claude-nomad 0.63.0 → 0.63.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.63.1](https://github.com/funkadelic/claude-nomad/compare/v0.63.0...v0.63.1) (2026-07-31)
+
+
+### Fixed
+
+* **push:** correct gitleaks column offsets in recovery prompts ([#478](https://github.com/funkadelic/claude-nomad/issues/478)) ([e230993](https://github.com/funkadelic/claude-nomad/commit/e2309932456f5646694685dd0c3b6b6e1007059f))
+
 ## [0.63.0](https://github.com/funkadelic/claude-nomad/compare/v0.62.6...v0.63.0) (2026-07-31)
 
 ### What's new

package/dist/nomad.mjs

@@ -5658,6 +5658,93 @@ function dropSessionFromStaged(sid, map) {
 init_push_gitleaks_scan();
 init_utils();
 
+// src/commands.push.recovery.span-align.ts
+var REDACTED_TOKEN = "REDACTED";
+var SHIFT_WINDOW = [0, -1, 1, -2, 2];
+var ENTROPY_TOLERANCE = 1e-4;
+function byteAt(buf, at) {
+  return at >= 0 && at < buf.length ? buf[at] : void 0;
+}
+function isWordByte(byte) {
+  if (byte === void 0) return false;
+  return byte >= 48 && byte <= 57 || byte >= 65 && byte <= 90 || byte >= 97 && byte <= 122 || byte === 95;
+}
+function splitsToken(buf, at) {
+  return isWordByte(byteAt(buf, at - 1)) && isWordByte(byteAt(buf, at));
+}
+function shannonEntropy(text) {
+  if (text.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of text) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let bits = 0;
+  for (const n of counts.values()) {
+    const p = n / text.length;
+    bits -= p * Math.log2(p);
+  }
+  return bits;
+}
+function matchTemplate(finding) {
+  if (finding.Match.length === 0) return null;
+  const idx = finding.Match.indexOf(REDACTED_TOKEN);
+  if (idx < 0) return { pre: "", post: "", redacted: false };
+  return {
+    pre: finding.Match.slice(0, idx),
+    post: finding.Match.slice(idx + REDACTED_TOKEN.length),
+    redacted: true
+  };
+}
+function fitsTemplate(span, finding, template) {
+  if (!template.redacted) return span === finding.Match;
+  return span.startsWith(template.pre) && span.endsWith(template.post);
+}
+function candidateAt(finding, buf, template, shift) {
+  const start = finding.StartColumn - 1 + shift;
+  const end = start + (finding.EndColumn - finding.StartColumn + 1);
+  if (start < 0 || end > buf.length) return null;
+  const span = buf.subarray(start, end).toString("utf8");
+  if (!fitsTemplate(span, finding, template)) return null;
+  const valueStart = start + Buffer.byteLength(template.pre, "utf8");
+  const valueEnd = end - Buffer.byteLength(template.post, "utf8");
+  const value = buf.subarray(valueStart, valueEnd).toString("utf8");
+  if (value.length === 0) return null;
+  if (splitsToken(buf, start) || splitsToken(buf, end)) return null;
+  return { start, end, valueStart, value, exact: template.redacted };
+}
+function locateSecretLiteral(finding, buf) {
+  const secret = finding.Secret;
+  if (typeof secret !== "string" || secret.length === 0 || secret === REDACTED_TOKEN) return null;
+  const needle = Buffer.from(secret, "utf8");
+  const hint = finding.StartColumn - 1;
+  let best = null;
+  for (let at = buf.indexOf(needle); at >= 0; at = buf.indexOf(needle, at + 1)) {
+    if (best === null || Math.abs(at - hint) < Math.abs(best - hint)) best = at;
+  }
+  if (best === null) return null;
+  return { start: best, end: best + needle.length, valueStart: best, value: secret, exact: true };
+}
+function breakTie(hits, finding) {
+  const reported = finding.Entropy;
+  if (typeof reported !== "number" || !Number.isFinite(reported) || reported <= 0) return null;
+  const agreeing = hits.filter(
+    (h2) => h2.exact && Math.abs(shannonEntropy(h2.value) - reported) <= ENTROPY_TOLERANCE
+  );
+  return agreeing.length === 1 ? agreeing[0] : null;
+}
+function alignFindingSpan(finding, buf) {
+  const literal = locateSecretLiteral(finding, buf);
+  if (literal !== null) return literal;
+  if (typeof finding.EndLine === "number" && finding.EndLine > finding.StartLine) return null;
+  const template = matchTemplate(finding);
+  if (template === null) return null;
+  const hits = [];
+  for (const shift of SHIFT_WINDOW) {
+    const candidate = candidateAt(finding, buf, template, shift);
+    if (candidate !== null) hits.push(candidate);
+  }
+  if (hits.length === 1) return hits[0];
+  return breakTie(hits, finding);
+}
+
 // src/commands.push.recovery.secret-shape.ts
 var VALUE_HEAD = 4;
 var VALUE_TAIL = 4;
@@ -5665,7 +5752,7 @@ var MIN_ELIDE_LEN = 16;
 var FRAGMENT_SEP = "...";
 var NEAR_WINDOW = 40;
 var VALUE_PAD = 16;
-var REDACTED_TOKEN = "REDACTED";
+var SIBLING_PAD = 2;
 var CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
 function classifyCharset(value) {
   if (/^[0-9a-fA-F]+$/.test(value)) return "hex";
@@ -5691,26 +5778,23 @@ function withoutValue(near, value) {
   const idx = near.indexOf(value);
   return idx < 0 ? near : emptyToNull(near.slice(0, idx));
 }
-function alignRedactedMatch(finding, span, lead) {
+function templateLead(finding) {
   const idx = finding.Match.indexOf(REDACTED_TOKEN);
-  if (idx < 0) return null;
-  const pre = finding.Match.slice(0, idx);
-  const post = finding.Match.slice(idx + REDACTED_TOKEN.length);
-  if (span !== finding.Match && span.startsWith(pre) && span.endsWith(post) && span.length > pre.length + post.length) {
-    return {
-      value: span.slice(pre.length, span.length - post.length),
-      near: emptyToNull(lead + pre),
-      exact: true
-    };
-  }
-  return { value: null, near: emptyToNull(lead + pre), exact: false };
+  return idx > 0 ? finding.Match.slice(0, idx) : null;
+}
+function siblingBounds(sibling, buf) {
+  const aligned = alignFindingSpan(sibling, buf);
+  if (aligned !== null) return { start: aligned.start, end: aligned.end };
+  const reportedStart = sibling.StartColumn - 1;
+  if (sibling.EndColumn <= reportedStart) return { start: 0, end: 0 };
+  const start = Math.max(0, Math.min(reportedStart, buf.length) - SIBLING_PAD);
+  return { start, end: Math.max(start, Math.min(sibling.EndColumn + SIBLING_PAD, buf.length)) };
 }
 function maskSiblingSpans(buf, siblings, ownStart, ownEnd) {
   if (siblings.length === 0) return buf;
   const copy = Buffer.from(buf);
   for (const sibling of siblings) {
-    const start = Math.max(1, Math.min(sibling.StartColumn, copy.length + 1)) - 1;
-    const end = Math.max(start, Math.min(sibling.EndColumn, copy.length));
+    const { start, end } = siblingBounds(sibling, buf);
     const headEnd = Math.min(end, ownStart);
     if (start < headEnd) copy.fill(0, start, headEnd);
     const tailStart = Math.max(start, ownEnd);
@@ -5720,43 +5804,27 @@ function maskSiblingSpans(buf, siblings, ownStart, ownEnd) {
 }
 function resolveSecretContext(finding, readLine, siblings = []) {
   const resolved = resolveSpanContext(finding, readLine, siblings);
-  const ownStripped = withoutValue(resolved.near, resolved.value);
-  const multiLine = typeof finding.EndLine === "number" && finding.EndLine > finding.StartLine;
   return {
     value: resolved.value,
-    near: ownStripped,
-    exact: resolved.exact && !multiLine
+    near: withoutValue(resolved.near, resolved.value),
+    exact: resolved.exact
   };
 }
+function resolveWithoutLine(finding) {
+  if (finding.Match.includes(REDACTED_TOKEN)) {
+    return { value: null, near: templateLead(finding), exact: false };
+  }
+  return { value: emptyToNull(finding.Match), near: null, exact: false };
+}
 function resolveSpanContext(finding, readLine, siblings = []) {
   const raw = readLine(finding.File, finding.StartLine);
-  let span;
-  let lead;
-  if (raw !== null) {
-    const buf = Buffer.from(raw, "utf8");
-    const len = buf.length;
-    const startCol = Math.max(1, Math.min(finding.StartColumn, len + 1));
-    const endCol = Math.max(startCol, Math.min(finding.EndColumn, len));
-    span = buf.subarray(startCol - 1, endCol).toString("utf8");
-    lead = maskSiblingSpans(buf, siblings, startCol - 1, endCol).subarray(0, startCol - 1).toString("utf8");
-  } else {
-    span = finding.Match;
-    lead = "";
-  }
-  const aligned = alignRedactedMatch(finding, span, lead);
-  if (aligned !== null) return aligned;
-  if (typeof finding.Secret === "string" && finding.Secret.length > 0 && span.includes(finding.Secret)) {
-    return {
-      value: finding.Secret,
-      near: emptyToNull(lead + span.slice(0, span.indexOf(finding.Secret))),
-      exact: true
-    };
-  }
-  return {
-    value: span.length > 0 ? span : null,
-    near: emptyToNull(lead),
-    exact: false
-  };
+  if (raw === null) return resolveWithoutLine(finding);
+  const unresolved = { value: null, near: templateLead(finding), exact: false };
+  const buf = Buffer.from(raw, "utf8");
+  const aligned = alignFindingSpan(finding, buf);
+  if (aligned === null) return unresolved;
+  const near = maskSiblingSpans(buf, siblings, aligned.start, aligned.end).subarray(0, aligned.valueStart).toString("utf8");
+  return { value: aligned.value, near: emptyToNull(near), exact: aligned.exact };
 }
 function formatNear(text) {
   const stripped = elideTokenRuns(text.replace(CONTROL_CHARS, ""));
@@ -9439,7 +9507,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.63.0",
+  version: "0.63.1",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.63.0",
+  "version": "0.63.1",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [