claude-nomad 0.62.6 → 0.63.0

package/dist/nomad.mjs

@@ -1082,12 +1082,40 @@ import { execFileSync as execFileSync8 } from "node:child_process";
 import { mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join23 } from "node:path";
+function toFinding(entry) {
+  if (typeof entry !== "object" || entry === null) return null;
+  const e = entry;
+  const str = (v) => typeof v === "string" ? v : "";
+  const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+  const file = str(e.File);
+  const rule = str(e.RuleID);
+  if (file === "" || rule === "") return null;
+  return {
+    RuleID: rule,
+    File: file,
+    StartLine: num(e.StartLine),
+    EndLine: Number.isFinite(e.EndLine) ? e.EndLine : void 0,
+    StartColumn: num(e.StartColumn),
+    EndColumn: num(e.EndColumn),
+    Match: str(e.Match),
+    Fingerprint: str(e.Fingerprint),
+    Description: typeof e.Description === "string" ? e.Description : void 0,
+    Secret: typeof e.Secret === "string" ? e.Secret : void 0,
+    Entropy: Number.isFinite(e.Entropy) ? e.Entropy : void 0
+  };
+}
 function readGitleaksReport(reportPath) {
   try {
     const raw = readFileSync6(reportPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return null;
-    return parsed;
+    const findings = [];
+    for (const entry of parsed) {
+      const finding = toFinding(entry);
+      if (finding === null) return null;
+      findings.push(finding);
+    }
+    return findings;
   } catch {
     return null;
   }
@@ -1796,6 +1824,10 @@ function* eachExtrasTarget(v, counts) {
   }
 }
 function copyExtrasOverlayFiltered(src, dst, blockSet) {
+  const dstStat = lstatSync2(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0 && !dstStat.isDirectory()) {
+    rmSync2(dst, { recursive: true, force: true });
+  }
   stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
   cpSyncGuarded(
     src,
@@ -1961,16 +1993,32 @@ function applySharedLinks(ts, map, opts = {}) {
   }
 }
 function syncSharedLinksPush(map) {
+  mirrorSharedNames(map, { adoptNew: true, overlay: false });
+}
+function stageLocalSharedEdits(map, ts) {
+  mirrorSharedNames(map, { adoptNew: false, overlay: true, backupTs: ts });
+}
+function mirrorOneSharedName(name, claude, repo, policy) {
+  const localPath = join5(claude, name);
+  const stat = lstatSync4(localPath, { throwIfNoEntry: false });
+  if (stat === void 0) return;
+  if (stat.isSymbolicLink()) return;
+  const target = join5(repo, "shared", name);
+  if (!policy.adoptNew && !existsSync4(target)) return;
+  if (policy.backupTs !== void 0) backupRepoWrite(target, policy.backupTs, repo);
+  if (policy.overlay && stat.isDirectory()) {
+    copyExtrasOverlayFiltered(localPath, target, ALWAYS_NEVER_SYNC);
+  } else {
+    copyExtrasFiltered(localPath, target, ALWAYS_NEVER_SYNC);
+  }
+}
+function mirrorSharedNames(map, policy) {
   if (process.platform !== "win32") return;
   if (map === null) return;
   const claude = claudeHome();
   const repo = repoHome();
   for (const name of allSharedLinks(map)) {
-    const localPath = join5(claude, name);
-    const stat = lstatSync4(localPath, { throwIfNoEntry: false });
-    if (stat === void 0) continue;
-    if (stat.isSymbolicLink()) continue;
-    copyExtrasFiltered(localPath, join5(repo, "shared", name), ALWAYS_NEVER_SYNC);
+    mirrorOneSharedName(name, claude, repo, policy);
   }
 }
 function readExistingSettings(settingsPath) {
@@ -4883,8 +4931,10 @@ function reportLongPathsCheck(section2, run = execFileSync12) {
     "enable LongPathsEnabled in Local Group Policy or the registry (admin required)"
   );
 }
+var MODALITY_COPY_SYNC = "copy-sync (native Windows; local edits reach the repo on the next pull or push)";
+var MODALITY_SYMLINK = "symlink (posix)";
 function reportSyncModality(section2) {
-  const modality = process.platform === "win32" ? "copy-sync (win32)" : "symlink (posix)";
+  const modality = process.platform === "win32" ? MODALITY_COPY_SYNC : MODALITY_SYMLINK;
   addItem(section2, `${dim(infoGlyph)} sync modality: ${modality}`);
 }
 
@@ -4955,248 +5005,19 @@ init_config();
 import { readFileSync as readFileSync17 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep8 } from "node:path";
 
-// src/commands.push.recovery.redact.ts
-init_config();
-init_config_sharedDirs_guard();
-import { cpSync as cpSync8, existsSync as existsSync31, mkdirSync as mkdirSync10 } from "node:fs";
-import { dirname as dirname11, join as join39, sep as sep6 } from "node:path";
-
-// src/commands.redact.ts
-init_config();
-import { existsSync as existsSync30 } from "node:fs";
-import { dirname as dirname9, join as join37 } from "node:path";
-
-// src/commands.redact.subtree.ts
-import { existsSync as existsSync29, lstatSync as lstatSync11, readFileSync as readFileSync14, readdirSync as readdirSync13, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join36 } from "node:path";
-init_utils_fs();
-init_utils();
-function collectFiles(dir, out) {
-  if (!existsSync29(dir)) return;
-  const st = lstatSync11(dir);
-  if (!st.isDirectory()) return;
-  for (const entry of readdirSync13(dir)) {
-    const abs = join36(dir, entry);
-    const lst = lstatSync11(abs);
-    if (lst.isSymbolicLink()) continue;
-    if (lst.isDirectory()) {
-      collectFiles(abs, out);
-      continue;
-    }
-    if (lst.isFile()) out.push(abs);
-  }
-}
-function listSubtreeFiles(sessionDir) {
-  const out = [];
-  collectFiles(sessionDir, out);
-  return out.sort((a, b) => a.localeCompare(b));
-}
-function newestSubtreeMtimeMs(mainPath, subtreeFiles, statMtime = (p) => statSync6(p).mtimeMs) {
-  let newest = statMtime(mainPath);
-  for (const filePath of subtreeFiles) {
-    const t = statMtime(filePath);
-    if (t > newest) newest = t;
-  }
-  return newest;
-}
-function isSubtreeActive(mainPath, subtreeFiles, now) {
-  const subtreeMtime = newestSubtreeMtimeMs(mainPath, subtreeFiles, (p) => statSync6(p).mtimeMs);
-  return isRecentlyModified(subtreeMtime, now);
-}
-function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts, scan, dryRun) {
-  const dirty = [];
-  if (mainFindings.length > 0) dirty.push({ path: mainPath, findings: mainFindings });
-  for (const filePath of subtreeFiles) {
-    const raw = scan(filePath);
-    if (raw === null || raw.length === 0) continue;
-    const filtered = rule === void 0 ? raw : raw.filter((f) => f.RuleID === rule);
-    if (filtered.length === 0) continue;
-    dirty.push({ path: filePath, findings: filtered });
-  }
-  const total = dirty.reduce((n, e) => n + e.findings.length, 0);
-  if (!dryRun && total > 0) {
-    for (const { path: filePath, findings } of dirty) {
-      backupBeforeWrite(filePath, ts);
-      const before = readFileSync14(filePath, "utf8");
-      const after = applyRedactions(before, findings);
-      if (after === before) {
-        log(
-          `warning: no redaction applied to ${filePath}: finding match values were not located in the file. Inspect it manually; the push re-scan still blocks a real leak.`
-        );
-      }
-      writeFileSync6(filePath, after, "utf8");
-    }
-  }
-  return { total, dirty };
-}
-
-// src/commands.pushed-history.ts
-init_utils();
-import { execFileSync as execFileSync14 } from "node:child_process";
-function pushedRef(repo) {
-  try {
-    const ref = execFileSync14("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
-      cwd: repo,
-      stdio: ["ignore", "pipe", "ignore"]
-    }).toString().trim();
-    return ref.length > 0 ? ref : null;
-  } catch {
-    return null;
-  }
-}
-function sessionInPushedHistory(id, repo) {
-  const ref = pushedRef(repo);
-  if (ref === null) return false;
-  try {
-    const out = execFileSync14(
-      "git",
-      [
-        "log",
-        ref,
-        "--oneline",
-        "-1",
-        "--",
-        `shared/projects/*/${id}.jsonl`,
-        `shared/projects/*/${id}/*`
-      ],
-      { cwd: repo, stdio: ["ignore", "pipe", "ignore"] }
-    ).toString().trim();
-    return out.length > 0;
-  } catch {
-    return false;
-  }
-}
-function warnIfSessionPushed(id, repo) {
-  if (!sessionInPushedHistory(id, repo)) return;
-  log(
-    `warning: session ${id} is already in pushed history (origin).
-  This command only changes your local copy and the next push; it does NOT
-  remove the secret from commits already on the remote.
-  To fully remediate a real secret: rotate the credential, then rewrite
-  history (e.g. with git filter-repo) and force-push, coordinating with
-  anyone else who has cloned the repo.`
-  );
-}
-
-// src/commands.redact.ts
-init_push_gitleaks_scan();
-init_exit_codes();
-init_utils_fs();
-init_utils_json();
-init_utils();
-function resolveLiveTranscript(id) {
-  try {
-    const mapPath = join37(repoHome(), "path-map.json");
-    if (!existsSync30(mapPath)) return null;
-    const projects = readJson(mapPath).projects;
-    const claude = claudeHome();
-    for (const hostMap of Object.values(projects)) {
-      const abs = hostMap[HOST];
-      if (abs === void 0) continue;
-      const live = join37(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync30(live)) return live;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function resolveRedactFindings(localPath, rawFindings, rule, scan) {
-  const source = rawFindings ?? scan(localPath);
-  if (source === null) return null;
-  return source.filter((f) => rule === void 0 || f.RuleID === rule);
-}
-function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
-  const { id, rule, dryRun = false, findings: rawFindings } = opts;
-  if (id.length === 0 || id.length > 128 || !/^[A-Za-z0-9_-]+$/.test(id)) {
-    fail(`invalid session id: ${id}`);
-    process.exit(EXIT.USAGE);
-  }
-  const repo = repoHome();
-  const backup = backupBase();
-  if (!existsSync30(repo)) die(`repo not cloned at ${repo}`);
-  const handle = acquireLock("redact");
-  if (handle === null) process.exit(0);
-  try {
-    const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync30(localPath)) {
-      fail(`could not resolve local transcript for session ${id} on this host`);
-      process.exitCode = 1;
-      return;
-    }
-    const sessionDir = join37(dirname9(localPath), id);
-    const subtreeFiles = listSubtreeFiles(sessionDir);
-    if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
-      log(
-        `session ${id} was modified recently and may be active.
-  Refusing to rewrite a potentially live transcript.
-  To proceed: wait for the session to end, then re-run nomad redact.
-  Or drop from the staged tree: nomad drop-session ${id}
-  Or skip this finding during nomad push.`
-      );
-      return;
-    }
-    const mainFindings = resolveRedactFindings(localPath, rawFindings, rule, scan);
-    if (mainFindings === null) {
-      fail(`gitleaks scan failed for session ${id} (is gitleaks installed?)`);
-      process.exitCode = 1;
-      return;
-    }
-    const ts = freshBackupTs(backup);
-    const { total: totalCount, dirty } = applySubtreeRedactions(
-      localPath,
-      mainFindings,
-      subtreeFiles,
-      rule,
-      ts,
-      scan,
-      dryRun
-    );
-    if (totalCount === 0) {
-      const ruleClause = rule === void 0 ? "" : ` for rule ${rule}`;
-      log(`no findings${ruleClause} in session ${id}`);
-      return;
-    }
-    if (dryRun) {
-      const lines = dirty.flatMap((e) => e.findings.map((f) => `  ${e.path}  line ${f.StartLine} [${f.RuleID}]`)).join("\n");
-      log(`dry-run: would redact ${totalCount} finding(s) in session ${id}
-${lines}`);
-      return;
-    }
-    log(`redacted ${totalCount} finding(s) in ${localPath} (backup: ${ts})`);
-    warnIfSessionPushed(id, repo);
-  } catch (err) {
-    if (!(err instanceof NomadFatal)) {
-      throw err;
-    }
-    fail(err.message);
-    process.exitCode = 1;
-  } finally {
-    releaseLock(handle);
-  }
-}
-
-// src/commands.push.recovery.redact.ts
-init_push_gitleaks_scan();
-init_utils_json();
-init_utils();
-
-// src/commands.push.recovery.seams.ts
-init_push_gitleaks();
-
 // src/commands.push.recovery.memory.ts
 init_config();
 init_config_sharedDirs_guard();
 import {
   cpSync as cpSync7,
-  lstatSync as lstatSync12,
+  lstatSync as lstatSync11,
   mkdirSync as mkdirSync9,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync14,
   realpathSync as realpathSync4,
-  statSync as statSync7,
-  writeFileSync as writeFileSync7
+  statSync as statSync6,
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname10, join as join38, sep as sep5 } from "node:path";
+import { dirname as dirname9, join as join36, sep as sep5 } from "node:path";
 init_push_gitleaks_scan();
 
 // src/rel-path-guard.ts
@@ -5225,15 +5046,15 @@ function resolveMemoryLocalPath(logical, relPath, map) {
   if (!isSafeRelPath(relPath)) return null;
   const abs = map.projects[logical]?.[HOST];
   if (abs === void 0) return null;
-  const memoryRoot = join38(claudeHome(), "projects", encodePath(abs), "memory");
-  const localPath = join38(memoryRoot, ...relPath.split("/"));
+  const memoryRoot = join36(claudeHome(), "projects", encodePath(abs), "memory");
+  const localPath = join36(memoryRoot, ...relPath.split("/"));
   if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep5)) return null;
   try {
-    if (lstatSync12(localPath).isSymbolicLink()) return null;
+    if (lstatSync11(localPath).isSymbolicLink()) return null;
     const realLocal = realpathSync4(localPath);
     const realRoot = realpathSync4(memoryRoot);
     if (!realLocal.startsWith(realRoot + sep5)) return null;
-    if (!statSync7(realLocal).isFile()) return null;
+    if (!statSync6(realLocal).isFile()) return null;
   } catch {
     return null;
   }
@@ -5272,30 +5093,181 @@ function applyMemoryRedact(f, ts, map, scan = scanFile) {
     return refuse(`nothing to redact in ${logical}/memory/${relPath}; choose Skip.`);
   }
   backupBeforeWrite(localPath, ts);
-  const before = readFileSync15(localPath, "utf8");
+  const before = readFileSync14(localPath, "utf8");
   const after = applyRedactions(before, findings);
   if (after === before) {
     warn(
       `no redaction applied to ${logical}/memory/${relPath}: finding match values were not located in the file. Inspect it manually; the push re-scan still blocks a real leak.`
     );
   }
-  writeFileSync7(localPath, after, "utf8");
-  const dest = join38(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
-  mkdirSync9(dirname10(dest), { recursive: true });
+  writeFileSync6(localPath, after, "utf8");
+  const dest = join36(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
+  mkdirSync9(dirname9(dest), { recursive: true });
   cpSync7(localPath, dest, { force: true });
   return true;
 }
 
-// src/commands.push.recovery.seams.ts
-var MASK_LEAD = 4;
-var MASK_BODY = "************";
-var CONTEXT_WINDOW = 40;
-var CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
-function findingKey(f) {
-  return `${f.File}:${f.StartLine}:${f.StartColumn}:${f.RuleID}`;
+// src/commands.push.recovery.skills.ts
+init_config();
+import {
+  cpSync as cpSync8,
+  lstatSync as lstatSync13,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync15,
+  realpathSync as realpathSync5,
+  statSync as statSync7,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import { dirname as dirname10, join as join38, sep as sep6 } from "node:path";
+
+// src/skills-sync.ts
+init_config();
+import { existsSync as existsSync29, lstatSync as lstatSync12, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
+import { join as join37 } from "node:path";
+
+// src/skills-sync.tracked.ts
+init_utils();
+import { basename as basename3 } from "node:path";
+function trackedRootSkillsAt(ref, repo) {
+  try {
+    const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
+    const entries = raw.split("\0").filter((entry) => entry !== "");
+    return new Set(entries.map((entry) => basename3(entry)));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
 }
-var VALID_SID = /^[A-Za-z0-9_-]+$/;
-var SUBTREE_PATH = /^shared\/projects\/[^/]+\/([^/]+)\/.+$/;
+
+// src/skills-sync.ts
+init_utils_fs();
+function isGsdOwned(name) {
+  return name.startsWith(GSD_PREFIX);
+}
+function isSkillExcluded(name) {
+  return isGsdOwned(name) || isDeniedName(ALWAYS_NEVER_SYNC, name);
+}
+function copySkillsPush(src, dst) {
+  const srcNames = readdirSync13(src, { encoding: "utf8" });
+  const blockSet = /* @__PURE__ */ new Set([
+    ...srcNames.filter((n) => isGsdOwned(n)),
+    ...ALWAYS_NEVER_SYNC
+  ]);
+  copyExtrasFiltered(src, dst, blockSet);
+}
+function copySkillsPull(src, dst, isRootPreserved) {
+  copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded, isRootPreserved);
+}
+function syncSkillsPull(ts, prePostHeads) {
+  const sharedSkills = join37(repoHome(), "shared", "skills");
+  if (!existsSync29(sharedSkills)) return;
+  const localSkills = join37(claudeHome(), "skills");
+  backupBeforeWrite(localSkills, ts);
+  const dstStat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  if (dstStat?.isSymbolicLink() === true) {
+    rmSync13(localSkills, { recursive: true, force: true });
+    mkdirSync10(localSkills, { recursive: true });
+  }
+  const tracked = prePostHeads === void 0 ? /* @__PURE__ */ new Set() : trackedRootSkillsAt(prePostHeads.pre, repoHome());
+  copySkillsPull(sharedSkills, localSkills, (name) => !tracked.has(name));
+}
+function syncSkillsPush() {
+  const localSkills = join37(claudeHome(), "skills");
+  const stat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  if (stat === void 0) return;
+  if (stat.isSymbolicLink()) return;
+  const sharedSkills = join37(repoHome(), "shared", "skills");
+  copySkillsPush(localSkills, sharedSkills);
+}
+
+// src/commands.push.recovery.skills.ts
+init_push_gitleaks_scan();
+init_utils_fs();
+init_utils();
+var SKILL_FINDING_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
+var SAFE_SKILL_NAME = /^[A-Za-z0-9._-]+$/;
+var SKILL_DIR_PATH = /^shared\/skills\/[^/]+\//;
+function skillFileFromFinding(f) {
+  const m = SKILL_FINDING_PATH.exec(f.File);
+  if (m?.[1] === void 0 || m[2] === void 0) return null;
+  return { name: m[1], relPath: m[2] };
+}
+function isSkillFindingPath(f) {
+  return SKILL_DIR_PATH.test(f.File);
+}
+function resolveSkillLocalPath(name, relPath) {
+  if (!SAFE_SKILL_NAME.test(name) || name === "." || name === "..") return null;
+  if (isGsdOwned(name)) return null;
+  if (!isSafeRelPath(relPath)) return null;
+  const skillsRoot = join38(claudeHome(), "skills");
+  const skillRoot = join38(skillsRoot, name);
+  const localPath = join38(skillRoot, ...relPath.split("/"));
+  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep6)) return null;
+  try {
+    if (lstatSync13(localPath).isSymbolicLink()) return null;
+    const realLocal = realpathSync5(localPath);
+    const realRoot = realpathSync5(skillsRoot);
+    if (!realLocal.startsWith(realRoot + sep6)) return null;
+    if (!statSync7(realLocal).isFile()) return null;
+  } catch {
+    return null;
+  }
+  return localPath;
+}
+function preflightSkillRedactable(f) {
+  const parsed = skillFileFromFinding(f);
+  if (parsed === null) return "a finding is not a skill file";
+  const localPath = resolveSkillLocalPath(parsed.name, parsed.relPath);
+  if (localPath === null) {
+    return `skill file ${parsed.name}/${parsed.relPath}: local file not found or unresolvable`;
+  }
+  return null;
+}
+function applySkillRedact(f, ts, scan = scanFile) {
+  const refuse = (msg) => {
+    log(msg);
+    return false;
+  };
+  const parsed = skillFileFromFinding(f);
+  if (parsed === null) {
+    return refuse("could not parse this finding as a skill file; choose Skip.");
+  }
+  const { name, relPath } = parsed;
+  const localPath = resolveSkillLocalPath(name, relPath);
+  if (localPath === null) {
+    return refuse(`could not locate the local skill file for ${name}/${relPath}; choose Skip.`);
+  }
+  const findings = scan(localPath);
+  if (findings === null) {
+    return refuse(`re-scan of ${name}/${relPath} failed; choose Skip.`);
+  }
+  if (findings.length === 0) {
+    return refuse(`nothing to redact in ${name}/${relPath}; choose Skip.`);
+  }
+  backupBeforeWrite(localPath, ts);
+  const before = readFileSync15(localPath, "utf8");
+  const after = applyRedactions(before, findings);
+  if (after === before) {
+    warn(
+      `no redaction applied to ${name}/${relPath}: finding match values were not located in the file. Inspect it manually; the push re-scan still blocks a real leak.`
+    );
+  }
+  writeFileSync7(localPath, after, "utf8");
+  const dest = join38(repoHome(), "shared", "skills", name, ...relPath.split("/"));
+  mkdirSync11(dirname10(dest), { recursive: true });
+  cpSync8(localPath, dest, { force: true });
+  return true;
+}
+
+// src/commands.push.recovery.allow-gate.ts
+init_utils();
+
+// src/commands.push.recovery.seams.ts
+init_push_gitleaks();
+function findingKey(f) {
+  return `${f.File}:${f.StartLine}:${f.StartColumn}:${f.RuleID}`;
+}
+var VALID_SID = /^[A-Za-z0-9_-]+$/;
+var SUBTREE_PATH = /^shared\/projects\/[^/]+\/([^/]+)\/.+$/;
 function sessionIdFromFinding(f) {
   if (isMemoryFindingPath(f)) return null;
   const m = SESSION_PATH.exec(f.File) ?? SUBTREE_PATH.exec(f.File);
@@ -5310,43 +5282,283 @@ function parseAction(raw) {
   if (t === "d" || t === "drop") return "drop";
   return "skip";
 }
-function maskSecret(secret) {
-  return secret.slice(0, MASK_LEAD) + MASK_BODY;
+
+// src/commands.push.recovery.allow-gate.ts
+function isCleared(f, state) {
+  const action = state.actions.get(findingKey(f)) ?? "skip";
+  if (action === "allow") return true;
+  const sid = sessionIdFromFinding(f);
+  if (sid !== null) return state.droppedSids.has(sid) || state.redactedSids.has(sid);
+  if (isMemoryFindingPath(f)) {
+    const parsed = memoryFileFromFinding(f);
+    return parsed !== null && state.redactedMemory.has(`${parsed.logical}/${parsed.relPath}`);
+  }
+  if (isSkillFindingPath(f)) {
+    const parsed = skillFileFromFinding(f);
+    return parsed !== null && state.redactedSkills.has(`${parsed.name}/${parsed.relPath}`);
+  }
+  return false;
 }
-function buildFindingContext(finding, readLine) {
-  const raw = readLine(finding.File, finding.StartLine);
-  if (raw !== null) {
-    const len = raw.length;
-    const startCol = Math.max(1, Math.min(finding.StartColumn, len + 1));
-    const endCol = Math.max(startCol, Math.min(finding.EndColumn, len));
-    const spanStart = startCol - 1;
-    const spanEnd = endCol;
-    const secret = raw.slice(spanStart, spanEnd);
-    const masked = maskSecret(secret);
-    const fullPrefix = raw.slice(0, spanStart);
-    const fullSuffix = raw.slice(spanEnd);
-    const prefixTruncated = fullPrefix.length > CONTEXT_WINDOW;
-    const suffixTruncated = fullSuffix.length > CONTEXT_WINDOW;
-    const prefix = prefixTruncated ? fullPrefix.slice(fullPrefix.length - CONTEXT_WINDOW) : fullPrefix;
-    const suffix = suffixTruncated ? fullSuffix.slice(0, CONTEXT_WINDOW) : fullSuffix;
-    const excerpt = (prefixTruncated ? "..." : "") + prefix + masked + suffix + (suffixTruncated ? "..." : "");
-    const stripped = excerpt.replace(CONTROL_CHARS, "");
-    if (stripped.trim().length > 0) return stripped;
-  }
-  if (finding.Match.length > 0) {
-    return maskSecret(finding.Match).replace(CONTROL_CHARS, "");
+function byFingerprint(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    if (f.Fingerprint.length === 0) continue;
+    const existing = groups.get(f.Fingerprint);
+    if (existing === void 0) groups.set(f.Fingerprint, [f]);
+    else existing.push(f);
+  }
+  return groups;
+}
+function applyDeferredAllows(findings, state, repo) {
+  for (const [fingerprint, peers] of byFingerprint(findings)) {
+    const allows = peers.filter((p) => {
+      if ((state.actions.get(findingKey(p)) ?? "skip") !== "allow") return false;
+      const sid = sessionIdFromFinding(p);
+      return sid === null || !state.droppedSids.has(sid);
+    });
+    if (allows.length === 0) continue;
+    if (peers.every((p) => isCleared(p, state))) {
+      appendGitleaksIgnore(fingerprint, repo);
+      continue;
+    }
+    warn(
+      `not allowing ${fingerprint}: another secret sharing that line was not cleaned, and the entry would suppress it too`
+    );
   }
-  return null;
 }
 
 // src/commands.push.recovery.redact.ts
+init_config();
+init_config_sharedDirs_guard();
+import { cpSync as cpSync9, existsSync as existsSync32, mkdirSync as mkdirSync12 } from "node:fs";
+import { dirname as dirname12, join as join41, sep as sep7 } from "node:path";
+
+// src/commands.redact.ts
+init_config();
+import { existsSync as existsSync31 } from "node:fs";
+import { dirname as dirname11, join as join40 } from "node:path";
+
+// src/commands.redact.subtree.ts
+import { existsSync as existsSync30, lstatSync as lstatSync14, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join39 } from "node:path";
+init_utils_fs();
+init_utils();
+function collectFiles(dir, out) {
+  if (!existsSync30(dir)) return;
+  const st = lstatSync14(dir);
+  if (!st.isDirectory()) return;
+  for (const entry of readdirSync14(dir)) {
+    const abs = join39(dir, entry);
+    const lst = lstatSync14(abs);
+    if (lst.isSymbolicLink()) continue;
+    if (lst.isDirectory()) {
+      collectFiles(abs, out);
+      continue;
+    }
+    if (lst.isFile()) out.push(abs);
+  }
+}
+function listSubtreeFiles(sessionDir) {
+  const out = [];
+  collectFiles(sessionDir, out);
+  return out.sort((a, b) => a.localeCompare(b));
+}
+function newestSubtreeMtimeMs(mainPath, subtreeFiles, statMtime = (p) => statSync8(p).mtimeMs) {
+  let newest = statMtime(mainPath);
+  for (const filePath of subtreeFiles) {
+    const t = statMtime(filePath);
+    if (t > newest) newest = t;
+  }
+  return newest;
+}
+function isSubtreeActive(mainPath, subtreeFiles, now) {
+  const subtreeMtime = newestSubtreeMtimeMs(mainPath, subtreeFiles, (p) => statSync8(p).mtimeMs);
+  return isRecentlyModified(subtreeMtime, now);
+}
+function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts, scan, dryRun) {
+  const dirty = [];
+  if (mainFindings.length > 0) dirty.push({ path: mainPath, findings: mainFindings });
+  for (const filePath of subtreeFiles) {
+    const raw = scan(filePath);
+    if (raw === null || raw.length === 0) continue;
+    const filtered = rule === void 0 ? raw : raw.filter((f) => f.RuleID === rule);
+    if (filtered.length === 0) continue;
+    dirty.push({ path: filePath, findings: filtered });
+  }
+  const total = dirty.reduce((n, e) => n + e.findings.length, 0);
+  if (!dryRun && total > 0) {
+    for (const { path: filePath, findings } of dirty) {
+      backupBeforeWrite(filePath, ts);
+      const before = readFileSync16(filePath, "utf8");
+      const after = applyRedactions(before, findings);
+      if (after === before) {
+        log(
+          `warning: no redaction applied to ${filePath}: finding match values were not located in the file. Inspect it manually; the push re-scan still blocks a real leak.`
+        );
+      }
+      writeFileSync8(filePath, after, "utf8");
+    }
+  }
+  return { total, dirty };
+}
+
+// src/commands.pushed-history.ts
+init_utils();
+import { execFileSync as execFileSync14 } from "node:child_process";
+function pushedRef(repo) {
+  try {
+    const ref = execFileSync14("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+      cwd: repo,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+    return ref.length > 0 ? ref : null;
+  } catch {
+    return null;
+  }
+}
+function sessionInPushedHistory(id, repo) {
+  const ref = pushedRef(repo);
+  if (ref === null) return false;
+  try {
+    const out = execFileSync14(
+      "git",
+      [
+        "log",
+        ref,
+        "--oneline",
+        "-1",
+        "--",
+        `shared/projects/*/${id}.jsonl`,
+        `shared/projects/*/${id}/*`
+      ],
+      { cwd: repo, stdio: ["ignore", "pipe", "ignore"] }
+    ).toString().trim();
+    return out.length > 0;
+  } catch {
+    return false;
+  }
+}
+function warnIfSessionPushed(id, repo) {
+  if (!sessionInPushedHistory(id, repo)) return;
+  log(
+    `warning: session ${id} is already in pushed history (origin).
+  This command only changes your local copy and the next push; it does NOT
+  remove the secret from commits already on the remote.
+  To fully remediate a real secret: rotate the credential, then rewrite
+  history (e.g. with git filter-repo) and force-push, coordinating with
+  anyone else who has cloned the repo.`
+  );
+}
+
+// src/commands.redact.ts
+init_push_gitleaks_scan();
+init_exit_codes();
+init_utils_fs();
+init_utils_json();
+init_utils();
+function resolveLiveTranscript(id) {
+  try {
+    const mapPath = join40(repoHome(), "path-map.json");
+    if (!existsSync31(mapPath)) return null;
+    const projects = readJson(mapPath).projects;
+    const claude = claudeHome();
+    for (const hostMap of Object.values(projects)) {
+      const abs = hostMap[HOST];
+      if (abs === void 0) continue;
+      const live = join40(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync31(live)) return live;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function resolveRedactFindings(localPath, rawFindings, rule, scan) {
+  const source = rawFindings ?? scan(localPath);
+  if (source === null) return null;
+  return source.filter((f) => rule === void 0 || f.RuleID === rule);
+}
+function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
+  const { id, rule, dryRun = false, findings: rawFindings } = opts;
+  if (id.length === 0 || id.length > 128 || !/^[A-Za-z0-9_-]+$/.test(id)) {
+    fail(`invalid session id: ${id}`);
+    process.exit(EXIT.USAGE);
+  }
+  const repo = repoHome();
+  const backup = backupBase();
+  if (!existsSync31(repo)) die(`repo not cloned at ${repo}`);
+  const handle = acquireLock("redact");
+  if (handle === null) process.exit(0);
+  try {
+    const localPath = resolveLiveTranscript(id);
+    if (localPath === null || !existsSync31(localPath)) {
+      fail(`could not resolve local transcript for session ${id} on this host`);
+      process.exitCode = 1;
+      return;
+    }
+    const sessionDir = join40(dirname11(localPath), id);
+    const subtreeFiles = listSubtreeFiles(sessionDir);
+    if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
+      log(
+        `session ${id} was modified recently and may be active.
+  Refusing to rewrite a potentially live transcript.
+  To proceed: wait for the session to end, then re-run nomad redact.
+  Or drop from the staged tree: nomad drop-session ${id}
+  Or skip this finding during nomad push.`
+      );
+      return;
+    }
+    const mainFindings = resolveRedactFindings(localPath, rawFindings, rule, scan);
+    if (mainFindings === null) {
+      fail(`gitleaks scan failed for session ${id} (is gitleaks installed?)`);
+      process.exitCode = 1;
+      return;
+    }
+    const ts = freshBackupTs(backup);
+    const { total: totalCount, dirty } = applySubtreeRedactions(
+      localPath,
+      mainFindings,
+      subtreeFiles,
+      rule,
+      ts,
+      scan,
+      dryRun
+    );
+    if (totalCount === 0) {
+      const ruleClause = rule === void 0 ? "" : ` for rule ${rule}`;
+      log(`no findings${ruleClause} in session ${id}`);
+      return;
+    }
+    if (dryRun) {
+      const lines = dirty.flatMap((e) => e.findings.map((f) => `  ${e.path}  line ${f.StartLine} [${f.RuleID}]`)).join("\n");
+      log(`dry-run: would redact ${totalCount} finding(s) in session ${id}
+${lines}`);
+      return;
+    }
+    log(`redacted ${totalCount} finding(s) in ${localPath} (backup: ${ts})`);
+    warnIfSessionPushed(id, repo);
+  } catch (err) {
+    if (!(err instanceof NomadFatal)) {
+      throw err;
+    }
+    fail(err.message);
+    process.exitCode = 1;
+  } finally {
+    releaseLock(handle);
+  }
+}
+
+// src/commands.push.recovery.redact.ts
+init_push_gitleaks_scan();
+init_utils_json();
+init_utils();
 function resolveStagedDir(localPath, map, claude, repo) {
   for (const [logical, hostMap] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join39(claude, "projects", encodePath(abs)) + sep6)) {
-      return join39(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep7)) {
+      return join41(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -5356,7 +5568,7 @@ function preflightRedactable(f, map, nowMs) {
   if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
   const localPath = resolveLiveTranscript(sid);
   if (localPath === null) return `session ${sid}: local transcript not found`;
-  const sessionDir = join39(dirname11(localPath), sid);
+  const sessionDir = join41(dirname12(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return `session ${sid}: looks active (modified within the last 5 minutes)`;
@@ -5385,7 +5597,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join39(dirname11(localPath), sid);
+  const sessionDir = join41(dirname12(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return refuse(
@@ -5417,188 +5629,209 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `nothing to redact in the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  mkdirSync10(stagedProjectDir, { recursive: true });
-  cpSync8(localPath, join39(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync31(sessionDir)) {
-    cpSync8(sessionDir, join39(stagedProjectDir, sid), { force: true, recursive: true });
+  mkdirSync12(stagedProjectDir, { recursive: true });
+  cpSync9(localPath, join41(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync32(sessionDir)) {
+    cpSync9(sessionDir, join41(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
 
 // src/commands.push.recovery.drop.ts
 init_config();
-import { rmSync as rmSync13 } from "node:fs";
-import { join as join40 } from "node:path";
+import { rmSync as rmSync14 } from "node:fs";
+import { join as join42 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join40(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join40(repo, "shared", "projects", logical, sid);
-    rmSync13(jsonl, { force: true });
-    rmSync13(dir, { recursive: true, force: true });
+    const jsonl = join42(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join42(repo, "shared", "projects", logical, sid);
+    rmSync14(jsonl, { force: true });
+    rmSync14(dir, { recursive: true, force: true });
   }
   return true;
 }
 
-// src/commands.push.recovery.skills.ts
-init_config();
-import {
-  cpSync as cpSync9,
-  lstatSync as lstatSync14,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync16,
-  realpathSync as realpathSync5,
-  statSync as statSync8,
-  writeFileSync as writeFileSync8
-} from "node:fs";
-import { dirname as dirname12, join as join42, sep as sep7 } from "node:path";
-
-// src/skills-sync.ts
-init_config();
-import { existsSync as existsSync32, lstatSync as lstatSync13, mkdirSync as mkdirSync11, readdirSync as readdirSync14, rmSync as rmSync14 } from "node:fs";
-import { join as join41 } from "node:path";
-
-// src/skills-sync.tracked.ts
+// src/commands.push.recovery.actions.ts
+init_push_gitleaks_scan();
 init_utils();
-import { basename as basename3 } from "node:path";
-function trackedRootSkillsAt(ref, repo) {
-  try {
-    const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
-    const entries = raw.split("\0").filter((entry) => entry !== "");
-    return new Set(entries.map((entry) => basename3(entry)));
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-}
 
-// src/skills-sync.ts
-init_utils_fs();
-function isGsdOwned(name) {
-  return name.startsWith(GSD_PREFIX);
-}
-function isSkillExcluded(name) {
-  return isGsdOwned(name) || isDeniedName(ALWAYS_NEVER_SYNC, name);
-}
-function copySkillsPush(src, dst) {
-  const srcNames = readdirSync14(src, { encoding: "utf8" });
-  const blockSet = /* @__PURE__ */ new Set([
-    ...srcNames.filter((n) => isGsdOwned(n)),
-    ...ALWAYS_NEVER_SYNC
-  ]);
-  copyExtrasFiltered(src, dst, blockSet);
-}
-function copySkillsPull(src, dst, isRootPreserved) {
-  copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded, isRootPreserved);
+// src/commands.push.recovery.secret-shape.ts
+var VALUE_HEAD = 4;
+var VALUE_TAIL = 4;
+var MIN_ELIDE_LEN = 16;
+var FRAGMENT_SEP = "...";
+var NEAR_WINDOW = 40;
+var VALUE_PAD = 16;
+var REDACTED_TOKEN = "REDACTED";
+var CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
+function classifyCharset(value) {
+  if (/^[0-9a-fA-F]+$/.test(value)) return "hex";
+  if (/^[0-9a-zA-Z]+$/.test(value)) return "alphanumeric";
+  if (/^[0-9a-zA-Z_-]+$/.test(value)) return "base64url";
+  return "mixed";
+}
+function describeSecret(secret, entropy) {
+  const parts = [`${secret.length} chars`, classifyCharset(secret)];
+  if (typeof entropy === "number" && Number.isFinite(entropy) && entropy > 0) {
+    parts.push(`entropy ${entropy.toFixed(2)}`);
+  }
+  const summary = parts.join(", ");
+  if (secret.length < MIN_ELIDE_LEN) return summary;
+  const fragment = secret.slice(0, VALUE_HEAD) + FRAGMENT_SEP + secret.slice(-VALUE_TAIL);
+  return `${fragment.padEnd(VALUE_PAD)}  ${summary}`;
+}
+function emptyToNull(text) {
+  return text.length > 0 ? text : null;
+}
+function withoutValue(near, value) {
+  if (near === null || value === null || value.length === 0) return near;
+  const idx = near.indexOf(value);
+  return idx < 0 ? near : emptyToNull(near.slice(0, idx));
+}
+function alignRedactedMatch(finding, span, lead) {
+  const idx = finding.Match.indexOf(REDACTED_TOKEN);
+  if (idx < 0) return null;
+  const pre = finding.Match.slice(0, idx);
+  const post = finding.Match.slice(idx + REDACTED_TOKEN.length);
+  if (span !== finding.Match && span.startsWith(pre) && span.endsWith(post) && span.length > pre.length + post.length) {
+    return {
+      value: span.slice(pre.length, span.length - post.length),
+      near: emptyToNull(lead + pre),
+      exact: true
+    };
+  }
+  return { value: null, near: emptyToNull(lead + pre), exact: false };
+}
+function maskSiblingSpans(buf, siblings, ownStart, ownEnd) {
+  if (siblings.length === 0) return buf;
+  const copy = Buffer.from(buf);
+  for (const sibling of siblings) {
+    const start = Math.max(1, Math.min(sibling.StartColumn, copy.length + 1)) - 1;
+    const end = Math.max(start, Math.min(sibling.EndColumn, copy.length));
+    const headEnd = Math.min(end, ownStart);
+    if (start < headEnd) copy.fill(0, start, headEnd);
+    const tailStart = Math.max(start, ownEnd);
+    if (tailStart < end) copy.fill(0, tailStart, end);
+  }
+  return copy;
+}
+function resolveSecretContext(finding, readLine, siblings = []) {
+  const resolved = resolveSpanContext(finding, readLine, siblings);
+  const ownStripped = withoutValue(resolved.near, resolved.value);
+  const multiLine = typeof finding.EndLine === "number" && finding.EndLine > finding.StartLine;
+  return {
+    value: resolved.value,
+    near: ownStripped,
+    exact: resolved.exact && !multiLine
+  };
 }
-function syncSkillsPull(ts, prePostHeads) {
-  const sharedSkills = join41(repoHome(), "shared", "skills");
-  if (!existsSync32(sharedSkills)) return;
-  const localSkills = join41(claudeHome(), "skills");
-  backupBeforeWrite(localSkills, ts);
-  const dstStat = lstatSync13(localSkills, { throwIfNoEntry: false });
-  if (dstStat?.isSymbolicLink() === true) {
-    rmSync14(localSkills, { recursive: true, force: true });
-    mkdirSync11(localSkills, { recursive: true });
+function resolveSpanContext(finding, readLine, siblings = []) {
+  const raw = readLine(finding.File, finding.StartLine);
+  let span;
+  let lead;
+  if (raw !== null) {
+    const buf = Buffer.from(raw, "utf8");
+    const len = buf.length;
+    const startCol = Math.max(1, Math.min(finding.StartColumn, len + 1));
+    const endCol = Math.max(startCol, Math.min(finding.EndColumn, len));
+    span = buf.subarray(startCol - 1, endCol).toString("utf8");
+    lead = maskSiblingSpans(buf, siblings, startCol - 1, endCol).subarray(0, startCol - 1).toString("utf8");
+  } else {
+    span = finding.Match;
+    lead = "";
   }
-  const tracked = prePostHeads === void 0 ? /* @__PURE__ */ new Set() : trackedRootSkillsAt(prePostHeads.pre, repoHome());
-  copySkillsPull(sharedSkills, localSkills, (name) => !tracked.has(name));
+  const aligned = alignRedactedMatch(finding, span, lead);
+  if (aligned !== null) return aligned;
+  if (typeof finding.Secret === "string" && finding.Secret.length > 0 && span.includes(finding.Secret)) {
+    return {
+      value: finding.Secret,
+      near: emptyToNull(lead + span.slice(0, span.indexOf(finding.Secret))),
+      exact: true
+    };
+  }
+  return {
+    value: span.length > 0 ? span : null,
+    near: emptyToNull(lead),
+    exact: false
+  };
 }
-function syncSkillsPush() {
-  const localSkills = join41(claudeHome(), "skills");
-  const stat = lstatSync13(localSkills, { throwIfNoEntry: false });
-  if (stat === void 0) return;
-  if (stat.isSymbolicLink()) return;
-  const sharedSkills = join41(repoHome(), "shared", "skills");
-  copySkillsPush(localSkills, sharedSkills);
+function formatNear(text) {
+  const stripped = elideTokenRuns(text.replace(CONTROL_CHARS, ""));
+  const truncated = stripped.length > NEAR_WINDOW;
+  const window = stripped.slice(-NEAR_WINDOW).trim();
+  if (window.length === 0) return null;
+  return (truncated ? FRAGMENT_SEP : "") + window;
+}
+function elideTokenRuns(text) {
+  return text.replace(/[A-Za-z0-9_+=-]+/g, (atom) => {
+    if (atom.length < MIN_ELIDE_LEN) return atom;
+    if (/^[A-Za-z_-]+$/.test(atom)) return atom;
+    return FRAGMENT_SEP;
+  });
 }
 
-// src/commands.push.recovery.skills.ts
-init_push_gitleaks_scan();
-init_utils_fs();
-init_utils();
-var SKILL_FINDING_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
-var SAFE_SKILL_NAME = /^[A-Za-z0-9._-]+$/;
-var SKILL_DIR_PATH = /^shared\/skills\/[^/]+\//;
-function skillFileFromFinding(f) {
-  const m = SKILL_FINDING_PATH.exec(f.File);
-  if (m?.[1] === void 0 || m[2] === void 0) return null;
-  return { name: m[1], relPath: m[2] };
-}
-function isSkillFindingPath(f) {
-  return SKILL_DIR_PATH.test(f.File);
+// src/commands.push.recovery.display.ts
+var RULE_PAD = 24;
+var GROUP_SEP = "\0";
+function sessionSuffix(finding) {
+  const sid = sessionIdFromFinding(finding);
+  if (sid === null) return "";
+  const rawBasename = finding.File.replace(/^.*\//, "");
+  const basename4 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
+  return basename4 === sid ? "" : ` (session: ${sid})`;
+}
+function renderFindingBlock(finding, readLine, siblings = []) {
+  const lines = [`  file:  ${finding.File}:${finding.StartLine}${sessionSuffix(finding)}`];
+  const { value, near, exact } = resolveSecretContext(finding, readLine, siblings);
+  if (value !== null) {
+    lines.push(`  value: ${describeSecret(value, exact ? finding.Entropy : void 0)}`);
+  }
+  const formattedNear = near !== null ? formatNear(near) : null;
+  if (formattedNear !== null) lines.push(`  near:  ${formattedNear}`);
+  return lines;
 }
-function resolveSkillLocalPath(name, relPath) {
-  if (!SAFE_SKILL_NAME.test(name) || name === "." || name === "..") return null;
-  if (isGsdOwned(name)) return null;
-  if (!isSafeRelPath(relPath)) return null;
-  const skillsRoot = join42(claudeHome(), "skills");
-  const skillRoot = join42(skillsRoot, name);
-  const localPath = join42(skillRoot, ...relPath.split("/"));
-  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep7)) return null;
-  try {
-    if (lstatSync14(localPath).isSymbolicLink()) return null;
-    const realLocal = realpathSync5(localPath);
-    const realRoot = realpathSync5(skillsRoot);
-    if (!realLocal.startsWith(realRoot + sep7)) return null;
-    if (!statSync8(realLocal).isFile()) return null;
-  } catch {
-    return null;
+function groupFindingsForPrompt(findings, readLine) {
+  const groups = [];
+  const indexByKey = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const { value } = resolveSecretContext(f, readLine);
+    const key = f.Fingerprint.length > 0 && value !== null ? `${f.Fingerprint}${GROUP_SEP}${value}` : (
+      // findingKey omits the fingerprint, so carry it here too, or two
+      // findings differing ONLY by fingerprint would merge.
+      `${f.Fingerprint}${GROUP_SEP}${findingKey(f)}`
+    );
+    const idx = indexByKey.get(key);
+    if (idx === void 0) {
+      indexByKey.set(key, groups.length);
+      groups.push([f]);
+    } else {
+      groups[idx].push(f);
+    }
   }
-  return localPath;
+  return groups;
 }
-function preflightSkillRedactable(f) {
-  const parsed = skillFileFromFinding(f);
-  if (parsed === null) return "a finding is not a skill file";
-  const localPath = resolveSkillLocalPath(parsed.name, parsed.relPath);
-  if (localPath === null) {
-    return `skill file ${parsed.name}/${parsed.relPath}: local file not found or unresolvable`;
-  }
-  return null;
+function sharedFingerprintPeers(groups, index) {
+  const target = groups[index][0].Fingerprint;
+  if (target.length === 0) return 0;
+  return groups.filter((g, i) => i !== index && g[0].Fingerprint === target).length;
 }
-function applySkillRedact(f, ts, scan = scanFile) {
-  const refuse = (msg) => {
-    log(msg);
-    return false;
-  };
-  const parsed = skillFileFromFinding(f);
-  if (parsed === null) {
-    return refuse("could not parse this finding as a skill file; choose Skip.");
-  }
-  const { name, relPath } = parsed;
-  const localPath = resolveSkillLocalPath(name, relPath);
-  if (localPath === null) {
-    return refuse(`could not locate the local skill file for ${name}/${relPath}; choose Skip.`);
-  }
-  const findings = scan(localPath);
-  if (findings === null) {
-    return refuse(`re-scan of ${name}/${relPath} failed; choose Skip.`);
-  }
-  if (findings.length === 0) {
-    return refuse(`nothing to redact in ${name}/${relPath}; choose Skip.`);
+function buildPromptHeader(group, index, total, readLine, peers = 0, siblings = []) {
+  const first = group[0];
+  const headerLine = group.length === 1 ? `Finding ${index}/${total}: ${first.RuleID}` : `Finding ${index}/${total}: ${first.RuleID.padEnd(RULE_PAD)}  ${group.length} occurrences, 1 ignore entry`;
+  const body = renderFindingBlock(first, readLine, siblings);
+  if (peers > 0) {
+    const other = peers === 1 ? "secret" : "secrets";
+    body.push(`  warn:  Allow also suppresses ${peers} other distinct ${other} on this line`);
   }
-  backupBeforeWrite(localPath, ts);
-  const before = readFileSync16(localPath, "utf8");
-  const after = applyRedactions(before, findings);
-  if (after === before) {
-    warn(
-      `no redaction applied to ${name}/${relPath}: finding match values were not located in the file. Inspect it manually; the push re-scan still blocks a real leak.`
-    );
-  }
-  writeFileSync8(localPath, after, "utf8");
-  const dest = join42(repoHome(), "shared", "skills", name, ...relPath.split("/"));
-  mkdirSync12(dirname12(dest), { recursive: true });
-  cpSync9(localPath, dest, { force: true });
-  return true;
+  const sid = sessionIdFromFinding(first);
+  const menu = sid === null ? "  [R]edact  [A]llow  [S]kip (default)" : "  [R]edact  [A]llow  [D]rop session  [S]kip (default)";
+  return ["", headerLine, ...body, menu, ""].join("\n");
 }
 
 // src/commands.push.recovery.actions.ts
-init_push_gitleaks_scan();
-init_utils();
-function applyAllow(f, repo) {
-  appendGitleaksIgnore(f.Fingerprint, repo);
-}
 function allowAllFindings(findings, repo) {
   for (const f of findings) {
     appendGitleaksIgnore(f.Fingerprint, repo);
@@ -5615,6 +5848,7 @@ function allowFindingsByRule(findings, ruleId, repo) {
   return count;
 }
 function makeDefaultReadLine(repo) {
+  const cache = /* @__PURE__ */ new Map();
   return (file, line) => {
     try {
       const repoRoot = resolve3(repo);
@@ -5622,8 +5856,11 @@ function makeDefaultReadLine(repo) {
       if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep8)) {
         return null;
       }
-      const content = readFileSync17(target, "utf8");
-      const lines = content.split(/\r?\n/);
+      let lines = cache.get(target);
+      if (lines === void 0) {
+        lines = readFileSync17(target, "utf8").split(/\r?\n/);
+        cache.set(target, lines);
+      }
       const idx = line - 1;
       if (idx < 0 || idx >= lines.length) return null;
       return lines[idx] ?? null;
@@ -5634,16 +5871,19 @@ function makeDefaultReadLine(repo) {
 }
 async function collectActions(findings, prompt, readLine) {
   const reader = readLine ?? makeDefaultReadLine(repoHome());
+  const groups = groupFindingsForPrompt(findings, reader);
   const actions = /* @__PURE__ */ new Map();
-  for (const f of findings) {
-    const sid = sessionIdFromFinding(f);
-    const ctx = buildFindingContext(f, reader);
-    const header = `
-Finding: ${f.RuleID} in ${f.File} line ${f.StartLine}` + (sid === null ? "" : ` (session: ${sid})`) + (ctx === null ? "" : `
-  context: ${ctx}`) + // [D]rop applies only to session findings; a null sid (memory/skill
-    // finding) has no session to drop, so omit the dead affordance.
-    (sid === null ? "\n  [R]edact  [A]llow  [S]kip (default)\n" : "\n  [R]edact  [A]llow  [D]rop session  [S]kip (default)\n");
-    actions.set(findingKey(f), parseAction(await prompt(header + "> ")));
+  for (let i = 0; i < groups.length; i++) {
+    const group = groups[i];
+    const peers = sharedFingerprintPeers(groups, i);
+    const siblings = findings.filter(
+      (o) => o.File === group[0].File && o.StartLine === group[0].StartLine && !group.includes(o)
+    );
+    const header = buildPromptHeader(group, i + 1, groups.length, reader, peers, siblings);
+    const action = parseAction(await prompt(header + "> "));
+    for (const f of group) {
+      actions.set(findingKey(f), action);
+    }
   }
   return actions;
 }
@@ -5683,13 +5923,9 @@ function dispatchNonSession(f, action, ctx) {
 }
 function dispatchOne(f, ctx) {
   const action = ctx.actions.get(findingKey(f)) ?? "skip";
-  if (action === "skip") return;
+  if (action === "skip" || action === "allow") return;
   const sid = sessionIdFromFinding(f);
   if (sid !== null && ctx.droppedSids.has(sid)) return;
-  if (action === "allow") {
-    applyAllow(f, ctx.repo);
-    return;
-  }
   if (sid === null) {
     dispatchNonSession(f, action, ctx);
     return;
@@ -5725,6 +5961,7 @@ function dispatchActions(findings, actions, opts) {
   for (const f of findings) {
     dispatchOne(f, ctx);
   }
+  applyDeferredAllows(findings, ctx, repo);
 }
 
 // src/commands.push.recovery.redact-all.ts
@@ -6228,11 +6465,19 @@ function isProblem(item2) {
 function isRepoStateLine(item2) {
   return item2.includes("repo state:");
 }
+function isCopySyncModalityLine(item2) {
+  return item2.includes("sync modality: copy-sync");
+}
 function compactSections(sections) {
   return sections.map((s) => {
     if (ALWAYS_FULL.has(s.header)) return s;
     if (s.header === "Environment") {
-      return { ...s, items: s.items.filter((it) => isRepoStateLine(it) || isProblem(it)) };
+      return {
+        ...s,
+        items: s.items.filter(
+          (it) => isRepoStateLine(it) || isCopySyncModalityLine(it) || isProblem(it)
+        )
+      };
     }
     return { ...s, items: s.items.filter(isProblem) };
   });
@@ -7547,6 +7792,22 @@ function handleWedge(repo, forceRemote) {
   const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
   die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
 }
+function readMapForMirror(mapPath) {
+  if (!existsSync42(mapPath)) return { projects: {} };
+  try {
+    return readPathMap(mapPath);
+  } catch {
+    return null;
+  }
+}
+function mirrorSharedLinksBeforePull(repo, ts) {
+  if (process.platform !== "win32") return;
+  try {
+    stageLocalSharedEdits(readMapForMirror(join53(repo, "path-map.json")), ts);
+  } catch (err) {
+    warn(`could not stage local shared edits before the pull: ${err.message}`);
+  }
+}
 function runPullCore(opts = {}) {
   const dryRun = opts.dryRun === true;
   const forceRemote = opts.forceRemote === true;
@@ -7568,6 +7829,7 @@ function runPullCore(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
   }
+  if (!dryRun && !forceRemote) mirrorSharedLinksBeforePull(repo, ts);
   const prePostHeads = capturePrePostHeads(repo, () => {
     gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
   });
@@ -9103,7 +9365,7 @@ function parsePullArgs(argv) {
 
 // src/nomad.dispatch.push.ts
 var RULE_ID_RE = /^\w[\w-]*$/;
-function applyAllow2(argv, i, st) {
+function applyAllow(argv, i, st) {
   if (st.allowRule !== void 0) return REJECT;
   const val = extractFlagValue(argv, i);
   if (val === null || !RULE_ID_RE.test(val)) return REJECT;
@@ -9119,7 +9381,7 @@ function applyPushToken(argv, i, st) {
     case "--allow-all":
       return applyBool(st.allowAll, () => st.allowAll = true);
     case "--allow":
-      return applyAllow2(argv, i, st);
+      return applyAllow(argv, i, st);
     case "--full-scan":
       return applyBool(st.fullScan, () => st.fullScan = true);
     default:
@@ -9177,7 +9439,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.62.6",
+  version: "0.63.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [