claude-nomad 0.62.3 → 0.62.5

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [0.62.5](https://github.com/funkadelic/claude-nomad/compare/v0.62.4...v0.62.5) (2026-07-24)
+
+
+### Fixed
+
+* close secret-scan parity and safety gaps ([#460](https://github.com/funkadelic/claude-nomad/issues/460)) ([02b8b3b](https://github.com/funkadelic/claude-nomad/commit/02b8b3bc91a4bf2a3cbbd483836ddede7c8bcc7e))
+* close skill/memory redaction and dry-run scan parity gaps ([#462](https://github.com/funkadelic/claude-nomad/issues/462)) ([ae281de](https://github.com/funkadelic/claude-nomad/commit/ae281def35618bde81adecd9ab39f2ed16f19b42))
+* harden crash-report redactor against best-effort-scan gaps ([#463](https://github.com/funkadelic/claude-nomad/issues/463)) ([703c538](https://github.com/funkadelic/claude-nomad/commit/703c538a6b9c64e941ec70f4281d83c3f5d65ab2))
+* **pull:** fail closed when the autostash guard cannot probe the index ([#461](https://github.com/funkadelic/claude-nomad/issues/461)) ([224e10d](https://github.com/funkadelic/claude-nomad/commit/224e10d1e688d47f6ae105fc3ceeb83782445b40))
+* **push:** reconcile dry-run leak exit code and recovery-menu UX ([#464](https://github.com/funkadelic/claude-nomad/issues/464)) ([a9fcf8b](https://github.com/funkadelic/claude-nomad/commit/a9fcf8badbcf7358a9fe2a3be32449243ad048f3))
+* **update:** report a no-op when already on the latest version ([#465](https://github.com/funkadelic/claude-nomad/issues/465)) ([6066124](https://github.com/funkadelic/claude-nomad/commit/60661244f875699dc75a5bb5357979336032b1b0))
+
+
+### Changed
+
+* add staged gate runner and local dev-loop caches ([#458](https://github.com/funkadelic/claude-nomad/issues/458)) ([81da5e7](https://github.com/funkadelic/claude-nomad/commit/81da5e7db0db90e7b66d053383daf8d033a5869d))
+
+## [0.62.4](https://github.com/funkadelic/claude-nomad/compare/v0.62.3...v0.62.4) (2026-07-21)
+
+
+### Fixed
+
+* **sync:** compute the dry-run pull preview after the fetch ([#451](https://github.com/funkadelic/claude-nomad/issues/451)) ([8118625](https://github.com/funkadelic/claude-nomad/commit/81186258896081a7b2a2585f40eed67bd3e5c6b6))
+
+
+### Changed
+
+* **pull:** split commands.pull.recovery.ts on the force-remote seam ([#456](https://github.com/funkadelic/claude-nomad/issues/456)) ([1c1875b](https://github.com/funkadelic/claude-nomad/commit/1c1875b40e67512329e9a2d1215afa7667c29d1c))
+* **push:** split redact-all batch from recovery actions ([#457](https://github.com/funkadelic/claude-nomad/issues/457)) ([b104472](https://github.com/funkadelic/claude-nomad/commit/b104472b87d3f847546ee938900bcaa4ea1abdd8))
+
+
+### Testing
+
+* precompile the CLI once per vitest run ([#453](https://github.com/funkadelic/claude-nomad/issues/453)) ([e0b043b](https://github.com/funkadelic/claude-nomad/commit/e0b043b851ae9bd89da026199f70d723e213aed9))
+* **pull:** reset process.exitCode in beforeEach as well as afterEach ([#450](https://github.com/funkadelic/claude-nomad/issues/450)) ([78943e7](https://github.com/funkadelic/claude-nomad/commit/78943e72a41d4a542a4d6528d995ae9f8a8452cc))
+
 ## [0.62.3](https://github.com/funkadelic/claude-nomad/compare/v0.62.2...v0.62.3) (2026-07-21)
 
 

package/README.md

@@ -331,13 +331,16 @@ What this means for you:
   is ever uploaded anywhere. The file just sits there until you decide to share it or delete it.
 - **The saved report is scrubbed twice.** First a structural pass rewrites your home directory to
   `~` and your hostname to a placeholder (absolute paths are personal information a secret scanner
-  would not catch). Then a best-effort secret scan runs the same gitleaks-based redaction nomad
-  already uses for session transcripts. The secret scan works on a temporary, owner-only (`0o600`)
-  copy that already has the structural scrub applied; that scratch file is deleted immediately after
-  the scan, and only the fully-redacted report is kept.
-- **It degrades safely without gitleaks.** If gitleaks is not installed, the structural scrub still
-  runs and the report is still written, with a one-line note that the secret scan did not run, so
-  give it a glance before posting it publicly.
+  would not catch), and redacts credential-shaped tokens it recognizes (GitHub, GitLab, Slack, and
+  AWS keys, plus any credentials embedded in a URL); this pass needs no external tools. Then a
+  best-effort secret scan runs the same gitleaks-based redaction nomad already uses for session
+  transcripts. The secret scan works on a temporary, owner-only (`0o600`) copy that already has the
+  structural scrub applied; that scratch file is deleted immediately after the scan, and only the
+  fully-redacted report is kept.
+- **It degrades safely without gitleaks.** If gitleaks is not installed, the structural scrub and
+  the credential-shape backstop still run and the report is still written, with a one-line note that
+  the deeper secret scan did not run. The backstop catches common token shapes but not everything,
+  so still give the report a glance before posting it publicly.
 - **It is small and bounded.** The report contains only the nomad version, the command you ran
   (bounded, and including any flag values you typed), the error name and message, a trimmed stack,
   your platform, the Node.js version, and a timestamp. It never includes an environment dump or the