}"''',
     '''key=[a-f0-9]{8,} [\w./-]+\.\w+:\d+''',
 ]
 paths = [
     '''^shared/projects/[^/]+/.*\.jsonl$''',
+    '''^shared/skills/[^/]+/.*$''',
 ]
 condition = "AND"
 
@@ -41,7 +66,11 @@ condition = "AND"
 # false-positive handler is a narrow allowlist scoped to synced session
 # paths. `condition = "AND"` requires BOTH a known literal AND a
 # `shared/projects/<logical>/.../*.jsonl` path; a real PAT in the same
-# file (different 36-char body) still fires.
+# file (different 36-char body) still fires. Also scoped to
+# `shared/projects/<logical>/memory/*.md`: these exact literals legitimately
+# appear in curated memory prose that discusses the fixture pattern itself
+# (e.g. a memory note documenting this allowlist), and the exact-literal match
+# carries no false-negative risk there either.
 [[allowlists]]
 description = "claude-nomad: documented test-fixture github-pat literals + scrub placeholders in synced session transcripts"
 regexes = [
@@ -52,6 +81,7 @@ regexes = [
 ]
 paths = [
     '''^shared/projects/[^/]+/.*\.jsonl$''',
+    '''^shared/projects/[^/]+/memory/[^/]+\.md$''',
 ]
 condition = "AND"
 
@@ -64,7 +94,13 @@ condition = "AND"
 # regexTarget = "line") keeps this from whitelisting a bare token: a real
 # secret is never preceded by an SSH key-type label and the SHA256: scheme
 # prefix. `condition = "AND"` plus the session-jsonl path scope double-locks
-# it to synced transcripts.
+# it to synced transcripts. Also scoped to `shared/projects/<logical>/memory/*.md`:
+# this is plausible content in a curated memory note documenting a commit
+# signature-verification procedure, and the structural `with <keytype> key
+# SHA256:` anchor keeps the false-negative risk low there too. Also scoped
+# (recursively) to `shared/skills/<name>/**`: a skill documenting a
+# signature-verification procedure can plausibly quote the same fingerprint
+# line shape, with the same low false-negative risk.
 [[allowlists]]
 description = "claude-nomad: SSH public-key fingerprints (with <keytype> key SHA256:<b64>) in git signature output in synced session transcripts"
 regexTarget = "line"
@@ -73,6 +109,8 @@ regexes = [
 ]
 paths = [
     '''^shared/projects/[^/]+/.*\.jsonl$''',
+    '''^shared/projects/[^/]+/memory/[^/]+\.md$''',
+    '''^shared/skills/[^/]+/.*$''',
 ]
 condition = "AND"
 
@@ -84,7 +122,10 @@ condition = "AND"
 # above keys on. Anchoring on the surrounding `key:`/`rule:` structure (via
 # regexTarget = "line") keeps this from whitelisting a bare token: a real API
 # key is never followed by `\n  rule: <lang>:S####`. `condition = "AND"` plus
-# the session-jsonl path scope double-locks it to synced transcripts.
+# the session-jsonl path scope double-locks it to synced transcripts. Also
+# scoped (recursively) to `shared/skills/<name>/**`: a skill documenting a
+# SonarCloud triage procedure can plausibly quote the same issue-listing
+# pair shape, with the same low false-negative risk.
 [[allowlists]]
 description = "claude-nomad: SonarCloud issue-listing output (key: <id> / rule: <lang>:S<n>) in synced session transcripts"
 regexTarget = "line"
@@ -93,5 +134,6 @@ regexes = [
 ]
 paths = [
     '''^shared/projects/[^/]+/.*\.jsonl$''',
+    '''^shared/skills/[^/]+/.*$''',
 ]
 condition = "AND"

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [0.62.0](https://github.com/funkadelic/claude-nomad/compare/v0.61.0...v0.62.0) (2026-07-18)
+
+
+### Added
+
+* **crash-handler:** redacted crash reports for unexpected errors ([#433](https://github.com/funkadelic/claude-nomad/issues/433)) ([cb2d23c](https://github.com/funkadelic/claude-nomad/commit/cb2d23c16165b0004a8769a8ab5c60af026c9577))
+* **exit-codes:** documented exit-code contract for scripted callers ([#432](https://github.com/funkadelic/claude-nomad/issues/432)) ([890e6a2](https://github.com/funkadelic/claude-nomad/commit/890e6a2a28d37e6559f7167ae57c695b4d1337f5))
+* **push:** handle shared/skills secrets at parity with sessions and memory ([#431](https://github.com/funkadelic/claude-nomad/issues/431)) ([759262c](https://github.com/funkadelic/claude-nomad/commit/759262c52aeaf4e2913fc1421ccd90260327c882))
+
+
+### Dependencies
+
+* bump markdownlint-cli2 from 0.23.0 to 0.23.1 ([#434](https://github.com/funkadelic/claude-nomad/issues/434)) ([68c6402](https://github.com/funkadelic/claude-nomad/commit/68c6402cea2dbc3a8f9c1eb8fd8db0a416005a53))
+
+## [0.61.0](https://github.com/funkadelic/claude-nomad/compare/v0.60.0...v0.61.0) (2026-07-17)
+
+
+### Added
+
+* **push:** handle memory/*.md secrets at parity with session transcripts ([#427](https://github.com/funkadelic/claude-nomad/issues/427)) ([d1e544c](https://github.com/funkadelic/claude-nomad/commit/d1e544c4f402dae80e319c62ed1fae903fef6e4b))
+
+
+### Changed
+
+* **publish:** checkout in smoke-test so setup-node can read .nvmrc ([#424](https://github.com/funkadelic/claude-nomad/issues/424)) ([3d8fd2c](https://github.com/funkadelic/claude-nomad/commit/3d8fd2c66ba7947a9326c46f997c336793786efc))
+
+
+### Documentation
+
+* correct release-bump, Stryker HOME, and offboarding details ([#429](https://github.com/funkadelic/claude-nomad/issues/429)) ([bb5f0fe](https://github.com/funkadelic/claude-nomad/commit/bb5f0fede4cafb848609134bbd1581ac62d42f2c))
+* drop redundant overview file tree in how-it-works ([#428](https://github.com/funkadelic/claude-nomad/issues/428)) ([dd795c8](https://github.com/funkadelic/claude-nomad/commit/dd795c831b876be3ed6bfe1b1313c8ce8f108715))
+* **site:** show claude-nomad version badge in the header ([#430](https://github.com/funkadelic/claude-nomad/issues/430)) ([18d5e86](https://github.com/funkadelic/claude-nomad/commit/18d5e864cd5579d79a79fdd8060352afedcc32fe))
+
+
+### Testing
+
+* **integration:** cover recovery, sync, dry-run, manifest, and eject flows ([#426](https://github.com/funkadelic/claude-nomad/issues/426)) ([c9c5223](https://github.com/funkadelic/claude-nomad/commit/c9c5223117426439ad57e2442137891c379af1f7))
+
 ## [0.60.0](https://github.com/funkadelic/claude-nomad/compare/v0.59.0...v0.60.0) (2026-07-15)
 
 

package/README.md

@@ -45,6 +45,9 @@ survives different file paths and your secrets never ride along.
   entirely and can leak a secret that `nomad push` would have caught. Steady-state pushes scan only
   the transcripts that changed since the last successful push (incremental); a cold start, a
   gitleaks version change, a config file change, or `--full-scan` forces a full rescan.
+  `nomad doctor --check-shared` also runs a read-only advisory over memory notes and skill files
+  already synced to the repo, flagging (but never blocking on) a secret that already made it through
+  in a past push; the fix is the same interactive Redact step `nomad push` offers.
 - **Preview before you trust it.** `nomad diff` shows offline what a pull would change (gsd-owned
   hook churn is filtered the same as on pull, so the preview matches what a real pull writes), and
   `--dry-run` on pull and push prints the plan without writing anything.
@@ -297,6 +300,51 @@ version-staleness check and `nomad doctor --check-schema`. The CLI works without
 curl or wget needed) and verifies that `shared/` and a valid `path-map.json` are present there; it
 skips with a `⚠︎` when the ref is unavailable, and is non-fatal in all cases.
 
+## Exit codes
+
+Every `nomad` subcommand exits with one of a small set of codes, so a script or cron wrapper can
+branch on `$?` without parsing stderr text.
+
+| Code | Name            | Meaning                                                                              |
+| ---- | --------------- | ------------------------------------------------------------------------------------ |
+| 0    | Success         | Completed successfully.                                                              |
+| 1    | Generic failure | Unclassified failure; the default for any error not covered below.                   |
+| 2    | Usage           | Bad argv: an unknown subcommand, an unknown flag, or a malformed flag value.         |
+| 4    | Conflict        | The sync repo is wedged (e.g. an unresolved rebase) and needs manual git resolution. |
+| 5    | Leak blocked    | gitleaks confirmed a secret in the staged tree and the push was aborted.             |
+
+A run skipped because another nomad process already holds the lock also exits 0: this is an
+intentional no-op skip, not a failure, so a backgrounded shell-rc or cron invocation never raises a
+false alarm from a concurrent run. Value `3` is reserved for future use.
+
+## Crash reports
+
+If `nomad` ever hits an unexpected bug, it no longer dumps a raw stack trace at you. Instead it
+prints a short "this looks like a bug" banner (with a link to the issue tracker) and writes a small
+report you can attach to a bug report if you choose. The exit code is unchanged: an unexpected crash
+exits `1`, and a documented failure still exits with its own code from the table above.
+
+What this means for you:
+
+- **The report stays on your machine.** It is written to `~/.cache/claude-nomad/crash/` and nothing
+  is ever uploaded anywhere. The file just sits there until you decide to share it or delete it.
+- **The saved report is scrubbed twice.** First a structural pass rewrites your home directory to
+  `~` and your hostname to a placeholder (absolute paths are personal information a secret scanner
+  would not catch). Then a best-effort secret scan runs the same gitleaks-based redaction nomad
+  already uses for session transcripts. The secret scan works on a temporary, owner-only (`0o600`)
+  copy that already has the structural scrub applied; that scratch file is deleted immediately after
+  the scan, and only the fully-redacted report is kept.
+- **It degrades safely without gitleaks.** If gitleaks is not installed, the structural scrub still
+  runs and the report is still written, with a one-line note that the secret scan did not run, so
+  give it a glance before posting it publicly.
+- **It is small and bounded.** The report contains only the nomad version, the command you ran
+  (bounded, and including any flag values you typed), the error name and message, a trimmed stack,
+  your platform, the Node.js version, and a timestamp. It never includes an environment dump or the
+  contents of any file.
+- **The directory manages itself.** Only the most recent reports are kept; older ones are pruned
+  automatically on the next crash. There is no `nomad clean` flag for the crash directory, by
+  design: it self-manages.
+
 ## Learn more
 
 - [How it works](https://funkadelic.github.io/claude-nomad/how-it-works/) -- path remapping,