claude-nomad 0.64.0 → 0.65.0

package/CHANGELOG.md

@@ -1,5 +1,109 @@
 # Changelog
 
+## [0.65.0](https://github.com/funkadelic/claude-nomad/compare/v0.64.1...v0.65.0) (2026-08-13)
+
+### What's new
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and none of these apply to
+it.
+
+- **`nomad pull --force-remote` no longer discards edits you have not published.** The flag exists
+  to rescue a sync repo that got stuck part-way through an update. On native Windows it also skipped
+  the step that saves your local shared-config edits into the repo, every time it ran, even on a
+  healthy machine with nothing to rescue. That was the flag's only visible effect on a healthy repo,
+  and nothing told you it had happened. It now rescues a stuck repo and nothing else, and when a
+  rescue genuinely does replace your copies, the pull says how many and where your previous ones
+  were saved.
+- **A pull now says what it did to your shared config.** On Windows your shared config is kept as
+  real file copies rather than symlinks, so every pull starts by copying your local edits into the
+  sync repo. That step used to be silent. It now prints a `Symlinks` section naming each file it
+  picked up, and each file it removed from the repo because you deleted it here. If a file cannot be
+  read at all, because another program is holding it open or its permissions changed, the pull names
+  it and says why rather than leaving a silent gap. `nomad diff` and `nomad pull --dry-run` read
+  from the same place, so a preview now matches what a real pull does.
+- **Windows keeps the same things out of your sync repo that your other machines do.** The Windows
+  copy step used to hold back only files whose names looked like passwords or keys. It now skips
+  everything on the never-sync list, so the folders Claude Code uses for its own state, named things
+  like `sessions`, `tasks`, `plans`, and `cache`, stay on the machine even when they sit inside a
+  folder you share. If one of them is already sitting in your sync repo, the pull tells you, and
+  takes a backup copy before removing it.
+
+**On all supported platforms, i.e. \*nix, Mac, WSL2, and native Windows.**
+
+- **`nomad doctor` names the files that have drifted.** When it reports that your skills or your
+  shared config no longer match the repo, it lists them. Before, you got a count and had to run it
+  again with `--verbose` to find out which files it meant.
+- **`nomad pull --force-remote` tells you when there was nothing to rescue.** On a repo that is not
+  stuck it now says so and pulls normally, instead of appearing to do nothing. If it cannot tell
+  whether the repo is stuck, it says that too rather than reporting a clean repo. The help text,
+  README, and docs site now agree on what the flag does.
+
+
+### Added
+
+* **doctor:** open with the nomad wordmark and name the diverging files ([#508](https://github.com/funkadelic/claude-nomad/issues/508)) ([1fea0c7](https://github.com/funkadelic/claude-nomad/commit/1fea0c7913b38f934d529d888a0aef96dc1dfc08))
+* make the win32 pre-pull mirror visible and gate what it writes ([#503](https://github.com/funkadelic/claude-nomad/issues/503)) ([8d3a76d](https://github.com/funkadelic/claude-nomad/commit/8d3a76dd42c89efd38b2a76b2684b8b4014878ac))
+* **pull:** report the shared files a pull removes, not just the ones it captures ([#510](https://github.com/funkadelic/claude-nomad/issues/510)) ([9ab6ef5](https://github.com/funkadelic/claude-nomad/commit/9ab6ef5b9961a8542eb25a650ada27bd3bdf9de6))
+
+
+### Fixed
+
+* **mirror:** report what the never-sync cleanup actually removed ([#509](https://github.com/funkadelic/claude-nomad/issues/509)) ([6596ed3](https://github.com/funkadelic/claude-nomad/commit/6596ed341d4e764b29a56bb73f900aa6dd48fcc9))
+* **mirror:** warn when the win32 mirror skips a name it cannot stat ([#505](https://github.com/funkadelic/claude-nomad/issues/505)) ([5806db6](https://github.com/funkadelic/claude-nomad/commit/5806db6e2d2861747738d498d0255fe0483a6650))
+* **pull:** make --force-remote mean wedge recovery again ([#506](https://github.com/funkadelic/claude-nomad/issues/506)) ([2bf8d5d](https://github.com/funkadelic/claude-nomad/commit/2bf8d5d3b19e8c022ff1137be96b0f009e5503df))
+
+
+### Changed
+
+* fail the gitleaks install on a download error, not a checksum mismatch ([#504](https://github.com/funkadelic/claude-nomad/issues/504)) ([724dd3c](https://github.com/funkadelic/claude-nomad/commit/724dd3c276bdea113f9719e5b62ee0741a3c3885))
+
+
+### Documentation
+
+* describe what the force-remote recovery warning actually counts ([#507](https://github.com/funkadelic/claude-nomad/issues/507)) ([6235858](https://github.com/funkadelic/claude-nomad/commit/6235858e40459e136deff4b081187c89b9e7b670))
+* keep the Windows explainer in one place ([#511](https://github.com/funkadelic/claude-nomad/issues/511)) ([9a9287f](https://github.com/funkadelic/claude-nomad/commit/9a9287f87d86e2353ca4a0d936346482e37a1041))
+
+
+### Dependencies
+
+* bump @astrojs/starlight from 0.41.6 to 0.41.7 in /docs-site in the prod-dependencies group ([#499](https://github.com/funkadelic/claude-nomad/issues/499)) ([61ecb3f](https://github.com/funkadelic/claude-nomad/commit/61ecb3fef0213c6bc0f2a36713da0e166e356238))
+* bump astro from 7.1.6 to 7.2.0 in /docs-site ([#500](https://github.com/funkadelic/claude-nomad/issues/500)) ([4909e02](https://github.com/funkadelic/claude-nomad/commit/4909e02e5754081432e567cae2344989ab8b1309))
+* bump the codeql-action group across 1 directory with 2 updates ([#498](https://github.com/funkadelic/claude-nomad/issues/498)) ([ad3310d](https://github.com/funkadelic/claude-nomad/commit/ad3310d33e9662ae407d304ef949efd1bebf9c3e))
+* bump the dev-dependencies group across 1 directory with 4 updates ([#501](https://github.com/funkadelic/claude-nomad/issues/501)) ([446c6da](https://github.com/funkadelic/claude-nomad/commit/446c6dae3905609bef1d3ec4366d58e50651c44a))
+
+## [0.64.1](https://github.com/funkadelic/claude-nomad/compare/v0.64.0...v0.64.1) (2026-08-07)
+
+### What's new
+
+- **A stray dot or space at the end of a file name no longer hides a secret.** nomad never copies
+  password and key files (things like `.env`, `id_rsa`, or `server.pem`) out of the project folders
+  you sync. It spots them by name, and a name with an extra dot or space on the end, such as
+  `.env.`, did not match, so a file like that could end up in your sync repo. It matches now, and so
+  do the other files nomad always keeps out, such as `settings.local.json`. Nothing changes in how
+  you use nomad. It simply catches more ways of writing the same names it already blocked.
+- **A `.claude` folder is recognized however it is capitalized.** If a project had a folder named
+  `.Claude` instead of `.claude`, nomad checked what was inside it less carefully than it should
+  have. Both are treated the same now.
+- **A folder name nomad will never sync is turned down as soon as you add it.** You can ask nomad to
+  sync extra folders by listing their names in `path-map.json`. If a name you list is one nomad
+  refuses to sync, because it looks like a password file, or because it is a name that causes
+  trouble on one of the machines you sync to, you are told straight away and told why. Before,
+  nothing was said until a later `nomad push` stopped without explaining itself. `nomad doctor` also
+  lists any names in this situation and what to do about them.
+
+All of this applies on macOS, Linux, WSL2, and native Windows.
+
+
+### Fixed
+
+* **config:** close the trailing-dot bypass in the secret-name guard ([#495](https://github.com/funkadelic/claude-nomad/issues/495)) ([9aaf5d9](https://github.com/funkadelic/claude-nomad/commit/9aaf5d958027a3557974c1ab32254c6171aea631))
+* reject a secret-shaped name as a shared dir ([#493](https://github.com/funkadelic/claude-nomad/issues/493)) ([3054464](https://github.com/funkadelic/claude-nomad/commit/3054464c91c974a7abdad24b2067bab8386e1dfd))
+
+
+### Changed
+
+* **release:** publish the release body from CHANGELOG.md ([#496](https://github.com/funkadelic/claude-nomad/issues/496)) ([e7bff07](https://github.com/funkadelic/claude-nomad/commit/e7bff07504935e563936733eae1146dc6eeaca83))
+
 ## [0.64.0](https://github.com/funkadelic/claude-nomad/compare/v0.63.2...v0.64.0) (2026-08-05)
 
 ### What's new

package/README.md

@@ -71,7 +71,8 @@ survives different file paths and your secrets never ride along.
   parks stranded work on a branch, refuses if shared config is at risk), and a repo where the rebase
   was interrupted but the git index was left with unmerged entries and no active operation (clears
   the index via `git reset --mixed HEAD`, surfaces any orphaned stash entry left by the interrupted
-  autostash, never discards working-tree edits).
+  autostash, never discards working-tree edits). On a repo that is not stuck, the flag reports there
+  is nothing to recover and pulls normally instead of doing nothing silently.
 - **Easy off.** `nomad eject` replaces every managed `~/.claude/` symlink with a real copy in one
   step, so your setup keeps working after you delete the sync checkout and uninstall the CLI.
 
@@ -118,27 +119,40 @@ export NOMAD_HOST=<your-host-label>   # add to ~/.zshrc or ~/.bashrc
 $ nomad pull
 ```
 
+Everyday loop on any host:
+
+```bash
+$ nomad doctor   # confirm setup
+$ nomad sync     # pull config, then publish local changes, in one step
+```
+
+`nomad sync` is the command to reach for day to day: it always pulls first (so changes from your
+other machines land before anything is pushed, and work that exists only on this machine is kept,
+not deleted) and then pushes, under one lock, so there is no ordering to remember. Output is compact
+by default: a run prints only a short Sync summary, not the full status tree; pass
+`nomad sync --verbose` (or `--all` / `-v`) to see the full tree. `nomad pull` and `nomad push` are
+still available as lower-level commands for cases `sync` does not cover: recovering a wedged repo
+with `nomad pull --force-remote`, or resolving a detected secret without the interactive menu via
+`nomad push --redact-all` / `--allow` / `--allow-all` (see [Changing settings](#changing-settings)
+and [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/)). The
+[FAQ](https://funkadelic.github.io/claude-nomad/faq/) covers what `sync` does under the hood and the
+push/pull order it enforces.
+
 ### Windows
 
 claude-nomad runs natively on Windows (PowerShell or cmd), and WSL2 works too. The everyday loop is
 the same either way; the difference is under the hood.
 
-On macOS, Linux, and WSL2, claude-nomad symlinks your shared config into `~/.claude/`, so there is
-only ever one file: the one in your sync repo. Native Windows cannot use symlinks, because creating
-one there needs Developer Mode or admin rights, so claude-nomad keeps a real copy there instead.
-That leaves two files to keep in step, and claude-nomad does it for you: `nomad pull` and
-`nomad sync` both copy your edits into the repo before they fetch, so an unpublished edit is never
-overwritten. Enabling Developer Mode does not change this; copies are used on every native Windows
-host either way.
-
-Two things come from native Windows specifically, both covered in the bullets below: a
-`.gitleaksignore` allow entry may not travel to a macOS, Linux, or WSL2 host, and deep session paths
-can hit the native Windows 260-character path limit.
-
-The native Windows steps are the same as above with a couple of PowerShell-specific swaps:
+Native Windows cannot use symlinks, so claude-nomad keeps a real copy of your shared config in
+`~/.claude/` instead of a symlink. `nomad pull` and `nomad sync` both mirror your local copies into
+the repo before they fetch, so an edit you have not published yet is captured rather than
+overwritten. If a file cannot be read, the pull leaves it out and warns naming the file: fix that
+and run again before you rely on the result.
 
 ```powershell
-# 1. Install the CLI.
+# 1. Install prerequisites and the CLI. (Using Scoop instead? scoop install gh gitleaks.)
+> winget install GitHub.cli
+> winget install gitleaks.gitleaks
 > npm i -g claude-nomad
 
 # 2. Create your private sync repo and scaffold it.
@@ -155,66 +169,9 @@ The native Windows steps are the same as above with a couple of PowerShell-speci
 > nomad push
 ```
 
-A few native Windows specifics worth knowing. WSL2 behaves like Linux, so the copy-sync and
-path-length items below do not apply to it; the `.gitleaksignore` one can still reach it, from the
-other side:
-
-- **Installing gh:** `winget install GitHub.cli` (or `scoop install gh`), then `gh auth login`.
-  Needed before `nomad init` on the first host; later hosts only clone with it.
-- **Installing gitleaks:** `winget install gitleaks.gitleaks` (or `scoop install gitleaks` if you
-  use Scoop). `nomad doctor` prints the same hint whenever gitleaks is missing from PATH.
-- **Shared config is copied, not symlinked.** On macOS and Linux, files like `CLAUDE.md` and your
-  skills live in the sync repo and are symlinked into `~/.claude/`, so there is one source of truth
-  on disk. Creating a symlink on native Windows needs Developer Mode or admin rights, so there these
-  are real copies instead, whether or not you have Developer Mode enabled. WSL2 is unaffected and
-  behaves like Linux. What this means for you: nothing extra. On native Windows both `nomad pull`
-  and `nomad sync` mirror your local copies into the repo before they fetch, so an unpublished edit
-  is captured rather than reverted. A file you delete from a shared directory is handled the same
-  way: it is removed from the sync repo by the next pull, exactly as deleting inside a symlinked
-  directory already removes it on macOS or Linux. The removal is left uncommitted, so it publishes
-  on your next push and passes the same secret scan as everything else, and the file is snapshotted
-  to the backup dir first. The safety rule behind this: nomad only removes a file it has a record of
-  having given this machine, so a repo file this machine has never synced is never touched. That
-  record is also why the first pull after you upgrade to this version is an exception: there is
-  nothing to compare against yet, so a deletion made before that pull comes back once, and deleting
-  it again sticks. If a file you created has the same name as one another machine just created, the
-  pull stops before it changes anything and tells you which file under `~/.claude/` to move or
-  rename, with the two ways to finish. Nothing is lost either way: your file stays exactly as you
-  left it and the update simply waits for the next pull. The one command that deliberately takes the
-  repo's version is `nomad pull --force-remote`, which is what that flag is for; the copy it
-  replaces is snapshotted to the backup dir first. This is the same behavior claude-nomad's
-  `skills/` sync already has on every platform.
-- **A `.gitleaksignore` allow entry may not travel across hosts.** gitleaks fingerprints each
-  finding using the file path exactly as it saw it: backslashes on native Windows, forward slashes
-  on macOS/Linux/WSL2. If you allow a finding with `nomad push --allow` (or `nomad allow`) on native
-  Windows, the identical finding can reappear as "new" the first time it is scanned from a macOS,
-  Linux, or WSL2 host, and the same happens in reverse. This is a known gitleaks limitation, not a
-  claude-nomad bug; just allow it again from the other host.
-- **Line endings stay put.** A fresh `nomad init` writes a `.gitattributes` with `* -text`, so Git
-  never converts line endings between hosts. If you are joining a sync repo created before this file
-  existed, add that one line from any host (or watch for the `nomad doctor` warning that nudges
-  you), otherwise a native Windows checkout with the common `core.autocrlf=true` Git default would
-  rewrite every text file's line endings, and every host would then see the whole tree as
-  permanently changed.
-
-Everyday loop on any host:
-
-```bash
-$ nomad doctor   # confirm setup
-$ nomad sync     # pull config, then publish local changes, in one step
-```
-
-`nomad sync` is the command to reach for day to day: it always pulls first (so changes from your
-other machines land before anything is pushed, and work that exists only on this machine is kept,
-not deleted) and then pushes, under one lock, so there is no ordering to remember. Output is compact
-by default: a run prints only a short Sync summary, not the full status tree; pass
-`nomad sync --verbose` (or `--all` / `-v`) to see the full tree. `nomad pull` and `nomad push` are
-still available as lower-level commands for cases `sync` does not cover: recovering a wedged repo
-with `nomad pull --force-remote`, or resolving a detected secret without the interactive menu via
-`nomad push --redact-all` / `--allow` / `--allow-all` (see [Changing settings](#changing-settings)
-and [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/)). The
-[FAQ](https://funkadelic.github.io/claude-nomad/faq/) covers what `sync` does under the hood and the
-push/pull order it enforces.
+See the full explainer at <https://funkadelic.github.io/claude-nomad/quickstart/#windows> for how
+the copy-sync behaves on pull and push, why a `.gitleaksignore` allow entry may not travel to a
+macOS, Linux, or WSL2 host, the 260-character path limit, and the line-endings setting.
 
 ### Make your sessions follow you
 
@@ -321,8 +278,8 @@ independently from the CLI, but requires nomad `>= 0.35.0` because it calls rece
 - `gh` ([GitHub CLI](https://cli.github.com/)), required by `nomad init`
 
 Works on macOS, Linux (including WSL2), and native Windows (PowerShell or cmd). See
-[Windows](#windows) above for the native Windows equivalents of the install and host-label steps,
-the copy-sync trade-off, and the `.gitleaksignore` cross-host caveat.
+[Windows](#windows) above for the native Windows equivalents of the install and host-label steps and
+the copy-sync trade-off.
 
 **Optional:** [curl](https://curl.se/) or [wget](https://www.gnu.org/software/wget/) for the
 version-staleness check and `nomad doctor --check-schema`. The CLI works without them. The opt-in