claude-nomad 0.64.0 → 0.65.0

package/dist/nomad.mjs

@@ -42,13 +42,42 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/config.never-sync.ts
+function stripTrailingDotsAndWhitespace(name) {
+  let end = name.length;
+  while (end > 0 && (name[end - 1] === "." || /\s/.test(name[end - 1]))) end -= 1;
+  return name.slice(0, end);
+}
 function isSecretFileName(name) {
-  return SECRET_FILE_PATTERNS.some((re) => re.test(name));
+  const stripped = stripTrailingDotsAndWhitespace(name);
+  return SECRET_FILE_PATTERNS.some((re) => re.test(stripped));
 }
 function isDeniedName(blockSet, name) {
-  return blockSet.has(name) || blockSet.has(name.toLowerCase()) || isSecretFileName(name);
+  const stripped = stripTrailingDotsAndWhitespace(name);
+  return blockSet.has(name) || blockSet.has(name.toLowerCase()) || blockSet.has(stripped) || blockSet.has(stripped.toLowerCase()) || isSecretFileName(name);
+}
+function isClaudeExtraName(name) {
+  return stripTrailingDotsAndWhitespace(name).toLowerCase() === ".claude";
+}
+function isExtrasScoped(segments) {
+  return segments[0] === "shared" && segments[1] === "extras";
+}
+function blockSetFor(segments) {
+  if (!isExtrasScoped(segments)) return NEVER_SYNC;
+  return isClaudeExtraName(segments[3] ?? "") ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+}
+function deniedSegmentFor(path) {
+  const segments = path.split("/");
+  const blockSet = blockSetFor(segments);
+  const scan = isExtrasScoped(segments) ? segments.slice(4) : segments;
+  for (const segment of scan) {
+    if (isDeniedName(blockSet, segment)) return segment;
+  }
+  return null;
+}
+function isNeverSync(path) {
+  return deniedSegmentFor(path) !== null;
 }
-var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, SECRET_FILE_PATTERNS;
+var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, ALWAYS_NEVER_SYNC, SECRET_FILE_PATTERNS;
 var init_config_never_sync = __esm({
   "src/config.never-sync.ts"() {
     "use strict";
@@ -78,6 +107,13 @@ var init_config_never_sync = __esm({
       "sessions"
     ]);
     CLAUDE_EXTRA_NEVER_SYNC = /* @__PURE__ */ new Set([...NEVER_SYNC, "projects"]);
+    ALWAYS_NEVER_SYNC = /* @__PURE__ */ new Set([
+      ".claude.json",
+      ".credentials.json",
+      "settings.local.json",
+      "history.jsonl",
+      "stats-cache.json"
+    ]);
     SECRET_FILE_PATTERNS = [
       /^\.env(\..+)?$/i,
       // .env, .env.local, .env.production
@@ -302,14 +338,67 @@ function assertSafeLogical(logical) {
     );
   }
 }
+function validateSharedDirEntry(entry) {
+  if (typeof entry !== "string") {
+    return { reason: "not-a-string", message: "not a string" };
+  }
+  if (!SAFE_SEGMENT.test(entry) || entry === "." || entry === "..") {
+    return {
+      reason: "not-a-segment",
+      message: 'not a single path segment (contains a path separator, an unsupported character, "." or "..")'
+    };
+  }
+  const addressed = stripTrailingDots(entry);
+  const named = classifyDeniedName(addressed);
+  if (named !== null) {
+    return addressed === entry ? named : {
+      reason: named.reason,
+      message: `a trailing-dot name shadowing ${named.message}`
+    };
+  }
+  if (entry.endsWith(".")) {
+    return {
+      reason: "win32-alias",
+      message: 'a trailing-dot name (git for Windows refuses to create or check out a path ending in ".")'
+    };
+  }
+  return null;
+}
+function stripTrailingDots(name) {
+  let end = name.length;
+  while (end > 0 && name[end - 1] === ".") end -= 1;
+  return name.slice(0, end);
+}
+function classifyDeniedName(name) {
+  const folded = name.toLowerCase();
+  if (NEVER_SYNC.has(name) || NEVER_SYNC.has(folded)) {
+    return { reason: "never-sync", message: "a never-sync name" };
+  }
+  if (RESERVED_SHARED.has(name) || RESERVED_SHARED_FOLDED.has(folded)) {
+    return { reason: "reserved", message: "a reserved shared/ name" };
+  }
+  const dot = folded.indexOf(".");
+  const stem = dot === -1 ? folded : folded.slice(0, dot);
+  if (WIN32_DEVICE_NAMES.has(stem)) {
+    return { reason: "reserved", message: "a reserved Windows device name" };
+  }
+  if (isSecretFileName(name)) {
+    return {
+      reason: "secret-shaped",
+      message: "a credential-shaped filename (.env, id_rsa, credentials, *.pem, *.key and similar)"
+    };
+  }
+  return null;
+}
+function mayJoinRefusedEntry(entry, reason, remediable) {
+  if (UNJOINABLE_REASONS.has(reason)) return false;
+  if (entry.endsWith(".")) return true;
+  return remediable.has(reason);
+}
 function isValidSharedDir(entry) {
-  if (typeof entry !== "string") return false;
-  if (!SAFE_SEGMENT.test(entry) || entry === "." || entry === "..") return false;
-  if (NEVER_SYNC.has(entry)) return false;
-  if (RESERVED_SHARED.has(entry)) return false;
-  return true;
+  return validateSharedDirEntry(entry) === null;
 }
-var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED;
+var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED, RESERVED_SHARED_FOLDED, WIN32_DEVICE_NAMES, UNJOINABLE_REASONS;
 var init_config_sharedDirs_guard = __esm({
   "src/config.sharedDirs.guard.ts"() {
     "use strict";
@@ -331,6 +420,19 @@ var init_config_sharedDirs_guard = __esm({
       "extras",
       "projects"
     ]);
+    RESERVED_SHARED_FOLDED = new Set([...RESERVED_SHARED].map((name) => name.toLowerCase()));
+    WIN32_DEVICE_NAMES = /* @__PURE__ */ new Set([
+      "con",
+      "prn",
+      "aux",
+      "nul",
+      ...Array.from({ length: 9 }, (_unused, i) => `com${i + 1}`),
+      ...Array.from({ length: 9 }, (_unused, i) => `lpt${i + 1}`)
+    ]);
+    UNJOINABLE_REASONS = /* @__PURE__ */ new Set([
+      "not-a-string",
+      "not-a-segment"
+    ]);
   }
 });
 
@@ -541,20 +643,29 @@ function manifestPath() {
 function sharedBaselinePath() {
   return join(home(), ".cache", "claude-nomad", `shared-baseline-${encodeURIComponent(HOST)}.json`);
 }
-function allSharedLinks(map) {
+function allSharedLinks(map, opts = {}) {
+  const emit = opts.quiet === true ? () => void 0 : warn;
+  const raw = map.sharedDirs;
+  if (raw !== void 0 && !Array.isArray(raw)) {
+    emit("sharedDirs in path-map.json is not an array; ignoring the whole field");
+    return [...SHARED_LINKS];
+  }
   const extras = [];
-  for (const entry of map.sharedDirs ?? []) {
-    if (isValidSharedDir(entry)) {
+  for (const entry of raw ?? []) {
+    const rejection = validateSharedDirEntry(entry);
+    if (rejection === null) {
       extras.push(entry);
     } else {
-      warn(
-        `sharedDirs entry ${JSON.stringify(entry)} is invalid (path separator, reserved name, or NEVER_SYNC); skipping`
-      );
+      emit(`sharedDirs entry ${JSON.stringify(entry)} rejected: ${rejection.message}; skipping`);
     }
   }
   return [...SHARED_LINKS, ...extras];
 }
-var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
+function sharedDirEntries(map) {
+  const raw = map.sharedDirs;
+  return Array.isArray(raw) ? raw : [];
+}
+var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -571,13 +682,6 @@ var init_config = __esm({
     GSD_PREFIX = "gsd-";
     GSD_DROPPED_NAMES = ["hooks", "agents"];
     SUPPORTED_EXTRAS = [".planning", "CLAUDE.md", ".claude"];
-    ALWAYS_NEVER_SYNC = /* @__PURE__ */ new Set([
-      ".claude.json",
-      ".credentials.json",
-      "settings.local.json",
-      "history.jsonl",
-      "stats-cache.json"
-    ]);
     PUSH_ALLOWED_STATIC = [
       "shared/CLAUDE.md",
       "shared/my-statusline.cjs",
@@ -809,13 +913,20 @@ function probeUnmergedIndex(repo) {
   }
   return raw.split("\0").some(Boolean) ? "unmerged" : "clean";
 }
-function unmergedIndexPresent(repo) {
-  return probeUnmergedIndex(repo) === "unmerged";
+function classifyWedgeWithProbe(repo) {
+  const mode = detectWedge(repo);
+  if (mode !== null) return { state: mode, probe: "clean" };
+  const probe = probeUnmergedIndex(repo);
+  return { state: probe === "unmerged" ? "unmerged-index" : null, probe };
 }
 function classifyWedge(repo) {
-  const mode = detectWedge(repo);
-  if (mode !== null) return mode;
-  return unmergedIndexPresent(repo) ? "unmerged-index" : null;
+  return classifyWedgeWithProbe(repo).state;
+}
+function cleanRepoForceRemoteMessage(probe) {
+  if (probe === "error") {
+    return "could not determine whether the repo is wedged; continuing with a normal pull";
+  }
+  return "repo is clean, nothing to recover; continuing with a normal pull";
 }
 function unmergedIndexRunbookText(resumeCmd2) {
   return `repo has an unmerged index with no active rebase or merge in progress (torn-down rebase or merge left stage-2/3 entries behind).
@@ -1422,6 +1533,7 @@ var init_push_leak_verdict = __esm({
 // src/commands.adopt.ts
 init_config();
 init_config_sharedDirs_guard();
+init_exit_codes();
 import { cpSync as cpSync4, existsSync as existsSync5, lstatSync as lstatSync5, rmSync as rmSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 
@@ -1892,7 +2004,7 @@ function copyExtrasFileSkipDiverged(src, dst) {
   copyExtras(src, dst);
 }
 function extrasDenySet(dirname14) {
-  return dirname14 === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+  return isClaudeExtraName(dirname14) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function copyExtrasFiltered(src, dst, blockSet) {
   rmSync2(dst, { recursive: true, force: true });
@@ -2004,7 +2116,7 @@ function applySharedLinks(ts, map, opts = {}) {
   const dryRun = opts.dryRun === true;
   const claude = claudeHome();
   const repo = repoHome();
-  const linkNames = allSharedLinks(map);
+  const linkNames = allSharedLinks(map, { quiet: opts.quietNames === true });
   if (process.platform === "win32") {
     applySharedLinksWin32(linkNames, claude, repo, ts, dryRun, opts.onPreview);
     return;
@@ -2022,35 +2134,6 @@ function applySharedLinks(ts, map, opts = {}) {
     ensureSymlink(linkPath, target);
   }
 }
-function syncSharedLinksPush(map) {
-  mirrorSharedNames(map, { adoptNew: true, overlay: false });
-}
-function stageLocalSharedEdits(map, ts) {
-  mirrorSharedNames(map, { adoptNew: false, overlay: true, backupTs: ts });
-}
-function mirrorOneSharedName(name, claude, repo, policy) {
-  const localPath = join5(claude, name);
-  const stat = lstatSync4(localPath, { throwIfNoEntry: false });
-  if (stat === void 0) return;
-  if (stat.isSymbolicLink()) return;
-  const target = join5(repo, "shared", name);
-  if (!policy.adoptNew && !existsSync4(target)) return;
-  if (policy.backupTs !== void 0) backupRepoWrite(target, policy.backupTs, repo);
-  if (policy.overlay && stat.isDirectory()) {
-    copyExtrasOverlayFiltered(localPath, target, ALWAYS_NEVER_SYNC);
-  } else {
-    copyExtrasFiltered(localPath, target, ALWAYS_NEVER_SYNC);
-  }
-}
-function mirrorSharedNames(map, policy) {
-  if (process.platform !== "win32") return;
-  if (map === null) return;
-  const claude = claudeHome();
-  const repo = repoHome();
-  for (const name of allSharedLinks(map)) {
-    mirrorOneSharedName(name, claude, repo, policy);
-  }
-}
 function readExistingSettings(settingsPath) {
   if (!existsSync4(settingsPath)) return { existing: {}, present: false, malformed: false };
   try {
@@ -2133,7 +2216,7 @@ function readMapIfPresent(repoHome2) {
   return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function isConfiguredTarget(name, map) {
-  return SHARED_LINKS.includes(name) || (map.sharedDirs?.includes(name) ?? false);
+  return SHARED_LINKS.includes(name) || sharedDirEntries(map).includes(name);
 }
 function isValidAdoptName(name) {
   if (SHARED_LINKS.includes(name)) return true;
@@ -2155,6 +2238,13 @@ function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
 }
 function cmdAdopt(name, opts = {}) {
   const dryRun = opts.dryRun === true;
+  const rejection = validateSharedDirEntry(name);
+  if (rejection !== null && rejection.reason === "secret-shaped") {
+    throw new NomadFatal(
+      `cannot adopt ${JSON.stringify(name)}: ${rejection.message}. If it is listed in sharedDirs in path-map.json, remove it there too.`,
+      { code: EXIT.GENERIC_FAILURE }
+    );
+  }
   if (!isValidAdoptName(name)) {
     fail(`invalid name: ${JSON.stringify(name)}`);
     process.exit(1);
@@ -2568,6 +2658,7 @@ function cmdClean(opts, backupBase2 = backupBase()) {
 
 // src/commands.eject.ts
 init_config();
+init_config_sharedDirs_guard();
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -2705,6 +2796,19 @@ function materializeOneOrDie(name, linkPath, sharedRoot, done) {
     );
   }
 }
+var WIDENED_REASONS = /* @__PURE__ */ new Set([
+  "never-sync",
+  "reserved",
+  "secret-shaped"
+]);
+function ejectNames(map) {
+  const alreadyMaterialized = sharedDirEntries(map).filter((entry) => {
+    if (typeof entry !== "string") return false;
+    const rejection = validateSharedDirEntry(entry);
+    return rejection === null || mayJoinRefusedEntry(entry, rejection.reason, WIDENED_REASONS);
+  });
+  return [.../* @__PURE__ */ new Set([...allSharedLinks(map), ...alreadyMaterialized])];
+}
 function defaultEjectRoots() {
   return { claudeHome: claudeHome(), repoHome: repoHome() };
 }
@@ -2712,16 +2816,31 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   const dryRun = opts.dryRun === true;
   const { claudeHome: claudeHome2, repoHome: repoHome2 } = roots;
   const map = readMapIfPresent2(repoHome2);
-  const names = allSharedLinks(map);
+  const names = ejectNames(map);
   const classifications = /* @__PURE__ */ new Map();
   for (const name of names) {
     classifications.set(name, classifyName(join11(claudeHome2, name)));
   }
+  const base = new Set(allSharedLinks(map, { quiet: true }));
+  for (const name of names) {
+    if (base.has(name)) continue;
+    if (classifications.get(name) !== "materialize") continue;
+    item(`processing rejected entry already present on this host: ${name}`);
+  }
   const dangling = names.filter((n) => classifications.get(n) === "dangling");
-  if (dangling.length > 0) {
+  const danglingBase = dangling.filter((n) => base.has(n));
+  const danglingRefused = dangling.filter((n) => !base.has(n));
+  if (danglingBase.length > 0) {
     fail(
-      `dangling symlink(s): ${dangling.join(", ")}. run \`nomad pull\` first to restore the missing target, then re-run \`nomad eject\``
+      `dangling symlink(s): ${danglingBase.join(", ")}. run \`nomad pull\` first to restore the missing target, then re-run \`nomad eject\``
     );
+  }
+  if (danglingRefused.length > 0) {
+    fail(
+      `dangling symlink(s) for a refused name nomad cannot restore: ${danglingRefused.join(", ")}. recover the content by hand if you need it, then remove the dead link and re-run \`nomad eject\``
+    );
+  }
+  if (dangling.length > 0) {
     process.exit(1);
   }
   const sharedRoot = resolveSharedRoot(repoHome2);
@@ -2745,7 +2864,7 @@ import { join as join45 } from "node:path";
 init_color();
 init_config();
 import { existsSync as existsSync11, lstatSync as lstatSync8, readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
-import { basename as basename3, join as join13 } from "node:path";
+import { join as join13, win32 as win32Path } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -2999,19 +3118,30 @@ function reportRepoState(section2) {
 function repoHasSharedSource(name) {
   return existsSync11(join13(repoHome(), "shared", name));
 }
-function win32CopyOkRow(name) {
-  return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)`, fail: false };
+function win32CopyOkRow(name, exempt = 0) {
+  const note = exempt > 0 ? dim(` (${exempt} never-synced path(s) not compared)`) : "";
+  return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)${note}`, fail: false };
+}
+function relativeUnder(root, path) {
+  const rel = win32Path.relative(root, path);
+  const segments = rel.split(win32Path.sep);
+  if (rel === "" || segments[0] === ".." || win32Path.isAbsolute(rel)) return null;
+  return segments.join("/");
 }
-function divergingBasename(line) {
-  return basename3(line.replace(/ \((?:local|repo) only\)$/, ""));
+function divergingRepoPath(line, name, local, shared) {
+  const path = line.replace(/ \((?:local|repo) only\)$/, "");
+  const rel = relativeUnder(local, path) ?? relativeUnder(shared, path);
+  return rel === null ? `shared/${name}` : `shared/${name}/${rel}`;
 }
 function classifyWin32Copy(name, p) {
   const sharedPath = join13(repoHome(), "shared", name);
   if (!existsSync11(sharedPath)) return win32CopyOkRow(name);
-  const diverging = listDivergingFiles(p, sharedPath).filter(
-    (line) => !isDeniedName(ALWAYS_NEVER_SYNC, divergingBasename(line))
+  const compared = listDivergingFiles(p, sharedPath);
+  const diverging = compared.filter(
+    (line) => deniedSegmentFor(divergingRepoPath(line, name, p, sharedPath)) === null
   );
-  if (diverging.length === 0) return win32CopyOkRow(name);
+  const exempt = compared.length - diverging.length;
+  if (diverging.length === 0) return win32CopyOkRow(name, exempt);
   return {
     line: `${yellow(warnGlyph)} ${name}: ${diverging.length} file(s) diverge from shared/${name}`,
     fail: false,
@@ -3066,7 +3196,7 @@ function classifySymlinkTarget(name, p) {
 }
 function reportSharedLinks(section2, map) {
   const claude = claudeHome();
-  for (const name of allSharedLinks(map)) {
+  for (const name of allSharedLinks(map, { quiet: true })) {
     const p = join13(claude, name);
     const { line, fail: fail2, children } = classifySharedLink(name, p);
     addItem(section2, line);
@@ -3158,8 +3288,9 @@ function reportHostOverrides(section2, base, settings) {
 // src/commands.doctor.checks.pathmap.ts
 init_color();
 init_config();
-import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
-import { join as join15 } from "node:path";
+init_config_sharedDirs_guard();
+import { existsSync as existsSync13, lstatSync as lstatSync9, readdirSync as readdirSync6, realpathSync as realpathSync2 } from "node:fs";
+import { join as join15, sep as sep4 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
@@ -3199,6 +3330,95 @@ function reportCurrentHostPathsMissing(section2, map) {
     }
   }
 }
+function hasSharedLeftover(entry) {
+  try {
+    return lstatSync9(join15(repoHome(), "shared", entry), { throwIfNoEntry: false }) !== void 0;
+  } catch {
+    return false;
+  }
+}
+var PROBEABLE_REASONS = /* @__PURE__ */ new Set([
+  "never-sync",
+  "secret-shaped"
+]);
+function classifyLocalLink(entry) {
+  const linkPath = join15(claudeHome(), entry);
+  let stat;
+  try {
+    stat = lstatSync9(linkPath, { throwIfNoEntry: false });
+  } catch {
+    return "absent";
+  }
+  if (stat?.isSymbolicLink() !== true) return "absent";
+  let target;
+  try {
+    target = realpathSync2(linkPath);
+  } catch {
+    return "dangling";
+  }
+  let root;
+  try {
+    root = realpathSync2(join15(repoHome(), "shared"));
+  } catch {
+    return "foreign";
+  }
+  return target.startsWith(root + sep4) ? "managed" : "foreign";
+}
+function reportRejectedSharedDirs(section2, map) {
+  const raw = map.sharedDirs;
+  if (raw !== void 0 && !Array.isArray(raw)) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} path-map: sharedDirs is not an array (${typeof raw}); the whole field is ignored`
+    );
+    return;
+  }
+  const entries = Array.isArray(raw) ? raw : [];
+  const probable = [];
+  for (const entry of entries) {
+    const rejection = validateSharedDirEntry(entry);
+    if (rejection === null) continue;
+    if (typeof entry === "string" && mayJoinRefusedEntry(entry, rejection.reason, PROBEABLE_REASONS)) {
+      probable.push(entry);
+    }
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} path-map: sharedDirs entry ${JSON.stringify(entry)} rejected: ${rejection.message}; skipping`
+    );
+  }
+  reportRejectedLeftovers(section2, probable);
+}
+function reportRejectedLeftovers(section2, probable) {
+  for (const entry of probable) {
+    const link = classifyLocalLink(entry);
+    if (link === "managed") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a symlink under ~/.claude/ pointing into shared/; copy the content out first (cp -RL), then remove both. nomad will not do it for you`
+      );
+      continue;
+    }
+    if (link === "dangling") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a DANGLING symlink under ~/.claude/ (its target does not resolve); do not delete anything under shared/ yet, since a copy there may be the only one left. nomad cannot restore this name, because the entry is refused: recover the content by hand if you need it, then remove the dead link`
+      );
+      continue;
+    }
+    if (link === "foreign") {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: entry ${JSON.stringify(entry)} is a symlink under ~/.claude/ pointing OUTSIDE shared/; nomad does not manage it, so leave it alone and just drop the entry from sharedDirs`
+      );
+    }
+    if (hasSharedLeftover(entry)) {
+      addItem(
+        section2,
+        `${yellow(warnGlyph)} path-map: shared/ entry ${JSON.stringify(entry)} exists in the repo working tree; remove it by hand, nomad will not delete it`
+      );
+    }
+  }
+}
 function reportPathCollisions(section2, map) {
   const seen = /* @__PURE__ */ new Map();
   let collisionCount = 0;
@@ -3230,6 +3450,7 @@ function reportPathMap(section2) {
   }
   const map = readJsonSafe(mapPath, mapPath, section2);
   if (map === null) return;
+  reportRejectedSharedDirs(section2, map);
   const shapeError = validatePathMapShape(map);
   if (shapeError !== null) {
     addItem(section2, `${red(failGlyph)} ${shapeError}`);
@@ -3425,7 +3646,7 @@ function reportGitIdentity(section2) {
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync18, lstatSync as lstatSync9, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync18, lstatSync as lstatSync10, readdirSync as readdirSync8 } from "node:fs";
 import { join as join21 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
@@ -3443,7 +3664,7 @@ function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
     const full = join21(dir, entry);
-    const st = lstatSync9(full, { throwIfNoEntry: false });
+    const st = lstatSync10(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) bytes += dirSizeBytes(full);
@@ -3922,8 +4143,8 @@ init_config();
 
 // src/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync10, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join28, relative as relative5, sep as sep4 } from "node:path";
+import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync10, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
+import { dirname as dirname6, join as join28, relative as relative5, sep as sep5 } from "node:path";
 init_config();
 
 // src/push-manifest.ts
@@ -4055,7 +4276,7 @@ function copyFileAtomic(src, dst) {
   renameAtomicRetry(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
-  const prefix = `${localDir}${sep4}`;
+  const prefix = `${localDir}${sep5}`;
   for (const p of sel.changed) if (p.startsWith(prefix)) return true;
   for (const p of sel.deleted) if (p.startsWith(prefix)) return true;
   return false;
@@ -4064,7 +4285,7 @@ function skipForSelection(sel, localDir) {
   return sel !== void 0 && !hasDeltaForDir(sel, localDir);
 }
 function applySelective(sel, localDir, repoDst) {
-  const prefix = `${localDir}${sep4}`;
+  const prefix = `${localDir}${sep5}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
     copyFileAtomic(src, join28(repoDst, relative5(localDir, src)));
@@ -4082,7 +4303,7 @@ function copyDirJsonlOnly(src, dst) {
     filter: (srcPath) => {
       const rel = relative5(src, srcPath);
       if (rel === "") return true;
-      if (rel.split(sep4).length > 1) return true;
+      if (rel.split(sep5).length > 1) return true;
       if (statSync5(srcPath).isDirectory()) return true;
       if (srcPath.endsWith(".jsonl")) return true;
       item(`skip ${rel}: extension not in allowlist`);
@@ -4142,9 +4363,9 @@ function countLocalOnly(src, dst) {
   for (const name of readdirSync10(dst)) {
     const dstPath = join28(dst, name);
     const srcPath = join28(src, name);
-    if (lstatSync10(dstPath).isDirectory()) {
+    if (lstatSync11(dstPath).isDirectory()) {
       count += countLocalOnly(srcPath, dstPath);
-    } else if (lstatSync10(srcPath, { throwIfNoEntry: false }) === void 0) {
+    } else if (lstatSync11(srcPath, { throwIfNoEntry: false }) === void 0) {
       count++;
     }
   }
@@ -4334,7 +4555,7 @@ function reportCheckShared(section2, gitleaksReady) {
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync3 } from "node:fs";
 import { dirname as dirname7, extname, join as join30 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
@@ -4351,7 +4572,7 @@ function effectiveType(hookPath) {
   if (ext === ".cjs") return "cjs";
   let real;
   try {
-    real = realpathSync2(hookPath);
+    real = realpathSync3(hookPath);
   } catch {
     return null;
   }
@@ -4513,7 +4734,7 @@ import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:
 import { join as join33 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync3 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
 import { dirname as dirname8, join as join32, resolve as resolve2 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
@@ -4558,7 +4779,7 @@ function specifierIsMissing(specifier, baseDir) {
 function relativeRequireTargetsBroken(scriptPath) {
   let realPath;
   try {
-    realPath = realpathSync3(scriptPath);
+    realPath = realpathSync4(scriptPath);
   } catch {
     return false;
   }
@@ -4702,7 +4923,7 @@ function reportPreserveSymlinksCheck(section2) {
     return;
   }
   const map = readPathMapSafe();
-  const sharedLinkNames = allSharedLinks(map);
+  const sharedLinkNames = allSharedLinks(map, { quiet: true });
   let anyWarn = false;
   for (const [event, groups] of Object.entries(hooks)) {
     if (!Array.isArray(groups)) continue;
@@ -5052,21 +5273,21 @@ import { createInterface as createInterface2 } from "node:readline/promises";
 // src/commands.push.recovery.actions.ts
 init_config();
 import { readFileSync as readFileSync17 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep8 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep9 } from "node:path";
 
 // src/commands.push.recovery.memory.ts
 init_config();
 init_config_sharedDirs_guard();
 import {
   cpSync as cpSync7,
-  lstatSync as lstatSync11,
+  lstatSync as lstatSync12,
   mkdirSync as mkdirSync9,
   readFileSync as readFileSync14,
-  realpathSync as realpathSync4,
+  realpathSync as realpathSync5,
   statSync as statSync6,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname9, join as join36, sep as sep5 } from "node:path";
+import { dirname as dirname9, join as join36, sep as sep6 } from "node:path";
 init_push_gitleaks_scan();
 
 // src/rel-path-guard.ts
@@ -5097,12 +5318,12 @@ function resolveMemoryLocalPath(logical, relPath, map) {
   if (abs === void 0) return null;
   const memoryRoot = join36(claudeHome(), "projects", encodePath(abs), "memory");
   const localPath = join36(memoryRoot, ...relPath.split("/"));
-  if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep5)) return null;
+  if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep6)) return null;
   try {
-    if (lstatSync11(localPath).isSymbolicLink()) return null;
-    const realLocal = realpathSync4(localPath);
-    const realRoot = realpathSync4(memoryRoot);
-    if (!realLocal.startsWith(realRoot + sep5)) return null;
+    if (lstatSync12(localPath).isSymbolicLink()) return null;
+    const realLocal = realpathSync5(localPath);
+    const realRoot = realpathSync5(memoryRoot);
+    if (!realLocal.startsWith(realRoot + sep6)) return null;
     if (!statSync6(realLocal).isFile()) return null;
   } catch {
     return null;
@@ -5160,28 +5381,28 @@ function applyMemoryRedact(f, ts, map, scan = scanFile) {
 init_config();
 import {
   cpSync as cpSync8,
-  lstatSync as lstatSync13,
+  lstatSync as lstatSync14,
   mkdirSync as mkdirSync11,
   readFileSync as readFileSync15,
-  realpathSync as realpathSync5,
+  realpathSync as realpathSync6,
   statSync as statSync7,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname10, join as join38, sep as sep6 } from "node:path";
+import { dirname as dirname10, join as join38, sep as sep7 } from "node:path";
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync29, lstatSync as lstatSync12, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync29, lstatSync as lstatSync13, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
 import { join as join37 } from "node:path";
 
 // src/skills-sync.tracked.ts
 init_utils();
-import { basename as basename4 } from "node:path";
+import { basename as basename3 } from "node:path";
 function trackedRootSkillsAt(ref, repo) {
   try {
     const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
     const entries = raw.split("\0").filter((entry) => entry !== "");
-    return new Set(entries.map((entry) => basename4(entry)));
+    return new Set(entries.map((entry) => basename3(entry)));
   } catch {
     return /* @__PURE__ */ new Set();
   }
@@ -5211,7 +5432,7 @@ function syncSkillsPull(ts, prePostHeads) {
   if (!existsSync29(sharedSkills)) return;
   const localSkills = join37(claudeHome(), "skills");
   backupBeforeWrite(localSkills, ts);
-  const dstStat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  const dstStat = lstatSync13(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     rmSync13(localSkills, { recursive: true, force: true });
     mkdirSync10(localSkills, { recursive: true });
@@ -5221,7 +5442,7 @@ function syncSkillsPull(ts, prePostHeads) {
 }
 function syncSkillsPush() {
   const localSkills = join37(claudeHome(), "skills");
-  const stat = lstatSync12(localSkills, { throwIfNoEntry: false });
+  const stat = lstatSync13(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
   const sharedSkills = join37(repoHome(), "shared", "skills");
@@ -5250,12 +5471,12 @@ function resolveSkillLocalPath(name, relPath) {
   const skillsRoot = join38(claudeHome(), "skills");
   const skillRoot = join38(skillsRoot, name);
   const localPath = join38(skillRoot, ...relPath.split("/"));
-  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep6)) return null;
+  if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep7)) return null;
   try {
-    if (lstatSync13(localPath).isSymbolicLink()) return null;
-    const realLocal = realpathSync5(localPath);
-    const realRoot = realpathSync5(skillsRoot);
-    if (!realLocal.startsWith(realRoot + sep6)) return null;
+    if (lstatSync14(localPath).isSymbolicLink()) return null;
+    const realLocal = realpathSync6(localPath);
+    const realRoot = realpathSync6(skillsRoot);
+    if (!realLocal.startsWith(realRoot + sep7)) return null;
     if (!statSync7(realLocal).isFile()) return null;
   } catch {
     return null;
@@ -5380,7 +5601,7 @@ function applyDeferredAllows(findings, state, repo) {
 init_config();
 init_config_sharedDirs_guard();
 import { cpSync as cpSync9, existsSync as existsSync32, mkdirSync as mkdirSync12 } from "node:fs";
-import { dirname as dirname12, join as join41, sep as sep7 } from "node:path";
+import { dirname as dirname12, join as join41, sep as sep8 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
@@ -5388,17 +5609,17 @@ import { existsSync as existsSync31 } from "node:fs";
 import { dirname as dirname11, join as join40 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync30, lstatSync as lstatSync14, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync30, lstatSync as lstatSync15, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join39 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
   if (!existsSync30(dir)) return;
-  const st = lstatSync14(dir);
+  const st = lstatSync15(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync14(dir)) {
     const abs = join39(dir, entry);
-    const lst = lstatSync14(abs);
+    const lst = lstatSync15(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -5606,7 +5827,7 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep7)) {
+    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep8)) {
       return join41(repo, "shared", "projects", logical);
     }
   }
@@ -5897,8 +6118,8 @@ function sessionSuffix(finding) {
   const sid = sessionIdFromFinding(finding);
   if (sid === null) return "";
   const rawBasename = finding.File.replace(/^.*\//, "");
-  const basename5 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
-  return basename5 === sid ? "" : ` (session: ${sid})`;
+  const basename4 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
+  return basename4 === sid ? "" : ` (session: ${sid})`;
 }
 function renderFindingBlock(finding, readLine, siblings = []) {
   const lines = [`  file:  ${finding.File}:${finding.StartLine}${sessionSuffix(finding)}`];
@@ -5970,7 +6191,7 @@ function makeDefaultReadLine(repo) {
     try {
       const repoRoot = resolve3(repo);
       const target = resolve3(repoRoot, file);
-      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep8)) {
+      if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep9)) {
         return null;
       }
       let lines = cache.get(target);
@@ -6567,6 +6788,20 @@ function buildVerdictSection(sections) {
   return summary;
 }
 
+// src/commands.doctor.banner.ts
+var NOMAD_BANNER = [
+  "                                        __",
+  "   ____   ____   ____ ___   ____ _ ____/ /",
+  "  / __ \\ / __ \\ / __ `__ \\ / __ `// __  /",
+  " / / / // /_/ // / / / / // /_/ // /_/ /",
+  String.raw`/_/ /_/ \____//_/ /_/ /_/ \__,_/ \__,_/`
+];
+function printBanner(log2, stdout) {
+  if (stdout.isTTY !== true) return;
+  for (const line of NOMAD_BANNER) log2(line);
+  log2("");
+}
+
 // src/commands.doctor.compact.ts
 init_color();
 var ALWAYS_FULL = /* @__PURE__ */ new Set([
@@ -6585,18 +6820,27 @@ function isRepoStateLine(item2) {
 function isCopySyncModalityLine(item2) {
   return item2.includes("sync modality: copy-sync");
 }
+function isKeptEnvironmentRow(item2) {
+  return isRepoStateLine(item2) || isCopySyncModalityLine(item2) || isProblem(item2);
+}
+function keepWithChildren(items, keep) {
+  const out = [];
+  let parentKept = false;
+  for (const item2 of items) {
+    if (isChild(item2)) {
+      if (parentKept) out.push(item2);
+      continue;
+    }
+    parentKept = keep(item2);
+    if (parentKept) out.push(item2);
+  }
+  return out;
+}
 function compactSections(sections) {
   return sections.map((s) => {
     if (ALWAYS_FULL.has(s.header)) return s;
-    if (s.header === "Environment") {
-      return {
-        ...s,
-        items: s.items.filter(
-          (it) => isRepoStateLine(it) || isCopySyncModalityLine(it) || isProblem(it)
-        )
-      };
-    }
-    return { ...s, items: s.items.filter(isProblem) };
+    const keep = s.header === "Environment" ? isKeptEnvironmentRow : isProblem;
+    return { ...s, items: keepWithChildren(s.items, keep) };
   });
 }
 
@@ -6673,6 +6917,7 @@ function gatherDoctorSections(opts) {
   return [...body, buildVerdictSection(body)];
 }
 function cmdDoctor(opts = {}) {
+  printBanner(console.log, process.stdout);
   const makeSpinner = opts.startSpinner ?? startSpinner;
   const sp = makeSpinner("Running checks");
   let report;
@@ -6980,11 +7225,11 @@ init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync16, readFileSync as readFileSync19, realpathSync as realpathSync6, rmSync as rmSync16 } from "node:fs";
-import { dirname as dirname13, join as join49, sep as sep10 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync16, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
+import { dirname as dirname13, join as join49, sep as sep11 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
-import { join as join48, normalize as normalize2, sep as sep9 } from "node:path";
+import { join as join48, normalize as normalize2, sep as sep10 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -7037,7 +7282,7 @@ function planningDeleteTargets(opts) {
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
   const planningRoot = join48(localRoot, ".planning");
-  const planningRootBoundary = planningRoot + sep9;
+  const planningRootBoundary = planningRoot + sep10;
   const targets = [];
   for (const repoPath of deleted) {
     if (!repoPath.startsWith(prefix)) {
@@ -7079,7 +7324,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
 }
 function pruneEmptyAncestors(target, planningRoot) {
   let dir = dirname13(target);
-  while (dir !== planningRoot && dir.startsWith(planningRoot + sep10)) {
+  while (dir !== planningRoot && dir.startsWith(planningRoot + sep11)) {
     try {
       if (readdirSync16(dir).length > 0) break;
       rmSync16(dir, { recursive: true, force: true });
@@ -7091,13 +7336,13 @@ function pruneEmptyAncestors(target, planningRoot) {
 }
 function tryRealpath(dir) {
   try {
-    return realpathSync6(dir);
+    return realpathSync7(dir);
   } catch {
     return void 0;
   }
 }
 function isInsidePlanningRoot(parentReal, rootReal) {
-  return parentReal === rootReal || parentReal.startsWith(rootReal + sep10);
+  return parentReal === rootReal || parentReal.startsWith(rootReal + sep11);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   if (existsSync38(repoCounterpart)) return;
@@ -7124,11 +7369,11 @@ function planningDiffArgs(pre, post, logical) {
 function deletePairsFor(t, raw) {
   return planningDeleteTargets({ raw, logical: t.logical, localRoot: t.localRoot }).map(
     (target) => {
-      const relToLocal = target.slice(t.localRoot.length + sep10.length);
+      const relToLocal = target.slice(t.localRoot.length + sep11.length);
       return {
         target,
         relToLocal,
-        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep10).join("/")}`
+        repoRel: `shared/extras/${t.logical}/${relToLocal.split(sep11).join("/")}`
       };
     }
   );
@@ -7202,7 +7447,8 @@ function remapExtrasPush(ts, opts = {}) {
     //     The filter prevents ALWAYS_NEVER_SYNC files from landing in the repo
     //     working tree before the allow-list gate fires, eliminating the
     //     "residue wedges repeat push" regression. The allow-list gate
-    //     (enforceAllowList / blockSetFor in commands.push.allowlist.ts)
+    //     (enforceAllowList in commands.push.allowlist.ts, blockSetFor in
+    //     config.never-sync.ts)
     //     remains the hard security boundary.
     //   All others: copyExtrasFiltered with per-extra denylist.
     (src, dst, dirname14) => dirname14 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname14)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname14))
@@ -7302,8 +7548,8 @@ function divergenceCheckExtras(ts, prePostHeads) {
 
 // src/links.baseline.ts
 init_config();
-import { lstatSync as lstatSync15, readdirSync as readdirSync17 } from "node:fs";
-import { join as join51, relative as relative7, sep as sep11 } from "node:path";
+import { lstatSync as lstatSync16, readdirSync as readdirSync17 } from "node:fs";
+import { join as join51, relative as relative7, sep as sep12 } from "node:path";
 init_utils();
 var SHARED_BASELINE_KIND = "shared-links-baseline/1";
 var SHARED_BASELINE_CONFIG_HASH = "not-applicable";
@@ -7314,13 +7560,13 @@ function readSharedBaseline() {
   return parsed;
 }
 function baselineKey(claude, abs) {
-  return relative7(claude, abs).split(sep11).join("/");
+  return relative7(claude, abs).split(sep12).join("/");
 }
 function addLocalPath(abs, claude, scan) {
   const key = baselineKey(claude, abs);
   let st;
   try {
-    st = lstatSync15(abs, { throwIfNoEntry: false });
+    st = lstatSync16(abs, { throwIfNoEntry: false });
   } catch {
     scan.declined.push(key);
     return;
@@ -7353,10 +7599,10 @@ function collectSharedFiles(dir, claude, scan) {
     addLocalPath(abs, claude, scan);
   }
 }
-function enumerateLocalSharedScan(map) {
+function enumerateLocalSharedScan(map, opts = {}) {
   const claude = claudeHome();
   const scan = { files: {}, declined: [] };
-  for (const name of allSharedLinks(map)) {
+  for (const name of opts.linkNames ?? allSharedLinks(map, { quiet: opts.quiet === true })) {
     if (isDeniedName(ALWAYS_NEVER_SYNC, name)) {
       scan.declined.push(name);
       continue;
@@ -7365,13 +7611,13 @@ function enumerateLocalSharedScan(map) {
   }
   return scan;
 }
-function enumerateLocalSharedFiles(map) {
-  return enumerateLocalSharedScan(map).files;
+function enumerateLocalSharedFiles(map, opts = {}) {
+  return enumerateLocalSharedScan(map, opts).files;
 }
-function buildSharedBaseline(map) {
+function buildSharedBaseline(map, opts = {}) {
   const claude = claudeHome();
   const files = {};
-  for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map))) {
+  for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map, opts))) {
     try {
       files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join51(claude, key)) };
     } catch {
@@ -7379,27 +7625,69 @@ function buildSharedBaseline(map) {
   }
   return buildManifest(files, SHARED_BASELINE_KIND, SHARED_BASELINE_CONFIG_HASH);
 }
-function writeSharedBaseline(map) {
+function writeSharedBaseline(map, opts = {}) {
   if (process.platform !== "win32") return;
   try {
-    writeManifest(sharedBaselinePath(), buildSharedBaseline(map));
+    writeManifest(sharedBaselinePath(), buildSharedBaseline(map, opts));
   } catch (err) {
     warn(`could not record the shared-config baseline: ${err.message}`);
   }
 }
 
 // src/commands.pull.win32.ts
-init_config();
+init_color();
 import { existsSync as existsSync44 } from "node:fs";
 import { join as join56 } from "node:path";
 
-// src/git-probe.ts
+// src/commands.pull.recovery.git.ts
+init_utils();
 import { execFileSync as execFileSync21 } from "node:child_process";
+function gitCapture(args, cwd) {
+  return execFileSync21("git", args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 64 * 1024 * 1024
+  }).toString().trim();
+}
+function parsePorcelainZ(raw) {
+  const tracked = [];
+  const untracked = [];
+  if (!raw) return { tracked, untracked };
+  const records = raw.split("\0");
+  for (let i = 0; i < records.length; i++) {
+    const record = records[i];
+    if (record.length < 3) continue;
+    const xy = record.slice(0, 2);
+    const filePath = record.slice(3);
+    if (xy === "??") {
+      untracked.push(filePath);
+      continue;
+    }
+    tracked.push(filePath);
+    if (xy.startsWith("R") || xy.startsWith("C")) {
+      const src = records[i + 1];
+      if (src) {
+        tracked.push(src);
+        i++;
+      }
+    }
+  }
+  return { tracked, untracked };
+}
+function parseDirtyPaths(repo, opts = {}) {
+  return parsePorcelainZ(gitStatusPorcelainZ(repo, opts));
+}
+
+// src/commands.pull.win32.ts
+init_config();
+
+// src/git-probe.ts
+import { execFileSync as execFileSync22 } from "node:child_process";
 var PROBE_TIMEOUT_MS4 = 1e4;
 var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
 function gitProbe(args, repo) {
   try {
-    return execFileSync21("git", args, {
+    return execFileSync22("git", args, {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: PROBE_TIMEOUT_MS4,
@@ -7410,37 +7698,10 @@ function gitProbe(args, repo) {
   }
 }
 
-// src/links.captures.ts
-init_config();
-import { existsSync as existsSync40, lstatSync as lstatSync16 } from "node:fs";
-import { join as join52 } from "node:path";
-function planSharedLinkCaptures(map) {
-  if (process.platform !== "win32") return [];
-  if (map === null) return [];
-  const claude = claudeHome();
-  const repo = repoHome();
-  const plan = [];
-  for (const name of allSharedLinks(map)) {
-    const localPath = join52(claude, name);
-    let stat;
-    try {
-      stat = lstatSync16(localPath, { throwIfNoEntry: false });
-    } catch {
-      continue;
-    }
-    if (stat === void 0) continue;
-    if (stat.isSymbolicLink()) continue;
-    const repoPath = join52(repo, "shared", name);
-    if (!existsSync40(repoPath)) continue;
-    plan.push({ name, localPath, repoPath });
-  }
-  return plan;
-}
-
 // src/links.deletions.ts
 init_config();
-import { existsSync as existsSync41, lstatSync as lstatSync17, rmSync as rmSync17 } from "node:fs";
-import { join as join53, relative as relative8, resolve as resolve4, sep as sep12 } from "node:path";
+import { existsSync as existsSync40, lstatSync as lstatSync17, rmSync as rmSync17 } from "node:fs";
+import { join as join52, relative as relative8, resolve as resolve4, sep as sep13 } from "node:path";
 init_utils();
 init_utils_fs();
 function isUnknown(declined, key) {
@@ -7450,27 +7711,28 @@ function deletionFor(key, names, claude, sharedRoot) {
   const segments = key.split("/");
   const name = segments[0];
   if (!names.has(name)) return null;
-  if (!existsSync41(join53(claude, name))) return null;
+  if (!existsSync40(join52(claude, name))) return null;
   if (segments.some((segment) => isDeniedName(ALWAYS_NEVER_SYNC, segment))) return null;
   const repoPath = resolve4(sharedRoot, key);
-  const rel = relative8(join53(sharedRoot, name), repoPath);
-  if (rel === "" || rel === ".." || rel.startsWith(`..${sep12}`)) return null;
+  const rel = relative8(join52(sharedRoot, name), repoPath);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep13}`)) return null;
   if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
     return null;
-  if (!existsSync41(repoPath)) return null;
-  return { name, localPath: join53(claude, key), repoPath };
+  if (!existsSync40(repoPath)) return null;
+  return { kind: "deletion", name, localPath: join52(claude, key), repoPath };
 }
-function planSharedLinkDeletions(map) {
+function planSharedLinkDeletions(map, opts = {}) {
   if (process.platform !== "win32") return [];
   if (map === null) return [];
   const baseline = readSharedBaseline();
   if (baseline === null) return [];
   const claude = claudeHome();
-  const sharedRoot = join53(repoHome(), "shared");
-  const scan = enumerateLocalSharedScan(map);
+  const sharedRoot = join52(repoHome(), "shared");
+  const linkNames = opts.linkNames ?? allSharedLinks(map);
+  const scan = enumerateLocalSharedScan(map, { linkNames });
   const present = new Set(Object.keys(scan.files).map((key) => key.toLowerCase()));
   const declined = scan.declined.map((path) => path.toLowerCase());
-  const names = new Set(allSharedLinks(map));
+  const names = new Set(linkNames);
   const plan = [];
   for (const key of Object.keys(baseline.files)) {
     const folded = key.toLowerCase();
@@ -7481,17 +7743,151 @@ function planSharedLinkDeletions(map) {
   }
   return plan;
 }
-function applySharedLinkDeletions(map, ts) {
+function applySharedLinkDeletions(map, ts, opts = {}) {
   const repo = repoHome();
-  for (const entry of planSharedLinkDeletions(map)) {
+  const removed = [];
+  for (const entry of planSharedLinkDeletions(map, opts)) {
     try {
       if (!lstatSync17(entry.repoPath).isFile()) continue;
       backupRepoWrite(entry.repoPath, ts, repo);
       rmSync17(entry.repoPath, { force: true });
+      removed.push(entry);
     } catch (err) {
       warn(`could not remove ${entry.repoPath}: ${err.message}`);
     }
   }
+  return removed;
+}
+
+// src/links.mirror.ts
+init_config();
+import { existsSync as existsSync41, lstatSync as lstatSync18, rmSync as rmSync18 } from "node:fs";
+import { join as join53 } from "node:path";
+init_utils();
+init_utils_fs();
+function emitMirror(onPreview, name, localPath, repoPath) {
+  if (onPreview) {
+    onPreview({ kind: "mirror", name, localPath, repoPath });
+  } else {
+    log(`would capture: ${localPath} -> ${repoPath}`);
+  }
+}
+function emitMirrorWet(onPreview, name, localPath, repoPath) {
+  if (onPreview) onPreview({ kind: "mirror", name, localPath, repoPath });
+}
+function notShared(policy, target) {
+  return !policy.adoptNew && !existsSync41(target);
+}
+function mirrorOneSharedName(name, claude, repo, policy, opts) {
+  const localPath = join53(claude, name);
+  const target = join53(repo, "shared", name);
+  let stat;
+  try {
+    stat = lstatSync18(localPath, { throwIfNoEntry: false });
+  } catch (err) {
+    if (notShared(policy, target)) return;
+    warn(
+      `${name} could not be read (${err.message}), so it was left out of shared/ this run. Check its permissions, or whether another program has it open`
+    );
+    return;
+  }
+  if (stat === void 0) return;
+  if (stat.isSymbolicLink()) return;
+  if (notShared(policy, target)) return;
+  if (opts.dryRun === true) {
+    emitMirror(opts.onPreview, name, localPath, target);
+    return;
+  }
+  if (policy.backupTs !== void 0) backupRepoWrite(target, policy.backupTs, repo);
+  if (policy.overlay && stat.isDirectory()) {
+    copyExtrasOverlayFiltered(localPath, target, NEVER_SYNC);
+  } else {
+    copyExtrasFiltered(localPath, target, NEVER_SYNC);
+  }
+  emitMirrorWet(opts.onPreview, name, localPath, target);
+}
+function mirrorSharedNames(map, policy, opts = {}) {
+  if (process.platform !== "win32") return;
+  if (map === null) return;
+  const claude = claudeHome();
+  const repo = repoHome();
+  const linkNames = opts.linkNames ?? allSharedLinks(map);
+  for (const name of linkNames) {
+    mirrorOneSharedName(name, claude, repo, policy, opts);
+  }
+}
+function syncSharedLinksPush(map, opts = {}) {
+  mirrorSharedNames(map, { adoptNew: true, overlay: false }, opts);
+}
+function stageLocalSharedEdits(map, ts, opts = {}) {
+  mirrorSharedNames(map, { adoptNew: false, overlay: true, backupTs: ts }, opts);
+}
+function presentAt(abs) {
+  try {
+    return lstatSync18(abs, { throwIfNoEntry: false }) !== void 0;
+  } catch {
+    return true;
+  }
+}
+function removeUntrackedDenied(repo, path, segment, ts) {
+  const abs = join53(repo, path);
+  const denied = `the path segment "${segment}" is on the never-sync list`;
+  if (!presentAt(abs)) {
+    warn(
+      `nothing was removed for ${path}: ${denied}, but nothing is at that path now. Either it went away after git listed it, in which case there is nothing left to do, or its name did not survive the decode of git's output and the real file is still in the sync repo under a name nomad cannot address. Look for it in ${repo} with "git status --untracked-files=all -- shared/"`
+    );
+    return;
+  }
+  const snapshotted = existsSync41(abs);
+  try {
+    backupRepoWrite(abs, ts, repo);
+  } catch (err) {
+    warn(
+      `could not snapshot ${abs} before removing it (${err.message}), so it was left in place: ${denied}, so remove it by hand`
+    );
+    return;
+  }
+  try {
+    rmSync18(abs, { recursive: true, force: true });
+    if (presentAt(abs)) {
+      warn(`could not remove ${abs}: ${denied}, so remove it by hand`);
+      return;
+    }
+    const where = snapshotted ? `. A copy was snapshotted under backup/${ts}/repo/ first` : "";
+    warn(`removed ${path} from the sync repo working tree: ${denied}${where}`);
+  } catch (err) {
+    warn(`could not remove ${abs}: ${err.message}`);
+  }
+}
+function reportTrackedDenied(repo, path, segment) {
+  const inHead = gitProbe(["ls-tree", "--name-only", "HEAD", "--", path], repo);
+  const denied = `the path segment "${segment}" is on the never-sync list`;
+  if (inHead === null) {
+    warn(
+      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it with "git status -- ${path}" and take it out of shared/ before committing`
+    );
+    return;
+  }
+  if (inHead.trim() === "") {
+    warn(
+      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run "git rm --cached -- ${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, "git diff --cached --name-status" names the source, whose content IS committed, so restore that half with "git checkout HEAD -- <source>" rather than leaving its deletion staged`
+    );
+    return;
+  }
+  if (!existsSync41(join53(repo, path))) return;
+  warn(
+    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run "git checkout HEAD -- ${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: "git rm -- ${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
+  );
+}
+function revertDeniedMirrorPaths(repo, status, ts) {
+  for (const path of new Set(status.untracked)) {
+    const segment = deniedSegmentFor(path);
+    if (segment !== null) removeUntrackedDenied(repo, path, segment, ts);
+  }
+  for (const path of new Set(status.tracked)) {
+    const segment = deniedSegmentFor(path);
+    if (segment !== null) reportTrackedDenied(repo, path, segment);
+  }
 }
 
 // src/preview.ts
@@ -7838,8 +8234,8 @@ function formatLinkRow(e) {
   if (e.kind === "copy") return `would copy  ${e.from} -> ${e.to}`;
   return `${e.kind}  ${e.from} -> ${e.to}`;
 }
-function formatCaptureRow(c) {
-  return `would capture  ${c.localPath} -> ${c.repoPath}`;
+function formatMirrorRow(e) {
+  return `would capture  ${e.localPath} -> ${e.repoPath}`;
 }
 function formatDeletionRow(d) {
   return `would remove  ${d.repoPath} (gone from ${d.localPath})`;
@@ -7847,6 +8243,23 @@ function formatDeletionRow(d) {
 function formatSessionRow(e) {
   return e.kind === "overwrite" ? `overwrite  ${e.dst} (from ${e.src})` : e.text;
 }
+function appendMirrorPlanRows(links, ts, map, plans) {
+  if (plans) {
+    for (const capture of plans.captures) addItem(links, formatMirrorRow(capture));
+    for (const deletion of plans.deletions) addItem(links, formatDeletionRow(deletion));
+    return plans.namesDerived;
+  }
+  const linkNames = allSharedLinks(map);
+  stageLocalSharedEdits(map, ts, {
+    dryRun: true,
+    onPreview: (e) => addItem(links, formatMirrorRow(e)),
+    linkNames
+  });
+  for (const deletion of planSharedLinkDeletions(map, { linkNames })) {
+    addItem(links, formatDeletionRow(deletion));
+  }
+  return true;
+}
 function buildSettingsSectionForPreview(result) {
   const s = section("settings.json", true);
   if (result.diff !== "") {
@@ -7865,18 +8278,10 @@ function computePreview(ts, map, verb = "pull", plans) {
   console.log(`would pull on host=${HOST} (preview; nothing applied)`);
   console.log("");
   const links = section("Symlinks");
-  const { captures, deletions } = plans ?? {
-    captures: planSharedLinkCaptures(map),
-    deletions: planSharedLinkDeletions(map)
-  };
-  for (const capture of captures) {
-    addItem(links, formatCaptureRow(capture));
-  }
-  for (const deletion of deletions) {
-    addItem(links, formatDeletionRow(deletion));
-  }
+  const namesDerived = appendMirrorPlanRows(links, ts, map, plans);
   applySharedLinks(ts, map, {
     dryRun: true,
+    quietNames: namesDerived,
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
@@ -7926,6 +8331,19 @@ function readMapForMirror(mapPath) {
     return null;
   }
 }
+function sharedDirsUnchanged(before, after) {
+  return JSON.stringify(before) === JSON.stringify(after);
+}
+function namesAlreadyReported(namesDerived, derivedSharedDirs, map) {
+  return namesDerived && sharedDirsUnchanged(derivedSharedDirs, map.sharedDirs);
+}
+function plansAgainst(plans, map) {
+  if (plans === void 0) return void 0;
+  return {
+    ...plans,
+    namesDerived: namesAlreadyReported(plans.namesDerived, plans.derivedSharedDirs, map)
+  };
+}
 function untrackedUnderShared(repo) {
   const out = gitProbe(["ls-files", "--others", "--exclude-standard", "-z", "--", "shared/"], repo);
   if (out === null) return null;
@@ -7935,27 +8353,94 @@ function newlyUntracked(before, after) {
   if (before === null || after === null) return [];
   return [...after].filter((p) => !before.has(p));
 }
+function revertDeniedUnderShared(repo, ts) {
+  const out = gitProbe(
+    ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "shared/"],
+    repo
+  );
+  if (out === null) return;
+  revertDeniedMirrorPaths(repo, parsePorcelainZ(out), ts);
+}
 function reconcileSharedLinksBeforePull(repo, ts) {
-  if (process.platform !== "win32") return [];
+  if (process.platform !== "win32") {
+    return { mirrored: [], events: [], namesDerived: false, derivedSharedDirs: void 0 };
+  }
   const before = untrackedUnderShared(repo);
+  const events = [];
+  let linkNames = [];
+  let namesDerived = false;
+  let derivedSharedDirs;
   try {
     const map = readMapForMirror(join56(repo, "path-map.json"));
-    stageLocalSharedEdits(map, ts);
-    applySharedLinkDeletions(map, ts);
+    if (map !== null) {
+      linkNames = allSharedLinks(map);
+      namesDerived = true;
+      derivedSharedDirs = map.sharedDirs;
+    }
+    stageLocalSharedEdits(map, ts, { onPreview: (e) => events.push(e), linkNames });
+    events.push(...applySharedLinkDeletions(map, ts, { linkNames }));
   } catch (err) {
     warn(`could not reconcile local shared edits before the pull: ${err.message}`);
   }
-  return newlyUntracked(before, untrackedUnderShared(repo));
+  revertDeniedUnderShared(repo, ts);
+  return {
+    mirrored: newlyUntracked(before, untrackedUnderShared(repo)),
+    events,
+    namesDerived,
+    derivedSharedDirs
+  };
+}
+function buildMirrorSection(events, discard) {
+  const s = section("Symlinks");
+  for (const e of events) {
+    addItem(
+      s,
+      e.kind === "deletion" ? `removed  ${e.repoPath} (gone from ${e.localPath})` : `captured  ${e.localPath} -> ${e.repoPath}`
+    );
+  }
+  if (discard) {
+    const names = discard.count === 1 ? "name was" : "names were";
+    addItem(
+      s,
+      `${yellow(warnGlyph)} recovered from a wedged repo, ${discard.count} shared ${names} restored from the repo copy, previous host copies backed up to ${discard.backupPath}`
+    );
+  }
+  return s;
 }
-function planSharedReconcileBeforePull(repo) {
+function describeSkippedMirrorDiscard(repo, ts) {
+  if (process.platform !== "win32") return null;
+  try {
+    const map = readMapForMirror(join56(repo, "path-map.json"));
+    const linkNames = map !== null ? allSharedLinks(map, { quiet: true }) : void 0;
+    const captures = [];
+    stageLocalSharedEdits(map, ts, {
+      dryRun: true,
+      onPreview: (e) => captures.push(e),
+      linkNames
+    });
+    if (captures.length === 0) return null;
+    return { count: captures.length, backupPath: join56(backupBase(), ts) };
+  } catch {
+    return null;
+  }
+}
+function planSharedReconcileBeforePull(repo, ts) {
   const map = readMapForMirror(join56(repo, "path-map.json"));
-  return { captures: planSharedLinkCaptures(map), deletions: planSharedLinkDeletions(map) };
+  const captures = [];
+  const linkNames = process.platform === "win32" && map !== null ? allSharedLinks(map) : void 0;
+  stageLocalSharedEdits(map, ts, { dryRun: true, onPreview: (e) => captures.push(e), linkNames });
+  return {
+    captures,
+    deletions: planSharedLinkDeletions(map, { linkNames }),
+    namesDerived: linkNames !== void 0,
+    derivedSharedDirs: map?.sharedDirs
+  };
 }
 
 // src/commands.pull.collision.ts
 init_config();
 init_exit_codes();
-import { existsSync as existsSync45, lstatSync as lstatSync18, readFileSync as readFileSync20, rmSync as rmSync18 } from "node:fs";
+import { existsSync as existsSync45, lstatSync as lstatSync19, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
 import { join as join57 } from "node:path";
 init_utils();
 var SHARED_PREFIX = /^shared\//;
@@ -8022,9 +8507,9 @@ function removeMirroredCopies(repo, repoRelPaths) {
   for (const rel of repoRelPaths.filter(isContainedMirrorPath)) {
     const abs = join57(repo, rel);
     try {
-      if (lstatSync18(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
+      if (lstatSync19(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
       if (!matchesLocalOriginal(repo, rel)) continue;
-      rmSync18(abs, { force: true });
+      rmSync19(abs, { force: true });
     } catch (err) {
       warn(`could not remove nomad's copy at ${abs}: ${err.message}`);
     }
@@ -8051,47 +8536,6 @@ init_commands_pull_wedge();
 init_config();
 init_utils();
 init_utils_fs();
-
-// src/commands.pull.recovery.git.ts
-init_utils();
-import { execFileSync as execFileSync22 } from "node:child_process";
-function gitCapture(args, cwd) {
-  return execFileSync22("git", args, {
-    cwd,
-    stdio: ["ignore", "pipe", "pipe"],
-    maxBuffer: 64 * 1024 * 1024
-  }).toString().trim();
-}
-function parsePorcelainZ(raw) {
-  const tracked = [];
-  const untracked = [];
-  if (!raw) return { tracked, untracked };
-  const records = raw.split("\0");
-  for (let i = 0; i < records.length; i++) {
-    const record = records[i];
-    if (record.length < 3) continue;
-    const xy = record.slice(0, 2);
-    const filePath = record.slice(3);
-    if (xy === "??") {
-      untracked.push(filePath);
-      continue;
-    }
-    tracked.push(filePath);
-    if (xy.startsWith("R") || xy.startsWith("C")) {
-      const src = records[i + 1];
-      if (src) {
-        tracked.push(src);
-        i++;
-      }
-    }
-  }
-  return { tracked, untracked };
-}
-function parseDirtyPaths(repo, opts = {}) {
-  return parsePorcelainZ(gitStatusPorcelainZ(repo, opts));
-}
-
-// src/commands.pull.recovery.ts
 function isSyncedConfig(path) {
   return PUSH_ALLOWED_STATIC.some(
     (entry) => entry.endsWith("/") ? path.startsWith(entry) : path === entry
@@ -8207,9 +8651,9 @@ function capturePrePostHeads(repo, rebase) {
   if (pre === void 0 || post === void 0) return void 0;
   return { pre, post };
 }
-function buildWetPullSections(ts, map, prePostHeads) {
-  applySharedLinks(ts, map);
-  writeSharedBaseline(map);
+function buildWetPullSections(ts, map, prePostHeads, namesDerived = false) {
+  applySharedLinks(ts, map, { quietNames: namesDerived });
+  writeSharedBaseline(map, { quiet: true });
   const { label } = regenerateSettings(ts);
   syncSkillsPull(ts, prePostHeads);
   const remapResult = withSpinner("Syncing sessions", () => remapPull(ts));
@@ -8232,22 +8676,24 @@ function buildWetPullSections(ts, map, prePostHeads) {
   };
 }
 function handleWedge(repo, forceRemote) {
-  const wedge = classifyWedge(repo);
-  if (wedge === null) return;
+  const { state: wedge, probe } = classifyWedgeWithProbe(repo);
+  if (wedge === null) {
+    if (forceRemote) log(cleanRepoForceRemoteMessage(probe));
+    return false;
+  }
   if (wedge === "unmerged-index") {
     if (forceRemote) {
       recoverUnmergedIndex(repo);
-    } else {
-      die(unmergedIndexRunbookText("nomad pull"), { code: EXIT.CONFLICT });
+      return false;
     }
-    return;
+    return die(unmergedIndexRunbookText("nomad pull"), { code: EXIT.CONFLICT });
   }
   if (forceRemote) {
     recoverForceRemote(wedge, repo);
-    return;
+    return true;
   }
   const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
-  die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
+  return die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
 }
 function runPullCore(opts = {}) {
   const dryRun = opts.dryRun === true;
@@ -8256,7 +8702,7 @@ function runPullCore(opts = {}) {
   const repo = repoHome();
   const backup = backupBase();
   const ts = freshBackupTs(backup);
-  handleWedge(repo, forceRemote);
+  const recovered = handleWedge(repo, forceRemote);
   if (!dryRun) {
     const backupRoot = join58(backup, ts);
     try {
@@ -8270,8 +8716,13 @@ function runPullCore(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
   }
-  const mirrored = !dryRun && !forceRemote ? reconcileSharedLinksBeforePull(repo, ts) : [];
-  const sharedPlans = dryRun ? planSharedReconcileBeforePull(repo) : void 0;
+  const {
+    mirrored,
+    events: mirrorEvents,
+    namesDerived,
+    derivedSharedDirs
+  } = !dryRun && !recovered ? reconcileSharedLinksBeforePull(repo, ts) : { mirrored: [], events: [], namesDerived: false, derivedSharedDirs: void 0 };
+  const sharedPlans = dryRun ? planSharedReconcileBeforePull(repo, ts) : void 0;
   const prePostHeads = capturePrePostHeads(repo, () => {
     pullWithCollisionRunbook(repo, mirrored);
   });
@@ -8280,18 +8731,20 @@ function runPullCore(opts = {}) {
   const map = existsSync46(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
-    computePreview(ts, map, "pull", sharedPlans);
+    computePreview(ts, map, "pull", plansAgainst(sharedPlans, map));
     return { tag: "dry" };
   }
+  const discardedMirror = recovered && !dryRun ? describeSkippedMirrorDiscard(repo, ts) : void 0;
   const { sections, localOnly, settingsLabel, unmapped, extrasSkipped } = buildWetPullSections(
     ts,
     map,
-    prePostHeads
+    prePostHeads,
+    namesAlreadyReported(namesDerived, derivedSharedDirs, map)
   );
   const incomingChanges = prePostHeads === void 0 ? true : prePostHeads.pre !== prePostHeads.post;
   return {
     tag: "wet",
-    sections,
+    sections: [buildMirrorSection(mirrorEvents, discardedMirror), ...sections],
     localOnly,
     divergedKeptLocal,
     incomingChanges,
@@ -8399,19 +8852,6 @@ function isAllowed(path, allowed) {
   }
   return false;
 }
-function blockSetFor(segments) {
-  if (segments[0] !== "shared" || segments[1] !== "extras") return NEVER_SYNC;
-  return segments[3] === ".claude" ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
-}
-function isNeverSync(path) {
-  const segments = path.split("/");
-  const blockSet = blockSetFor(segments);
-  const scan = segments[0] === "shared" && segments[1] === "extras" ? segments.slice(4) : segments;
-  for (const segment of scan) {
-    if (isDeniedName(blockSet, segment)) return true;
-  }
-  return false;
-}
 var GSD_HOOKS_SUPPORT_FILES = /* @__PURE__ */ new Set(["managed-hooks-registry.cjs", "package.json"]);
 var GSD_HOOKS_SUPPORT_DIR = "lib";
 function isGsdDropped(path) {
@@ -8451,7 +8891,11 @@ function enforceAllowList(statusPorcelain, map) {
     ...Object.entries(map.extras ?? {}).flatMap(
       ([l, names]) => names.filter((n) => extrasWhitelist.includes(n)).flatMap((n) => [`shared/extras/${l}/${n}`, `shared/extras/${l}/${n}/`])
     ),
-    ...(map.sharedDirs ?? []).filter((d) => isValidSharedDir(d)).map((d) => `shared/${d}/`)
+    // Predicate passed by reference, not wrapped in an arrow: `isValidSharedDir`
+    // is a type guard, and an arrow returning its result is just a boolean, so
+    // wrapping it would leave `d` as `unknown` and let a non-string reach the
+    // template literal as "[object Object]".
+    ...sharedDirEntries(map).filter(isValidSharedDir).map((d) => `shared/${d}/`)
   ];
   const neverSyncHits = [];
   const violations = [];
@@ -8632,9 +9076,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync19, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync19 } from "node:fs";
+import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync20, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync20 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join62, relative as relative10, sep as sep13 } from "node:path";
+import { join as join62, relative as relative10, sep as sep14 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -8642,7 +9086,7 @@ init_utils_json();
 var NOTHING_TO_SCAN_ROW = `${dim(infoGlyph)} nothing to scan, no leaks`;
 function stageSessionDir(localDir, dstDir, changed) {
   if (changed !== void 0) {
-    const prefix = `${localDir}${sep13}`;
+    const prefix = `${localDir}${sep14}`;
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
@@ -8696,7 +9140,7 @@ function stageExtras(tmpRoot, map) {
 }
 function stageSkills(tmpRoot) {
   const localSkills = join62(claudeHome(), "skills");
-  const stat = lstatSync19(localSkills, { throwIfNoEntry: false });
+  const stat = lstatSync20(localSkills, { throwIfNoEntry: false });
   if (stat === void 0 || stat.isSymbolicLink()) return 0;
   const names = readdirSync19(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
   if (names.length === 0) return 0;
@@ -8730,7 +9174,7 @@ function previewPushLeaks(map, opts = {}) {
     }
     return verdictFromFindings(findings);
   } finally {
-    rmSync19(tmpRoot, { recursive: true, force: true });
+    rmSync20(tmpRoot, { recursive: true, force: true });
   }
 }
 
@@ -8859,7 +9303,8 @@ async function runPushCore(opts = {}) {
   const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
   if (!dryRun) {
     syncSkillsPush();
-    syncSharedLinksPush(map);
+    const linkNames = map !== null ? allSharedLinks(map) : void 0;
+    syncSharedLinksPush(map, { linkNames });
     stripGsdHooksFromBase(repo, backup);
   }
   const st = { dryRun, remap, extras, globalConfig: [] };
@@ -8982,7 +9427,14 @@ function buildSyncSummarySection(pull, pushOutcome) {
   for (const row2 of buildSkipAndCollisionRows(pull, result)) addItem(s, row2);
   return s;
 }
-var SYNC_SECTION_ORDER = ["Settings", "Global config", "Sessions", "Extras", "Leak scan"];
+var SYNC_SECTION_ORDER = [
+  "Symlinks",
+  "Settings",
+  "Global config",
+  "Sessions",
+  "Extras",
+  "Leak scan"
+];
 function isDroppedSummaryHeader(header) {
   return header === PULL_SUMMARY_HEADER || header === "Push summary";
 }
@@ -9211,7 +9663,7 @@ function buildCrashReport(input) {
 }
 
 // src/crash-report.redact.ts
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync20, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync21, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join65 } from "node:path";
 init_push_gitleaks_scan();
@@ -9231,7 +9683,7 @@ function redactWithGitleaks(text, scan = scanFile) {
   } finally {
     if (dir !== void 0) {
       try {
-        rmSync20(dir, { recursive: true, force: true });
+        rmSync21(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -9409,7 +9861,7 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync53, rmSync as rmSync21, statSync as statSync13 } from "node:fs";
+import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync53, rmSync as rmSync22, statSync as statSync13 } from "node:fs";
 import { join as join68 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
@@ -9420,7 +9872,7 @@ function snapshotIntoShared(map) {
     const dst = join68(repo, "shared", name);
     if (statSync13(src).isDirectory()) {
       const gk = join68(dst, ".gitkeep");
-      if (existsSync53(gk)) rmSync21(gk);
+      if (existsSync53(gk)) rmSync22(gk);
       cpSync10(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
@@ -9881,7 +10333,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.64.0",
+  version: "0.65.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -9992,7 +10444,8 @@ var DEFAULT_HELP = [
   cont("abort the in-progress rebase/merge, park stranded commits on"),
   cont("nomad/stranded-<ts>, reset to origin/main, and re-pull. Refuses"),
   cont("if stranded or dirty tracked changes touch synced config (shared/,"),
-  cont("hosts/, path-map.json). Cannot combine with --dry-run."),
+  cont("hosts/, path-map.json). Cannot combine with --dry-run. On a clean"),
+  cont("repo, reports nothing to recover and pulls normally."),
   "",
   row("  push", "Rebase, run safety checks (gitleaks, gitlinks, allow-list), commit, push."),
   row("       --dry-run", "Run pre-checks (rebase, gitleaks probe, gitlink scan) and preview"),