claude-nomad 0.62.0 → 0.62.2

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.62.2](https://github.com/funkadelic/claude-nomad/compare/v0.62.1...v0.62.2) (2026-07-21)
+
+
+### Fixed
+
+* **push:** close the interactive-push secret-gate fail-open ([#446](https://github.com/funkadelic/claude-nomad/issues/446)) ([5de8975](https://github.com/funkadelic/claude-nomad/commit/5de8975f83f5e99711041ef6025fe69933b1ab15))
+
+## [0.62.1](https://github.com/funkadelic/claude-nomad/compare/v0.62.0...v0.62.1) (2026-07-20)
+
+
+### Changed
+
+* **coderabbit:** skip Snyk security-bump PRs ([#436](https://github.com/funkadelic/claude-nomad/issues/436)) ([10ded7c](https://github.com/funkadelic/claude-nomad/commit/10ded7cb5657b1180f8d33b1fbf73c3000fea6c3))
+* **deps:** refresh lockfile for brace-expansion and fast-uri patches ([#445](https://github.com/funkadelic/claude-nomad/issues/445)) ([d4ea973](https://github.com/funkadelic/claude-nomad/commit/d4ea9739a450c71763a98769f48a7deefb38eca5))
+* drop 3 dead exports flagged by knip ([#437](https://github.com/funkadelic/claude-nomad/issues/437)) ([51750d8](https://github.com/funkadelic/claude-nomad/commit/51750d8801f96b4bca8137ac863c851d63f7c074))
+* **redact:** extract shared live-session guard ([#438](https://github.com/funkadelic/claude-nomad/issues/438)) ([59d8208](https://github.com/funkadelic/claude-nomad/commit/59d82085aaf59a53d8341de6850240fdce4aa7ea))
+
+
+### Dependencies
+
+* bump actions/setup-node from 6.4.0 to 7.0.0 ([#441](https://github.com/funkadelic/claude-nomad/issues/441)) ([f24a847](https://github.com/funkadelic/claude-nomad/commit/f24a847476e6ec63c4e85715c2ebfc42cce138c3))
+* bump astro from 7.0.7 to 7.1.3 in /docs-site ([#444](https://github.com/funkadelic/claude-nomad/issues/444)) ([01d56b7](https://github.com/funkadelic/claude-nomad/commit/01d56b7f20e1ea71f1dd64b7076411abc4fe9c02))
+* bump SonarSource/sonarqube-scan-action from 8.2.0 to 8.2.1 ([#443](https://github.com/funkadelic/claude-nomad/issues/443)) ([2928f0f](https://github.com/funkadelic/claude-nomad/commit/2928f0f87e40147a17b068b0053486fee6cbd6e6))
+* bump the codeql-action group with 2 updates ([#440](https://github.com/funkadelic/claude-nomad/issues/440)) ([8d30319](https://github.com/funkadelic/claude-nomad/commit/8d303191e692128c5fdc9dfaab7ff1f16eb0780d))
+* bump the dev-dependencies group with 2 updates ([#442](https://github.com/funkadelic/claude-nomad/issues/442)) ([22427db](https://github.com/funkadelic/claude-nomad/commit/22427dbbe4fb3f455a6ec24f0d4105dee904ee17))
+
 ## [0.62.0](https://github.com/funkadelic/claude-nomad/compare/v0.61.0...v0.62.0) (2026-07-18)
 
 

package/dist/nomad.mjs

@@ -4895,12 +4895,12 @@ import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep7 } from "nod
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync8, existsSync as existsSync32, mkdirSync as mkdirSync10, statSync as statSync8 } from "node:fs";
+import { cpSync as cpSync8, existsSync as existsSync32, mkdirSync as mkdirSync10 } from "node:fs";
 import { dirname as dirname10, join as join39, sep as sep5 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync30, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 import { dirname as dirname9, join as join37 } from "node:path";
 
 // src/commands.redact.subtree.ts
@@ -4936,6 +4936,10 @@ function newestSubtreeMtimeMs(mainPath, subtreeFiles, statMtime = (p) => statSyn
   }
   return newest;
 }
+function isSubtreeActive(mainPath, subtreeFiles, now) {
+  const subtreeMtime = newestSubtreeMtimeMs(mainPath, subtreeFiles, (p) => statSync6(p).mtimeMs);
+  return isRecentlyModified(subtreeMtime, now);
+}
 function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts, scan, dryRun) {
   const dirty = [];
   if (mainFindings.length > 0) dirty.push({ path: mainPath, findings: mainFindings });
@@ -5059,8 +5063,7 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
     }
     const sessionDir = join37(dirname9(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
-    const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync7(p).mtimeMs);
-    if (isRecentlyModified(subtreeMtime, nowMs())) {
+    if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
       log(
         `session ${id} was modified recently and may be active.
   Refusing to rewrite a potentially live transcript.
@@ -5260,8 +5263,7 @@ function preflightRedactable(f, map, nowMs) {
   if (localPath === null) return `session ${sid}: local transcript not found`;
   const sessionDir = join39(dirname10(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
-  const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
-  if (isRecentlyModified(subtreeMtime, nowMs())) {
+  if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return `session ${sid}: looks active (modified within the last 5 minutes)`;
   }
   if (resolveStagedDir(localPath, map, claudeHome(), repoHome()) === null) {
@@ -5290,8 +5292,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
   }
   const sessionDir = join39(dirname10(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
-  const subtreeMtime = newestSubtreeMtimeMs(localPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
-  if (isRecentlyModified(subtreeMtime, nowMs())) {
+  if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return refuse(
       `session ${sid} looks active (modified within the last 5 minutes); refusing to redact, no changes made.
   End the session and choose Redact again, or choose Drop session (holds this session back from the push, local copy kept) or Skip.`
@@ -5354,7 +5355,7 @@ import {
   mkdirSync as mkdirSync12,
   readFileSync as readFileSync16,
   realpathSync as realpathSync4,
-  statSync as statSync9,
+  statSync as statSync7,
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { dirname as dirname11, join as join42, sep as sep6 } from "node:path";
@@ -5435,7 +5436,7 @@ function resolveSkillLocalPath(name, relPath) {
     const realLocal = realpathSync4(localPath);
     const realRoot = realpathSync4(skillsRoot);
     if (!realLocal.startsWith(realRoot + sep6)) return null;
-    if (!statSync9(realLocal).isFile()) return null;
+    if (!statSync7(realLocal).isFile()) return null;
   } catch {
     return null;
   }
@@ -5725,6 +5726,9 @@ function allowThenRescan(append, scanVerdict, repoHome2) {
     throw err;
   }
 }
+function leakBlockedFatal(recovery) {
+  return new NomadFatal(recovery ?? "gitleaks detected secrets", { code: EXIT.LEAK_BLOCKED });
+}
 function makeRealPrompt() {
   return async (prompt) => {
     const rl = createInterface2({
@@ -5771,9 +5775,10 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
     );
   }
   if (!isTTYCheck()) {
-    throw new NomadFatal(current.recovery ?? "gitleaks detected secrets", {
-      code: EXIT.LEAK_BLOCKED
-    });
+    throw leakBlockedFatal(current.recovery);
+  }
+  if (current.leak && current.findings.length === 0) {
+    throw leakBlockedFatal(current.recovery);
   }
   const prompt = makePromptFn();
   printLegend();
@@ -5788,6 +5793,7 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
     gitOrFatal(["add", "-A"], "git add", repo);
     current = scanVerdict(repo);
   }
+  if (current.leak) throw leakBlockedFatal(current.recovery);
   return current;
 }
 
@@ -6223,7 +6229,7 @@ function parseDoctorArgs(args) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync20 } from "node:child_process";
-import { existsSync as existsSync38, readdirSync as readdirSync15, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync38, readdirSync as readdirSync15, statSync as statSync8 } from "node:fs";
 import { join as join47, relative as relative6 } from "node:path";
 
 // src/commands.drop-session.git.ts
@@ -6343,7 +6349,7 @@ function collectMatches(repoProjects, id, repo) {
       matches.push(relative6(repo, candidate));
     }
     const dir = join47(repoProjects, logical, id);
-    if (existsSync38(dir) && statSync10(dir).isDirectory()) {
+    if (existsSync38(dir) && statSync8(dir).isDirectory()) {
       const dirRel = relative6(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
@@ -6487,7 +6493,7 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync40, statSync as statSync11 } from "node:fs";
+import { existsSync as existsSync40, statSync as statSync9 } from "node:fs";
 import { join as join50 } from "node:path";
 init_utils();
 init_utils_json();
@@ -6799,7 +6805,7 @@ function divergenceCheckExtras(ts, prePostHeads) {
       divergenceWarnLine({
         dirname: dirname13,
         logical,
-        isDir: statSync11(local).isDirectory(),
+        isDir: statSync9(local).isDirectory(),
         count: modified.length,
         projectBackupRoot
       })
@@ -7466,7 +7472,7 @@ import { join as join57 } from "node:path";
 
 // src/commands.push.selection.ts
 init_config();
-import { existsSync as existsSync43, statSync as statSync12 } from "node:fs";
+import { existsSync as existsSync43, statSync as statSync10 } from "node:fs";
 import { join as join53 } from "node:path";
 init_utils_json();
 function buildCurrentMap(map) {
@@ -7479,7 +7485,7 @@ function buildCurrentMap(map) {
     const localDir = join53(claude, "projects", encodePath(localPath));
     if (!existsSync43(localDir)) continue;
     for (const f of enumerateSourceFiles(localDir)) {
-      const st = statSync12(f);
+      const st = statSync10(f);
       current[f] = { size: st.size, mtime: st.mtimeMs };
     }
   }
@@ -7883,6 +7889,7 @@ async function commitAndPush(st, ts, map, resolution, repo, newManifest, render)
     if (!render) log("push (leak recovery)");
     renderPushTree(st, verdict);
     verdict = await resolveLeakFindings(verdict, ts, map, resolution);
+    if (verdict.leak) throw leakBlockedFatal(verdict.recovery);
   }
   gitOrFatal(["commit", "-m", `chore: sync from ${HOST}`], "git commit", repo);
   withSpinner("Pushing", () => gitOrFatal(["push"], "git push", repo));
@@ -8251,7 +8258,7 @@ init_config();
 
 // src/crash-report.write.ts
 init_config();
-import { mkdirSync as mkdirSync16, readdirSync as readdirSync18, statSync as statSync13, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
+import { mkdirSync as mkdirSync16, readdirSync as readdirSync18, statSync as statSync11, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join60 } from "node:path";
 
 // src/crash-report.ts
@@ -8364,7 +8371,7 @@ function listCrashFiles(dir = crashDir()) {
   try {
     return readdirSync18(dir).flatMap((name) => {
       try {
-        return [{ name, mtimeMs: statSync13(join60(dir, name)).mtimeMs }];
+        return [{ name, mtimeMs: statSync11(join60(dir, name)).mtimeMs }];
       } catch {
         return [];
       }
@@ -8525,7 +8532,7 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync49, rmSync as rmSync19, statSync as statSync14 } from "node:fs";
+import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync49, rmSync as rmSync19, statSync as statSync12 } from "node:fs";
 import { join as join62 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
@@ -8534,7 +8541,7 @@ function snapshotIntoShared(map) {
     const src = join62(claude, name);
     if (!existsSync49(src)) continue;
     const dst = join62(repo, "shared", name);
-    if (statSync14(src).isDirectory()) {
+    if (statSync12(src).isDirectory()) {
       const gk = join62(dst, ".gitkeep");
       if (existsSync49(gk)) rmSync19(gk);
       cpSync10(src, dst, { recursive: true, force: false, errorOnExist: true });
@@ -8676,13 +8683,13 @@ function maybeDisableRepoActions(repoHome2, run) {
 // src/init.prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync51, readdirSync as readdirSync19, statSync as statSync15 } from "node:fs";
+import { existsSync as existsSync51, readdirSync as readdirSync19, statSync as statSync13 } from "node:fs";
 import { join as join64 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
   if (!existsSync51(path)) return false;
   try {
-    if (statSync15(path).isDirectory()) return readdirSync19(path).length > 0;
+    if (statSync13(path).isDirectory()) return readdirSync19(path).length > 0;
     return true;
   } catch {
     return false;
@@ -8997,7 +9004,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.62.0",
+  version: "0.62.2",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.62.0",
+  "version": "0.62.2",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [