claude-nomad 0.64.0 → 0.64.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## [0.64.1](https://github.com/funkadelic/claude-nomad/compare/v0.64.0...v0.64.1) (2026-08-07)
+
+### What's new
+
+- **A stray dot or space at the end of a file name no longer hides a secret.** nomad never copies
+  password and key files (things like `.env`, `id_rsa`, or `server.pem`) out of the project folders
+  you sync. It spots them by name, and a name with an extra dot or space on the end, such as
+  `.env.`, did not match, so a file like that could end up in your sync repo. It matches now, and so
+  do the other files nomad always keeps out, such as `settings.local.json`. Nothing changes in how
+  you use nomad. It simply catches more ways of writing the same names it already blocked.
+- **A `.claude` folder is recognized however it is capitalized.** If a project had a folder named
+  `.Claude` instead of `.claude`, nomad checked what was inside it less carefully than it should
+  have. Both are treated the same now.
+- **A folder name nomad will never sync is turned down as soon as you add it.** You can ask nomad to
+  sync extra folders by listing their names in `path-map.json`. If a name you list is one nomad
+  refuses to sync, because it looks like a password file, or because it is a name that causes
+  trouble on one of the machines you sync to, you are told straight away and told why. Before,
+  nothing was said until a later `nomad push` stopped without explaining itself. `nomad doctor` also
+  lists any names in this situation and what to do about them.
+
+All of this applies on macOS, Linux, WSL2, and native Windows.
+
+
+### Fixed
+
+* **config:** close the trailing-dot bypass in the secret-name guard ([#495](https://github.com/funkadelic/claude-nomad/issues/495)) ([9aaf5d9](https://github.com/funkadelic/claude-nomad/commit/9aaf5d958027a3557974c1ab32254c6171aea631))
+* reject a secret-shaped name as a shared dir ([#493](https://github.com/funkadelic/claude-nomad/issues/493)) ([3054464](https://github.com/funkadelic/claude-nomad/commit/3054464c91c974a7abdad24b2067bab8386e1dfd))
+
+
+### Changed
+
+* **release:** publish the release body from CHANGELOG.md ([#496](https://github.com/funkadelic/claude-nomad/issues/496)) ([e7bff07](https://github.com/funkadelic/claude-nomad/commit/e7bff07504935e563936733eae1146dc6eeaca83))
+
 ## [0.64.0](https://github.com/funkadelic/claude-nomad/compare/v0.63.2...v0.64.0) (2026-08-05)
 
 ### What's new

package/dist/nomad.mjs

@@ -42,11 +42,21 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/config.never-sync.ts
+function stripTrailingDotsAndWhitespace(name) {
+  let end = name.length;
+  while (end > 0 && (name[end - 1] === "." || /\s/.test(name[end - 1]))) end -= 1;
+  return name.slice(0, end);
+}
 function isSecretFileName(name) {
-  return SECRET_FILE_PATTERNS.some((re) => re.test(name));
+  const stripped = stripTrailingDotsAndWhitespace(name);
+  return SECRET_FILE_PATTERNS.some((re) => re.test(stripped));
 }
 function isDeniedName(blockSet, name) {
-  return blockSet.has(name) || blockSet.has(name.toLowerCase()) || isSecretFileName(name);
+  const stripped = stripTrailingDotsAndWhitespace(name);
+  return blockSet.has(name) || blockSet.has(name.toLowerCase()) || blockSet.has(stripped) || blockSet.has(stripped.toLowerCase()) || isSecretFileName(name);
+}
+function isClaudeExtraName(name) {
+  return stripTrailingDotsAndWhitespace(name).toLowerCase() === ".claude";
 }
 var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, SECRET_FILE_PATTERNS;
 var init_config_never_sync = __esm({
@@ -302,14 +312,67 @@ function assertSafeLogical(logical) {
     );
   }
 }
+function validateSharedDirEntry(entry) {
+  if (typeof entry !== "string") {
+    return { reason: "not-a-string", message: "not a string" };
+  }
+  if (!SAFE_SEGMENT.test(entry) || entry === "." || entry === "..") {
+    return {
+      reason: "not-a-segment",
+      message: 'not a single path segment (contains a path separator, an unsupported character, "." or "..")'
+    };
+  }
+  const addressed = stripTrailingDots(entry);
+  const named = classifyDeniedName(addressed);
+  if (named !== null) {
+    return addressed === entry ? named : {
+      reason: named.reason,
+      message: `a trailing-dot name shadowing ${named.message}`
+    };
+  }
+  if (entry.endsWith(".")) {
+    return {
+      reason: "win32-alias",
+      message: 'a trailing-dot name (git for Windows refuses to create or check out a path ending in ".")'
+    };
+  }
+  return null;
+}
+function stripTrailingDots(name) {
+  let end = name.length;
+  while (end > 0 && name[end - 1] === ".") end -= 1;
+  return name.slice(0, end);
+}
+function classifyDeniedName(name) {
+  const folded = name.toLowerCase();
+  if (NEVER_SYNC.has(name) || NEVER_SYNC.has(folded)) {
+    return { reason: "never-sync", message: "a never-sync name" };
+  }
+  if (RESERVED_SHARED.has(name) || RESERVED_SHARED_FOLDED.has(folded)) {
+    return { reason: "reserved", message: "a reserved shared/ name" };
+  }
+  const dot = folded.indexOf(".");
+  const stem = dot === -1 ? folded : folded.slice(0, dot);
+  if (WIN32_DEVICE_NAMES.has(stem)) {
+    return { reason: "reserved", message: "a reserved Windows device name" };
+  }
+  if (isSecretFileName(name)) {
+    return {
+      reason: "secret-shaped",
+      message: "a credential-shaped filename (.env, id_rsa, credentials, *.pem, *.key and similar)"
+    };
+  }
+  return null;
+}
+function mayJoinRefusedEntry(entry, reason, remediable) {
+  if (UNJOINABLE_REASONS.has(reason)) return false;
+  if (entry.endsWith(".")) return true;
+  return remediable.has(reason);
+}
 function isValidSharedDir(entry) {
-  if (typeof entry !== "string") return false;
-  if (!SAFE_SEGMENT.test(entry) || entry === "." || entry === "..") return false;
-  if (NEVER_SYNC.has(entry)) return false;
-  if (RESERVED_SHARED.has(entry)) return false;
-  return true;
+  return validateSharedDirEntry(entry) === null;
 }
-var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED;
+var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED, RESERVED_SHARED_FOLDED, WIN32_DEVICE_NAMES, UNJOINABLE_REASONS;
 var init_config_sharedDirs_guard = __esm({
   "src/config.sharedDirs.guard.ts"() {
     "use strict";
@@ -331,6 +394,19 @@ var init_config_sharedDirs_guard = __esm({
       "extras",
       "projects"
     ]);
+    RESERVED_SHARED_FOLDED = new Set([...RESERVED_SHARED].map((name) => name.toLowerCase()));
+    WIN32_DEVICE_NAMES = /* @__PURE__ */ new Set([
+      "con",
+      "prn",
+      "aux",
+      "nul",
+      ...Array.from({ length: 9 }, (_unused, i) => `com${i + 1}`),
+      ...Array.from({ length: 9 }, (_unused, i) => `lpt${i + 1}`)
+    ]);
+    UNJOINABLE_REASONS = /* @__PURE__ */ new Set([
+      "not-a-string",
+      "not-a-segment"
+    ]);
   }
 });
 
@@ -541,19 +617,28 @@ function manifestPath() {
 function sharedBaselinePath() {
   return join(home(), ".cache", "claude-nomad", `shared-baseline-${encodeURIComponent(HOST)}.json`);
 }
-function allSharedLinks(map) {
+function allSharedLinks(map, opts = {}) {
+  const emit = opts.quiet === true ? () => void 0 : warn;
+  const raw = map.sharedDirs;
+  if (raw !== void 0 && !Array.isArray(raw)) {
+    emit("sharedDirs in path-map.json is not an array; ignoring the whole field");
+    return [...SHARED_LINKS];
+  }
   const extras = [];
-  for (const entry of map.sharedDirs ?? []) {
-    if (isValidSharedDir(entry)) {
+  for (const entry of raw ?? []) {
+    const rejection = validateSharedDirEntry(entry);
+    if (rejection === null) {
       extras.push(entry);
     } else {
-      warn(
-        `sharedDirs entry ${JSON.stringify(entry)} is invalid (path separator, reserved name, or NEVER_SYNC); skipping`
-      );
+      emit(`sharedDirs entry ${JSON.stringify(entry)} rejected: ${rejection.message}; skipping`);
     }
   }
   return [...SHARED_LINKS, ...extras];
 }
+function sharedDirEntries(map) {
+  const raw = map.sharedDirs;
+  return Array.isArray(raw) ? raw : [];
+}
 var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
   "src/config.ts"() {
@@ -1422,6 +1507,7 @@ var init_push_leak_verdict = __esm({
 // src/commands.adopt.ts
 init_config();
 init_config_sharedDirs_guard();
+init_exit_codes();
 import { cpSync as cpSync4, existsSync as existsSync5, lstatSync as lstatSync5, rmSync as rmSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 
@@ -1892,7 +1978,7 @@ function copyExtrasFileSkipDiverged(src, dst) {
   copyExtras(src, dst);
 }
 function extrasDenySet(dirname14) {
-  return dirname14 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+  return isClaudeExtraName(dirname14) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function copyExtrasFiltered(src, dst, blockSet) {
   rmSync2(dst, { recursive: true, force: true });
@@ -2133,7 +2219,7 @@ function readMapIfPresent(repoHome2) {
   return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function isConfiguredTarget(name, map) {
-  return SHARED_LINKS.includes(name) || (map.sharedDirs?.includes(name) ?? false);
+  return SHARED_LINKS.includes(name) || sharedDirEntries(map).includes(name);
 }
 function isValidAdoptName(name) {
   if (SHARED_LINKS.includes(name)) return true;
@@ -2155,6 +2241,13 @@ function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
 }
 function cmdAdopt(name, opts = {}) {
   const dryRun = opts.dryRun === true;
+  const rejection = validateSharedDirEntry(name);
+  if (rejection !== null && rejection.reason === "secret-shaped") {
+    throw new NomadFatal(
+      `cannot adopt ${JSON.stringify(name)}: ${rejection.message}. If it is listed in sharedDirs in path-map.json, remove it there too.`,
+      { code: EXIT.GENERIC_FAILURE }
+    );
+  }
   if (!isValidAdoptName(name)) {
     fail(`invalid name: ${JSON.stringify(name)}`);
     process.exit(1);
@@ -2568,6 +2661,7 @@ function cmdClean(opts, backupBase2 = backupBase()) {
 
 // src/commands.eject.ts
 init_config();
+init_config_sharedDirs_guard();
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -2705,6 +2799,19 @@ function materializeOneOrDie(name, linkPath, sharedRoot, done) {
     );
   }
 }
+var WIDENED_REASONS = /* @__PURE__ */ new Set([
+  "never-sync",
+  "reserved",
+  "secret-shaped"
+]);
+function ejectNames(map) {
+  const alreadyMaterialized = sharedDirEntries(map).filter((entry) => {
+    if (typeof entry !== "string") return false;
+    const rejection = validateSharedDirEntry(entry);
+    return rejection === null || mayJoinRefusedEntry(entry, rejection.reason, WIDENED_REASONS);
+  });
+  return [.../* @__PURE__ */ new Set([...allSharedLinks(map), ...alreadyMaterialized])];
+}
 function defaultEjectRoots() {
   return { claudeHome: claudeHome(), repoHome: repoHome() };
 }
@@ -2712,16 +2819,31 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   const dryRun = opts.dryRun === true;
   const { claudeHome: claudeHome2, repoHome: repoHome2 } = roots;
   const map = readMapIfPresent2(repoHome2);
-  const names = allSharedLinks(map);
+  const names = ejectNames(map);
   const classifications = /* @__PURE__ */ new Map();
   for (const name of names) {
     classifications.set(name, classifyName(join11(claudeHome2, name)));
   }
+  const base = new Set(allSharedLinks(map, { quiet: true }));
+  for (const name of names) {
+    if (base.has(name)) continue;
+    if (classifications.get(name) !== "materialize") continue;
+    item(`processing rejected entry already present on this host: ${name}`);
+  }
   const dangling = names.filter((n) => classifications.get(n) === "dangling");
-  if (dangling.length > 0) {
+  const danglingBase = dangling.filter((n) => base.has(n));
+  const danglingRefused = dangling.filter((n) => !base.has(n));
+  if (danglingBase.length > 0) {
+    fail(
+      `dangling symlink(s): ${danglingBase.join(", ")}. run \`nomad pull\` first to restore the missing target, then re-run \`nomad eject\``
+    );
+  }
+  if (danglingRefused.length > 0) {
     fail(
-      `dangling symlink(s): ${dangling.join(", ")}. run \`nomad pull\` first to restore the missing target, then re-run \`nomad eject\``
+      `dangling symlink(s) for a refused name nomad cannot restore: ${danglingRefused.join(", ")}. recover the content by hand if you need it, then remove the dead link and re-run \`nomad eject\``
     );
+  }
+  if (dangling.length > 0) {
     process.exit(1);
   }
   const sharedRoot = resolveSharedRoot(repoHome2);
@@ -3066,7 +3188,7 @@ function classifySymlinkTarget(name, p) {
 }
 function reportSharedLinks(section2, map) {
   const claude = claudeHome();
-  for (const name of allSharedLinks(map)) {
+  for (const name of allSharedLinks(map, { quiet: true })) {
     const p = join13(claude, name);
     const { line, fail: fail2, children } = classifySharedLink(name, p);
     addItem(section2, line);
@@ -3158,8 +3280,9 @@ function reportHostOverrides(section2, base, settings) {
 // src/commands.doctor.checks.pathmap.ts
 init_color();
 init_config();
-import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
-import { join as join15 } from "node:path";
+init_config_sharedDirs_guard();
+import { existsSync as existsSync13, lstatSync as lstatSync9, readdirSync as readdirSync6, realpathSync as realpathSync2 } from "node:fs";
+import { join as join15, sep as sep4 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
@@ -3199,6 +3322,95 @@ function reportCurrentHostPathsMissing(section2, map) {
     }
   }
 }
+function hasSharedLeftover(entry) {
+  try {
+    return lstatSync9(join15(repoHome(), "shared", entry), { throwIfNoEntry: false }) !== void 0;
+  } catch {
+    return false;
+  }
+}
+var PROBEABLE_REASONS = /* @__PURE__ */ new Set([
+  "never-sync",
+  "secret-shaped"
+]);
+function classifyLocalLink(entry) {
+  const linkPath = join15(claudeHome(), entry);
+  let stat;
+  try {
+    stat = lstatSync9(linkPath, { throwIfNoEntry: false });
+  } catch {
+    return "absent";
+  }
+  if (stat?.isSymbolicLink() !== true) return "absent";
+  let target;
+  try {
+    target = realpathSync2(linkPath);
+  } catch {
+    return "dangling";
+  }
+  let root;
+  try {
+    root = realpathSync2(join15(repoHome(), "shared"));
+  } catch {
+    return "foreign";
+  }
+  return target.startsWith(root + sep4) ? "managed" : "foreign";
+}
+function reportRejectedSharedDirs(section2, map) {
+  const raw = map.sharedDirs;
+  if (raw !== void 0 && !Array.isArray(raw)) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} path-map: sharedDirs is not an array (${typeof raw}); the whole field is ignored`
+    );
+    return;
+  }
+  const entries = Array.isArray(raw) ? raw : [];
+  const probable = [];
+  for (const entry of entries) {
+    const rejection = validateSharedDirEntry(entry);
+    if (rejection === null) continue;
+    if (typeof entry === "string" && mayJoinRefusedEntry(entry, rejection.reason, PROBEABLE_REASONS)) {
+      probable.push(entry);
+    }
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} path-map: sharedDirs entry ${JSON.stringify(entry)} rejected: ${rejection.message}; skipping`
+    );
+  }
+  reportRejectedLeftovers(section2, probable);
+}
+function reportRejectedLeftovers(section2, probable) {
+  for (const entry of probable) {
+    const link = classifyLocalLink(entry);
+    if (link === "managed") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a symlink under ~/.claude/ pointing into shared/; copy the content out first (cp -RL), then remove both. nomad will not do it for you`
+      );
+      continue;
+    }
+    if (link === "dangling") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a DANGLING symlink under ~/.claude/ (its target does not resolve); do not delete anything under shared/ yet, since a copy there may be the only one left. nomad cannot restore this name, because the entry is refused: recover the content by hand if you need it, then remove the dead link`
+      );
+      continue;
+    }
+    if (link === "foreign") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a symlink under ~/.claude/ pointing OUTSIDE shared/; nomad does not manage it, so leave it alone and just drop the entry from sharedDirs`
+      );
+    }
+    if (hasSharedLeftover(entry)) {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: shared/ entry ${JSON.stringify(entry)} exists in the repo working tree; remove it by hand, nomad will not delete it`
+      );
+    }
+  }
+}
 function reportPathCollisions(section2, map) {
   const seen = /* @__PURE__ */ new Map();
   let collisionCount = 0;
@@ -3230,6 +3442,7 @@ function reportPathMap(section2) {
   }
   const map = readJsonSafe(mapPath, mapPath, section2);
   if (map === null) return;
+  reportRejectedSharedDirs(section2, map);
   const shapeError = validatePathMapShape(map);
   if (shapeError !== null) {
     addItem(section2, `${red(failGlyph)} ${shapeError}`);
@@ -3425,7 +3638,7 @@ function reportGitIdentity(section2) {
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync18, lstatSync as lstatSync9, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync18, lstatSync as lstatSync10, readdirSync as readdirSync8 } from "node:fs";
 import { join as join21 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
@@ -3443,7 +3656,7 @@ function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
     const full = join21(dir, entry);
-    const st = lstatSync9(full, { throwIfNoEntry: false });
+    const st = lstatSync10(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) bytes += dirSizeBytes(full);
@@ -3922,8 +4135,8 @@ init_config();
 
 // src/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync10, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join28, relative as relative5, sep as sep4 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync10, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
+import { dirname as dirname6, join as join28, relative as relative5, sep as sep5 } from "node:path";
 init_config();
 
 // src/push-manifest.ts
@@ -4055,7 +4268,7 @@ function copyFileAtomic(src, dst) {
   renameAtomicRetry(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
-  const prefix = `${localDir}${sep4}`;
+  const prefix = `${localDir}${sep5}`;
   for (const p of sel.changed) if (p.startsWith(prefix)) return true;
   for (const p of sel.deleted) if (p.startsWith(prefix)) return true;
   return false;
@@ -4064,7 +4277,7 @@ function skipForSelection(sel, localDir) {
   return sel !== void 0 && !hasDeltaForDir(sel, localDir);
 }
 function applySelective(sel, localDir, repoDst) {
-  const prefix = `${localDir}${sep4}`;
+  const prefix = `${localDir}${sep5}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
     copyFileAtomic(src, join28(repoDst, relative5(localDir, src)));
@@ -4082,7 +4295,7 @@ function copyDirJsonlOnly(src, dst) {
     filter: (srcPath) => {
       const rel = relative5(src, srcPath);
       if (rel === "") return true;
-      if (rel.split(sep4).length > 1) return true;
+      if (rel.split(sep5).length > 1) return true;
       if (statSync5(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       item(`skip ${rel}: extension not in allowlist`);
@@ -4142,9 +4355,9 @@ function countLocalOnly(src, dst) {
   for (const name of readdirSync10(dst)) {
     const dstPath = join28(dst, name);
     const srcPath = join28(src, name);
-    if (lstatSync10(dstPath).isDirectory()) {
+    if (lstatSync11(dstPath).isDirectory()) {
       count += countLocalOnly(srcPath, dstPath);
-    } else if (lstatSync10(srcPath, { throwIfNoEntry: false }) === void 0) {
+    } else if (lstatSync11(srcPath, { throwIfNoEntry: false }) === void 0) {
       count++;
     }
   }
@@ -4334,7 +4547,7 @@ function reportCheckShared(section2, gitleaksReady) {
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync3 } from "node:fs";
 import { dirname as dirname7, extname, join as join30 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
@@ -4351,7 +4564,7 @@ function effectiveType(hookPath) {
   if (ext === ".cjs") return "cjs";
   let real;
   try {
-    real = realpathSync2(hookPath);
+    real = realpathSync3(hookPath);
   } catch {
     return null;
   }
@@ -4513,7 +4726,7 @@ import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:
 import { join as join33 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
 import { dirname as dirname8, join as join32, resolve as resolve2 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
@@ -4558,7 +4771,7 @@ function specifierIsMissing(specifier, baseDir) {
 function relativeRequireTargetsBroken(scriptPath) {
   let realPath;
   try {
-    realPath = realpathSync3(scriptPath);
+    realPath = realpathSync4(scriptPath);
   } catch {
     return false;
   }
@@ -4702,7 +4915,7 @@ function reportPreserveSymlinksCheck(section2) {
     return;
   }
   const map = readPathMapSafe();
-  const sharedLinkNames = allSharedLinks(map);
+  const sharedLinkNames = allSharedLinks(map, { quiet: true });
   let anyWarn = false;
   for (const [event, groups] of Object.entries(hooks)) {
     if (!Array.isArray(groups)) continue;
@@ -5052,21 +5265,21 @@ import { createInterface as createInterface2 } from "node:readline/promises";
 // src/commands.push.recovery.actions.ts
 init_config();
 import { readFileSync as readFileSync17 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep8 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep9 } from "node:path";
 
 // src/commands.push.recovery.memory.ts
 init_config();
 init_config_sharedDirs_guard();
 import {
   cpSync as cpSync7,
-  lstatSync as lstatSync11,
+  lstatSync as lstatSync12,
   mkdirSync as mkdirSync9,
   readFileSync as readFileSync14,
-  realpathSync as realpathSync4,
+  realpathSync as realpathSync5,
   statSync as statSync6,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname9, join as join36, sep as sep5 } from "node:path";
+import { dirname as dirname9, join as join36, sep as sep6 } from "node:path";
 init_push_gitleaks_scan();
 
 // src/rel-path-guard.ts
@@ -5097,12 +5310,12 @@ function resolveMemoryLocalPath(logical, relPath, map) {
   if (abs === void 0) return null;
   const memoryRoot = join36(claudeHome(), "projects", encodePath(abs), "memory");
   const localPath = join36(memoryRoot, ...relPath.split("/"));
-  if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep5)) return null;
+  if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep6)) return null;
   try {
-    if (lstatSync11(localPath).isSymbolicLink()) return null;
-    const realLocal = realpathSync4(localPath);
-    const realRoot = realpathSync4(memoryRoot);
-    if (!realLocal.startsWith(realRoot + sep5)) return null;
+    if (lstatSync12(localPath).isSymbolicLink()) return null;
+    const realLocal = realpathSync5(localPath);
+    const realRoot = realpathSync5(memoryRoot);
+    if (!realLocal.startsWith(realRoot + sep6)) return null;
     if (!statSync6(realLocal).isFile()) return null;
   } catch {
     return null;
@@ -5160,18 +5373,18 @@ function applyMemoryRedact(f, ts, map, scan = scanFile) {
 init_config();
 import {
   cpSync as cpSync8,
-  lstatSync as lstatSync13,
+  lstatSync as lstatSync14,
   mkdirSync as mkdirSync11,
   readFileSync as readFileSync15,
-  realpathSync as realpathSync5,
+  realpathSync as realpathSync6,
   statSync as statSync7,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname10, join as join38, sep as sep6 } from "node:path";
+import { dirname as dirname10, join as join38, sep as sep7 } from "node:path";
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync29, lstatSync as lstatSync12, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync29, lstatSync as lstatSync13, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
 import { join as join37 } from "node:path";
 
 // src/skills-sync.tracked.ts
@@ -5211,7 +5424,7 @@ function syncSkillsPull(ts, prePostHeads) {
   if (!existsSync29(sharedSkills)) return;
   const localSkills = join37(claudeHome(), "skills");
   backupBeforeWrite(localSkills, ts);
-  const dstStat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  const dstStat = lstatSync13(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     rmSync13(localSkills, { recursive: true, force: true });
     mkdirSync10(localSkills, { recursive: true });
@@ -5221,7 +5434,7 @@ function syncSkillsPull(ts, prePostHeads) {
 }
 function syncSkillsPush() {
   const localSkills = join37(claudeHome(), "skills");
-  const stat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  const stat = lstatSync13(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
   const sharedSkills = join37(repoHome(), "shared", "skills");
@@ -5250,12 +5463,12 @@ function resolveSkillLocalPath(name, relPath) {
   const skillsRoot = join38(claudeHome(), "skills");
   const skillRoot = join38(skillsRoot, name);
   const localPath = join38(skillRoot, ...relPath.split("/"));
-  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep6)) return null;
+  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep7)) return null;
   try {
-    if (lstatSync13(localPath).isSymbolicLink()) return null;
-    const realLocal = realpathSync5(localPath);
-    const realRoot = realpathSync5(skillsRoot);
-    if (!realLocal.startsWith(realRoot + sep6)) return null;
+    if (lstatSync14(localPath).isSymbolicLink()) return null;
+    const realLocal = realpathSync6(localPath);
+    const realRoot = realpathSync6(skillsRoot);
+    if (!realLocal.startsWith(realRoot + sep7)) return null;
     if (!statSync7(realLocal).isFile()) return null;
   } catch {
     return null;
@@ -5380,7 +5593,7 @@ function applyDeferredAllows(findings, state, repo) {
 init_config();
 init_config_sharedDirs_guard();
 import { cpSync as cpSync9, existsSync as existsSync32, mkdirSync as mkdirSync12 } from "node:fs";
-import { dirname as dirname12, join as join41, sep as sep7 } from "node:path";
+import { dirname as dirname12, join as join41, sep as sep8 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
@@ -5388,17 +5601,17 @@ import { existsSync as existsSync31 } from "node:fs";
 import { dirname as dirname11, join as join40 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync30, lstatSync as lstatSync14, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync30, lstatSync as lstatSync15, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join39 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
   if (!existsSync30(dir)) return;
-  const st = lstatSync14(dir);
+  const st = lstatSync15(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync14(dir)) {
     const abs = join39(dir, entry);
-    const lst = lstatSync14(abs);
+    const lst = lstatSync15(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -5606,7 +5819,7 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep7)) {
+    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep8)) {
       return join41(repo, "shared", "projects", logical);
     }
   }
@@ -5970,7 +6183,7 @@ function makeDefaultReadLine(repo) {
     try {
       const repoRoot = resolve3(repo);
       const target = resolve3(repoRoot, file);
-      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep8)) {
+      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep9)) {
         return null;
       }
       let lines = cache.get(target);
@@ -6980,11 +7193,11 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync16, readFileSync as readFileSync19, realpathSync as realpathSync6, rmSync as rmSync16 } from "node:fs";
-import { dirname as dirname13, join as join49, sep as sep10 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync16, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
+import { dirname as dirname13, join as join49, sep as sep11 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
-import { join as join48, normalize as normalize2, sep as sep9 } from "node:path";
+import { join as join48, normalize as normalize2, sep as sep10 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -7037,7 +7250,7 @@ function planningDeleteTargets(opts) {
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
   const planningRoot = join48(localRoot, ".planning");
-  const planningRootBoundary = planningRoot + sep9;
+  const planningRootBoundary = planningRoot + sep10;
   const targets = [];
   for (const repoPath of deleted) {
     if (!repoPath.startsWith(prefix)) {
@@ -7079,7 +7292,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
 }
 function pruneEmptyAncestors(target, planningRoot) {
   let dir = dirname13(target);
-  while (dir !== planningRoot && dir.startsWith(planningRoot + sep10)) {
+  while (dir !== planningRoot && dir.startsWith(planningRoot + sep11)) {
     try {
       if (readdirSync16(dir).length > 0) break;
       rmSync16(dir, { recursive: true, force: true });
@@ -7091,13 +7304,13 @@ function pruneEmptyAncestors(target, planningRoot) {
 }
 function tryRealpath(dir) {
   try {
-    return realpathSync6(dir);
+    return realpathSync7(dir);
   } catch {
     return void 0;
   }
 }
 function isInsidePlanningRoot(parentReal, rootReal) {
-  return parentReal === rootReal || parentReal.startsWith(rootReal + sep10);
+  return parentReal === rootReal || parentReal.startsWith(rootReal + sep11);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   if (existsSync38(repoCounterpart)) return;
@@ -7124,11 +7337,11 @@ function planningDiffArgs(pre, post, logical) {
 function deletePairsFor(t, raw) {
   return planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot }).map(
     (target) => {
-      const relToLocal = target.slice(t.localRoot.length + sep10.length);
+      const relToLocal = target.slice(t.localRoot.length + sep11.length);
       return {
         target,
         relToLocal,
-        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep10).join("/")}`
+        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep11).join("/")}`
       };
     }
   );
@@ -7302,8 +7515,8 @@ function divergenceCheckExtras(ts, prePostHeads) {
 
 // src/links.baseline.ts
 init_config();
-import { lstatSync as lstatSync15, readdirSync as readdirSync17 } from "node:fs";
-import { join as join51, relative as relative7, sep as sep11 } from "node:path";
+import { lstatSync as lstatSync16, readdirSync as readdirSync17 } from "node:fs";
+import { join as join51, relative as relative7, sep as sep12 } from "node:path";
 init_utils();
 var SHARED_BASELINE_KIND = "shared-links-baseline/1";
 var SHARED_BASELINE_CONFIG_HASH = "not-applicable";
@@ -7314,13 +7527,13 @@ function readSharedBaseline() {
   return parsed;
 }
 function baselineKey(claude, abs) {
-  return relative7(claude, abs).split(sep11).join("/");
+  return relative7(claude, abs).split(sep12).join("/");
 }
 function addLocalPath(abs, claude, scan) {
   const key = baselineKey(claude, abs);
   let st;
   try {
-    st = lstatSync15(abs, { throwIfNoEntry: false });
+    st = lstatSync16(abs, { throwIfNoEntry: false });
   } catch {
     scan.declined.push(key);
     return;
@@ -7412,7 +7625,7 @@ function gitProbe(args, repo) {
 
 // src/links.captures.ts
 init_config();
-import { existsSync as existsSync40, lstatSync as lstatSync16 } from "node:fs";
+import { existsSync as existsSync40, lstatSync as lstatSync17 } from "node:fs";
 import { join as join52 } from "node:path";
 function planSharedLinkCaptures(map) {
   if (process.platform !== "win32") return [];
@@ -7424,7 +7637,7 @@ function planSharedLinkCaptures(map) {
     const localPath = join52(claude, name);
     let stat;
     try {
-      stat = lstatSync16(localPath, { throwIfNoEntry: false });
+      stat = lstatSync17(localPath, { throwIfNoEntry: false });
     } catch {
       continue;
     }
@@ -7439,8 +7652,8 @@ function planSharedLinkCaptures(map) {
 
 // src/links.deletions.ts
 init_config();
-import { existsSync as existsSync41, lstatSync as lstatSync17, rmSync as rmSync17 } from "node:fs";
-import { join as join53, relative as relative8, resolve as resolve4, sep as sep12 } from "node:path";
+import { existsSync as existsSync41, lstatSync as lstatSync18, rmSync as rmSync17 } from "node:fs";
+import { join as join53, relative as relative8, resolve as resolve4, sep as sep13 } from "node:path";
 init_utils();
 init_utils_fs();
 function isUnknown(declined, key) {
@@ -7454,7 +7667,7 @@ function deletionFor(key, names, claude, sharedRoot) {
   if (segments.some((segment) => isDeniedName(ALWAYS_NEVER_SYNC, segment))) return null;
   const repoPath = resolve4(sharedRoot, key);
   const rel = relative8(join53(sharedRoot, name), repoPath);
-  if (rel === "" || rel === ".." || rel.startsWith(`..${sep12}`)) return null;
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep13}`)) return null;
   if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
     return null;
   if (!existsSync41(repoPath)) return null;
@@ -7485,7 +7698,7 @@ function applySharedLinkDeletions(map, ts) {
   const repo = repoHome();
   for (const entry of planSharedLinkDeletions(map)) {
     try {
-      if (!lstatSync17(entry.repoPath).isFile()) continue;
+      if (!lstatSync18(entry.repoPath).isFile()) continue;
       backupRepoWrite(entry.repoPath, ts, repo);
       rmSync17(entry.repoPath, { force: true });
     } catch (err) {
@@ -7955,7 +8168,7 @@ function planSharedReconcileBeforePull(repo) {
 // src/commands.pull.collision.ts
 init_config();
 init_exit_codes();
-import { existsSync as existsSync45, lstatSync as lstatSync18, readFileSync as readFileSync20, rmSync as rmSync18 } from "node:fs";
+import { existsSync as existsSync45, lstatSync as lstatSync19, readFileSync as readFileSync20, rmSync as rmSync18 } from "node:fs";
 import { join as join57 } from "node:path";
 init_utils();
 var SHARED_PREFIX = /^shared\//;
@@ -8022,7 +8235,7 @@ function removeMirroredCopies(repo, repoRelPaths) {
   for (const rel of repoRelPaths.filter(isContainedMirrorPath)) {
     const abs = join57(repo, rel);
     try {
-      if (lstatSync18(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
+      if (lstatSync19(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
       if (!matchesLocalOriginal(repo, rel)) continue;
       rmSync18(abs, { force: true });
     } catch (err) {
@@ -8401,7 +8614,7 @@ function isAllowed(path, allowed) {
 }
 function blockSetFor(segments) {
   if (segments[0] !== "shared" || segments[1] !== "extras") return NEVER_SYNC;
-  return segments[3] === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+  return isClaudeExtraName(segments[3] ?? "") ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function isNeverSync(path) {
   const segments = path.split("/");
@@ -8451,7 +8664,11 @@ function enforceAllowList(statusPorcelain, map) {
     ...Object.entries(map.extras ?? {}).flatMap(
       ([l, names]) => names.filter((n) => extrasWhitelist.includes(n)).flatMap((n) => [`shared/extras/${l}/${n}`, `shared/extras/${l}/${n}/`])
     ),
-    ...(map.sharedDirs ?? []).filter((d) => isValidSharedDir(d)).map((d) => `shared/${d}/`)
+    // Predicate passed by reference, not wrapped in an arrow: `isValidSharedDir`
+    // is a type guard, and an arrow returning its result is just a boolean, so
+    // wrapping it would leave `d` as `unknown` and let a non-string reach the
+    // template literal as "[object Object]".
+    ...sharedDirEntries(map).filter(isValidSharedDir).map((d) => `shared/${d}/`)
   ];
   const neverSyncHits = [];
   const violations = [];
@@ -8632,9 +8849,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync19, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync19 } from "node:fs";
+import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync20, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync19 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join62, relative as relative10, sep as sep13 } from "node:path";
+import { join as join62, relative as relative10, sep as sep14 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -8642,7 +8859,7 @@ init_utils_json();
 var NOTHING_TO_SCAN_ROW = `${dim(infoGlyph)} nothing to scan, no leaks`;
 function stageSessionDir(localDir, dstDir, changed) {
   if (changed !== void 0) {
-    const prefix = `${localDir}${sep13}`;
+    const prefix = `${localDir}${sep14}`;
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
@@ -8696,7 +8913,7 @@ function stageExtras(tmpRoot, map) {
 }
 function stageSkills(tmpRoot) {
   const localSkills = join62(claudeHome(), "skills");
-  const stat = lstatSync19(localSkills, { throwIfNoEntry: false });
+  const stat = lstatSync20(localSkills, { throwIfNoEntry: false });
   if (stat === void 0 || stat.isSymbolicLink()) return 0;
   const names = readdirSync19(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
   if (names.length === 0) return 0;
@@ -9881,7 +10098,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.64.0",
+  version: "0.64.1",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.64.0",
+  "version": "0.64.1",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [