claude-nomad 0.64.1 → 0.65.0

package/CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## [0.65.0](https://github.com/funkadelic/claude-nomad/compare/v0.64.1...v0.65.0) (2026-08-13)
+
+### What's new
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and none of these apply to
+it.
+
+- **`nomad pull --force-remote` no longer discards edits you have not published.** The flag exists
+  to rescue a sync repo that got stuck part-way through an update. On native Windows it also skipped
+  the step that saves your local shared-config edits into the repo, every time it ran, even on a
+  healthy machine with nothing to rescue. That was the flag's only visible effect on a healthy repo,
+  and nothing told you it had happened. It now rescues a stuck repo and nothing else, and when a
+  rescue genuinely does replace your copies, the pull says how many and where your previous ones
+  were saved.
+- **A pull now says what it did to your shared config.** On Windows your shared config is kept as
+  real file copies rather than symlinks, so every pull starts by copying your local edits into the
+  sync repo. That step used to be silent. It now prints a `Symlinks` section naming each file it
+  picked up, and each file it removed from the repo because you deleted it here. If a file cannot be
+  read at all, because another program is holding it open or its permissions changed, the pull names
+  it and says why rather than leaving a silent gap. `nomad diff` and `nomad pull --dry-run` read
+  from the same place, so a preview now matches what a real pull does.
+- **Windows keeps the same things out of your sync repo that your other machines do.** The Windows
+  copy step used to hold back only files whose names looked like passwords or keys. It now skips
+  everything on the never-sync list, so the folders Claude Code uses for its own state, named things
+  like `sessions`, `tasks`, `plans`, and `cache`, stay on the machine even when they sit inside a
+  folder you share. If one of them is already sitting in your sync repo, the pull tells you, and
+  takes a backup copy before removing it.
+
+**On all supported platforms, i.e. \*nix, Mac, WSL2, and native Windows.**
+
+- **`nomad doctor` names the files that have drifted.** When it reports that your skills or your
+  shared config no longer match the repo, it lists them. Before, you got a count and had to run it
+  again with `--verbose` to find out which files it meant.
+- **`nomad pull --force-remote` tells you when there was nothing to rescue.** On a repo that is not
+  stuck it now says so and pulls normally, instead of appearing to do nothing. If it cannot tell
+  whether the repo is stuck, it says that too rather than reporting a clean repo. The help text,
+  README, and docs site now agree on what the flag does.
+
+
+### Added
+
+* **doctor:** open with the nomad wordmark and name the diverging files ([#508](https://github.com/funkadelic/claude-nomad/issues/508)) ([1fea0c7](https://github.com/funkadelic/claude-nomad/commit/1fea0c7913b38f934d529d888a0aef96dc1dfc08))
+* make the win32 pre-pull mirror visible and gate what it writes ([#503](https://github.com/funkadelic/claude-nomad/issues/503)) ([8d3a76d](https://github.com/funkadelic/claude-nomad/commit/8d3a76dd42c89efd38b2a76b2684b8b4014878ac))
+* **pull:** report the shared files a pull removes, not just the ones it captures ([#510](https://github.com/funkadelic/claude-nomad/issues/510)) ([9ab6ef5](https://github.com/funkadelic/claude-nomad/commit/9ab6ef5b9961a8542eb25a650ada27bd3bdf9de6))
+
+
+### Fixed
+
+* **mirror:** report what the never-sync cleanup actually removed ([#509](https://github.com/funkadelic/claude-nomad/issues/509)) ([6596ed3](https://github.com/funkadelic/claude-nomad/commit/6596ed341d4e764b29a56bb73f900aa6dd48fcc9))
+* **mirror:** warn when the win32 mirror skips a name it cannot stat ([#505](https://github.com/funkadelic/claude-nomad/issues/505)) ([5806db6](https://github.com/funkadelic/claude-nomad/commit/5806db6e2d2861747738d498d0255fe0483a6650))
+* **pull:** make --force-remote mean wedge recovery again ([#506](https://github.com/funkadelic/claude-nomad/issues/506)) ([2bf8d5d](https://github.com/funkadelic/claude-nomad/commit/2bf8d5d3b19e8c022ff1137be96b0f009e5503df))
+
+
+### Changed
+
+* fail the gitleaks install on a download error, not a checksum mismatch ([#504](https://github.com/funkadelic/claude-nomad/issues/504)) ([724dd3c](https://github.com/funkadelic/claude-nomad/commit/724dd3c276bdea113f9719e5b62ee0741a3c3885))
+
+
+### Documentation
+
+* describe what the force-remote recovery warning actually counts ([#507](https://github.com/funkadelic/claude-nomad/issues/507)) ([6235858](https://github.com/funkadelic/claude-nomad/commit/6235858e40459e136deff4b081187c89b9e7b670))
+* keep the Windows explainer in one place ([#511](https://github.com/funkadelic/claude-nomad/issues/511)) ([9a9287f](https://github.com/funkadelic/claude-nomad/commit/9a9287f87d86e2353ca4a0d936346482e37a1041))
+
+
+### Dependencies
+
+* bump @astrojs/starlight from 0.41.6 to 0.41.7 in /docs-site in the prod-dependencies group ([#499](https://github.com/funkadelic/claude-nomad/issues/499)) ([61ecb3f](https://github.com/funkadelic/claude-nomad/commit/61ecb3fef0213c6bc0f2a36713da0e166e356238))
+* bump astro from 7.1.6 to 7.2.0 in /docs-site ([#500](https://github.com/funkadelic/claude-nomad/issues/500)) ([4909e02](https://github.com/funkadelic/claude-nomad/commit/4909e02e5754081432e567cae2344989ab8b1309))
+* bump the codeql-action group across 1 directory with 2 updates ([#498](https://github.com/funkadelic/claude-nomad/issues/498)) ([ad3310d](https://github.com/funkadelic/claude-nomad/commit/ad3310d33e9662ae407d304ef949efd1bebf9c3e))
+* bump the dev-dependencies group across 1 directory with 4 updates ([#501](https://github.com/funkadelic/claude-nomad/issues/501)) ([446c6da](https://github.com/funkadelic/claude-nomad/commit/446c6dae3905609bef1d3ec4366d58e50651c44a))
+
 ## [0.64.1](https://github.com/funkadelic/claude-nomad/compare/v0.64.0...v0.64.1) (2026-08-07)
 
 ### What's new

package/README.md

@@ -71,7 +71,8 @@ survives different file paths and your secrets never ride along.
   parks stranded work on a branch, refuses if shared config is at risk), and a repo where the rebase
   was interrupted but the git index was left with unmerged entries and no active operation (clears
   the index via `git reset --mixed HEAD`, surfaces any orphaned stash entry left by the interrupted
-  autostash, never discards working-tree edits).
+  autostash, never discards working-tree edits). On a repo that is not stuck, the flag reports there
+  is nothing to recover and pulls normally instead of doing nothing silently.
 - **Easy off.** `nomad eject` replaces every managed `~/.claude/` symlink with a real copy in one
   step, so your setup keeps working after you delete the sync checkout and uninstall the CLI.
 
@@ -118,27 +119,40 @@ export NOMAD_HOST=<your-host-label>   # add to ~/.zshrc or ~/.bashrc
 $ nomad pull
 ```
 
+Everyday loop on any host:
+
+```bash
+$ nomad doctor   # confirm setup
+$ nomad sync     # pull config, then publish local changes, in one step
+```
+
+`nomad sync` is the command to reach for day to day: it always pulls first (so changes from your
+other machines land before anything is pushed, and work that exists only on this machine is kept,
+not deleted) and then pushes, under one lock, so there is no ordering to remember. Output is compact
+by default: a run prints only a short Sync summary, not the full status tree; pass
+`nomad sync --verbose` (or `--all` / `-v`) to see the full tree. `nomad pull` and `nomad push` are
+still available as lower-level commands for cases `sync` does not cover: recovering a wedged repo
+with `nomad pull --force-remote`, or resolving a detected secret without the interactive menu via
+`nomad push --redact-all` / `--allow` / `--allow-all` (see [Changing settings](#changing-settings)
+and [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/)). The
+[FAQ](https://funkadelic.github.io/claude-nomad/faq/) covers what `sync` does under the hood and the
+push/pull order it enforces.
+
 ### Windows
 
 claude-nomad runs natively on Windows (PowerShell or cmd), and WSL2 works too. The everyday loop is
 the same either way; the difference is under the hood.
 
-On macOS, Linux, and WSL2, claude-nomad symlinks your shared config into `~/.claude/`, so there is
-only ever one file: the one in your sync repo. Native Windows cannot use symlinks, because creating
-one there needs Developer Mode or admin rights, so claude-nomad keeps a real copy there instead.
-That leaves two files to keep in step, and claude-nomad does it for you: `nomad pull` and
-`nomad sync` both copy your edits into the repo before they fetch, so an unpublished edit is never
-overwritten. Enabling Developer Mode does not change this; copies are used on every native Windows
-host either way.
-
-Two things come from native Windows specifically, both covered in the bullets below: a
-`.gitleaksignore` allow entry may not travel to a macOS, Linux, or WSL2 host, and deep session paths
-can hit the native Windows 260-character path limit.
-
-The native Windows steps are the same as above with a couple of PowerShell-specific swaps:
+Native Windows cannot use symlinks, so claude-nomad keeps a real copy of your shared config in
+`~/.claude/` instead of a symlink. `nomad pull` and `nomad sync` both mirror your local copies into
+the repo before they fetch, so an edit you have not published yet is captured rather than
+overwritten. If a file cannot be read, the pull leaves it out and warns naming the file: fix that
+and run again before you rely on the result.
 
 ```powershell
-# 1. Install the CLI.
+# 1. Install prerequisites and the CLI. (Using Scoop instead? scoop install gh gitleaks.)
+> winget install GitHub.cli
+> winget install gitleaks.gitleaks
 > npm i -g claude-nomad
 
 # 2. Create your private sync repo and scaffold it.
@@ -155,66 +169,9 @@ The native Windows steps are the same as above with a couple of PowerShell-speci
 > nomad push
 ```
 
-A few native Windows specifics worth knowing. WSL2 behaves like Linux, so the copy-sync and
-path-length items below do not apply to it; the `.gitleaksignore` one can still reach it, from the
-other side:
-
-- **Installing gh:** `winget install GitHub.cli` (or `scoop install gh`), then `gh auth login`.
-  Needed before `nomad init` on the first host; later hosts only clone with it.
-- **Installing gitleaks:** `winget install gitleaks.gitleaks` (or `scoop install gitleaks` if you
-  use Scoop). `nomad doctor` prints the same hint whenever gitleaks is missing from PATH.
-- **Shared config is copied, not symlinked.** On macOS and Linux, files like `CLAUDE.md` and your
-  skills live in the sync repo and are symlinked into `~/.claude/`, so there is one source of truth
-  on disk. Creating a symlink on native Windows needs Developer Mode or admin rights, so there these
-  are real copies instead, whether or not you have Developer Mode enabled. WSL2 is unaffected and
-  behaves like Linux. What this means for you: nothing extra. On native Windows both `nomad pull`
-  and `nomad sync` mirror your local copies into the repo before they fetch, so an unpublished edit
-  is captured rather than reverted. A file you delete from a shared directory is handled the same
-  way: it is removed from the sync repo by the next pull, exactly as deleting inside a symlinked
-  directory already removes it on macOS or Linux. The removal is left uncommitted, so it publishes
-  on your next push and passes the same secret scan as everything else, and the file is snapshotted
-  to the backup dir first. The safety rule behind this: nomad only removes a file it has a record of
-  having given this machine, so a repo file this machine has never synced is never touched. That
-  record is also why the first pull after you upgrade to this version is an exception: there is
-  nothing to compare against yet, so a deletion made before that pull comes back once, and deleting
-  it again sticks. If a file you created has the same name as one another machine just created, the
-  pull stops before it changes anything and tells you which file under `~/.claude/` to move or
-  rename, with the two ways to finish. Nothing is lost either way: your file stays exactly as you
-  left it and the update simply waits for the next pull. The one command that deliberately takes the
-  repo's version is `nomad pull --force-remote`, which is what that flag is for; the copy it
-  replaces is snapshotted to the backup dir first. This is the same behavior claude-nomad's
-  `skills/` sync already has on every platform.
-- **A `.gitleaksignore` allow entry may not travel across hosts.** gitleaks fingerprints each
-  finding using the file path exactly as it saw it: backslashes on native Windows, forward slashes
-  on macOS/Linux/WSL2. If you allow a finding with `nomad push --allow` (or `nomad allow`) on native
-  Windows, the identical finding can reappear as "new" the first time it is scanned from a macOS,
-  Linux, or WSL2 host, and the same happens in reverse. This is a known gitleaks limitation, not a
-  claude-nomad bug; just allow it again from the other host.
-- **Line endings stay put.** A fresh `nomad init` writes a `.gitattributes` with `* -text`, so Git
-  never converts line endings between hosts. If you are joining a sync repo created before this file
-  existed, add that one line from any host (or watch for the `nomad doctor` warning that nudges
-  you), otherwise a native Windows checkout with the common `core.autocrlf=true` Git default would
-  rewrite every text file's line endings, and every host would then see the whole tree as
-  permanently changed.
-
-Everyday loop on any host:
-
-```bash
-$ nomad doctor   # confirm setup
-$ nomad sync     # pull config, then publish local changes, in one step
-```
-
-`nomad sync` is the command to reach for day to day: it always pulls first (so changes from your
-other machines land before anything is pushed, and work that exists only on this machine is kept,
-not deleted) and then pushes, under one lock, so there is no ordering to remember. Output is compact
-by default: a run prints only a short Sync summary, not the full status tree; pass
-`nomad sync --verbose` (or `--all` / `-v`) to see the full tree. `nomad pull` and `nomad push` are
-still available as lower-level commands for cases `sync` does not cover: recovering a wedged repo
-with `nomad pull --force-remote`, or resolving a detected secret without the interactive menu via
-`nomad push --redact-all` / `--allow` / `--allow-all` (see [Changing settings](#changing-settings)
-and [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/)). The
-[FAQ](https://funkadelic.github.io/claude-nomad/faq/) covers what `sync` does under the hood and the
-push/pull order it enforces.
+See the full explainer at <https://funkadelic.github.io/claude-nomad/quickstart/#windows> for how
+the copy-sync behaves on pull and push, why a `.gitleaksignore` allow entry may not travel to a
+macOS, Linux, or WSL2 host, the 260-character path limit, and the line-endings setting.
 
 ### Make your sessions follow you
 
@@ -321,8 +278,8 @@ independently from the CLI, but requires nomad `>= 0.35.0` because it calls rece
 - `gh` ([GitHub CLI](https://cli.github.com/)), required by `nomad init`
 
 Works on macOS, Linux (including WSL2), and native Windows (PowerShell or cmd). See
-[Windows](#windows) above for the native Windows equivalents of the install and host-label steps,
-the copy-sync trade-off, and the `.gitleaksignore` cross-host caveat.
+[Windows](#windows) above for the native Windows equivalents of the install and host-label steps and
+the copy-sync trade-off.
 
 **Optional:** [curl](https://curl.se/) or [wget](https://www.gnu.org/software/wget/) for the
 version-staleness check and `nomad doctor --check-schema`. The CLI works without them. The opt-in

package/dist/nomad.mjs

@@ -58,7 +58,26 @@ function isDeniedName(blockSet, name) {
 function isClaudeExtraName(name) {
   return stripTrailingDotsAndWhitespace(name).toLowerCase() === ".claude";
 }
-var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, SECRET_FILE_PATTERNS;
+function isExtrasScoped(segments) {
+  return segments[0] === "shared" && segments[1] === "extras";
+}
+function blockSetFor(segments) {
+  if (!isExtrasScoped(segments)) return NEVER_SYNC;
+  return isClaudeExtraName(segments[3] ?? "") ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+}
+function deniedSegmentFor(path) {
+  const segments = path.split("/");
+  const blockSet = blockSetFor(segments);
+  const scan = isExtrasScoped(segments) ? segments.slice(4) : segments;
+  for (const segment of scan) {
+    if (isDeniedName(blockSet, segment)) return segment;
+  }
+  return null;
+}
+function isNeverSync(path) {
+  return deniedSegmentFor(path) !== null;
+}
+var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, ALWAYS_NEVER_SYNC, SECRET_FILE_PATTERNS;
 var init_config_never_sync = __esm({
   "src/config.never-sync.ts"() {
     "use strict";
@@ -88,6 +107,13 @@ var init_config_never_sync = __esm({
       "sessions"
     ]);
     CLAUDE_EXTRA_NEVER_SYNC = /* @__PURE__ */ new Set([...NEVER_SYNC, "projects"]);
+    ALWAYS_NEVER_SYNC = /* @__PURE__ */ new Set([
+      ".claude.json",
+      ".credentials.json",
+      "settings.local.json",
+      "history.jsonl",
+      "stats-cache.json"
+    ]);
     SECRET_FILE_PATTERNS = [
       /^\.env(\..+)?$/i,
       // .env, .env.local, .env.production
@@ -639,7 +665,7 @@ function sharedDirEntries(map) {
   const raw = map.sharedDirs;
   return Array.isArray(raw) ? raw : [];
 }
-var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, ALWAYS_NEVER_SYNC, PUSH_ALLOWED_STATIC;
+var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -656,13 +682,6 @@ var init_config = __esm({
     GSD_PREFIX = "gsd-";
     GSD_DROPPED_NAMES = ["hooks", "agents"];
     SUPPORTED_EXTRAS = [".planning", "CLAUDE.md", ".claude"];
-    ALWAYS_NEVER_SYNC = /* @__PURE__ */ new Set([
-      ".claude.json",
-      ".credentials.json",
-      "settings.local.json",
-      "history.jsonl",
-      "stats-cache.json"
-    ]);
     PUSH_ALLOWED_STATIC = [
       "shared/CLAUDE.md",
       "shared/my-statusline.cjs",
@@ -894,13 +913,20 @@ function probeUnmergedIndex(repo) {
   }
   return raw.split("\0").some(Boolean) ? "unmerged" : "clean";
 }
-function unmergedIndexPresent(repo) {
-  return probeUnmergedIndex(repo) === "unmerged";
+function classifyWedgeWithProbe(repo) {
+  const mode = detectWedge(repo);
+  if (mode !== null) return { state: mode, probe: "clean" };
+  const probe = probeUnmergedIndex(repo);
+  return { state: probe === "unmerged" ? "unmerged-index" : null, probe };
 }
 function classifyWedge(repo) {
-  const mode = detectWedge(repo);
-  if (mode !== null) return mode;
-  return unmergedIndexPresent(repo) ? "unmerged-index" : null;
+  return classifyWedgeWithProbe(repo).state;
+}
+function cleanRepoForceRemoteMessage(probe) {
+  if (probe === "error") {
+    return "could not determine whether the repo is wedged; continuing with a normal pull";
+  }
+  return "repo is clean, nothing to recover; continuing with a normal pull";
 }
 function unmergedIndexRunbookText(resumeCmd2) {
   return `repo has an unmerged index with no active rebase or merge in progress (torn-down rebase or merge left stage-2/3 entries behind).
@@ -2090,7 +2116,7 @@ function applySharedLinks(ts, map, opts = {}) {
   const dryRun = opts.dryRun === true;
   const claude = claudeHome();
   const repo = repoHome();
-  const linkNames = allSharedLinks(map);
+  const linkNames = allSharedLinks(map, { quiet: opts.quietNames === true });
   if (process.platform === "win32") {
     applySharedLinksWin32(linkNames, claude, repo, ts, dryRun, opts.onPreview);
     return;
@@ -2108,35 +2134,6 @@ function applySharedLinks(ts, map, opts = {}) {
     ensureSymlink(linkPath, target);
   }
 }
-function syncSharedLinksPush(map) {
-  mirrorSharedNames(map, { adoptNew: true, overlay: false });
-}
-function stageLocalSharedEdits(map, ts) {
-  mirrorSharedNames(map, { adoptNew: false, overlay: true, backupTs: ts });
-}
-function mirrorOneSharedName(name, claude, repo, policy) {
-  const localPath = join5(claude, name);
-  const stat = lstatSync4(localPath, { throwIfNoEntry: false });
-  if (stat === void 0) return;
-  if (stat.isSymbolicLink()) return;
-  const target = join5(repo, "shared", name);
-  if (!policy.adoptNew && !existsSync4(target)) return;
-  if (policy.backupTs !== void 0) backupRepoWrite(target, policy.backupTs, repo);
-  if (policy.overlay && stat.isDirectory()) {
-    copyExtrasOverlayFiltered(localPath, target, ALWAYS_NEVER_SYNC);
-  } else {
-    copyExtrasFiltered(localPath, target, ALWAYS_NEVER_SYNC);
-  }
-}
-function mirrorSharedNames(map, policy) {
-  if (process.platform !== "win32") return;
-  if (map === null) return;
-  const claude = claudeHome();
-  const repo = repoHome();
-  for (const name of allSharedLinks(map)) {
-    mirrorOneSharedName(name, claude, repo, policy);
-  }
-}
 function readExistingSettings(settingsPath) {
   if (!existsSync4(settingsPath)) return { existing: {}, present: false, malformed: false };
   try {
@@ -2867,7 +2864,7 @@ import { join as join45 } from "node:path";
 init_color();
 init_config();
 import { existsSync as existsSync11, lstatSync as lstatSync8, readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
-import { basename as basename3, join as join13 } from "node:path";
+import { join as join13, win32 as win32Path } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -3121,19 +3118,30 @@ function reportRepoState(section2) {
 function repoHasSharedSource(name) {
   return existsSync11(join13(repoHome(), "shared", name));
 }
-function win32CopyOkRow(name) {
-  return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)`, fail: false };
+function win32CopyOkRow(name, exempt = 0) {
+  const note = exempt > 0 ? dim(` (${exempt} never-synced path(s) not compared)`) : "";
+  return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)${note}`, fail: false };
+}
+function relativeUnder(root, path) {
+  const rel = win32Path.relative(root, path);
+  const segments = rel.split(win32Path.sep);
+  if (rel === "" || segments[0] === ".." || win32Path.isAbsolute(rel)) return null;
+  return segments.join("/");
 }
-function divergingBasename(line) {
-  return basename3(line.replace(/ \((?:local|repo) only\)$/, ""));
+function divergingRepoPath(line, name, local, shared) {
+  const path = line.replace(/ \((?:local|repo) only\)$/, "");
+  const rel = relativeUnder(local, path) ?? relativeUnder(shared, path);
+  return rel === null ? `shared/${name}` : `shared/${name}/${rel}`;
 }
 function classifyWin32Copy(name, p) {
   const sharedPath = join13(repoHome(), "shared", name);
   if (!existsSync11(sharedPath)) return win32CopyOkRow(name);
-  const diverging = listDivergingFiles(p, sharedPath).filter(
-    (line) => !isDeniedName(ALWAYS_NEVER_SYNC, divergingBasename(line))
+  const compared = listDivergingFiles(p, sharedPath);
+  const diverging = compared.filter(
+    (line) => deniedSegmentFor(divergingRepoPath(line, name, p, sharedPath)) === null
   );
-  if (diverging.length === 0) return win32CopyOkRow(name);
+  const exempt = compared.length - diverging.length;
+  if (diverging.length === 0) return win32CopyOkRow(name, exempt);
   return {
     line: `${yellow(warnGlyph)} ${name}: ${diverging.length} file(s) diverge from shared/${name}`,
     fail: false,
@@ -5389,12 +5397,12 @@ import { join as join37 } from "node:path";
 
 // src/skills-sync.tracked.ts
 init_utils();
-import { basename as basename4 } from "node:path";
+import { basename as basename3 } from "node:path";
 function trackedRootSkillsAt(ref, repo) {
   try {
     const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
     const entries = raw.split("\0").filter((entry) => entry !== "");
-    return new Set(entries.map((entry) => basename4(entry)));
+    return new Set(entries.map((entry) => basename3(entry)));
   } catch {
     return /* @__PURE__ */ new Set();
   }
@@ -6110,8 +6118,8 @@ function sessionSuffix(finding) {
   const sid = sessionIdFromFinding(finding);
   if (sid === null) return "";
   const rawBasename = finding.File.replace(/^.*\//, "");
-  const basename5 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
-  return basename5 === sid ? "" : ` (session: ${sid})`;
+  const basename4 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
+  return basename4 === sid ? "" : ` (session: ${sid})`;
 }
 function renderFindingBlock(finding, readLine, siblings = []) {
   const lines = [`  file:  ${finding.File}:${finding.StartLine}${sessionSuffix(finding)}`];
@@ -6780,6 +6788,20 @@ function buildVerdictSection(sections) {
   return summary;
 }
 
+// src/commands.doctor.banner.ts
+var NOMAD_BANNER = [
+  "                                        __",
+  "   ____   ____   ____ ___   ____ _ ____/ /",
+  "  / __ \\ / __ \\ / __ `__ \\ / __ `// __  /",
+  " / / / // /_/ // / / / / // /_/ // /_/ /",
+  String.raw`/_/ /_/ \____//_/ /_/ /_/ \__,_/ \__,_/`
+];
+function printBanner(log2, stdout) {
+  if (stdout.isTTY !== true) return;
+  for (const line of NOMAD_BANNER) log2(line);
+  log2("");
+}
+
 // src/commands.doctor.compact.ts
 init_color();
 var ALWAYS_FULL = /* @__PURE__ */ new Set([
@@ -6798,18 +6820,27 @@ function isRepoStateLine(item2) {
 function isCopySyncModalityLine(item2) {
   return item2.includes("sync modality: copy-sync");
 }
+function isKeptEnvironmentRow(item2) {
+  return isRepoStateLine(item2) || isCopySyncModalityLine(item2) || isProblem(item2);
+}
+function keepWithChildren(items, keep) {
+  const out = [];
+  let parentKept = false;
+  for (const item2 of items) {
+    if (isChild(item2)) {
+      if (parentKept) out.push(item2);
+      continue;
+    }
+    parentKept = keep(item2);
+    if (parentKept) out.push(item2);
+  }
+  return out;
+}
 function compactSections(sections) {
   return sections.map((s) => {
     if (ALWAYS_FULL.has(s.header)) return s;
-    if (s.header === "Environment") {
-      return {
-        ...s,
-        items: s.items.filter(
-          (it) => isRepoStateLine(it) || isCopySyncModalityLine(it) || isProblem(it)
-        )
-      };
-    }
-    return { ...s, items: s.items.filter(isProblem) };
+    const keep = s.header === "Environment" ? isKeptEnvironmentRow : isProblem;
+    return { ...s, items: keepWithChildren(s.items, keep) };
   });
 }
 
@@ -6886,6 +6917,7 @@ function gatherDoctorSections(opts) {
   return [...body, buildVerdictSection(body)];
 }
 function cmdDoctor(opts = {}) {
+  printBanner(console.log, process.stdout);
   const makeSpinner = opts.startSpinner ?? startSpinner;
   const sp = makeSpinner("Running checks");
   let report;
@@ -7415,7 +7447,8 @@ function remapExtrasPush(ts, opts = {}) {
     //     The filter prevents ALWAYS_NEVER_SYNC files from landing in the repo
     //     working tree before the allow-list gate fires, eliminating the
     //     "residue wedges repeat push" regression. The allow-list gate
-    //     (enforceAllowList / blockSetFor in commands.push.allowlist.ts)
+    //     (enforceAllowList in commands.push.allowlist.ts, blockSetFor in
+    //     config.never-sync.ts)
     //     remains the hard security boundary.
     //   All others: copyExtrasFiltered with per-extra denylist.
     (src, dst, dirname14) => dirname14 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname14)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname14))
@@ -7566,10 +7599,10 @@ function collectSharedFiles(dir, claude, scan) {
     addLocalPath(abs, claude, scan);
   }
 }
-function enumerateLocalSharedScan(map) {
+function enumerateLocalSharedScan(map, opts = {}) {
   const claude = claudeHome();
   const scan = { files: {}, declined: [] };
-  for (const name of allSharedLinks(map)) {
+  for (const name of opts.linkNames ?? allSharedLinks(map, { quiet: opts.quiet === true })) {
     if (isDeniedName(ALWAYS_NEVER_SYNC, name)) {
       scan.declined.push(name);
       continue;
@@ -7578,13 +7611,13 @@ function enumerateLocalSharedScan(map) {
   }
   return scan;
 }
-function enumerateLocalSharedFiles(map) {
-  return enumerateLocalSharedScan(map).files;
+function enumerateLocalSharedFiles(map, opts = {}) {
+  return enumerateLocalSharedScan(map, opts).files;
 }
-function buildSharedBaseline(map) {
+function buildSharedBaseline(map, opts = {}) {
   const claude = claudeHome();
   const files = {};
-  for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map))) {
+  for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map, opts))) {
     try {
       files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join51(claude, key)) };
     } catch {
@@ -7592,27 +7625,69 @@ function buildSharedBaseline(map) {
   }
   return buildManifest(files, SHARED_BASELINE_KIND, SHARED_BASELINE_CONFIG_HASH);
 }
-function writeSharedBaseline(map) {
+function writeSharedBaseline(map, opts = {}) {
   if (process.platform !== "win32") return;
   try {
-    writeManifest(sharedBaselinePath(), buildSharedBaseline(map));
+    writeManifest(sharedBaselinePath(), buildSharedBaseline(map, opts));
   } catch (err) {
     warn(`could not record the shared-config baseline: ${err.message}`);
   }
 }
 
 // src/commands.pull.win32.ts
-init_config();
+init_color();
 import { existsSync as existsSync44 } from "node:fs";
 import { join as join56 } from "node:path";
 
-// src/git-probe.ts
+// src/commands.pull.recovery.git.ts
+init_utils();
 import { execFileSync as execFileSync21 } from "node:child_process";
+function gitCapture(args, cwd) {
+  return execFileSync21("git", args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 64 * 1024 * 1024
+  }).toString().trim();
+}
+function parsePorcelainZ(raw) {
+  const tracked = [];
+  const untracked = [];
+  if (!raw) return { tracked, untracked };
+  const records = raw.split("\0");
+  for (let i = 0; i < records.length; i++) {
+    const record = records[i];
+    if (record.length < 3) continue;
+    const xy = record.slice(0, 2);
+    const filePath = record.slice(3);
+    if (xy === "??") {
+      untracked.push(filePath);
+      continue;
+    }
+    tracked.push(filePath);
+    if (xy.startsWith("R") || xy.startsWith("C")) {
+      const src = records[i + 1];
+      if (src) {
+        tracked.push(src);
+        i++;
+      }
+    }
+  }
+  return { tracked, untracked };
+}
+function parseDirtyPaths(repo, opts = {}) {
+  return parsePorcelainZ(gitStatusPorcelainZ(repo, opts));
+}
+
+// src/commands.pull.win32.ts
+init_config();
+
+// src/git-probe.ts
+import { execFileSync as execFileSync22 } from "node:child_process";
 var PROBE_TIMEOUT_MS4 = 1e4;
 var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
 function gitProbe(args, repo) {
   try {
-    return execFileSync21("git", args, {
+    return execFileSync22("git", args, {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: PROBE_TIMEOUT_MS4,
@@ -7623,37 +7698,10 @@ function gitProbe(args, repo) {
   }
 }
 
-// src/links.captures.ts
-init_config();
-import { existsSync as existsSync40, lstatSync as lstatSync17 } from "node:fs";
-import { join as join52 } from "node:path";
-function planSharedLinkCaptures(map) {
-  if (process.platform !== "win32") return [];
-  if (map === null) return [];
-  const claude = claudeHome();
-  const repo = repoHome();
-  const plan = [];
-  for (const name of allSharedLinks(map)) {
-    const localPath = join52(claude, name);
-    let stat;
-    try {
-      stat = lstatSync17(localPath, { throwIfNoEntry: false });
-    } catch {
-      continue;
-    }
-    if (stat === void 0) continue;
-    if (stat.isSymbolicLink()) continue;
-    const repoPath = join52(repo, "shared", name);
-    if (!existsSync40(repoPath)) continue;
-    plan.push({ name, localPath, repoPath });
-  }
-  return plan;
-}
-
 // src/links.deletions.ts
 init_config();
-import { existsSync as existsSync41, lstatSync as lstatSync18, rmSync as rmSync17 } from "node:fs";
-import { join as join53, relative as relative8, resolve as resolve4, sep as sep13 } from "node:path";
+import { existsSync as existsSync40, lstatSync as lstatSync17, rmSync as rmSync17 } from "node:fs";
+import { join as join52, relative as relative8, resolve as resolve4, sep as sep13 } from "node:path";
 init_utils();
 init_utils_fs();
 function isUnknown(declined, key) {
@@ -7663,27 +7711,28 @@ function deletionFor(key, names, claude, sharedRoot) {
   const segments = key.split("/");
   const name = segments[0];
   if (!names.has(name)) return null;
-  if (!existsSync41(join53(claude, name))) return null;
+  if (!existsSync40(join52(claude, name))) return null;
   if (segments.some((segment) => isDeniedName(ALWAYS_NEVER_SYNC, segment))) return null;
   const repoPath = resolve4(sharedRoot, key);
-  const rel = relative8(join53(sharedRoot, name), repoPath);
+  const rel = relative8(join52(sharedRoot, name), repoPath);
   if (rel === "" || rel === ".." || rel.startsWith(`..${sep13}`)) return null;
   if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
     return null;
-  if (!existsSync41(repoPath)) return null;
-  return { name, localPath: join53(claude, key), repoPath };
+  if (!existsSync40(repoPath)) return null;
+  return { kind: "deletion", name, localPath: join52(claude, key), repoPath };
 }
-function planSharedLinkDeletions(map) {
+function planSharedLinkDeletions(map, opts = {}) {
   if (process.platform !== "win32") return [];
   if (map === null) return [];
   const baseline = readSharedBaseline();
   if (baseline === null) return [];
   const claude = claudeHome();
-  const sharedRoot = join53(repoHome(), "shared");
-  const scan = enumerateLocalSharedScan(map);
+  const sharedRoot = join52(repoHome(), "shared");
+  const linkNames = opts.linkNames ?? allSharedLinks(map);
+  const scan = enumerateLocalSharedScan(map, { linkNames });
   const present = new Set(Object.keys(scan.files).map((key) => key.toLowerCase()));
   const declined = scan.declined.map((path) => path.toLowerCase());
-  const names = new Set(allSharedLinks(map));
+  const names = new Set(linkNames);
   const plan = [];
   for (const key of Object.keys(baseline.files)) {
     const folded = key.toLowerCase();
@@ -7694,17 +7743,151 @@ function planSharedLinkDeletions(map) {
   }
   return plan;
 }
-function applySharedLinkDeletions(map, ts) {
+function applySharedLinkDeletions(map, ts, opts = {}) {
   const repo = repoHome();
-  for (const entry of planSharedLinkDeletions(map)) {
+  const removed = [];
+  for (const entry of planSharedLinkDeletions(map, opts)) {
     try {
-      if (!lstatSync18(entry.repoPath).isFile()) continue;
+      if (!lstatSync17(entry.repoPath).isFile()) continue;
       backupRepoWrite(entry.repoPath, ts, repo);
       rmSync17(entry.repoPath, { force: true });
+      removed.push(entry);
     } catch (err) {
       warn(`could not remove ${entry.repoPath}: ${err.message}`);
     }
   }
+  return removed;
+}
+
+// src/links.mirror.ts
+init_config();
+import { existsSync as existsSync41, lstatSync as lstatSync18, rmSync as rmSync18 } from "node:fs";
+import { join as join53 } from "node:path";
+init_utils();
+init_utils_fs();
+function emitMirror(onPreview, name, localPath, repoPath) {
+  if (onPreview) {
+    onPreview({ kind: "mirror", name, localPath, repoPath });
+  } else {
+    log(`would capture: ${localPath} -> ${repoPath}`);
+  }
+}
+function emitMirrorWet(onPreview, name, localPath, repoPath) {
+  if (onPreview) onPreview({ kind: "mirror", name, localPath, repoPath });
+}
+function notShared(policy, target) {
+  return !policy.adoptNew && !existsSync41(target);
+}
+function mirrorOneSharedName(name, claude, repo, policy, opts) {
+  const localPath = join53(claude, name);
+  const target = join53(repo, "shared", name);
+  let stat;
+  try {
+    stat = lstatSync18(localPath, { throwIfNoEntry: false });
+  } catch (err) {
+    if (notShared(policy, target)) return;
+    warn(
+      `${name} could not be read (${err.message}), so it was left out of shared/ this run. Check its permissions, or whether another program has it open`
+    );
+    return;
+  }
+  if (stat === void 0) return;
+  if (stat.isSymbolicLink()) return;
+  if (notShared(policy, target)) return;
+  if (opts.dryRun === true) {
+    emitMirror(opts.onPreview, name, localPath, target);
+    return;
+  }
+  if (policy.backupTs !== void 0) backupRepoWrite(target, policy.backupTs, repo);
+  if (policy.overlay && stat.isDirectory()) {
+    copyExtrasOverlayFiltered(localPath, target, NEVER_SYNC);
+  } else {
+    copyExtrasFiltered(localPath, target, NEVER_SYNC);
+  }
+  emitMirrorWet(opts.onPreview, name, localPath, target);
+}
+function mirrorSharedNames(map, policy, opts = {}) {
+  if (process.platform !== "win32") return;
+  if (map === null) return;
+  const claude = claudeHome();
+  const repo = repoHome();
+  const linkNames = opts.linkNames ?? allSharedLinks(map);
+  for (const name of linkNames) {
+    mirrorOneSharedName(name, claude, repo, policy, opts);
+  }
+}
+function syncSharedLinksPush(map, opts = {}) {
+  mirrorSharedNames(map, { adoptNew: true, overlay: false }, opts);
+}
+function stageLocalSharedEdits(map, ts, opts = {}) {
+  mirrorSharedNames(map, { adoptNew: false, overlay: true, backupTs: ts }, opts);
+}
+function presentAt(abs) {
+  try {
+    return lstatSync18(abs, { throwIfNoEntry: false }) !== void 0;
+  } catch {
+    return true;
+  }
+}
+function removeUntrackedDenied(repo, path, segment, ts) {
+  const abs = join53(repo, path);
+  const denied = `the path segment "${segment}" is on the never-sync list`;
+  if (!presentAt(abs)) {
+    warn(
+      `nothing was removed for ${path}: ${denied}, but nothing is at that path now. Either it went away after git listed it, in which case there is nothing left to do, or its name did not survive the decode of git's output and the real file is still in the sync repo under a name nomad cannot address. Look for it in ${repo} with "git status --untracked-files=all -- shared/"`
+    );
+    return;
+  }
+  const snapshotted = existsSync41(abs);
+  try {
+    backupRepoWrite(abs, ts, repo);
+  } catch (err) {
+    warn(
+      `could not snapshot ${abs} before removing it (${err.message}), so it was left in place: ${denied}, so remove it by hand`
+    );
+    return;
+  }
+  try {
+    rmSync18(abs, { recursive: true, force: true });
+    if (presentAt(abs)) {
+      warn(`could not remove ${abs}: ${denied}, so remove it by hand`);
+      return;
+    }
+    const where = snapshotted ? `. A copy was snapshotted under backup/${ts}/repo/ first` : "";
+    warn(`removed ${path} from the sync repo working tree: ${denied}${where}`);
+  } catch (err) {
+    warn(`could not remove ${abs}: ${err.message}`);
+  }
+}
+function reportTrackedDenied(repo, path, segment) {
+  const inHead = gitProbe(["ls-tree", "--name-only", "HEAD", "--", path], repo);
+  const denied = `the path segment "${segment}" is on the never-sync list`;
+  if (inHead === null) {
+    warn(
+      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it with "git status -- ${path}" and take it out of shared/ before committing`
+    );
+    return;
+  }
+  if (inHead.trim() === "") {
+    warn(
+      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run "git rm --cached -- ${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, "git diff --cached --name-status" names the source, whose content IS committed, so restore that half with "git checkout HEAD -- <source>" rather than leaving its deletion staged`
+    );
+    return;
+  }
+  if (!existsSync41(join53(repo, path))) return;
+  warn(
+    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run "git checkout HEAD -- ${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: "git rm -- ${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
+  );
+}
+function revertDeniedMirrorPaths(repo, status, ts) {
+  for (const path of new Set(status.untracked)) {
+    const segment = deniedSegmentFor(path);
+    if (segment !== null) removeUntrackedDenied(repo, path, segment, ts);
+  }
+  for (const path of new Set(status.tracked)) {
+    const segment = deniedSegmentFor(path);
+    if (segment !== null) reportTrackedDenied(repo, path, segment);
+  }
 }
 
 // src/preview.ts
@@ -8051,8 +8234,8 @@ function formatLinkRow(e) {
   if (e.kind === "copy") return `would copy  ${e.from} -> ${e.to}`;
   return `${e.kind}  ${e.from} -> ${e.to}`;
 }
-function formatCaptureRow(c) {
-  return `would capture  ${c.localPath} -> ${c.repoPath}`;
+function formatMirrorRow(e) {
+  return `would capture  ${e.localPath} -> ${e.repoPath}`;
 }
 function formatDeletionRow(d) {
   return `would remove  ${d.repoPath} (gone from ${d.localPath})`;
@@ -8060,6 +8243,23 @@ function formatDeletionRow(d) {
 function formatSessionRow(e) {
   return e.kind === "overwrite" ? `overwrite  ${e.dst} (from ${e.src})` : e.text;
 }
+function appendMirrorPlanRows(links, ts, map, plans) {
+  if (plans) {
+    for (const capture of plans.captures) addItem(links, formatMirrorRow(capture));
+    for (const deletion of plans.deletions) addItem(links, formatDeletionRow(deletion));
+    return plans.namesDerived;
+  }
+  const linkNames = allSharedLinks(map);
+  stageLocalSharedEdits(map, ts, {
+    dryRun: true,
+    onPreview: (e) => addItem(links, formatMirrorRow(e)),
+    linkNames
+  });
+  for (const deletion of planSharedLinkDeletions(map, { linkNames })) {
+    addItem(links, formatDeletionRow(deletion));
+  }
+  return true;
+}
 function buildSettingsSectionForPreview(result) {
   const s = section("settings.json", true);
   if (result.diff !== "") {
@@ -8078,18 +8278,10 @@ function computePreview(ts, map, verb = "pull", plans) {
   console.log(`would pull on host=${HOST} (preview; nothing applied)`);
   console.log("");
   const links = section("Symlinks");
-  const { captures, deletions } = plans ?? {
-    captures: planSharedLinkCaptures(map),
-    deletions: planSharedLinkDeletions(map)
-  };
-  for (const capture of captures) {
-    addItem(links, formatCaptureRow(capture));
-  }
-  for (const deletion of deletions) {
-    addItem(links, formatDeletionRow(deletion));
-  }
+  const namesDerived = appendMirrorPlanRows(links, ts, map, plans);
   applySharedLinks(ts, map, {
     dryRun: true,
+    quietNames: namesDerived,
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
@@ -8139,6 +8331,19 @@ function readMapForMirror(mapPath) {
     return null;
   }
 }
+function sharedDirsUnchanged(before, after) {
+  return JSON.stringify(before) === JSON.stringify(after);
+}
+function namesAlreadyReported(namesDerived, derivedSharedDirs, map) {
+  return namesDerived && sharedDirsUnchanged(derivedSharedDirs, map.sharedDirs);
+}
+function plansAgainst(plans, map) {
+  if (plans === void 0) return void 0;
+  return {
+    ...plans,
+    namesDerived: namesAlreadyReported(plans.namesDerived, plans.derivedSharedDirs, map)
+  };
+}
 function untrackedUnderShared(repo) {
   const out = gitProbe(["ls-files", "--others", "--exclude-standard", "-z", "--", "shared/"], repo);
   if (out === null) return null;
@@ -8148,27 +8353,94 @@ function newlyUntracked(before, after) {
   if (before === null || after === null) return [];
   return [...after].filter((p) => !before.has(p));
 }
+function revertDeniedUnderShared(repo, ts) {
+  const out = gitProbe(
+    ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "shared/"],
+    repo
+  );
+  if (out === null) return;
+  revertDeniedMirrorPaths(repo, parsePorcelainZ(out), ts);
+}
 function reconcileSharedLinksBeforePull(repo, ts) {
-  if (process.platform !== "win32") return [];
+  if (process.platform !== "win32") {
+    return { mirrored: [], events: [], namesDerived: false, derivedSharedDirs: void 0 };
+  }
   const before = untrackedUnderShared(repo);
+  const events = [];
+  let linkNames = [];
+  let namesDerived = false;
+  let derivedSharedDirs;
   try {
     const map = readMapForMirror(join56(repo, "path-map.json"));
-    stageLocalSharedEdits(map, ts);
-    applySharedLinkDeletions(map, ts);
+    if (map !== null) {
+      linkNames = allSharedLinks(map);
+      namesDerived = true;
+      derivedSharedDirs = map.sharedDirs;
+    }
+    stageLocalSharedEdits(map, ts, { onPreview: (e) => events.push(e), linkNames });
+    events.push(...applySharedLinkDeletions(map, ts, { linkNames }));
   } catch (err) {
     warn(`could not reconcile local shared edits before the pull: ${err.message}`);
   }
-  return newlyUntracked(before, untrackedUnderShared(repo));
+  revertDeniedUnderShared(repo, ts);
+  return {
+    mirrored: newlyUntracked(before, untrackedUnderShared(repo)),
+    events,
+    namesDerived,
+    derivedSharedDirs
+  };
+}
+function buildMirrorSection(events, discard) {
+  const s = section("Symlinks");
+  for (const e of events) {
+    addItem(
+      s,
+      e.kind === "deletion" ? `removed  ${e.repoPath} (gone from ${e.localPath})` : `captured  ${e.localPath} -> ${e.repoPath}`
+    );
+  }
+  if (discard) {
+    const names = discard.count === 1 ? "name was" : "names were";
+    addItem(
+      s,
+      `${yellow(warnGlyph)} recovered from a wedged repo, ${discard.count} shared ${names} restored from the repo copy, previous host copies backed up to ${discard.backupPath}`
+    );
+  }
+  return s;
 }
-function planSharedReconcileBeforePull(repo) {
+function describeSkippedMirrorDiscard(repo, ts) {
+  if (process.platform !== "win32") return null;
+  try {
+    const map = readMapForMirror(join56(repo, "path-map.json"));
+    const linkNames = map !== null ? allSharedLinks(map, { quiet: true }) : void 0;
+    const captures = [];
+    stageLocalSharedEdits(map, ts, {
+      dryRun: true,
+      onPreview: (e) => captures.push(e),
+      linkNames
+    });
+    if (captures.length === 0) return null;
+    return { count: captures.length, backupPath: join56(backupBase(), ts) };
+  } catch {
+    return null;
+  }
+}
+function planSharedReconcileBeforePull(repo, ts) {
   const map = readMapForMirror(join56(repo, "path-map.json"));
-  return { captures: planSharedLinkCaptures(map), deletions: planSharedLinkDeletions(map) };
+  const captures = [];
+  const linkNames = process.platform === "win32" && map !== null ? allSharedLinks(map) : void 0;
+  stageLocalSharedEdits(map, ts, { dryRun: true, onPreview: (e) => captures.push(e), linkNames });
+  return {
+    captures,
+    deletions: planSharedLinkDeletions(map, { linkNames }),
+    namesDerived: linkNames !== void 0,
+    derivedSharedDirs: map?.sharedDirs
+  };
 }
 
 // src/commands.pull.collision.ts
 init_config();
 init_exit_codes();
-import { existsSync as existsSync45, lstatSync as lstatSync19, readFileSync as readFileSync20, rmSync as rmSync18 } from "node:fs";
+import { existsSync as existsSync45, lstatSync as lstatSync19, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
 import { join as join57 } from "node:path";
 init_utils();
 var SHARED_PREFIX = /^shared\//;
@@ -8237,7 +8509,7 @@ function removeMirroredCopies(repo, repoRelPaths) {
     try {
       if (lstatSync19(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
       if (!matchesLocalOriginal(repo, rel)) continue;
-      rmSync18(abs, { force: true });
+      rmSync19(abs, { force: true });
     } catch (err) {
       warn(`could not remove nomad's copy at ${abs}: ${err.message}`);
     }
@@ -8264,47 +8536,6 @@ init_commands_pull_wedge();
 init_config();
 init_utils();
 init_utils_fs();
-
-// src/commands.pull.recovery.git.ts
-init_utils();
-import { execFileSync as execFileSync22 } from "node:child_process";
-function gitCapture(args, cwd) {
-  return execFileSync22("git", args, {
-    cwd,
-    stdio: ["ignore", "pipe", "pipe"],
-    maxBuffer: 64 * 1024 * 1024
-  }).toString().trim();
-}
-function parsePorcelainZ(raw) {
-  const tracked = [];
-  const untracked = [];
-  if (!raw) return { tracked, untracked };
-  const records = raw.split("\0");
-  for (let i = 0; i < records.length; i++) {
-    const record = records[i];
-    if (record.length < 3) continue;
-    const xy = record.slice(0, 2);
-    const filePath = record.slice(3);
-    if (xy === "??") {
-      untracked.push(filePath);
-      continue;
-    }
-    tracked.push(filePath);
-    if (xy.startsWith("R") || xy.startsWith("C")) {
-      const src = records[i + 1];
-      if (src) {
-        tracked.push(src);
-        i++;
-      }
-    }
-  }
-  return { tracked, untracked };
-}
-function parseDirtyPaths(repo, opts = {}) {
-  return parsePorcelainZ(gitStatusPorcelainZ(repo, opts));
-}
-
-// src/commands.pull.recovery.ts
 function isSyncedConfig(path) {
   return PUSH_ALLOWED_STATIC.some(
     (entry) => entry.endsWith("/") ? path.startsWith(entry) : path === entry
@@ -8420,9 +8651,9 @@ function capturePrePostHeads(repo, rebase) {
   if (pre === void 0 || post === void 0) return void 0;
   return { pre, post };
 }
-function buildWetPullSections(ts, map, prePostHeads) {
-  applySharedLinks(ts, map);
-  writeSharedBaseline(map);
+function buildWetPullSections(ts, map, prePostHeads, namesDerived = false) {
+  applySharedLinks(ts, map, { quietNames: namesDerived });
+  writeSharedBaseline(map, { quiet: true });
   const { label } = regenerateSettings(ts);
   syncSkillsPull(ts, prePostHeads);
   const remapResult = withSpinner("Syncing sessions", () => remapPull(ts));
@@ -8445,22 +8676,24 @@ function buildWetPullSections(ts, map, prePostHeads) {
   };
 }
 function handleWedge(repo, forceRemote) {
-  const wedge = classifyWedge(repo);
-  if (wedge === null) return;
+  const { state: wedge, probe } = classifyWedgeWithProbe(repo);
+  if (wedge === null) {
+    if (forceRemote) log(cleanRepoForceRemoteMessage(probe));
+    return false;
+  }
   if (wedge === "unmerged-index") {
     if (forceRemote) {
       recoverUnmergedIndex(repo);
-    } else {
-      die(unmergedIndexRunbookText("nomad pull"), { code: EXIT.CONFLICT });
+      return false;
     }
-    return;
+    return die(unmergedIndexRunbookText("nomad pull"), { code: EXIT.CONFLICT });
   }
   if (forceRemote) {
     recoverForceRemote(wedge, repo);
-    return;
+    return true;
   }
   const state = wedge === "rebase" ? "mid-rebase" : "mid-merge";
-  die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
+  return die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
 }
 function runPullCore(opts = {}) {
   const dryRun = opts.dryRun === true;
@@ -8469,7 +8702,7 @@ function runPullCore(opts = {}) {
   const repo = repoHome();
   const backup = backupBase();
   const ts = freshBackupTs(backup);
-  handleWedge(repo, forceRemote);
+  const recovered = handleWedge(repo, forceRemote);
   if (!dryRun) {
     const backupRoot = join58(backup, ts);
     try {
@@ -8483,8 +8716,13 @@ function runPullCore(opts = {}) {
       dryRun ? `pulling on host=${HOST} (backup=${ts}; dry-run)` : `pull on host=${HOST} (backup=${ts})`
     );
   }
-  const mirrored = !dryRun && !forceRemote ? reconcileSharedLinksBeforePull(repo, ts) : [];
-  const sharedPlans = dryRun ? planSharedReconcileBeforePull(repo) : void 0;
+  const {
+    mirrored,
+    events: mirrorEvents,
+    namesDerived,
+    derivedSharedDirs
+  } = !dryRun && !recovered ? reconcileSharedLinksBeforePull(repo, ts) : { mirrored: [], events: [], namesDerived: false, derivedSharedDirs: void 0 };
+  const sharedPlans = dryRun ? planSharedReconcileBeforePull(repo, ts) : void 0;
   const prePostHeads = capturePrePostHeads(repo, () => {
     pullWithCollisionRunbook(repo, mirrored);
   });
@@ -8493,18 +8731,20 @@ function runPullCore(opts = {}) {
   const map = existsSync46(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
-    computePreview(ts, map, "pull", sharedPlans);
+    computePreview(ts, map, "pull", plansAgainst(sharedPlans, map));
     return { tag: "dry" };
   }
+  const discardedMirror = recovered && !dryRun ? describeSkippedMirrorDiscard(repo, ts) : void 0;
   const { sections, localOnly, settingsLabel, unmapped, extrasSkipped } = buildWetPullSections(
     ts,
     map,
-    prePostHeads
+    prePostHeads,
+    namesAlreadyReported(namesDerived, derivedSharedDirs, map)
   );
   const incomingChanges = prePostHeads === void 0 ? true : prePostHeads.pre !== prePostHeads.post;
   return {
     tag: "wet",
-    sections,
+    sections: [buildMirrorSection(mirrorEvents, discardedMirror), ...sections],
     localOnly,
     divergedKeptLocal,
     incomingChanges,
@@ -8612,19 +8852,6 @@ function isAllowed(path, allowed) {
   }
   return false;
 }
-function blockSetFor(segments) {
-  if (segments[0] !== "shared" || segments[1] !== "extras") return NEVER_SYNC;
-  return isClaudeExtraName(segments[3] ?? "") ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
-}
-function isNeverSync(path) {
-  const segments = path.split("/");
-  const blockSet = blockSetFor(segments);
-  const scan = segments[0] === "shared" && segments[1] === "extras" ? segments.slice(4) : segments;
-  for (const segment of scan) {
-    if (isDeniedName(blockSet, segment)) return true;
-  }
-  return false;
-}
 var GSD_HOOKS_SUPPORT_FILES = /* @__PURE__ */ new Set(["managed-hooks-registry.cjs", "package.json"]);
 var GSD_HOOKS_SUPPORT_DIR = "lib";
 function isGsdDropped(path) {
@@ -8849,7 +9076,7 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync20, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync19 } from "node:fs";
+import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync20, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync20 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join62, relative as relative10, sep as sep14 } from "node:path";
 init_push_leak_verdict();
@@ -8947,7 +9174,7 @@ function previewPushLeaks(map, opts = {}) {
     }
     return verdictFromFindings(findings);
   } finally {
-    rmSync19(tmpRoot, { recursive: true, force: true });
+    rmSync20(tmpRoot, { recursive: true, force: true });
   }
 }
 
@@ -9076,7 +9303,8 @@ async function runPushCore(opts = {}) {
   const extras = withSpinner("Syncing extras", () => remapExtrasPush(ts, { dryRun }));
   if (!dryRun) {
     syncSkillsPush();
-    syncSharedLinksPush(map);
+    const linkNames = map !== null ? allSharedLinks(map) : void 0;
+    syncSharedLinksPush(map, { linkNames });
     stripGsdHooksFromBase(repo, backup);
   }
   const st = { dryRun, remap, extras, globalConfig: [] };
@@ -9199,7 +9427,14 @@ function buildSyncSummarySection(pull, pushOutcome) {
   for (const row2 of buildSkipAndCollisionRows(pull, result)) addItem(s, row2);
   return s;
 }
-var SYNC_SECTION_ORDER = ["Settings", "Global config", "Sessions", "Extras", "Leak scan"];
+var SYNC_SECTION_ORDER = [
+  "Symlinks",
+  "Settings",
+  "Global config",
+  "Sessions",
+  "Extras",
+  "Leak scan"
+];
 function isDroppedSummaryHeader(header) {
   return header === PULL_SUMMARY_HEADER || header === "Push summary";
 }
@@ -9428,7 +9663,7 @@ function buildCrashReport(input) {
 }
 
 // src/crash-report.redact.ts
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync20, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync21, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join65 } from "node:path";
 init_push_gitleaks_scan();
@@ -9448,7 +9683,7 @@ function redactWithGitleaks(text, scan = scanFile) {
   } finally {
     if (dir !== void 0) {
       try {
-        rmSync20(dir, { recursive: true, force: true });
+        rmSync21(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -9626,7 +9861,7 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync53, rmSync as rmSync21, statSync as statSync13 } from "node:fs";
+import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync53, rmSync as rmSync22, statSync as statSync13 } from "node:fs";
 import { join as join68 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
@@ -9637,7 +9872,7 @@ function snapshotIntoShared(map) {
     const dst = join68(repo, "shared", name);
     if (statSync13(src).isDirectory()) {
       const gk = join68(dst, ".gitkeep");
-      if (existsSync53(gk)) rmSync21(gk);
+      if (existsSync53(gk)) rmSync22(gk);
       cpSync10(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
@@ -10098,7 +10333,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.64.1",
+  version: "0.65.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -10209,7 +10444,8 @@ var DEFAULT_HELP = [
   cont("abort the in-progress rebase/merge, park stranded commits on"),
   cont("nomad/stranded-<ts>, reset to origin/main, and re-pull. Refuses"),
   cont("if stranded or dirty tracked changes touch synced config (shared/,"),
-  cont("hosts/, path-map.json). Cannot combine with --dry-run."),
+  cont("hosts/, path-map.json). Cannot combine with --dry-run. On a clean"),
+  cont("repo, reports nothing to recover and pulls normally."),
   "",
   row("  push", "Rebase, run safety checks (gitleaks, gitlinks, allow-list), commit, push."),
   row("       --dry-run", "Run pre-checks (rebase, gitleaks probe, gitlink scan) and preview"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.64.1",
+  "version": "0.65.0",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [