claude-nomad 0.63.2 → 0.64.1

package/dist/nomad.mjs

@@ -42,11 +42,21 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/config.never-sync.ts
+function stripTrailingDotsAndWhitespace(name) {
+  let end = name.length;
+  while (end > 0 && (name[end - 1] === "." || /\s/.test(name[end - 1]))) end -= 1;
+  return name.slice(0, end);
+}
 function isSecretFileName(name) {
-  return SECRET_FILE_PATTERNS.some((re) => re.test(name));
+  const stripped = stripTrailingDotsAndWhitespace(name);
+  return SECRET_FILE_PATTERNS.some((re) => re.test(stripped));
 }
 function isDeniedName(blockSet, name) {
-  return blockSet.has(name) || blockSet.has(name.toLowerCase()) || isSecretFileName(name);
+  const stripped = stripTrailingDotsAndWhitespace(name);
+  return blockSet.has(name) || blockSet.has(name.toLowerCase()) || blockSet.has(stripped) || blockSet.has(stripped.toLowerCase()) || isSecretFileName(name);
+}
+function isClaudeExtraName(name) {
+  return stripTrailingDotsAndWhitespace(name).toLowerCase() === ".claude";
 }
 var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, SECRET_FILE_PATTERNS;
 var init_config_never_sync = __esm({
@@ -302,14 +312,67 @@ function assertSafeLogical(logical) {
     );
   }
 }
+function validateSharedDirEntry(entry) {
+  if (typeof entry !== "string") {
+    return { reason: "not-a-string", message: "not a string" };
+  }
+  if (!SAFE_SEGMENT.test(entry) || entry === "." || entry === "..") {
+    return {
+      reason: "not-a-segment",
+      message: 'not a single path segment (contains a path separator, an unsupported character, "." or "..")'
+    };
+  }
+  const addressed = stripTrailingDots(entry);
+  const named = classifyDeniedName(addressed);
+  if (named !== null) {
+    return addressed === entry ? named : {
+      reason: named.reason,
+      message: `a trailing-dot name shadowing ${named.message}`
+    };
+  }
+  if (entry.endsWith(".")) {
+    return {
+      reason: "win32-alias",
+      message: 'a trailing-dot name (git for Windows refuses to create or check out a path ending in ".")'
+    };
+  }
+  return null;
+}
+function stripTrailingDots(name) {
+  let end = name.length;
+  while (end > 0 && name[end - 1] === ".") end -= 1;
+  return name.slice(0, end);
+}
+function classifyDeniedName(name) {
+  const folded = name.toLowerCase();
+  if (NEVER_SYNC.has(name) || NEVER_SYNC.has(folded)) {
+    return { reason: "never-sync", message: "a never-sync name" };
+  }
+  if (RESERVED_SHARED.has(name) || RESERVED_SHARED_FOLDED.has(folded)) {
+    return { reason: "reserved", message: "a reserved shared/ name" };
+  }
+  const dot = folded.indexOf(".");
+  const stem = dot === -1 ? folded : folded.slice(0, dot);
+  if (WIN32_DEVICE_NAMES.has(stem)) {
+    return { reason: "reserved", message: "a reserved Windows device name" };
+  }
+  if (isSecretFileName(name)) {
+    return {
+      reason: "secret-shaped",
+      message: "a credential-shaped filename (.env, id_rsa, credentials, *.pem, *.key and similar)"
+    };
+  }
+  return null;
+}
+function mayJoinRefusedEntry(entry, reason, remediable) {
+  if (UNJOINABLE_REASONS.has(reason)) return false;
+  if (entry.endsWith(".")) return true;
+  return remediable.has(reason);
+}
 function isValidSharedDir(entry) {
-  if (typeof entry !== "string") return false;
-  if (!SAFE_SEGMENT.test(entry) || entry === "." || entry === "..") return false;
-  if (NEVER_SYNC.has(entry)) return false;
-  if (RESERVED_SHARED.has(entry)) return false;
-  return true;
+  return validateSharedDirEntry(entry) === null;
 }
-var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED;
+var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED, RESERVED_SHARED_FOLDED, WIN32_DEVICE_NAMES, UNJOINABLE_REASONS;
 var init_config_sharedDirs_guard = __esm({
   "src/config.sharedDirs.guard.ts"() {
     "use strict";
@@ -331,6 +394,19 @@ var init_config_sharedDirs_guard = __esm({
       "extras",
       "projects"
     ]);
+    RESERVED_SHARED_FOLDED = new Set([...RESERVED_SHARED].map((name) => name.toLowerCase()));
+    WIN32_DEVICE_NAMES = /* @__PURE__ */ new Set([
+      "con",
+      "prn",
+      "aux",
+      "nul",
+      ...Array.from({ length: 9 }, (_unused, i) => `com${i + 1}`),
+      ...Array.from({ length: 9 }, (_unused, i) => `lpt${i + 1}`)
+    ]);
+    UNJOINABLE_REASONS = /* @__PURE__ */ new Set([
+      "not-a-string",
+      "not-a-segment"
+    ]);
   }
 });
 
@@ -421,7 +497,6 @@ var init_settings_keys = __esm({
       "includeGitInstructions",
       "inputNeededNotifEnabled",
       "language",
-      "leftArrowOpensAgents",
       "managedMcpServers",
       "minimumVersion",
       "model",
@@ -539,19 +614,31 @@ function crashDir() {
 function manifestPath() {
   return join(home(), ".cache", "claude-nomad", `push-manifest-${encodeURIComponent(HOST)}.json`);
 }
-function allSharedLinks(map) {
+function sharedBaselinePath() {
+  return join(home(), ".cache", "claude-nomad", `shared-baseline-${encodeURIComponent(HOST)}.json`);
+}
+function allSharedLinks(map, opts = {}) {
+  const emit = opts.quiet === true ? () => void 0 : warn;
+  const raw = map.sharedDirs;
+  if (raw !== void 0 && !Array.isArray(raw)) {
+    emit("sharedDirs in path-map.json is not an array; ignoring the whole field");
+    return [...SHARED_LINKS];
+  }
   const extras = [];
-  for (const entry of map.sharedDirs ?? []) {
-    if (isValidSharedDir(entry)) {
+  for (const entry of raw ?? []) {
+    const rejection = validateSharedDirEntry(entry);
+    if (rejection === null) {
       extras.push(entry);
     } else {
-      warn(
-        `sharedDirs entry ${JSON.stringify(entry)} is invalid (path separator, reserved name, or NEVER_SYNC); skipping`
-      );
+      emit(`sharedDirs entry ${JSON.stringify(entry)} rejected: ${rejection.message}; skipping`);
     }
   }
   return [...SHARED_LINKS, ...extras];
 }
+function sharedDirEntries(map) {
+  const raw = map.sharedDirs;
+  return Array.isArray(raw) ? raw : [];
+}
 var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
   "src/config.ts"() {
@@ -1420,6 +1507,7 @@ var init_push_leak_verdict = __esm({
 // src/commands.adopt.ts
 init_config();
 init_config_sharedDirs_guard();
+init_exit_codes();
 import { cpSync as cpSync4, existsSync as existsSync5, lstatSync as lstatSync5, rmSync as rmSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 
@@ -1890,7 +1978,7 @@ function copyExtrasFileSkipDiverged(src, dst) {
   copyExtras(src, dst);
 }
 function extrasDenySet(dirname14) {
-  return dirname14 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+  return isClaudeExtraName(dirname14) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function copyExtrasFiltered(src, dst, blockSet) {
   rmSync2(dst, { recursive: true, force: true });
@@ -2131,7 +2219,7 @@ function readMapIfPresent(repoHome2) {
   return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function isConfiguredTarget(name, map) {
-  return SHARED_LINKS.includes(name) || (map.sharedDirs?.includes(name) ?? false);
+  return SHARED_LINKS.includes(name) || sharedDirEntries(map).includes(name);
 }
 function isValidAdoptName(name) {
   if (SHARED_LINKS.includes(name)) return true;
@@ -2153,6 +2241,13 @@ function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
 }
 function cmdAdopt(name, opts = {}) {
   const dryRun = opts.dryRun === true;
+  const rejection = validateSharedDirEntry(name);
+  if (rejection !== null && rejection.reason === "secret-shaped") {
+    throw new NomadFatal(
+      `cannot adopt ${JSON.stringify(name)}: ${rejection.message}. If it is listed in sharedDirs in path-map.json, remove it there too.`,
+      { code: EXIT.GENERIC_FAILURE }
+    );
+  }
   if (!isValidAdoptName(name)) {
     fail(`invalid name: ${JSON.stringify(name)}`);
     process.exit(1);
@@ -2566,6 +2661,7 @@ function cmdClean(opts, backupBase2 = backupBase()) {
 
 // src/commands.eject.ts
 init_config();
+init_config_sharedDirs_guard();
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -2703,6 +2799,19 @@ function materializeOneOrDie(name, linkPath, sharedRoot, done) {
     );
   }
 }
+var WIDENED_REASONS = /* @__PURE__ */ new Set([
+  "never-sync",
+  "reserved",
+  "secret-shaped"
+]);
+function ejectNames(map) {
+  const alreadyMaterialized = sharedDirEntries(map).filter((entry) => {
+    if (typeof entry !== "string") return false;
+    const rejection = validateSharedDirEntry(entry);
+    return rejection === null || mayJoinRefusedEntry(entry, rejection.reason, WIDENED_REASONS);
+  });
+  return [.../* @__PURE__ */ new Set([...allSharedLinks(map), ...alreadyMaterialized])];
+}
 function defaultEjectRoots() {
   return { claudeHome: claudeHome(), repoHome: repoHome() };
 }
@@ -2710,16 +2819,31 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   const dryRun = opts.dryRun === true;
   const { claudeHome: claudeHome2, repoHome: repoHome2 } = roots;
   const map = readMapIfPresent2(repoHome2);
-  const names = allSharedLinks(map);
+  const names = ejectNames(map);
   const classifications = /* @__PURE__ */ new Map();
   for (const name of names) {
     classifications.set(name, classifyName(join11(claudeHome2, name)));
   }
+  const base = new Set(allSharedLinks(map, { quiet: true }));
+  for (const name of names) {
+    if (base.has(name)) continue;
+    if (classifications.get(name) !== "materialize") continue;
+    item(`processing rejected entry already present on this host: ${name}`);
+  }
   const dangling = names.filter((n) => classifications.get(n) === "dangling");
-  if (dangling.length > 0) {
+  const danglingBase = dangling.filter((n) => base.has(n));
+  const danglingRefused = dangling.filter((n) => !base.has(n));
+  if (danglingBase.length > 0) {
+    fail(
+      `dangling symlink(s): ${danglingBase.join(", ")}. run \`nomad pull\` first to restore the missing target, then re-run \`nomad eject\``
+    );
+  }
+  if (danglingRefused.length > 0) {
     fail(
-      `dangling symlink(s): ${dangling.join(", ")}. run \`nomad pull\` first to restore the missing target, then re-run \`nomad eject\``
+      `dangling symlink(s) for a refused name nomad cannot restore: ${danglingRefused.join(", ")}. recover the content by hand if you need it, then remove the dead link and re-run \`nomad eject\``
     );
+  }
+  if (dangling.length > 0) {
     process.exit(1);
   }
   const sharedRoot = resolveSharedRoot(repoHome2);
@@ -2743,7 +2867,7 @@ import { join as join45 } from "node:path";
 init_color();
 init_config();
 import { existsSync as existsSync11, lstatSync as lstatSync8, readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
-import { join as join13 } from "node:path";
+import { basename as basename3, join as join13 } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -2818,6 +2942,61 @@ function readJsonSafe(path, label, section2) {
   }
 }
 
+// src/extras-sync.diff.ts
+init_utils();
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { relative as relative3 } from "node:path";
+var NAME_STATUS_DIFF_TIMEOUT_MS = 3e3;
+function parseNameStatus(stdout) {
+  const fields = stdout.split("\0").filter((f) => f.length > 0);
+  const entries = [];
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    entries.push({ status: fields[i], path: fields[i + 1] });
+  }
+  return entries;
+}
+function labelEntry(entry) {
+  if (entry.status === "D") return `${entry.path} (local only)`;
+  if (entry.status === "A") return `${entry.path} (repo only)`;
+  return entry.path;
+}
+function parseDiffOutput(stdout) {
+  return parseNameStatus(stdout).map(labelEntry);
+}
+function parseModifiedPaths(stdout, a) {
+  return parseNameStatus(stdout).filter((entry) => entry.status === "M").map((entry) => relative3(a, entry.path));
+}
+function runNameStatusDiff(a, b, parse) {
+  try {
+    const stdout = execFileSync2(
+      "git",
+      ["diff", "--no-index", "--no-renames", "-z", "--name-status", a, b],
+      {
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: NAME_STATUS_DIFF_TIMEOUT_MS
+      }
+    ).toString();
+    return parse(stdout);
+  } catch (err) {
+    const e = err;
+    if (e.status === 1 && e.stdout !== void 0) {
+      return parse(e.stdout.toString());
+    }
+    if (e.code === "ENOENT") {
+      warn(`git not on PATH; divergence check skipped for ${a}`);
+      return [];
+    }
+    warn(`divergence check failed for ${a}: ${e.message ?? String(err)}`);
+    return [];
+  }
+}
+function listDivergingFiles(a, b) {
+  return runNameStatusDiff(a, b, parseDiffOutput);
+}
+function listDivergingModified(a, b) {
+  return runNameStatusDiff(a, b, (stdout) => parseModifiedPaths(stdout, a));
+}
+
 // src/init.classify.ts
 init_config();
 init_utils_json();
@@ -2942,6 +3121,25 @@ function reportRepoState(section2) {
 function repoHasSharedSource(name) {
   return existsSync11(join13(repoHome(), "shared", name));
 }
+function win32CopyOkRow(name) {
+  return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)`, fail: false };
+}
+function divergingBasename(line) {
+  return basename3(line.replace(/ \((?:local|repo) only\)$/, ""));
+}
+function classifyWin32Copy(name, p) {
+  const sharedPath = join13(repoHome(), "shared", name);
+  if (!existsSync11(sharedPath)) return win32CopyOkRow(name);
+  const diverging = listDivergingFiles(p, sharedPath).filter(
+    (line) => !isDeniedName(ALWAYS_NEVER_SYNC, divergingBasename(line))
+  );
+  if (diverging.length === 0) return win32CopyOkRow(name);
+  return {
+    line: `${yellow(warnGlyph)} ${name}: ${diverging.length} file(s) diverge from shared/${name}`,
+    fail: false,
+    children: diverging
+  };
+}
 function classifySharedLink(name, p) {
   let stat;
   try {
@@ -2958,10 +3156,7 @@ function classifySharedLink(name, p) {
   }
   if (!stat.isSymbolicLink()) {
     if (process.platform === "win32") {
-      return {
-        line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)`,
-        fail: false
-      };
+      return classifyWin32Copy(name, p);
     }
     return {
       line: `${red(failGlyph)} ${name}: NOT a symlink (blocks sync); run \`nomad adopt ${name}\` to fix`,
@@ -2993,11 +3188,14 @@ function classifySymlinkTarget(name, p) {
 }
 function reportSharedLinks(section2, map) {
   const claude = claudeHome();
-  for (const name of allSharedLinks(map)) {
+  for (const name of allSharedLinks(map, { quiet: true })) {
     const p = join13(claude, name);
-    const { line, fail: fail2 } = classifySharedLink(name, p);
+    const { line, fail: fail2, children } = classifySharedLink(name, p);
     addItem(section2, line);
     if (fail2) process.exitCode = 1;
+    if (children) {
+      for (const child of children) addChildItem(section2, child);
+    }
   }
 }
 function reportDroppedNamesMigration(section2) {
@@ -3082,8 +3280,9 @@ function reportHostOverrides(section2, base, settings) {
 // src/commands.doctor.checks.pathmap.ts
 init_color();
 init_config();
-import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
-import { join as join15 } from "node:path";
+init_config_sharedDirs_guard();
+import { existsSync as existsSync13, lstatSync as lstatSync9, readdirSync as readdirSync6, realpathSync as realpathSync2 } from "node:fs";
+import { join as join15, sep as sep4 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
@@ -3123,6 +3322,95 @@ function reportCurrentHostPathsMissing(section2, map) {
     }
   }
 }
+function hasSharedLeftover(entry) {
+  try {
+    return lstatSync9(join15(repoHome(), "shared", entry), { throwIfNoEntry: false }) !== void 0;
+  } catch {
+    return false;
+  }
+}
+var PROBEABLE_REASONS = /* @__PURE__ */ new Set([
+  "never-sync",
+  "secret-shaped"
+]);
+function classifyLocalLink(entry) {
+  const linkPath = join15(claudeHome(), entry);
+  let stat;
+  try {
+    stat = lstatSync9(linkPath, { throwIfNoEntry: false });
+  } catch {
+    return "absent";
+  }
+  if (stat?.isSymbolicLink() !== true) return "absent";
+  let target;
+  try {
+    target = realpathSync2(linkPath);
+  } catch {
+    return "dangling";
+  }
+  let root;
+  try {
+    root = realpathSync2(join15(repoHome(), "shared"));
+  } catch {
+    return "foreign";
+  }
+  return target.startsWith(root + sep4) ? "managed" : "foreign";
+}
+function reportRejectedSharedDirs(section2, map) {
+  const raw = map.sharedDirs;
+  if (raw !== void 0 && !Array.isArray(raw)) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} path-map: sharedDirs is not an array (${typeof raw}); the whole field is ignored`
+    );
+    return;
+  }
+  const entries = Array.isArray(raw) ? raw : [];
+  const probable = [];
+  for (const entry of entries) {
+    const rejection = validateSharedDirEntry(entry);
+    if (rejection === null) continue;
+    if (typeof entry === "string" && mayJoinRefusedEntry(entry, rejection.reason, PROBEABLE_REASONS)) {
+      probable.push(entry);
+    }
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} path-map: sharedDirs entry ${JSON.stringify(entry)} rejected: ${rejection.message}; skipping`
+    );
+  }
+  reportRejectedLeftovers(section2, probable);
+}
+function reportRejectedLeftovers(section2, probable) {
+  for (const entry of probable) {
+    const link = classifyLocalLink(entry);
+    if (link === "managed") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a symlink under ~/.claude/ pointing into shared/; copy the content out first (cp -RL), then remove both. nomad will not do it for you`
+      );
+      continue;
+    }
+    if (link === "dangling") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a DANGLING symlink under ~/.claude/ (its target does not resolve); do not delete anything under shared/ yet, since a copy there may be the only one left. nomad cannot restore this name, because the entry is refused: recover the content by hand if you need it, then remove the dead link`
+      );
+      continue;
+    }
+    if (link === "foreign") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a symlink under ~/.claude/ pointing OUTSIDE shared/; nomad does not manage it, so leave it alone and just drop the entry from sharedDirs`
+      );
+    }
+    if (hasSharedLeftover(entry)) {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: shared/ entry ${JSON.stringify(entry)} exists in the repo working tree; remove it by hand, nomad will not delete it`
+      );
+    }
+  }
+}
 function reportPathCollisions(section2, map) {
   const seen = /* @__PURE__ */ new Map();
   let collisionCount = 0;
@@ -3154,6 +3442,7 @@ function reportPathMap(section2) {
   }
   const map = readJsonSafe(mapPath, mapPath, section2);
   if (map === null) return;
+  reportRejectedSharedDirs(section2, map);
   const shapeError = validatePathMapShape(map);
   if (shapeError !== null) {
     addItem(section2, `${red(failGlyph)} ${shapeError}`);
@@ -3179,61 +3468,6 @@ init_color();
 import { existsSync as existsSync14 } from "node:fs";
 import { join as join16 } from "node:path";
 init_config();
-
-// src/extras-sync.diff.ts
-init_utils();
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { relative as relative3 } from "node:path";
-function parseNameStatus(stdout) {
-  const fields = stdout.split("\0").filter((f) => f.length > 0);
-  const entries = [];
-  for (let i = 0; i + 1 < fields.length; i += 2) {
-    entries.push({ status: fields[i], path: fields[i + 1] });
-  }
-  return entries;
-}
-function labelEntry(entry) {
-  if (entry.status === "D") return `${entry.path} (local only)`;
-  if (entry.status === "A") return `${entry.path} (repo only)`;
-  return entry.path;
-}
-function parseDiffOutput(stdout) {
-  return parseNameStatus(stdout).map(labelEntry);
-}
-function parseModifiedPaths(stdout, a) {
-  return parseNameStatus(stdout).filter((entry) => entry.status === "M").map((entry) => relative3(a, entry.path));
-}
-function runNameStatusDiff(a, b, parse) {
-  try {
-    const stdout = execFileSync2(
-      "git",
-      ["diff", "--no-index", "--no-renames", "-z", "--name-status", a, b],
-      {
-        stdio: ["ignore", "pipe", "pipe"]
-      }
-    ).toString();
-    return parse(stdout);
-  } catch (err) {
-    const e = err;
-    if (e.status === 1 && e.stdout !== void 0) {
-      return parse(e.stdout.toString());
-    }
-    if (e.code === "ENOENT") {
-      warn(`git not on PATH; divergence check skipped for ${a}`);
-      return [];
-    }
-    warn(`divergence check failed for ${a}: ${e.message ?? String(err)}`);
-    return [];
-  }
-}
-function listDivergingFiles(a, b) {
-  return runNameStatusDiff(a, b, parseDiffOutput);
-}
-function listDivergingModified(a, b) {
-  return runNameStatusDiff(a, b, (stdout) => parseModifiedPaths(stdout, a));
-}
-
-// src/commands.doctor.checks.skills.ts
 function stripSideIndicator(line) {
   if (line.endsWith(" (local only)")) return line.slice(0, -" (local only)".length);
   if (line.endsWith(" (repo only)")) return line.slice(0, -" (repo only)".length);
@@ -3241,15 +3475,15 @@ function stripSideIndicator(line) {
 }
 function isGsdDiffLine(line, localBase, sharedBase) {
   const bare = stripSideIndicator(line);
-  let relative9;
+  let relative11;
   if (bare.startsWith(localBase + "/")) {
-    relative9 = bare.slice(localBase.length + 1);
+    relative11 = bare.slice(localBase.length + 1);
   } else if (bare.startsWith(sharedBase + "/")) {
-    relative9 = bare.slice(sharedBase.length + 1);
+    relative11 = bare.slice(sharedBase.length + 1);
   } else {
-    relative9 = bare;
+    relative11 = bare;
   }
-  return relative9.split("/")[0].startsWith(GSD_PREFIX);
+  return relative11.split("/")[0].startsWith(GSD_PREFIX);
 }
 function reportSkillsDivergence(section2) {
   const sharedSkills = join16(repoHome(), "shared", "skills");
@@ -3404,7 +3638,7 @@ function reportGitIdentity(section2) {
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync18, lstatSync as lstatSync9, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync18, lstatSync as lstatSync10, readdirSync as readdirSync8 } from "node:fs";
 import { join as join21 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
@@ -3422,7 +3656,7 @@ function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
     const full = join21(dir, entry);
-    const st = lstatSync9(full, { throwIfNoEntry: false });
+    const st = lstatSync10(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) bytes += dirSizeBytes(full);
@@ -3901,8 +4135,8 @@ init_config();
 
 // src/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync10, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join28, relative as relative5, sep as sep4 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync10, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
+import { dirname as dirname6, join as join28, relative as relative5, sep as sep5 } from "node:path";
 init_config();
 
 // src/push-manifest.ts
@@ -4034,7 +4268,7 @@ function copyFileAtomic(src, dst) {
   renameAtomicRetry(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
-  const prefix = `${localDir}${sep4}`;
+  const prefix = `${localDir}${sep5}`;
   for (const p of sel.changed) if (p.startsWith(prefix)) return true;
   for (const p of sel.deleted) if (p.startsWith(prefix)) return true;
   return false;
@@ -4043,7 +4277,7 @@ function skipForSelection(sel, localDir) {
   return sel !== void 0 && !hasDeltaForDir(sel, localDir);
 }
 function applySelective(sel, localDir, repoDst) {
-  const prefix = `${localDir}${sep4}`;
+  const prefix = `${localDir}${sep5}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
     copyFileAtomic(src, join28(repoDst, relative5(localDir, src)));
@@ -4061,7 +4295,7 @@ function copyDirJsonlOnly(src, dst) {
     filter: (srcPath) => {
       const rel = relative5(src, srcPath);
       if (rel === "") return true;
-      if (rel.split(sep4).length > 1) return true;
+      if (rel.split(sep5).length > 1) return true;
       if (statSync5(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       item(`skip ${rel}: extension not in allowlist`);
@@ -4121,9 +4355,9 @@ function countLocalOnly(src, dst) {
   for (const name of readdirSync10(dst)) {
     const dstPath = join28(dst, name);
     const srcPath = join28(src, name);
-    if (lstatSync10(dstPath).isDirectory()) {
+    if (lstatSync11(dstPath).isDirectory()) {
       count += countLocalOnly(srcPath, dstPath);
-    } else if (lstatSync10(srcPath, { throwIfNoEntry: false }) === void 0) {
+    } else if (lstatSync11(srcPath, { throwIfNoEntry: false }) === void 0) {
       count++;
     }
   }
@@ -4313,7 +4547,7 @@ function reportCheckShared(section2, gitleaksReady) {
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync3 } from "node:fs";
 import { dirname as dirname7, extname, join as join30 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
@@ -4330,7 +4564,7 @@ function effectiveType(hookPath) {
   if (ext === ".cjs") return "cjs";
   let real;
   try {
-    real = realpathSync2(hookPath);
+    real = realpathSync3(hookPath);
   } catch {
     return null;
   }
@@ -4492,7 +4726,7 @@ import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:
 import { join as join33 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
 import { dirname as dirname8, join as join32, resolve as resolve2 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
@@ -4537,7 +4771,7 @@ function specifierIsMissing(specifier, baseDir) {
 function relativeRequireTargetsBroken(scriptPath) {
   let realPath;
   try {
-    realPath = realpathSync3(scriptPath);
+    realPath = realpathSync4(scriptPath);
   } catch {
     return false;
   }
@@ -4681,7 +4915,7 @@ function reportPreserveSymlinksCheck(section2) {
     return;
   }
   const map = readPathMapSafe();
-  const sharedLinkNames = allSharedLinks(map);
+  const sharedLinkNames = allSharedLinks(map, { quiet: true });
   let anyWarn = false;
   for (const [event, groups] of Object.entries(hooks)) {
     if (!Array.isArray(groups)) continue;
@@ -5031,21 +5265,21 @@ import { createInterface as createInterface2 } from "node:readline/promises";
 // src/commands.push.recovery.actions.ts
 init_config();
 import { readFileSync as readFileSync17 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep8 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep9 } from "node:path";
 
 // src/commands.push.recovery.memory.ts
 init_config();
 init_config_sharedDirs_guard();
 import {
   cpSync as cpSync7,
-  lstatSync as lstatSync11,
+  lstatSync as lstatSync12,
   mkdirSync as mkdirSync9,
   readFileSync as readFileSync14,
-  realpathSync as realpathSync4,
+  realpathSync as realpathSync5,
   statSync as statSync6,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname9, join as join36, sep as sep5 } from "node:path";
+import { dirname as dirname9, join as join36, sep as sep6 } from "node:path";
 init_push_gitleaks_scan();
 
 // src/rel-path-guard.ts
@@ -5076,12 +5310,12 @@ function resolveMemoryLocalPath(logical, relPath, map) {
   if (abs === void 0) return null;
   const memoryRoot = join36(claudeHome(), "projects", encodePath(abs), "memory");
   const localPath = join36(memoryRoot, ...relPath.split("/"));
-  if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep5)) return null;
+  if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep6)) return null;
   try {
-    if (lstatSync11(localPath).isSymbolicLink()) return null;
-    const realLocal = realpathSync4(localPath);
-    const realRoot = realpathSync4(memoryRoot);
-    if (!realLocal.startsWith(realRoot + sep5)) return null;
+    if (lstatSync12(localPath).isSymbolicLink()) return null;
+    const realLocal = realpathSync5(localPath);
+    const realRoot = realpathSync5(memoryRoot);
+    if (!realLocal.startsWith(realRoot + sep6)) return null;
     if (!statSync6(realLocal).isFile()) return null;
   } catch {
     return null;
@@ -5139,28 +5373,28 @@ function applyMemoryRedact(f, ts, map, scan = scanFile) {
 init_config();
 import {
   cpSync as cpSync8,
-  lstatSync as lstatSync13,
+  lstatSync as lstatSync14,
   mkdirSync as mkdirSync11,
   readFileSync as readFileSync15,
-  realpathSync as realpathSync5,
+  realpathSync as realpathSync6,
   statSync as statSync7,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname10, join as join38, sep as sep6 } from "node:path";
+import { dirname as dirname10, join as join38, sep as sep7 } from "node:path";
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync29, lstatSync as lstatSync12, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync29, lstatSync as lstatSync13, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
 import { join as join37 } from "node:path";
 
 // src/skills-sync.tracked.ts
 init_utils();
-import { basename as basename3 } from "node:path";
+import { basename as basename4 } from "node:path";
 function trackedRootSkillsAt(ref, repo) {
   try {
     const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
     const entries = raw.split("\0").filter((entry) => entry !== "");
-    return new Set(entries.map((entry) => basename3(entry)));
+    return new Set(entries.map((entry) => basename4(entry)));
   } catch {
     return /* @__PURE__ */ new Set();
   }
@@ -5190,7 +5424,7 @@ function syncSkillsPull(ts, prePostHeads) {
   if (!existsSync29(sharedSkills)) return;
   const localSkills = join37(claudeHome(), "skills");
   backupBeforeWrite(localSkills, ts);
-  const dstStat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  const dstStat = lstatSync13(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     rmSync13(localSkills, { recursive: true, force: true });
     mkdirSync10(localSkills, { recursive: true });
@@ -5200,7 +5434,7 @@ function syncSkillsPull(ts, prePostHeads) {
 }
 function syncSkillsPush() {
   const localSkills = join37(claudeHome(), "skills");
-  const stat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  const stat = lstatSync13(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
   const sharedSkills = join37(repoHome(), "shared", "skills");
@@ -5229,12 +5463,12 @@ function resolveSkillLocalPath(name, relPath) {
   const skillsRoot = join38(claudeHome(), "skills");
   const skillRoot = join38(skillsRoot, name);
   const localPath = join38(skillRoot, ...relPath.split("/"));
-  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep6)) return null;
+  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep7)) return null;
   try {
-    if (lstatSync13(localPath).isSymbolicLink()) return null;
-    const realLocal = realpathSync5(localPath);
-    const realRoot = realpathSync5(skillsRoot);
-    if (!realLocal.startsWith(realRoot + sep6)) return null;
+    if (lstatSync14(localPath).isSymbolicLink()) return null;
+    const realLocal = realpathSync6(localPath);
+    const realRoot = realpathSync6(skillsRoot);
+    if (!realLocal.startsWith(realRoot + sep7)) return null;
     if (!statSync7(realLocal).isFile()) return null;
   } catch {
     return null;
@@ -5359,7 +5593,7 @@ function applyDeferredAllows(findings, state, repo) {
 init_config();
 init_config_sharedDirs_guard();
 import { cpSync as cpSync9, existsSync as existsSync32, mkdirSync as mkdirSync12 } from "node:fs";
-import { dirname as dirname12, join as join41, sep as sep7 } from "node:path";
+import { dirname as dirname12, join as join41, sep as sep8 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
@@ -5367,17 +5601,17 @@ import { existsSync as existsSync31 } from "node:fs";
 import { dirname as dirname11, join as join40 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync30, lstatSync as lstatSync14, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync30, lstatSync as lstatSync15, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join39 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
   if (!existsSync30(dir)) return;
-  const st = lstatSync14(dir);
+  const st = lstatSync15(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync14(dir)) {
     const abs = join39(dir, entry);
-    const lst = lstatSync14(abs);
+    const lst = lstatSync15(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -5585,7 +5819,7 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep7)) {
+    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep8)) {
       return join41(repo, "shared", "projects", logical);
     }
   }
@@ -5876,8 +6110,8 @@ function sessionSuffix(finding) {
   const sid = sessionIdFromFinding(finding);
   if (sid === null) return "";
   const rawBasename = finding.File.replace(/^.*\//, "");
-  const basename4 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
-  return basename4 === sid ? "" : ` (session: ${sid})`;
+  const basename5 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
+  return basename5 === sid ? "" : ` (session: ${sid})`;
 }
 function renderFindingBlock(finding, readLine, siblings = []) {
   const lines = [`  file:  ${finding.File}:${finding.StartLine}${sessionSuffix(finding)}`];
@@ -5949,7 +6183,7 @@ function makeDefaultReadLine(repo) {
     try {
       const repoRoot = resolve3(repo);
       const target = resolve3(repoRoot, file);
-      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep8)) {
+      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep9)) {
         return null;
       }
       let lines = cache.get(target);
@@ -6843,8 +7077,8 @@ function unstageOne(rel, repo) {
 
 // src/commands.pull.ts
 init_autostash_guard();
-import { existsSync as existsSync42, mkdirSync as mkdirSync14 } from "node:fs";
-import { join as join53 } from "node:path";
+import { existsSync as existsSync46, mkdirSync as mkdirSync14 } from "node:fs";
+import { join as join58 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -6959,11 +7193,11 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync16, readFileSync as readFileSync19, realpathSync as realpathSync6, rmSync as rmSync16 } from "node:fs";
-import { dirname as dirname13, join as join49, sep as sep10 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync16, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
+import { dirname as dirname13, join as join49, sep as sep11 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
-import { join as join48, normalize as normalize2, sep as sep9 } from "node:path";
+import { join as join48, normalize as normalize2, sep as sep10 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -7016,7 +7250,7 @@ function planningDeleteTargets(opts) {
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
   const planningRoot = join48(localRoot, ".planning");
-  const planningRootBoundary = planningRoot + sep9;
+  const planningRootBoundary = planningRoot + sep10;
   const targets = [];
   for (const repoPath of deleted) {
     if (!repoPath.startsWith(prefix)) {
@@ -7058,7 +7292,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
 }
 function pruneEmptyAncestors(target, planningRoot) {
   let dir = dirname13(target);
-  while (dir !== planningRoot && dir.startsWith(planningRoot + sep10)) {
+  while (dir !== planningRoot && dir.startsWith(planningRoot + sep11)) {
     try {
       if (readdirSync16(dir).length > 0) break;
       rmSync16(dir, { recursive: true, force: true });
@@ -7070,13 +7304,13 @@ function pruneEmptyAncestors(target, planningRoot) {
 }
 function tryRealpath(dir) {
   try {
-    return realpathSync6(dir);
+    return realpathSync7(dir);
   } catch {
     return void 0;
   }
 }
 function isInsidePlanningRoot(parentReal, rootReal) {
-  return parentReal === rootReal || parentReal.startsWith(rootReal + sep10);
+  return parentReal === rootReal || parentReal.startsWith(rootReal + sep11);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   if (existsSync38(repoCounterpart)) return;
@@ -7103,11 +7337,11 @@ function planningDiffArgs(pre, post, logical) {
 function deletePairsFor(t, raw) {
   return planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot }).map(
     (target) => {
-      const relToLocal = target.slice(t.localRoot.length + sep10.length);
+      const relToLocal = target.slice(t.localRoot.length + sep11.length);
       return {
         target,
         relToLocal,
-        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep10).join("/")}`
+        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep11).join("/")}`
       };
     }
   );
@@ -7279,10 +7513,204 @@ function divergenceCheckExtras(ts, prePostHeads) {
   return divergedCount;
 }
 
-// src/preview.ts
+// src/links.baseline.ts
+init_config();
+import { lstatSync as lstatSync16, readdirSync as readdirSync17 } from "node:fs";
+import { join as join51, relative as relative7, sep as sep12 } from "node:path";
+init_utils();
+var SHARED_BASELINE_KIND = "shared-links-baseline/1";
+var SHARED_BASELINE_CONFIG_HASH = "not-applicable";
+function readSharedBaseline() {
+  const parsed = readManifest(sharedBaselinePath());
+  if (parsed === null) return null;
+  if (parsed.scannerVersion !== SHARED_BASELINE_KIND) return null;
+  return parsed;
+}
+function baselineKey(claude, abs) {
+  return relative7(claude, abs).split(sep12).join("/");
+}
+function addLocalPath(abs, claude, scan) {
+  const key = baselineKey(claude, abs);
+  let st;
+  try {
+    st = lstatSync16(abs, { throwIfNoEntry: false });
+  } catch {
+    scan.declined.push(key);
+    return;
+  }
+  if (st === void 0) return;
+  if (st.isSymbolicLink()) {
+    scan.declined.push(key);
+    return;
+  }
+  if (st.isDirectory()) {
+    collectSharedFiles(abs, claude, scan);
+    return;
+  }
+  scan.files[key] = { size: st.size, mtime: st.mtimeMs };
+}
+function collectSharedFiles(dir, claude, scan) {
+  let entries;
+  try {
+    entries = readdirSync17(dir);
+  } catch {
+    scan.declined.push(baselineKey(claude, dir));
+    return;
+  }
+  for (const entry of entries) {
+    const abs = join51(dir, entry);
+    if (isDeniedName(ALWAYS_NEVER_SYNC, entry)) {
+      scan.declined.push(baselineKey(claude, abs));
+      continue;
+    }
+    addLocalPath(abs, claude, scan);
+  }
+}
+function enumerateLocalSharedScan(map) {
+  const claude = claudeHome();
+  const scan = { files: {}, declined: [] };
+  for (const name of allSharedLinks(map)) {
+    if (isDeniedName(ALWAYS_NEVER_SYNC, name)) {
+      scan.declined.push(name);
+      continue;
+    }
+    addLocalPath(join51(claude, name), claude, scan);
+  }
+  return scan;
+}
+function enumerateLocalSharedFiles(map) {
+  return enumerateLocalSharedScan(map).files;
+}
+function buildSharedBaseline(map) {
+  const claude = claudeHome();
+  const files = {};
+  for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map))) {
+    try {
+      files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join51(claude, key)) };
+    } catch {
+    }
+  }
+  return buildManifest(files, SHARED_BASELINE_KIND, SHARED_BASELINE_CONFIG_HASH);
+}
+function writeSharedBaseline(map) {
+  if (process.platform !== "win32") return;
+  try {
+    writeManifest(sharedBaselinePath(), buildSharedBaseline(map));
+  } catch (err) {
+    warn(`could not record the shared-config baseline: ${err.message}`);
+  }
+}
+
+// src/commands.pull.win32.ts
 init_config();
-import { existsSync as existsSync41 } from "node:fs";
+import { existsSync as existsSync44 } from "node:fs";
+import { join as join56 } from "node:path";
+
+// src/git-probe.ts
+import { execFileSync as execFileSync21 } from "node:child_process";
+var PROBE_TIMEOUT_MS4 = 1e4;
+var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
+function gitProbe(args, repo) {
+  try {
+    return execFileSync21("git", args, {
+      cwd: repo,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: PROBE_TIMEOUT_MS4,
+      maxBuffer: PROBE_MAX_BUFFER
+    }).toString();
+  } catch {
+    return null;
+  }
+}
+
+// src/links.captures.ts
+init_config();
+import { existsSync as existsSync40, lstatSync as lstatSync17 } from "node:fs";
 import { join as join52 } from "node:path";
+function planSharedLinkCaptures(map) {
+  if (process.platform !== "win32") return [];
+  if (map === null) return [];
+  const claude = claudeHome();
+  const repo = repoHome();
+  const plan = [];
+  for (const name of allSharedLinks(map)) {
+    const localPath = join52(claude, name);
+    let stat;
+    try {
+      stat = lstatSync17(localPath, { throwIfNoEntry: false });
+    } catch {
+      continue;
+    }
+    if (stat === void 0) continue;
+    if (stat.isSymbolicLink()) continue;
+    const repoPath = join52(repo, "shared", name);
+    if (!existsSync40(repoPath)) continue;
+    plan.push({ name, localPath, repoPath });
+  }
+  return plan;
+}
+
+// src/links.deletions.ts
+init_config();
+import { existsSync as existsSync41, lstatSync as lstatSync18, rmSync as rmSync17 } from "node:fs";
+import { join as join53, relative as relative8, resolve as resolve4, sep as sep13 } from "node:path";
+init_utils();
+init_utils_fs();
+function isUnknown(declined, key) {
+  return declined.some((prefix) => key === prefix || key.startsWith(`${prefix}/`));
+}
+function deletionFor(key, names, claude, sharedRoot) {
+  const segments = key.split("/");
+  const name = segments[0];
+  if (!names.has(name)) return null;
+  if (!existsSync41(join53(claude, name))) return null;
+  if (segments.some((segment) => isDeniedName(ALWAYS_NEVER_SYNC, segment))) return null;
+  const repoPath = resolve4(sharedRoot, key);
+  const rel = relative8(join53(sharedRoot, name), repoPath);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep13}`)) return null;
+  if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
+    return null;
+  if (!existsSync41(repoPath)) return null;
+  return { name, localPath: join53(claude, key), repoPath };
+}
+function planSharedLinkDeletions(map) {
+  if (process.platform !== "win32") return [];
+  if (map === null) return [];
+  const baseline = readSharedBaseline();
+  if (baseline === null) return [];
+  const claude = claudeHome();
+  const sharedRoot = join53(repoHome(), "shared");
+  const scan = enumerateLocalSharedScan(map);
+  const present = new Set(Object.keys(scan.files).map((key) => key.toLowerCase()));
+  const declined = scan.declined.map((path) => path.toLowerCase());
+  const names = new Set(allSharedLinks(map));
+  const plan = [];
+  for (const key of Object.keys(baseline.files)) {
+    const folded = key.toLowerCase();
+    if (present.has(folded)) continue;
+    if (isUnknown(declined, folded)) continue;
+    const entry = deletionFor(key, names, claude, sharedRoot);
+    if (entry !== null) plan.push(entry);
+  }
+  return plan;
+}
+function applySharedLinkDeletions(map, ts) {
+  const repo = repoHome();
+  for (const entry of planSharedLinkDeletions(map)) {
+    try {
+      if (!lstatSync18(entry.repoPath).isFile()) continue;
+      backupRepoWrite(entry.repoPath, ts, repo);
+      rmSync17(entry.repoPath, { force: true });
+    } catch (err) {
+      warn(`could not remove ${entry.repoPath}: ${err.message}`);
+    }
+  }
+}
+
+// src/preview.ts
+init_config();
+import { existsSync as existsSync43 } from "node:fs";
+import { join as join55 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -7557,16 +7985,16 @@ function diffLinesToUnified(oldStr, newStr) {
 
 // src/preview.skills.ts
 init_config();
-import { existsSync as existsSync40, readdirSync as readdirSync17 } from "node:fs";
-import { join as join51 } from "node:path";
+import { existsSync as existsSync42, readdirSync as readdirSync18 } from "node:fs";
+import { join as join54 } from "node:path";
 function buildSkillsPreviewSection() {
   const s = section("Skills");
-  const sharedSkills = join51(repoHome(), "shared", "skills");
-  if (!existsSync40(sharedSkills)) return s;
-  const sharedNames = readdirSync17(sharedSkills, { encoding: "utf8" }).filter((name) => !isSkillExcluded(name)).sort((a, b) => a.localeCompare(b, "en"));
+  const sharedSkills = join54(repoHome(), "shared", "skills");
+  if (!existsSync42(sharedSkills)) return s;
+  const sharedNames = readdirSync18(sharedSkills, { encoding: "utf8" }).filter((name) => !isSkillExcluded(name)).sort((a, b) => a.localeCompare(b, "en"));
   for (const name of sharedNames) addItem(s, name);
-  const localSkills = join51(claudeHome(), "skills");
-  const localOnly = existsSync40(localSkills) ? readdirSync17(localSkills, { encoding: "utf8" }).filter(
+  const localSkills = join54(claudeHome(), "skills");
+  const localOnly = existsSync42(localSkills) ? readdirSync18(localSkills, { encoding: "utf8" }).filter(
     (name) => !isSkillExcluded(name) && !sharedNames.includes(name)
   ).length : 0;
   if (localOnly > 0) {
@@ -7588,7 +8016,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync41(path)) return null;
+  if (!existsSync43(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -7602,12 +8030,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync41(hostPath)) {
+  if (hostOverrides === null && existsSync43(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = stripGsdHookEntries(deepMerge(base, hostOverrides ?? {}));
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync41(settingsPath)) {
+  if (current === null && existsSync43(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const strippedCurrent = stripGsdHookEntries(current ?? {});
@@ -7623,6 +8051,12 @@ function formatLinkRow(e) {
   if (e.kind === "copy") return `would copy  ${e.from} -> ${e.to}`;
   return `${e.kind}  ${e.from} -> ${e.to}`;
 }
+function formatCaptureRow(c) {
+  return `would capture  ${c.localPath} -> ${c.repoPath}`;
+}
+function formatDeletionRow(d) {
+  return `would remove  ${d.repoPath} (gone from ${d.localPath})`;
+}
 function formatSessionRow(e) {
   return e.kind === "overwrite" ? `overwrite  ${e.dst} (from ${e.src})` : e.text;
 }
@@ -7638,20 +8072,30 @@ function buildSettingsSectionForPreview(result) {
   }
   return s;
 }
-function computePreview(ts, map, verb = "pull") {
+function computePreview(ts, map, verb = "pull", plans) {
   const repo = repoHome();
   const claude = claudeHome();
   console.log(`would pull on host=${HOST} (preview; nothing applied)`);
   console.log("");
   const links = section("Symlinks");
+  const { captures, deletions } = plans ?? {
+    captures: planSharedLinkCaptures(map),
+    deletions: planSharedLinkDeletions(map)
+  };
+  for (const capture of captures) {
+    addItem(links, formatCaptureRow(capture));
+  }
+  for (const deletion of deletions) {
+    addItem(links, formatDeletionRow(deletion));
+  }
   applySharedLinks(ts, map, {
     dryRun: true,
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join52(repo, "shared", "settings.base.json"),
-    join52(repo, "hosts", `${HOST}.json`),
-    join52(claude, "settings.json")
+    join55(repo, "shared", "settings.base.json"),
+    join55(repo, "hosts", `${HOST}.json`),
+    join55(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -7667,7 +8111,7 @@ function computePreview(ts, map, verb = "pull") {
   const extras = section("Extras");
   let extrasSkipped = 0;
   let extrasUnmapped = 0;
-  if (existsSync41(join52(repo, "path-map.json")) && existsSync41(join52(repo, "shared", "extras"))) {
+  if (existsSync43(join55(repo, "path-map.json")) && existsSync43(join55(repo, "shared", "extras"))) {
     const extrasResult = remapExtrasPull(ts, { dryRun: true });
     for (const entry of extrasResult.wouldPull) {
       addItem(extras, entry);
@@ -7684,6 +8128,135 @@ function computePreview(ts, map, verb = "pull") {
   return { unmapped: remapResult.unmapped, collisions: 0, localOnly };
 }
 
+// src/commands.pull.win32.ts
+init_utils();
+init_utils_json();
+function readMapForMirror(mapPath) {
+  if (!existsSync44(mapPath)) return { projects: {} };
+  try {
+    return readPathMap(mapPath);
+  } catch {
+    return null;
+  }
+}
+function untrackedUnderShared(repo) {
+  const out = gitProbe(["ls-files", "--others", "--exclude-standard", "-z", "--", "shared/"], repo);
+  if (out === null) return null;
+  return new Set(out.split("\0").filter((p) => p !== ""));
+}
+function newlyUntracked(before, after) {
+  if (before === null || after === null) return [];
+  return [...after].filter((p) => !before.has(p));
+}
+function reconcileSharedLinksBeforePull(repo, ts) {
+  if (process.platform !== "win32") return [];
+  const before = untrackedUnderShared(repo);
+  try {
+    const map = readMapForMirror(join56(repo, "path-map.json"));
+    stageLocalSharedEdits(map, ts);
+    applySharedLinkDeletions(map, ts);
+  } catch (err) {
+    warn(`could not reconcile local shared edits before the pull: ${err.message}`);
+  }
+  return newlyUntracked(before, untrackedUnderShared(repo));
+}
+function planSharedReconcileBeforePull(repo) {
+  const map = readMapForMirror(join56(repo, "path-map.json"));
+  return { captures: planSharedLinkCaptures(map), deletions: planSharedLinkDeletions(map) };
+}
+
+// src/commands.pull.collision.ts
+init_config();
+init_exit_codes();
+import { existsSync as existsSync45, lstatSync as lstatSync19, readFileSync as readFileSync20, rmSync as rmSync18 } from "node:fs";
+import { join as join57 } from "node:path";
+init_utils();
+var SHARED_PREFIX = /^shared\//;
+var EXTENSION = /(\.[^.]+)?$/;
+function localOriginal(repoRel) {
+  return `~/.claude/${repoRel.replace(SHARED_PREFIX, "")}`;
+}
+function renameSuggestion(localPath) {
+  const base = localPath.slice(localPath.lastIndexOf("/") + 1);
+  return base.replace(EXTENSION, ".local$1");
+}
+function collisionSteps(locals) {
+  const single = locals.length === 1;
+  const target = single ? locals[0] : "each file listed above";
+  const rename = single ? renameSuggestion(locals[0]) : "mine.md becomes mine.local.md";
+  const combine = single ? "combine the two files" : "combine each pair";
+  return `Keep the incoming version (yours is set aside, not deleted):
+  1. move ${target} outside ~/.claude/
+  2. nomad pull
+
+Keep both and merge them yourself:
+  1. rename ${target} to a name the repo does not use (${rename})
+  2. nomad pull                      (brings in the other machine's version)
+  3. ${combine}, then nomad push`;
+}
+function collisionAdvice(single, cleared) {
+  const copies = single ? "nomad's copy" : "nomad's copies";
+  const them = single ? "it" : "them";
+  const fate = cleared ? "which nomad has now removed for you" : `which nomad could not remove (the warning above says why), so delete ${them} by hand if the next pull stops here again`;
+  const moving = single ? "Moving only that copy would not have cleared this anyway: the next pull re-copies your local file over it before fetching. The file to move is the one under ~/.claude/." : "Moving only those copies would not have cleared this anyway: the next pull re-copies your local files over them before fetching. The files to move are the ones under ~/.claude/.";
+  return `Git's advice above refers to ${copies} inside the sync repo, ${fate}. ${moving}`;
+}
+function untrackedCollisionRunbookText(repoRelPaths, cleared) {
+  const locals = repoRelPaths.map(localOriginal);
+  const single = locals.length === 1;
+  const claim = single ? "One of those copies has the same name as a file the incoming update also adds:" : "Each of the copies below has the same name as a file the incoming update also adds:";
+  const intact = single ? "Your file is still exactly as you left it." : "Your files are still exactly as you left them.";
+  const listed = locals.map((p) => `  ${p}`).join("\n");
+  return `nomad pull could not fetch. Your machine had unpublished shared-config edits, so nomad copied them into the sync repo first, the way an edit on macOS or Linux is already in the repo before a pull starts. ${claim}
+
+${listed}
+
+Nothing changed. Your ~/.claude/ config is untouched, the update did not land, and nothing was published. ${intact}
+
+${collisionAdvice(single, cleared)}
+
+` + collisionSteps(locals);
+}
+function addedByIncomingUpdate(repo, created) {
+  return created.filter((rel) => gitProbe(["cat-file", "-e", `FETCH_HEAD:${rel}`], repo) !== null);
+}
+function isContainedMirrorPath(rel) {
+  return rel.startsWith("shared/") && isSafeRelPath(rel);
+}
+function matchesLocalOriginal(repo, rel) {
+  try {
+    const local = join57(claudeHome(), rel.replace(SHARED_PREFIX, ""));
+    return readFileSync20(join57(repo, rel)).equals(readFileSync20(local));
+  } catch {
+    return false;
+  }
+}
+function removeMirroredCopies(repo, repoRelPaths) {
+  for (const rel of repoRelPaths.filter(isContainedMirrorPath)) {
+    const abs = join57(repo, rel);
+    try {
+      if (lstatSync19(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
+      if (!matchesLocalOriginal(repo, rel)) continue;
+      rmSync18(abs, { force: true });
+    } catch (err) {
+      warn(`could not remove nomad's copy at ${abs}: ${err.message}`);
+    }
+  }
+  return repoRelPaths.every((rel) => !existsSync45(join57(repo, rel)));
+}
+function pullWithCollisionRunbook(repo, mirrored) {
+  try {
+    gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
+  } catch (err) {
+    const colliding = addedByIncomingUpdate(repo, mirrored);
+    if (colliding.length === 0) throw err;
+    const cleared = removeMirroredCopies(repo, colliding);
+    throw new NomadFatal(untrackedCollisionRunbookText(colliding, cleared), {
+      code: EXIT.GENERIC_FAILURE
+    });
+  }
+}
+
 // src/commands.pull.ts
 init_commands_pull_wedge();
 
@@ -7694,9 +8267,9 @@ init_utils_fs();
 
 // src/commands.pull.recovery.git.ts
 init_utils();
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 function gitCapture(args, cwd) {
-  return execFileSync21("git", args, {
+  return execFileSync22("git", args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     maxBuffer: 64 * 1024 * 1024
@@ -7849,6 +8422,7 @@ function capturePrePostHeads(repo, rebase) {
 }
 function buildWetPullSections(ts, map, prePostHeads) {
   applySharedLinks(ts, map);
+  writeSharedBaseline(map);
   const { label } = regenerateSettings(ts);
   syncSkillsPull(ts, prePostHeads);
   const remapResult = withSpinner("Syncing sessions", () => remapPull(ts));
@@ -7888,22 +8462,6 @@ function handleWedge(repo, forceRemote) {
   const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
   die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
 }
-function readMapForMirror(mapPath) {
-  if (!existsSync42(mapPath)) return { projects: {} };
-  try {
-    return readPathMap(mapPath);
-  } catch {
-    return null;
-  }
-}
-function mirrorSharedLinksBeforePull(repo, ts) {
-  if (process.platform !== "win32") return;
-  try {
-    stageLocalSharedEdits(readMapForMirror(join53(repo, "path-map.json")), ts);
-  } catch (err) {
-    warn(`could not stage local shared edits before the pull: ${err.message}`);
-  }
-}
 function runPullCore(opts = {}) {
   const dryRun = opts.dryRun === true;
   const forceRemote = opts.forceRemote === true;
@@ -7913,7 +8471,7 @@ function runPullCore(opts = {}) {
   const ts = freshBackupTs(backup);
   handleWedge(repo, forceRemote);
   if (!dryRun) {
-    const backupRoot = join53(backup, ts);
+    const backupRoot = join58(backup, ts);
     try {
       mkdirSync14(backupRoot, { recursive: true });
     } catch (err) {
@@ -7925,16 +8483,17 @@ function runPullCore(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
   }
-  if (!dryRun && !forceRemote) mirrorSharedLinksBeforePull(repo, ts);
+  const mirrored = !dryRun && !forceRemote ? reconcileSharedLinksBeforePull(repo, ts) : [];
+  const sharedPlans = dryRun ? planSharedReconcileBeforePull(repo) : void 0;
   const prePostHeads = capturePrePostHeads(repo, () => {
-    gitOrFatal(["pull", "--rebase", "--autostash"], "git pull --rebase", repo);
+    pullWithCollisionRunbook(repo, mirrored);
   });
   assertNoAutostashConflict(repo, "nomad pull");
-  const mapPath = join53(repo, "path-map.json");
-  const map = existsSync42(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join58(repo, "path-map.json");
+  const map = existsSync46(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
-    computePreview(ts, map, "pull");
+    computePreview(ts, map, "pull", sharedPlans);
     return { tag: "dry" };
   }
   const { sections, localOnly, settingsLabel, unmapped, extrasSkipped } = buildWetPullSections(
@@ -7956,8 +8515,8 @@ function runPullCore(opts = {}) {
 }
 function cmdPull(opts = {}) {
   const repo = repoHome();
-  if (!existsSync42(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync42(join53(repo, "shared", "settings.base.json"))) {
+  if (!existsSync46(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync46(join58(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -7980,13 +8539,13 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync46 } from "node:fs";
-import { join as join58 } from "node:path";
+import { existsSync as existsSync50 } from "node:fs";
+import { join as join63 } from "node:path";
 
 // src/commands.push.selection.ts
 init_config();
-import { existsSync as existsSync43, statSync as statSync11 } from "node:fs";
-import { join as join54 } from "node:path";
+import { existsSync as existsSync47, statSync as statSync11 } from "node:fs";
+import { join as join59 } from "node:path";
 init_utils_json();
 function buildCurrentMap(map) {
   const current = {};
@@ -7995,8 +8554,8 @@ function buildCurrentMap(map) {
   for (const [, hostMap] of Object.entries(map.projects)) {
     const localPath = hostMap[HOST];
     if (!localPath) continue;
-    const localDir = join54(claude, "projects", encodePath(localPath));
-    if (!existsSync43(localDir)) continue;
+    const localDir = join59(claude, "projects", encodePath(localPath));
+    if (!existsSync47(localDir)) continue;
     for (const f of enumerateSourceFiles(localDir)) {
       const st = statSync11(f);
       current[f] = { size: st.size, mtime: st.mtimeMs };
@@ -8027,7 +8586,7 @@ function computePushSelection(map, old, scannerVersion, configHash, fullScan) {
   };
 }
 function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan) {
-  const map = existsSync43(mapPath) ? readPathMap(mapPath) : null;
+  const map = existsSync47(mapPath) ? readPathMap(mapPath) : null;
   const { selection, newManifest } = computePushSelection(
     map,
     old,
@@ -8055,7 +8614,7 @@ function isAllowed(path, allowed) {
 }
 function blockSetFor(segments) {
   if (segments[0] !== "shared" || segments[1] !== "extras") return NEVER_SYNC;
-  return segments[3] === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+  return isClaudeExtraName(segments[3] ?? "") ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function isNeverSync(path) {
   const segments = path.split("/");
@@ -8105,7 +8664,11 @@ function enforceAllowList(statusPorcelain, map) {
     ...Object.entries(map.extras ?? {}).flatMap(
       ([l, names]) => names.filter((n) => extrasWhitelist.includes(n)).flatMap((n) => [`shared/extras/${l}/${n}`, `shared/extras/${l}/${n}/`])
     ),
-    ...(map.sharedDirs ?? []).filter((d) => isValidSharedDir(d)).map((d) => `shared/${d}/`)
+    // Predicate passed by reference, not wrapped in an arrow: `isValidSharedDir`
+    // is a type guard, and an arrow returning its result is just a boolean, so
+    // wrapping it would leave `d` as `unknown` and let a non-string reach the
+    // template literal as "[object Object]".
+    ...sharedDirEntries(map).filter(isValidSharedDir).map((d) => `shared/${d}/`)
   ];
   const neverSyncHits = [];
   const violations = [];
@@ -8129,14 +8692,14 @@ function enforceAllowList(statusPorcelain, map) {
 
 // src/commands.push.settings.ts
 init_config();
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join55 } from "node:path";
+import { existsSync as existsSync48 } from "node:fs";
+import { join as join60 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function stripGsdHooksFromBase(repo, backup) {
-  const basePath = join55(repo, "shared", "settings.base.json");
-  if (!existsSync44(basePath)) return;
+  const basePath = join60(repo, "shared", "settings.base.json");
+  if (!existsSync48(basePath)) return;
   let base;
   try {
     base = readJson(basePath);
@@ -8150,14 +8713,14 @@ function stripGsdHooksFromBase(repo, backup) {
   writeJsonAtomic(basePath, stripped);
 }
 function reportSettingsAheadDrift(repo) {
-  const basePath = join55(repo, "shared", "settings.base.json");
-  if (!existsSync44(basePath)) return;
-  const settingsPath = join55(claudeHome(), "settings.json");
-  if (!existsSync44(settingsPath)) return;
+  const basePath = join60(repo, "shared", "settings.base.json");
+  if (!existsSync48(basePath)) return;
+  const settingsPath = join60(claudeHome(), "settings.json");
+  if (!existsSync48(settingsPath)) return;
   try {
     const base = readJson(basePath);
-    const hostPath = join55(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync44(hostPath) ? readJson(hostPath) : {};
+    const hostPath = join60(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync48(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
     const { ahead } = classifySettingsDrift(merged, settings);
@@ -8174,12 +8737,12 @@ function reportSettingsAheadDrift(repo) {
 // src/commands.push.guards.ts
 init_push_checks();
 init_utils();
-import { join as join56, relative as relative7 } from "node:path";
+import { join as join61, relative as relative9 } from "node:path";
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join56(repo, "shared"));
+  const gitlinks = findGitlinks(join61(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
-    const rel = relative7(repo, p).replaceAll("\\", "/");
+    const rel = relative9(repo, p).replaceAll("\\", "/");
     fail(`gitlink: ${rel} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`);
   }
   const noun = gitlinks.length === 1 ? "entry" : "entries";
@@ -8208,7 +8771,7 @@ init_config();
 
 // src/push-global-config.ts
 init_config();
-import { execFileSync as execFileSync22 } from "node:child_process";
+import { execFileSync as execFileSync23 } from "node:child_process";
 var STATUS_LABELS = {
   A: "add",
   M: "modify",
@@ -8248,7 +8811,7 @@ function isInScope(filePath, exactPrefixes, dirPrefixes) {
 }
 function collectGlobalConfigChanges(repoHome2, hostname2, opts) {
   const args = opts.staged ? ["diff", "--cached", "--name-status", "-z"] : ["diff", "HEAD", "--name-status", "-z"];
-  const raw = execFileSync22("git", args, {
+  const raw = execFileSync23("git", args, {
     cwd: repoHome2,
     stdio: ["ignore", "pipe", "pipe"]
   }).toString();
@@ -8286,9 +8849,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync45, lstatSync as lstatSync15, mkdirSync as mkdirSync15, readdirSync as readdirSync18, rmSync as rmSync17 } from "node:fs";
+import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync20, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync19 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join57, relative as relative8, sep as sep11 } from "node:path";
+import { join as join62, relative as relative10, sep as sep14 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -8296,11 +8859,11 @@ init_utils_json();
 var NOTHING_TO_SCAN_ROW = `${dim(infoGlyph)} nothing to scan, no leaks`;
 function stageSessionDir(localDir, dstDir, changed) {
   if (changed !== void 0) {
-    const prefix = `${localDir}${sep11}`;
+    const prefix = `${localDir}${sep14}`;
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
-      copyFileAtomic(src, join57(dstDir, relative8(localDir, src)));
+      copyFileAtomic(src, join62(dstDir, relative10(localDir, src)));
     }
     return true;
   }
@@ -8316,14 +8879,14 @@ function stageSessions(tmpRoot, map, changed) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join57(claudeHome(), "projects");
-  if (!existsSync45(localProjects)) return 0;
+  const localProjects = join62(claudeHome(), "projects");
+  if (!existsSync49(localProjects)) return 0;
   let staged = 0;
-  for (const dir of readdirSync18(localProjects)) {
+  for (const dir of readdirSync19(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    const localDir = join57(localProjects, dir);
-    const dstDir = join57(tmpRoot, "shared", "projects", logical);
+    const localDir = join62(localProjects, dir);
+    const dstDir = join62(tmpRoot, "shared", "projects", logical);
     if (stageSessionDir(localDir, dstDir, changed)) staged++;
   }
   return staged;
@@ -8339,9 +8902,9 @@ function stageExtras(tmpRoot, map) {
     if (!localRoot || localRoot === "TBD") continue;
     for (const dirname14 of dirnames) {
       if (!whitelist.includes(dirname14)) continue;
-      const src = join57(localRoot, dirname14);
-      if (!existsSync45(src)) continue;
-      const dst = join57(tmpRoot, "shared", "extras", logical, dirname14);
+      const src = join62(localRoot, dirname14);
+      if (!existsSync49(src)) continue;
+      const dst = join62(tmpRoot, "shared", "extras", logical, dirname14);
       copyExtras(src, dst);
       staged++;
     }
@@ -8349,19 +8912,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function stageSkills(tmpRoot) {
-  const localSkills = join57(claudeHome(), "skills");
-  const stat = lstatSync15(localSkills, { throwIfNoEntry: false });
+  const localSkills = join62(claudeHome(), "skills");
+  const stat = lstatSync20(localSkills, { throwIfNoEntry: false });
   if (stat === void 0 || stat.isSymbolicLink()) return 0;
-  const names = readdirSync18(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
+  const names = readdirSync19(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
   if (names.length === 0) return 0;
-  copySkillsPush(localSkills, join57(tmpRoot, "shared", "skills"));
+  copySkillsPush(localSkills, join62(tmpRoot, "shared", "skills"));
   return names.length;
 }
 function previewPushLeaks(map, opts = {}) {
-  const cacheDir = join57(homedir7(), ".cache", "claude-nomad");
+  const cacheDir = join62(homedir7(), ".cache", "claude-nomad");
   mkdirSync15(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes4(4).toString("hex")}`;
-  const tmpRoot = join57(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join62(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map, opts.selection?.changed);
     const extrasCount = stageExtras(tmpRoot, map);
@@ -8369,9 +8932,9 @@ function previewPushLeaks(map, opts = {}) {
     if (sessionCount + extrasCount + skillCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join57(repoHome(), ".gitleaksignore");
-    if (existsSync45(ignoreFile)) {
-      copyFileSync(ignoreFile, join57(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join62(repoHome(), ".gitleaksignore");
+    if (existsSync49(ignoreFile)) {
+      copyFileSync(ignoreFile, join62(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -8384,7 +8947,7 @@ function previewPushLeaks(map, opts = {}) {
     }
     return verdictFromFindings(findings);
   } finally {
-    rmSync17(tmpRoot, { recursive: true, force: true });
+    rmSync19(tmpRoot, { recursive: true, force: true });
   }
 }
 
@@ -8499,7 +9062,7 @@ async function runPushCore(opts = {}) {
   const scannerVersion = probeGitleaks();
   const configHash = computeConfigHash();
   const old = readManifest(manifestPath());
-  const mapPath = join58(repo, "path-map.json");
+  const mapPath = join63(repo, "path-map.json");
   const { map, selection, newManifest } = loadSelectionForPush(
     mapPath,
     old,
@@ -8551,7 +9114,7 @@ async function cmdPush(opts = {}) {
     opts.allowRule
   );
   const repo = repoHome();
-  if (!existsSync46(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync50(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -8569,8 +9132,8 @@ async function cmdPush(opts = {}) {
 }
 
 // src/commands.sync.ts
-import { existsSync as existsSync47 } from "node:fs";
-import { join as join59 } from "node:path";
+import { existsSync as existsSync51 } from "node:fs";
+import { join as join64 } from "node:path";
 init_config();
 init_color();
 init_utils();
@@ -8704,8 +9267,8 @@ async function cmdSync(opts = {}) {
   const dryRun = opts.dryRun === true;
   const verbose = opts.verbose === true;
   const repo = repoHome();
-  if (!existsSync47(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync47(join59(repo, "shared", "settings.base.json"))) {
+  if (!existsSync51(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync51(join64(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("sync");
@@ -8729,9 +9292,9 @@ async function cmdSync(opts = {}) {
 }
 
 // src/commands.update.ts
-import { execFileSync as execFileSync23 } from "node:child_process";
+import { execFileSync as execFileSync24 } from "node:child_process";
 init_utils();
-function readInstalledVersion(run = execFileSync23) {
+function readInstalledVersion(run = execFileSync24) {
   const isWin = process.platform === "win32";
   try {
     return run(isWin ? "nomad.cmd" : "nomad", ["--version"], {
@@ -8742,7 +9305,7 @@ function readInstalledVersion(run = execFileSync23) {
     return null;
   }
 }
-function cmdUpdate(currentVersion, run = execFileSync23) {
+function cmdUpdate(currentVersion, run = execFileSync24) {
   console.log(`Updating claude-nomad v${currentVersion}...`);
   const isWin = process.platform === "win32";
   try {
@@ -8781,8 +9344,8 @@ init_config();
 // src/crash-report.write.ts
 init_config();
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { mkdirSync as mkdirSync16, readdirSync as readdirSync19, statSync as statSync12, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join61 } from "node:path";
+import { mkdirSync as mkdirSync16, readdirSync as readdirSync20, statSync as statSync12, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join66 } from "node:path";
 
 // src/crash-report.ts
 var CRASH_MAX_STACK_LINES = 50;
@@ -8865,17 +9428,17 @@ function buildCrashReport(input) {
 }
 
 // src/crash-report.redact.ts
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync18, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync20, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join60 } from "node:path";
+import { join as join65 } from "node:path";
 init_push_gitleaks_scan();
 var CRASH_SCAN_TIMEOUT_MS = 3e3;
 var SCAN_UNAVAILABLE_ADVISORY = "\n\n[gitleaks value-based scan unavailable; only structural redaction applied. Review before sharing this file publicly.]\n";
 function redactWithGitleaks(text, scan = scanFile) {
   let dir;
   try {
-    dir = mkdtempSync3(join60(tmpdir2(), "nomad-crash-scan-"));
-    const tmp = join60(dir, "crash.txt");
+    dir = mkdtempSync3(join65(tmpdir2(), "nomad-crash-scan-"));
+    const tmp = join65(dir, "crash.txt");
     writeFileSync10(tmp, text, { mode: 384 });
     const findings = scan(tmp, false, CRASH_SCAN_TIMEOUT_MS);
     if (findings === null) return text + SCAN_UNAVAILABLE_ADVISORY;
@@ -8885,7 +9448,7 @@ function redactWithGitleaks(text, scan = scanFile) {
   } finally {
     if (dir !== void 0) {
       try {
-        rmSync18(dir, { recursive: true, force: true });
+        rmSync20(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -8898,9 +9461,9 @@ init_utils();
 var CRASH_RETENTION_KEEP = 20;
 function listCrashFiles(dir = crashDir()) {
   try {
-    return readdirSync19(dir).flatMap((name) => {
+    return readdirSync20(dir).flatMap((name) => {
       try {
-        return [{ name, mtimeMs: statSync12(join61(dir, name)).mtimeMs }];
+        return [{ name, mtimeMs: statSync12(join66(dir, name)).mtimeMs }];
       } catch {
         return [];
       }
@@ -8914,7 +9477,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
   const targets = prunableByCount(files, keep);
   for (const name of targets) {
     try {
-      unlinkSync2(join61(dir, name));
+      unlinkSync2(join66(dir, name));
     } catch {
     }
   }
@@ -8922,7 +9485,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
 function writeCrashReport(text, dir = crashDir()) {
   mkdirSync16(dir, { recursive: true, mode: 448 });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes5(4).toString("hex")}`;
-  const path = join61(dir, `crash-${stamp}.txt`);
+  const path = join66(dir, `crash-${stamp}.txt`);
   writeFileSync11(path, text, { mode: 384 });
   pruneCrashDir(dir);
   return path;
@@ -8954,18 +9517,18 @@ function handleCrash(err, argv, opts) {
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync48 } from "node:fs";
-import { join as join62 } from "node:path";
+import { existsSync as existsSync52 } from "node:fs";
+import { join as join67 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync48(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync52(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join62(repo, "path-map.json");
-    const map = existsSync48(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join67(repo, "path-map.json");
+    const map = existsSync52(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     computePreview(ts, map, "diff");
   } catch (err) {
@@ -8980,19 +9543,19 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync50, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join64 } from "node:path";
+import { existsSync as existsSync54, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join69 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
-import { execFileSync as execFileSync24 } from "node:child_process";
+import { execFileSync as execFileSync25 } from "node:child_process";
 init_utils();
 var DEFAULT_REPO_NAME = "claude-nomad-config";
 function isValidRepoName(name) {
   return /^[A-Za-z0-9._-]{1,100}$/.test(name);
 }
 var GH_NETWORK_TIMEOUT_MS = 3e4;
-function ensureOriginRepo(repoName, run = execFileSync24) {
+function ensureOriginRepo(repoName, run = execFileSync25) {
   if (!isValidRepoName(repoName)) {
     die(
       `invalid repo name: ${JSON.stringify(repoName)}. Use only letters, digits, hyphens, underscores, and dots (1-100 chars).`
@@ -9063,33 +9626,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync49, rmSync as rmSync19, statSync as statSync13 } from "node:fs";
-import { join as join63 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync53, rmSync as rmSync21, statSync as statSync13 } from "node:fs";
+import { join as join68 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join63(claude, name);
-    if (!existsSync49(src)) continue;
-    const dst = join63(repo, "shared", name);
+    const src = join68(claude, name);
+    if (!existsSync53(src)) continue;
+    const dst = join68(repo, "shared", name);
     if (statSync13(src).isDirectory()) {
-      const gk = join63(dst, ".gitkeep");
-      if (existsSync49(gk)) rmSync19(gk);
+      const gk = join68(dst, ".gitkeep");
+      if (existsSync53(gk)) rmSync21(gk);
       cpSync10(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join63(claude, "settings.json");
-  if (existsSync49(userSettings)) {
+  const userSettings = join68(claude, "settings.json");
+  if (existsSync53(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join63(repo, "hosts", `${HOST}.json`);
+    const hostFile = join68(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -9103,14 +9666,14 @@ var GITATTRIBUTES = "# nomad: sync content is byte-managed, disable all line-end
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join64(repoHome2, "shared", "settings.base.json"),
-    join64(repoHome2, "shared", "CLAUDE.md"),
-    join64(repoHome2, "path-map.json"),
-    join64(repoHome2, "hosts"),
-    join64(repoHome2, "shared")
+    join69(repoHome2, "shared", "settings.base.json"),
+    join69(repoHome2, "shared", "CLAUDE.md"),
+    join69(repoHome2, "path-map.json"),
+    join69(repoHome2, "hosts"),
+    join69(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync50(c)) return c;
+    if (existsSync54(c)) return c;
   }
   return null;
 }
@@ -9128,27 +9691,27 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync17(join64(repo, "shared"), { recursive: true });
-  mkdirSync17(join64(repo, "hosts"), { recursive: true });
+  mkdirSync17(join69(repo, "shared"), { recursive: true });
+  mkdirSync17(join69(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync17(join64(repo, "shared", name), { recursive: true });
+    mkdirSync17(join69(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join64(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync50(userClaudeMd)) {
-    writeFileSync12(join64(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join69(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync54(userClaudeMd)) {
+    writeFileSync12(join69(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync12(join64(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync12(join69(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync12(join64(repo, "hosts", ".gitkeep"), "");
+  writeFileSync12(join69(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join64(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join69(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join64(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join69(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
-  writeFileSync12(join64(repo, ".gitattributes"), GITATTRIBUTES);
+  writeFileSync12(join69(repo, ".gitattributes"), GITATTRIBUTES);
   item("created .gitattributes");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -9214,21 +9777,21 @@ function maybeDisableRepoActions(repoHome2, run) {
 // src/init.prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync51, readdirSync as readdirSync20, statSync as statSync14 } from "node:fs";
-import { join as join65 } from "node:path";
+import { existsSync as existsSync55, readdirSync as readdirSync21, statSync as statSync14 } from "node:fs";
+import { join as join70 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync51(path)) return false;
+  if (!existsSync55(path)) return false;
   try {
-    if (statSync14(path).isDirectory()) return readdirSync20(path).length > 0;
+    if (statSync14(path).isDirectory()) return readdirSync21(path).length > 0;
     return true;
   } catch {
     return false;
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync51(join65(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join65(claudeHome2, name)));
+  if (existsSync55(join70(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join70(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -9535,7 +10098,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.63.2",
+  version: "0.64.1",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -9779,15 +10342,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync52, readFileSync as readFileSync20, readdirSync as readdirSync21 } from "node:fs";
-import { join as join66 } from "node:path";
+import { existsSync as existsSync56, readFileSync as readFileSync21, readdirSync as readdirSync22 } from "node:fs";
+import { join as join71 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join66(claudeHome(), "projects");
-  if (!existsSync52(projectsRoot)) {
+  const projectsRoot = join71(claudeHome(), "projects");
+  if (!existsSync56(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -9801,8 +10364,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join66(repoHome(), "path-map.json");
-  if (!existsSync52(mapPath)) {
+  const mapPath = join71(repoHome(), "path-map.json");
+  if (!existsSync56(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -9824,14 +10387,14 @@ function resumeCmd(sessionId) {
   console.log(`cd ${shQuote(hit.localPath)} && claude --resume ${shQuote(sessionId)}`);
 }
 function findTranscriptPath(projectsRoot, sessionId) {
-  for (const dir of readdirSync21(projectsRoot)) {
-    const candidate = join66(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync52(candidate)) return candidate;
+  for (const dir of readdirSync22(projectsRoot)) {
+    const candidate = join71(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync56(candidate)) return candidate;
   }
   return null;
 }
 function extractRecordedCwd(jsonlPath) {
-  for (const line of readFileSync20(jsonlPath, "utf8").split("\n")) {
+  for (const line of readFileSync21(jsonlPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const obj = JSON.parse(line);