claude-nomad 0.62.1 → 0.62.3

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.62.3](https://github.com/funkadelic/claude-nomad/compare/v0.62.2...v0.62.3) (2026-07-21)
+
+
+### Fixed
+
+* abort when an autostash pop conflicts during rebase ([#448](https://github.com/funkadelic/claude-nomad/issues/448)) ([a22b3df](https://github.com/funkadelic/claude-nomad/commit/a22b3dfdc95478ba09a6cf6bf9994c9d8d9ac416))
+* **pull:** stop --force-remote applying conflict-markered config ([#452](https://github.com/funkadelic/claude-nomad/issues/452)) ([5612ac9](https://github.com/funkadelic/claude-nomad/commit/5612ac9c25e25118a73aaa465d2ccd9b16604e8a))
+* retain never-pushed local skills on pull ([#449](https://github.com/funkadelic/claude-nomad/issues/449)) ([0faf4f7](https://github.com/funkadelic/claude-nomad/commit/0faf4f726d2982ba9e4b6da9be58b17b838bcd37))
+
+## [0.62.2](https://github.com/funkadelic/claude-nomad/compare/v0.62.1...v0.62.2) (2026-07-21)
+
+
+### Fixed
+
+* **push:** close the interactive-push secret-gate fail-open ([#446](https://github.com/funkadelic/claude-nomad/issues/446)) ([5de8975](https://github.com/funkadelic/claude-nomad/commit/5de8975f83f5e99711041ef6025fe69933b1ab15))
+
 ## [0.62.1](https://github.com/funkadelic/claude-nomad/compare/v0.62.0...v0.62.1) (2026-07-20)
 
 

package/README.md

@@ -253,9 +253,10 @@ operation, parks stranded commits on a `nomad/stranded-<ts>` branch, resets to `
 re-pulls; refuses if stranded or dirty tracked changes touch synced config), and a repo where the
 rebase was torn down but the git index still has unmerged entries with no active rebase or merge in
 progress (clears the stuck index via `git reset --mixed HEAD`, preserving working-tree edits,
-surfaces any orphaned autostash entry, then re-pulls). Run `nomad doctor` first if you are unsure
-which state you are in; the Repository section names the specific problem and points at the right
-fix.
+surfaces any orphaned autostash entry, then re-pulls; stops after the index repair if any conflicted
+file still carries conflict markers, so they are never copied into your live config). Run
+`nomad doctor` first if you are unsure which state you are in; the Repository section names the
+specific problem and points at the right fix.
 
 If an external tool (such as Claude Code or GSD) wrote new keys into your `~/.claude/settings.json`
 that are not yet in your shared repo, run `nomad capture-settings` to promote them before the next

package/dist/nomad.mjs

@@ -779,7 +779,7 @@ function classifyWedge(repo) {
   return unmergedIndexPresent(repo) ? "unmerged-index" : null;
 }
 function unmergedIndexRunbookText(resumeCmd2) {
-  return `repo has an unmerged index with no active rebase or merge in progress (torn-down rebase left stage-2/3 entries behind).
+  return `repo has an unmerged index with no active rebase or merge in progress (torn-down rebase or merge left stage-2/3 entries behind).
 
 Manual recovery:
   1. git reset --mixed HEAD   (clears the stuck index; preserves working-tree files)
@@ -915,6 +915,43 @@ var init_push_gitleaks_config = __esm({
   }
 });
 
+// src/autostash-guard.ts
+function autostashConflictRunbookText(resumeCmd2, stashRetained) {
+  const head = `${resumeCmd2} reported success, but the autostash pop it ran internally conflicted. The working tree now holds conflict markers and the index is unmerged. Nothing has been copied to ~/.claude/ yet, and there is no rebase or merge in progress to abort.`;
+  if (stashRetained) {
+    return `${head}
+
+Recovery (the pre-conflict content is retained in the stash; nothing is lost):
+  1. git stash list                 (confirm stash@{0}: autostash is present)
+  2. git show 'stash@{0}:<path>'     (view the pre-conflict content; does not re-trigger the conflict)
+  3. git reset --hard HEAD           (discard the markered working tree)
+  4. re-apply the content from step 2 into <path>, as needed
+  5. git stash drop                  (once you are done with the stash entry)
+  6. ${resumeCmd2}`;
+  }
+  return `${head}
+
+No autostash entry was found to recover from, so the working tree is the only copy of this edit. Resolve the conflict markers by hand in the affected file(s), then:
+  1. git add <path>                  (mark resolved)
+  2. ${resumeCmd2}
+
+Do not run "git reset --hard": with no stash entry to fall back on, that would discard your only copy of the edit.`;
+}
+function assertNoAutostashConflict(repo, resumeCmd2) {
+  if (!unmergedIndexPresent(repo)) return;
+  throw new NomadFatal(autostashConflictRunbookText(resumeCmd2, orphanedAutostashPresent(repo)), {
+    code: EXIT.CONFLICT
+  });
+}
+var init_autostash_guard = __esm({
+  "src/autostash-guard.ts"() {
+    "use strict";
+    init_commands_pull_wedge();
+    init_exit_codes();
+    init_utils();
+  }
+});
+
 // src/push-checks.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { readdirSync as readdirSync7, rmSync as rmSync7 } from "node:fs";
@@ -1014,11 +1051,13 @@ function rebaseBeforePush(repo) {
       `rebase failed; if a conflict was reported, resolve it in ${repo} and run "git rebase --continue" (or "git rebase --abort" to give up). Re-run nomad push after resolution.`
     );
   }
+  assertNoAutostashConflict(repo, "nomad push");
 }
 var init_push_checks = __esm({
   "src/push-checks.ts"() {
     "use strict";
     init_push_gitleaks_config();
+    init_autostash_guard();
     init_commands_pull_wedge();
     init_exit_codes();
     init_utils();
@@ -1644,9 +1683,9 @@ function cpSyncGuarded(src, dst, filter, label) {
     throw err;
   }
 }
-function prunePreservingBy(src, dst, isPreserved) {
+function prunePreservingBy(src, dst, isPreserved, isRootPreserved) {
   for (const name of readdirSync(dst)) {
-    if (isPreserved(name)) continue;
+    if (isPreserved(name) || isRootPreserved?.(name) === true) continue;
     const dstPath = join2(dst, name);
     const srcStat = lstatSync(join2(src, name), { throwIfNoEntry: false });
     if (srcStat === void 0) {
@@ -1661,7 +1700,7 @@ function prunePreservingBy(src, dst, isPreserved) {
     }
   }
 }
-function copyExtrasFilteredPreservingBy(src, dst, isPreserved) {
+function copyExtrasFilteredPreservingBy(src, dst, isPreserved, isRootPreserved) {
   const dstStat = lstatSync(dst, { throwIfNoEntry: false });
   if (dstStat !== void 0) {
     if (dstStat.isDirectory()) {
@@ -1671,7 +1710,7 @@ function copyExtrasFilteredPreservingBy(src, dst, isPreserved) {
           `copyExtrasFilteredPreservingBy: type mismatch copying ${quoted(src)} -> ${quoted(dst)}: the repo entry is a file but the local entry is a directory; run nomad pull --force-remote to recover`
         );
       }
-      prunePreservingBy(src, dst, isPreserved);
+      prunePreservingBy(src, dst, isPreserved, isRootPreserved);
     } else {
       rmSync(dst, { recursive: true, force: true });
     }
@@ -5364,6 +5403,21 @@ import { dirname as dirname11, join as join42, sep as sep6 } from "node:path";
 init_config();
 import { existsSync as existsSync33, lstatSync as lstatSync12, mkdirSync as mkdirSync11, readdirSync as readdirSync14, rmSync as rmSync14 } from "node:fs";
 import { join as join41 } from "node:path";
+
+// src/skills-sync.tracked.ts
+init_utils();
+import { basename as basename3 } from "node:path";
+function trackedRootSkillsAt(ref, repo) {
+  try {
+    const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
+    const entries = raw.split("\0").filter((entry) => entry !== "");
+    return new Set(entries.map((entry) => basename3(entry)));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+
+// src/skills-sync.ts
 init_utils_fs();
 function isGsdOwned(name) {
   return name.startsWith(GSD_PREFIX);
@@ -5379,20 +5433,21 @@ function copySkillsPush(src, dst) {
   ]);
   copyExtrasFiltered(src, dst, blockSet);
 }
-function copySkillsPull(src, dst) {
-  copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded);
+function copySkillsPull(src, dst, isRootPreserved) {
+  copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded, isRootPreserved);
 }
-function syncSkillsPull(ts) {
+function syncSkillsPull(ts, prePostHeads) {
   const sharedSkills = join41(repoHome(), "shared", "skills");
   if (!existsSync33(sharedSkills)) return;
   const localSkills = join41(claudeHome(), "skills");
+  backupBeforeWrite(localSkills, ts);
   const dstStat = lstatSync12(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
-    backupBeforeWrite(localSkills, ts);
     rmSync14(localSkills, { recursive: true, force: true });
     mkdirSync11(localSkills, { recursive: true });
   }
-  copySkillsPull(sharedSkills, localSkills);
+  const tracked = prePostHeads === void 0 ? /* @__PURE__ */ new Set() : trackedRootSkillsAt(prePostHeads.pre, repoHome());
+  copySkillsPull(sharedSkills, localSkills, (name) => !tracked.has(name));
 }
 function syncSkillsPush() {
   const localSkills = join41(claudeHome(), "skills");
@@ -5726,6 +5781,9 @@ function allowThenRescan(append, scanVerdict, repoHome2) {
     throw err;
   }
 }
+function leakBlockedFatal(recovery) {
+  return new NomadFatal(recovery ?? "gitleaks detected secrets", { code: EXIT.LEAK_BLOCKED });
+}
 function makeRealPrompt() {
   return async (prompt) => {
     const rl = createInterface2({
@@ -5772,9 +5830,10 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
     );
   }
   if (!isTTYCheck()) {
-    throw new NomadFatal(current.recovery ?? "gitleaks detected secrets", {
-      code: EXIT.LEAK_BLOCKED
-    });
+    throw leakBlockedFatal(current.recovery);
+  }
+  if (current.leak && current.findings.length === 0) {
+    throw leakBlockedFatal(current.recovery);
   }
   const prompt = makePromptFn();
   printLegend();
@@ -5789,6 +5848,7 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
     gitOrFatal(["add", "-A"], "git add", repo);
     current = scanVerdict(repo);
   }
+  if (current.leak) throw leakBlockedFatal(current.recovery);
   return current;
 }
 
@@ -6379,8 +6439,9 @@ function unstageOne(rel, repo) {
 }
 
 // src/commands.pull.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync14 } from "node:fs";
-import { join as join52 } from "node:path";
+init_autostash_guard();
+import { existsSync as existsSync43, mkdirSync as mkdirSync14 } from "node:fs";
+import { join as join53 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -6817,8 +6878,8 @@ function divergenceCheckExtras(ts, prePostHeads) {
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync41 } from "node:fs";
-import { join as join51 } from "node:path";
+import { existsSync as existsSync42 } from "node:fs";
+import { join as join52 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -7091,6 +7152,26 @@ function diffLinesToUnified(oldStr, newStr) {
   return lines;
 }
 
+// src/preview.skills.ts
+init_config();
+import { existsSync as existsSync41, readdirSync as readdirSync17 } from "node:fs";
+import { join as join51 } from "node:path";
+function buildSkillsPreviewSection() {
+  const s = section("Skills");
+  const sharedSkills = join51(repoHome(), "shared", "skills");
+  if (!existsSync41(sharedSkills)) return s;
+  const sharedNames = readdirSync17(sharedSkills, { encoding: "utf8" }).filter((name) => !isSkillExcluded(name)).sort((a, b) => a.localeCompare(b, "en"));
+  for (const name of sharedNames) addItem(s, name);
+  const localSkills = join51(claudeHome(), "skills");
+  const localOnly = existsSync41(localSkills) ? readdirSync17(localSkills, { encoding: "utf8" }).filter(
+    (name) => !isSkillExcluded(name) && !sharedNames.includes(name)
+  ).length : 0;
+  if (localOnly > 0) {
+    addItem(s, `${localOnly} local-only present, not in repo (push to reconcile)`);
+  }
+  return s;
+}
+
 // src/preview.ts
 init_utils_json();
 var CANONICAL_ORDER_NOTE = "settings.json will be rewritten in canonical key order; no value changes";
@@ -7104,7 +7185,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync41(path)) return null;
+  if (!existsSync42(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -7118,12 +7199,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync41(hostPath)) {
+  if (hostOverrides === null && existsSync42(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = stripGsdHookEntries(deepMerge(base, hostOverrides ?? {}));
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync41(settingsPath)) {
+  if (current === null && existsSync42(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const strippedCurrent = stripGsdHookEntries(current ?? {});
@@ -7165,9 +7246,9 @@ function computePreview(ts, map, verb = "pull") {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join51(repo, "shared", "settings.base.json"),
-    join51(repo, "hosts", `${HOST}.json`),
-    join51(claude, "settings.json")
+    join52(repo, "shared", "settings.base.json"),
+    join52(repo, "hosts", `${HOST}.json`),
+    join52(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -7179,10 +7260,11 @@ function computePreview(ts, map, verb = "pull") {
   if (localOnly > 0) {
     addItem(sessions, `${localOnly} local-only present, not in repo (push to reconcile)`);
   }
+  const skills = buildSkillsPreviewSection();
   const extras = section("Extras");
   let extrasSkipped = 0;
   let extrasUnmapped = 0;
-  if (existsSync41(join51(repo, "path-map.json")) && existsSync41(join51(repo, "shared", "extras"))) {
+  if (existsSync42(join52(repo, "path-map.json")) && existsSync42(join52(repo, "shared", "extras"))) {
     const extrasResult = remapExtrasPull(ts, { dryRun: true });
     for (const entry of extrasResult.wouldPull) {
       addItem(extras, entry);
@@ -7195,7 +7277,7 @@ function computePreview(ts, map, verb = "pull") {
     summary,
     summaryRow(verb, remapResult.unmapped + extrasUnmapped, 0, extrasSkipped, localOnly)
   );
-  renderTree([links, settingsSection, sessions, extras, summary]);
+  renderTree([links, settingsSection, sessions, skills, extras, summary]);
   return { unmapped: remapResult.unmapped, collisions: 0, localOnly };
 }
 
@@ -7205,6 +7287,7 @@ init_commands_pull_wedge();
 // src/commands.pull.recovery.ts
 init_config();
 init_commands_pull_wedge();
+init_exit_codes();
 init_utils();
 init_utils_fs();
 import { execFileSync as execFileSync21 } from "node:child_process";
@@ -7257,8 +7340,8 @@ function parsePorcelainZ(raw) {
   }
   return { tracked, untracked };
 }
-function parseDirtyPaths(repo) {
-  return parsePorcelainZ(gitStatusPorcelainZ(repo));
+function parseDirtyPaths(repo, opts = {}) {
+  return parsePorcelainZ(gitStatusPorcelainZ(repo, opts));
 }
 function buildRecoverySummary(branchName, strandedLog, untracked) {
   const strandedLines = strandedLog.split("\n").filter(Boolean).map((l) => `  ${l}`).join("\n");
@@ -7285,18 +7368,24 @@ function freshStrandedBranch(repo) {
   return `${base}-${n}`;
 }
 function recoverUnmergedIndex(repo) {
+  const conflicted = new Set(
+    gitCapture(["diff", "--diff-filter=U", "--name-only", "-z"], repo).split("\0").filter(Boolean)
+  );
   gitOrFatal(["reset", "--mixed", "HEAD"], "git reset --mixed HEAD", repo);
-  const dirty = gitCapture(["diff", "--name-only", "-z"], repo).split("\0").filter(Boolean);
-  if (dirty.length > 0) {
-    log(
-      "index cleared, but these files still carry conflict content from the torn-down rebase; review and resolve before the next pull:\n" + dirty.map((p) => `  ${p}`).join("\n")
-    );
-  }
+  const { tracked, untracked } = parseDirtyPaths(repo, { untrackedAll: true });
+  const present = /* @__PURE__ */ new Set([...tracked, ...untracked]);
+  const residual = [...conflicted].filter((p) => present.has(p));
   if (orphanedAutostashPresent(repo)) {
     log(
       'orphaned autostash preserved in the stash list; run "git stash pop" to restore or "git stash drop" to discard it, then re-run "nomad pull"'
     );
   }
+  if (residual.length > 0) {
+    die(
+      "index cleared, but these files still carry unresolved conflict content from the torn-down rebase or merge:\n" + residual.map((p) => `  ${p}`).join("\n") + '\n\nThe repo is no longer wedged, so nothing else is blocked. Nothing was applied to ~/.claude/: pulling now would publish that content to your live config.\n\nResolve each file above (remove any <<<<<<< / ======= / >>>>>>> markers and keep the content you want; a file left untracked was deleted upstream, so keep or delete it deliberately), commit or checkout the result, then re-run "nomad pull".',
+      { code: EXIT.CONFLICT }
+    );
+  }
 }
 function recoverForceRemote(mode, repo) {
   if (mode === "merge") {
@@ -7350,7 +7439,7 @@ function capturePrePostHeads(repo, rebase) {
 function buildWetPullSections(ts, map, prePostHeads) {
   applySharedLinks(ts, map);
   const { label } = regenerateSettings(ts);
-  syncSkillsPull(ts);
+  syncSkillsPull(ts, prePostHeads);
   const remapResult = withSpinner("Syncing sessions", () => remapPull(ts));
   const extrasResult = remapExtrasPull(ts, { prePostHeads });
   const localOnly = scanLocalOnly();
@@ -7397,7 +7486,7 @@ function runPullCore(opts = {}) {
   const ts = freshBackupTs(backup);
   handleWedge(repo, forceRemote);
   if (!dryRun) {
-    const backupRoot = join52(backup, ts);
+    const backupRoot = join53(backup, ts);
     try {
       mkdirSync14(backupRoot, { recursive: true });
     } catch (err) {
@@ -7412,8 +7501,9 @@ function runPullCore(opts = {}) {
   const prePostHeads = capturePrePostHeads(repo, () => {
     gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
   });
-  const mapPath = join52(repo, "path-map.json");
-  const map = existsSync42(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  assertNoAutostashConflict(repo, "nomad pull");
+  const mapPath = join53(repo, "path-map.json");
+  const map = existsSync43(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
     computePreview(ts, map, "pull");
@@ -7439,8 +7529,8 @@ function runPullCore(opts = {}) {
 }
 function cmdPull(opts = {}) {
   const repo = repoHome();
-  if (!existsSync42(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync42(join52(repo, "shared", "settings.base.json"))) {
+  if (!existsSync43(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync43(join53(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -7462,13 +7552,13 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync46 } from "node:fs";
-import { join as join57 } from "node:path";
+import { existsSync as existsSync47 } from "node:fs";
+import { join as join58 } from "node:path";
 
 // src/commands.push.selection.ts
 init_config();
-import { existsSync as existsSync43, statSync as statSync10 } from "node:fs";
-import { join as join53 } from "node:path";
+import { existsSync as existsSync44, statSync as statSync10 } from "node:fs";
+import { join as join54 } from "node:path";
 init_utils_json();
 function buildCurrentMap(map) {
   const current = {};
@@ -7477,8 +7567,8 @@ function buildCurrentMap(map) {
   for (const [, hostMap] of Object.entries(map.projects)) {
     const localPath = hostMap[HOST];
     if (!localPath) continue;
-    const localDir = join53(claude, "projects", encodePath(localPath));
-    if (!existsSync43(localDir)) continue;
+    const localDir = join54(claude, "projects", encodePath(localPath));
+    if (!existsSync44(localDir)) continue;
     for (const f of enumerateSourceFiles(localDir)) {
       const st = statSync10(f);
       current[f] = { size: st.size, mtime: st.mtimeMs };
@@ -7509,7 +7599,7 @@ function computePushSelection(map, old, scannerVersion, configHash, fullScan) {
   };
 }
 function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan) {
-  const map = existsSync43(mapPath) ? readPathMap(mapPath) : null;
+  const map = existsSync44(mapPath) ? readPathMap(mapPath) : null;
   const { selection, newManifest } = computePushSelection(
     map,
     old,
@@ -7611,14 +7701,14 @@ function enforceAllowList(statusPorcelain, map) {
 
 // src/commands.push.settings.ts
 init_config();
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join54 } from "node:path";
+import { existsSync as existsSync45 } from "node:fs";
+import { join as join55 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function stripGsdHooksFromBase(repo, backup) {
-  const basePath = join54(repo, "shared", "settings.base.json");
-  if (!existsSync44(basePath)) return;
+  const basePath = join55(repo, "shared", "settings.base.json");
+  if (!existsSync45(basePath)) return;
   let base;
   try {
     base = readJson(basePath);
@@ -7632,14 +7722,14 @@ function stripGsdHooksFromBase(repo, backup) {
   writeJsonAtomic(basePath, stripped);
 }
 function reportSettingsAheadDrift(repo) {
-  const basePath = join54(repo, "shared", "settings.base.json");
-  if (!existsSync44(basePath)) return;
-  const settingsPath = join54(claudeHome(), "settings.json");
-  if (!existsSync44(settingsPath)) return;
+  const basePath = join55(repo, "shared", "settings.base.json");
+  if (!existsSync45(basePath)) return;
+  const settingsPath = join55(claudeHome(), "settings.json");
+  if (!existsSync45(settingsPath)) return;
   try {
     const base = readJson(basePath);
-    const hostPath = join54(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync44(hostPath) ? readJson(hostPath) : {};
+    const hostPath = join55(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync45(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
     const { ahead } = classifySettingsDrift(merged, settings);
@@ -7656,9 +7746,9 @@ function reportSettingsAheadDrift(repo) {
 // src/commands.push.guards.ts
 init_push_checks();
 init_utils();
-import { join as join55, relative as relative7 } from "node:path";
+import { join as join56, relative as relative7 } from "node:path";
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join55(repo, "shared"));
+  const gitlinks = findGitlinks(join56(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative7(repo, p).replaceAll("\\", "/");
@@ -7768,9 +7858,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync45, mkdirSync as mkdirSync15, readdirSync as readdirSync17, rmSync as rmSync17 } from "node:fs";
+import { copyFileSync, existsSync as existsSync46, mkdirSync as mkdirSync15, readdirSync as readdirSync18, rmSync as rmSync17 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join56, relative as relative8, sep as sep10 } from "node:path";
+import { join as join57, relative as relative8, sep as sep10 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -7782,7 +7872,7 @@ function stageSessionDir(localDir, dstDir, changed) {
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
-      copyFileAtomic(src, join56(dstDir, relative8(localDir, src)));
+      copyFileAtomic(src, join57(dstDir, relative8(localDir, src)));
     }
     return true;
   }
@@ -7798,14 +7888,14 @@ function stageSessions(tmpRoot, map, changed) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join56(claudeHome(), "projects");
-  if (!existsSync45(localProjects)) return 0;
+  const localProjects = join57(claudeHome(), "projects");
+  if (!existsSync46(localProjects)) return 0;
   let staged = 0;
-  for (const dir of readdirSync17(localProjects)) {
+  for (const dir of readdirSync18(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    const localDir = join56(localProjects, dir);
-    const dstDir = join56(tmpRoot, "shared", "projects", logical);
+    const localDir = join57(localProjects, dir);
+    const dstDir = join57(tmpRoot, "shared", "projects", logical);
     if (stageSessionDir(localDir, dstDir, changed)) staged++;
   }
   return staged;
@@ -7821,9 +7911,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname13 of dirnames) {
       if (!whitelist.includes(dirname13)) continue;
-      const src = join56(localRoot, dirname13);
-      if (!existsSync45(src)) continue;
-      const dst = join56(tmpRoot, "shared", "extras", logical, dirname13);
+      const src = join57(localRoot, dirname13);
+      if (!existsSync46(src)) continue;
+      const dst = join57(tmpRoot, "shared", "extras", logical, dirname13);
       copyExtras(src, dst);
       staged++;
     }
@@ -7831,19 +7921,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function previewPushLeaks(map, opts = {}) {
-  const cacheDir = join56(homedir7(), ".cache", "claude-nomad");
+  const cacheDir = join57(homedir7(), ".cache", "claude-nomad");
   mkdirSync15(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes4(4).toString("hex")}`;
-  const tmpRoot = join56(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join57(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map, opts.selection?.changed);
     const extrasCount = stageExtras(tmpRoot, map);
     if (sessionCount + extrasCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join56(repoHome(), ".gitleaksignore");
-    if (existsSync45(ignoreFile)) {
-      copyFileSync(ignoreFile, join56(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join57(repoHome(), ".gitleaksignore");
+    if (existsSync46(ignoreFile)) {
+      copyFileSync(ignoreFile, join57(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -7884,6 +7974,7 @@ async function commitAndPush(st, ts, map, resolution, repo, newManifest, render)
     if (!render) log("push (leak recovery)");
     renderPushTree(st, verdict);
     verdict = await resolveLeakFindings(verdict, ts, map, resolution);
+    if (verdict.leak) throw leakBlockedFatal(verdict.recovery);
   }
   gitOrFatal(["commit", "-m", `chore: sync from ${HOST}`], "git commit", repo);
   withSpinner("Pushing", () => gitOrFatal(["push"], "git push", repo));
@@ -7969,7 +8060,7 @@ async function runPushCore(opts = {}) {
   const scannerVersion = probeGitleaks();
   const configHash = computeConfigHash();
   const old = readManifest(manifestPath());
-  const mapPath = join57(repo, "path-map.json");
+  const mapPath = join58(repo, "path-map.json");
   const { map, selection, newManifest } = loadSelectionForPush(
     mapPath,
     old,
@@ -8020,7 +8111,7 @@ async function cmdPush(opts = {}) {
   const allowRule = opts.allowRule;
   guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule);
   const repo = repoHome();
-  if (!existsSync46(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync47(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -8038,8 +8129,8 @@ async function cmdPush(opts = {}) {
 }
 
 // src/commands.sync.ts
-import { existsSync as existsSync47 } from "node:fs";
-import { join as join58 } from "node:path";
+import { existsSync as existsSync48 } from "node:fs";
+import { join as join59 } from "node:path";
 init_config();
 init_color();
 init_utils();
@@ -8167,8 +8258,8 @@ async function runSyncWet(verbose) {
 }
 async function runSyncDryRun(repo, backup) {
   const ts = freshBackupTs(backup);
-  const mapPath = join58(repo, "path-map.json");
-  const map = existsSync47(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join59(repo, "path-map.json");
+  const map = existsSync48(mapPath) ? readPathMap(mapPath) : { projects: {} };
   computePreview(ts, map, "pull");
   log("push preview below is computed against pre-pull state (a real sync pushes after pull)");
   await runPushCore({ dryRun: true });
@@ -8178,8 +8269,8 @@ async function cmdSync(opts = {}) {
   const verbose = opts.verbose === true;
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync47(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync47(join58(repo, "shared", "settings.base.json"))) {
+  if (!existsSync48(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync48(join59(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("sync");
@@ -8252,8 +8343,8 @@ init_config();
 
 // src/crash-report.write.ts
 init_config();
-import { mkdirSync as mkdirSync16, readdirSync as readdirSync18, statSync as statSync11, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join60 } from "node:path";
+import { mkdirSync as mkdirSync16, readdirSync as readdirSync19, statSync as statSync11, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join61 } from "node:path";
 
 // src/crash-report.ts
 var CRASH_MAX_STACK_LINES = 50;
@@ -8332,15 +8423,15 @@ function buildCrashReport(input) {
 // src/crash-report.redact.ts
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync18, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join59 } from "node:path";
+import { join as join60 } from "node:path";
 init_push_gitleaks_scan();
 var CRASH_SCAN_TIMEOUT_MS = 3e3;
 var SCAN_UNAVAILABLE_ADVISORY = "\n\n[gitleaks value-based scan unavailable; only structural redaction applied. Review before sharing this file publicly.]\n";
 function redactWithGitleaks(text, scan = scanFile) {
   let dir;
   try {
-    dir = mkdtempSync2(join59(tmpdir2(), "nomad-crash-scan-"));
-    const tmp = join59(dir, "crash.txt");
+    dir = mkdtempSync2(join60(tmpdir2(), "nomad-crash-scan-"));
+    const tmp = join60(dir, "crash.txt");
     writeFileSync10(tmp, text, { mode: 384 });
     const findings = scan(tmp, false, CRASH_SCAN_TIMEOUT_MS);
     if (findings === null) return text + SCAN_UNAVAILABLE_ADVISORY;
@@ -8363,9 +8454,9 @@ init_utils();
 var CRASH_RETENTION_KEEP = 20;
 function listCrashFiles(dir = crashDir()) {
   try {
-    return readdirSync18(dir).flatMap((name) => {
+    return readdirSync19(dir).flatMap((name) => {
       try {
-        return [{ name, mtimeMs: statSync11(join60(dir, name)).mtimeMs }];
+        return [{ name, mtimeMs: statSync11(join61(dir, name)).mtimeMs }];
       } catch {
         return [];
       }
@@ -8379,14 +8470,14 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
   const targets = prunableByCount(files, keep);
   for (const name of targets) {
     try {
-      unlinkSync2(join60(dir, name));
+      unlinkSync2(join61(dir, name));
     } catch {
     }
   }
 }
 function writeCrashReport(text, dir = crashDir()) {
   mkdirSync16(dir, { recursive: true, mode: 448 });
-  const path = join60(dir, `crash-${nowTimestamp()}-${process.pid}.txt`);
+  const path = join61(dir, `crash-${nowTimestamp()}-${process.pid}.txt`);
   writeFileSync11(path, text, { mode: 384 });
   pruneCrashDir(dir);
   return path;
@@ -8417,18 +8508,18 @@ function handleCrash(err, argv, opts) {
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync48 } from "node:fs";
-import { join as join61 } from "node:path";
+import { existsSync as existsSync49 } from "node:fs";
+import { join as join62 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync48(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync49(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join61(repo, "path-map.json");
-    const map = existsSync48(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join62(repo, "path-map.json");
+    const map = existsSync49(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     computePreview(ts, map, "diff");
   } catch (err) {
@@ -8443,8 +8534,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync50, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join63 } from "node:path";
+import { existsSync as existsSync51, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join64 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -8526,33 +8617,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync49, rmSync as rmSync19, statSync as statSync12 } from "node:fs";
-import { join as join62 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync50, rmSync as rmSync19, statSync as statSync12 } from "node:fs";
+import { join as join63 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join62(claude, name);
-    if (!existsSync49(src)) continue;
-    const dst = join62(repo, "shared", name);
+    const src = join63(claude, name);
+    if (!existsSync50(src)) continue;
+    const dst = join63(repo, "shared", name);
     if (statSync12(src).isDirectory()) {
-      const gk = join62(dst, ".gitkeep");
-      if (existsSync49(gk)) rmSync19(gk);
+      const gk = join63(dst, ".gitkeep");
+      if (existsSync50(gk)) rmSync19(gk);
       cpSync10(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join62(claude, "settings.json");
-  if (existsSync49(userSettings)) {
+  const userSettings = join63(claude, "settings.json");
+  if (existsSync50(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join62(repo, "hosts", `${HOST}.json`);
+    const hostFile = join63(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -8566,14 +8657,14 @@ var GITATTRIBUTES = "# nomad: sync content is byte-managed, disable all line-end
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join63(repoHome2, "shared", "settings.base.json"),
-    join63(repoHome2, "shared", "CLAUDE.md"),
-    join63(repoHome2, "path-map.json"),
-    join63(repoHome2, "hosts"),
-    join63(repoHome2, "shared")
+    join64(repoHome2, "shared", "settings.base.json"),
+    join64(repoHome2, "shared", "CLAUDE.md"),
+    join64(repoHome2, "path-map.json"),
+    join64(repoHome2, "hosts"),
+    join64(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync50(c)) return c;
+    if (existsSync51(c)) return c;
   }
   return null;
 }
@@ -8591,27 +8682,27 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync17(join63(repo, "shared"), { recursive: true });
-  mkdirSync17(join63(repo, "hosts"), { recursive: true });
+  mkdirSync17(join64(repo, "shared"), { recursive: true });
+  mkdirSync17(join64(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync17(join63(repo, "shared", name), { recursive: true });
+    mkdirSync17(join64(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join63(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync50(userClaudeMd)) {
-    writeFileSync12(join63(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join64(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync51(userClaudeMd)) {
+    writeFileSync12(join64(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync12(join63(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync12(join64(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync12(join63(repo, "hosts", ".gitkeep"), "");
+  writeFileSync12(join64(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join63(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join64(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join63(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join64(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
-  writeFileSync12(join63(repo, ".gitattributes"), GITATTRIBUTES);
+  writeFileSync12(join64(repo, ".gitattributes"), GITATTRIBUTES);
   item("created .gitattributes");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -8677,21 +8768,21 @@ function maybeDisableRepoActions(repoHome2, run) {
 // src/init.prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync51, readdirSync as readdirSync19, statSync as statSync13 } from "node:fs";
-import { join as join64 } from "node:path";
+import { existsSync as existsSync52, readdirSync as readdirSync20, statSync as statSync13 } from "node:fs";
+import { join as join65 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync51(path)) return false;
+  if (!existsSync52(path)) return false;
   try {
-    if (statSync13(path).isDirectory()) return readdirSync19(path).length > 0;
+    if (statSync13(path).isDirectory()) return readdirSync20(path).length > 0;
     return true;
   } catch {
     return false;
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync51(join64(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join64(claudeHome2, name)));
+  if (existsSync52(join65(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join65(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -8998,7 +9089,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.62.1",
+  version: "0.62.3",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -9239,15 +9330,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync52, readFileSync as readFileSync20, readdirSync as readdirSync20 } from "node:fs";
-import { join as join65 } from "node:path";
+import { existsSync as existsSync53, readFileSync as readFileSync20, readdirSync as readdirSync21 } from "node:fs";
+import { join as join66 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join65(claudeHome(), "projects");
-  if (!existsSync52(projectsRoot)) {
+  const projectsRoot = join66(claudeHome(), "projects");
+  if (!existsSync53(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -9261,8 +9352,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join65(repoHome(), "path-map.json");
-  if (!existsSync52(mapPath)) {
+  const mapPath = join66(repoHome(), "path-map.json");
+  if (!existsSync53(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -9284,9 +9375,9 @@ function resumeCmd(sessionId) {
   console.log(`cd ${shQuote(hit.localPath)} && claude --resume ${shQuote(sessionId)}`);
 }
 function findTranscriptPath(projectsRoot, sessionId) {
-  for (const dir of readdirSync20(projectsRoot)) {
-    const candidate = join65(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync52(candidate)) return candidate;
+  for (const dir of readdirSync21(projectsRoot)) {
+    const candidate = join66(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync53(candidate)) return candidate;
   }
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.62.1",
+  "version": "0.62.3",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [