claude-nomad 0.65.0 → 0.67.0

package/dist/nomad.mjs

@@ -51,19 +51,34 @@ function isSecretFileName(name) {
   const stripped = stripTrailingDotsAndWhitespace(name);
   return SECRET_FILE_PATTERNS.some((re) => re.test(stripped));
 }
-function isDeniedName(blockSet, name) {
+function matchDeniedName(blockSet, name) {
   const stripped = stripTrailingDotsAndWhitespace(name);
-  return blockSet.has(name) || blockSet.has(name.toLowerCase()) || blockSet.has(stripped) || blockSet.has(stripped.toLowerCase()) || isSecretFileName(name);
+  for (const candidate of [name, name.toLowerCase(), stripped, stripped.toLowerCase()]) {
+    if (blockSet.has(candidate)) return { axis: "name", entry: candidate };
+  }
+  return isSecretFileName(name) ? { axis: "shape" } : null;
+}
+function isDeniedName(blockSet, name) {
+  return matchDeniedName(blockSet, name) !== null;
 }
 function isClaudeExtraName(name) {
   return stripTrailingDotsAndWhitespace(name).toLowerCase() === ".claude";
 }
+function regionKey(segment) {
+  return stripTrailingDotsAndWhitespace(segment).toLowerCase();
+}
 function isExtrasScoped(segments) {
-  return segments[0] === "shared" && segments[1] === "extras";
+  return segments[0] === "shared" && segments.length > 1 && regionKey(segments[1]) === "extras";
+}
+function isSharedNameScoped(segments) {
+  return segments[0] === "shared" && segments.length > 1 && !UNFILTERED_SHARED_REGIONS.has(regionKey(segments[1]));
 }
 function blockSetFor(segments) {
-  if (!isExtrasScoped(segments)) return NEVER_SYNC;
-  return isClaudeExtraName(segments[3] ?? "") ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+  if (isExtrasScoped(segments)) {
+    return isClaudeExtraName(segments[3] ?? "") ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+  }
+  if (isSharedNameScoped(segments)) return ALWAYS_NEVER_SYNC;
+  return NEVER_SYNC;
 }
 function deniedSegmentFor(path) {
   const segments = path.split("/");
@@ -77,7 +92,7 @@ function deniedSegmentFor(path) {
 function isNeverSync(path) {
   return deniedSegmentFor(path) !== null;
 }
-var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, ALWAYS_NEVER_SYNC, SECRET_FILE_PATTERNS;
+var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, ALWAYS_NEVER_SYNC, SECRET_FILE_PATTERNS, UNFILTERED_SHARED_REGIONS;
 var init_config_never_sync = __esm({
   "src/config.never-sync.ts"() {
     "use strict";
@@ -128,6 +143,7 @@ var init_config_never_sync = __esm({
       /^\.git-credentials$/i,
       /^credentials$/i
     ];
+    UNFILTERED_SHARED_REGIONS = /* @__PURE__ */ new Set(["extras", "projects"]);
   }
 });
 
@@ -787,15 +803,16 @@ import {
   cpSync as cpSync3,
   existsSync as existsSync3,
   fsyncSync,
-  lstatSync as lstatSync3,
+  lstatSync as lstatSync4,
   mkdirSync,
   openSync,
   renameSync,
+  rmdirSync,
   statSync,
   symlinkSync,
   writeFileSync
 } from "node:fs";
-import { dirname, join as join4, relative as relative2, sep as sep2 } from "node:path";
+import { dirname, join as join5, relative as relative3, sep as sep2 } from "node:path";
 function isRetryableRenameCode(code) {
   return code === "EPERM" || code === "EBUSY";
 }
@@ -846,14 +863,20 @@ function nowTimestamp() {
 }
 function freshBackupTs(backupRoot) {
   const base = nowTimestamp();
-  if (!existsSync3(join4(backupRoot, base))) return base;
+  if (!existsSync3(join5(backupRoot, base))) return base;
   let n = 1;
-  while (existsSync3(join4(backupRoot, `${base}-${n}`))) n++;
+  while (existsSync3(join5(backupRoot, `${base}-${n}`))) n++;
   return `${base}-${n}`;
 }
+function discardEmptyBackupDir(backupRoot) {
+  try {
+    rmdirSync(backupRoot);
+  } catch {
+  }
+}
 function ensureSymlink(linkPath, target) {
   if (existsSync3(linkPath)) {
-    if (lstatSync3(linkPath).isSymbolicLink()) return;
+    if (lstatSync4(linkPath).isSymbolicLink()) return;
     die(`${linkPath} exists and is not a symlink. Move it aside first.`);
   }
   mkdirSync(dirname(linkPath), { recursive: true });
@@ -861,21 +884,22 @@ function ensureSymlink(linkPath, target) {
   log(`linked ${linkPath} -> ${target}`);
 }
 function backupUnder(absPath, anchor, destRoot) {
-  if (!existsSync3(absPath)) return;
-  const rel = relative2(anchor, absPath);
-  if (rel === "" || rel === ".." || rel.startsWith(`..${sep2}`)) return;
-  const dst = join4(destRoot, rel);
+  if (!existsSync3(absPath)) return false;
+  const rel = relative3(anchor, absPath);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep2}`)) return false;
+  const dst = join5(destRoot, rel);
   mkdirSync(dirname(dst), { recursive: true });
   cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  return true;
 }
 function backupBeforeWrite(absPath, ts) {
-  backupUnder(absPath, claudeHome(), join4(backupBase(), ts));
+  return backupUnder(absPath, claudeHome(), join5(backupBase(), ts));
 }
 function backupRepoWrite(absPath, ts, repoHome2) {
-  backupUnder(absPath, repoHome2, join4(backupBase(), ts, "repo"));
+  backupUnder(absPath, repoHome2, join5(backupBase(), ts, "repo"));
 }
 function backupExtrasWrite(absPath, ts, projectRoot) {
-  backupUnder(absPath, projectRoot, join4(backupBase(), ts, "extras", encodePath(projectRoot)));
+  backupUnder(absPath, projectRoot, join5(backupBase(), ts, "extras", encodePath(projectRoot)));
 }
 var RENAME_RETRY_MAX_ATTEMPTS, RENAME_RETRY_BACKOFF_MS;
 var init_utils_fs = __esm({
@@ -891,12 +915,12 @@ var init_utils_fs = __esm({
 
 // src/commands.pull.wedge.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { join as join20 } from "node:path";
 function detectWedge(repo) {
-  const g = join17(repo, ".git");
-  if (existsSync15(join17(g, "rebase-merge")) || existsSync15(join17(g, "rebase-apply"))) return "rebase";
-  if (existsSync15(join17(g, "MERGE_HEAD"))) return "merge";
+  const g = join20(repo, ".git");
+  if (existsSync16(join20(g, "rebase-merge")) || existsSync16(join20(g, "rebase-apply"))) return "rebase";
+  if (existsSync16(join20(g, "MERGE_HEAD"))) return "merge";
   return null;
 }
 function probeUnmergedIndex(repo) {
@@ -966,15 +990,15 @@ var init_commands_pull_wedge = __esm({
 });
 
 // src/push-gitleaks.config.ts
-import { existsSync as existsSync16, mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync17, mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join21 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveTomlPath(repo = repoHome()) {
-  const repoToml = join18(repo, ".gitleaks.toml");
-  if (existsSync16(repoToml)) return repoToml;
+  const repoToml = join21(repo, ".gitleaks.toml");
+  if (existsSync17(repoToml)) return repoToml;
   const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync16(bundled) ? bundled : null;
+  return existsSync17(bundled) ? bundled : null;
 }
 function assertOverlayAllowlistsScoped(overlayBody) {
   if (OVERLAY_INLINE_ALLOWLIST_RE.test(overlayBody)) {
@@ -1012,17 +1036,17 @@ function buildOverlayTempConfig(overlayBody, bundled) {
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join18(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join18(tempPath, "config.toml");
+  const tempPath = mkdtempSync(join21(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join21(tempPath, "config.toml");
   writeFileSync3(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
   const repo = repoHome();
-  const overlayPath = join18(repo, ".gitleaks.overlay.toml");
-  const repoToml = join18(repo, ".gitleaks.toml");
+  const overlayPath = join21(repo, ".gitleaks.overlay.toml");
+  const repoToml = join21(repo, ".gitleaks.toml");
   const bundled = resolveTomlPath(repo);
-  if (!existsSync16(overlayPath)) {
+  if (!existsSync17(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -1108,9 +1132,9 @@ var init_autostash_guard = __esm({
 
 // src/push-checks.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { readdirSync as readdirSync7, rmSync as rmSync7 } from "node:fs";
+import { readdirSync as readdirSync8, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { delimiter, join as join19 } from "node:path";
+import { delimiter, join as join22 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -1150,23 +1174,23 @@ function gitleaksInstallHint() {
 }
 function findGitlinks(dir) {
   const hits = [];
-  function walk(current) {
+  function walk2(current) {
     let entries;
     try {
-      entries = readdirSync7(current, { withFileTypes: true });
+      entries = readdirSync8(current, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = join19(current, e.name);
+      const p = join22(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
       }
-      if (e.isDirectory()) walk(p);
+      if (e.isDirectory()) walk2(p);
     }
   }
-  walk(dir);
+  walk2(dir);
   return hits;
 }
 function probeGitleaks() {
@@ -1222,7 +1246,7 @@ var init_push_checks = __esm({
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join26 } from "node:path";
 function toFinding(entry) {
   if (typeof entry !== "object" || entry === null) return null;
   const e = entry;
@@ -1270,9 +1294,9 @@ function resolveScanFailure(reportPath, e, forwardStreams) {
   return report;
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join23(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join26(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
-  const reportPath = join23(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join26(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -1300,14 +1324,14 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   }
 }
 function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TIMEOUT_MS) {
-  const cacheDir = join23(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join26(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
   const { path: toml, tempPath } = resolveTomlConfig();
   let reportDir;
   let reportPath;
   try {
-    reportDir = mkdtempSync2(join23(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}-`));
-    reportPath = join23(reportDir, "report.json");
+    reportDir = mkdtempSync2(join26(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}-`));
+    reportPath = join26(reportDir, "report.json");
     const args = [
       "detect",
       "--no-git",
@@ -1531,16 +1555,314 @@ var init_push_leak_verdict = __esm({
 });
 
 // src/commands.adopt.ts
+import { existsSync as existsSync5, lstatSync as lstatSync7 } from "node:fs";
+import { join as join9 } from "node:path";
+
+// src/commands.adopt.recover.ts
+import { lstatSync as lstatSync6, rmSync as rmSync4 } from "node:fs";
+import { dirname as dirname2, join as join7, resolve as resolve2 } from "node:path";
+
+// src/commands.adopt.scan.ts
 init_config();
-init_config_sharedDirs_guard();
 init_exit_codes();
-import { cpSync as cpSync4, existsSync as existsSync5, lstatSync as lstatSync5, rmSync as rmSync4 } from "node:fs";
-import { join as join6 } from "node:path";
+init_utils();
+import { lstatSync, readdirSync } from "node:fs";
+import { join as join2, relative } from "node:path";
+function toForwardSlash(p) {
+  return p.replaceAll("\\", "/");
+}
+function walk(root, dir, out) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const match = matchDeniedName(ALWAYS_NEVER_SYNC, entry.name);
+    if (match !== null) {
+      out.push({
+        path: toForwardSlash(relative(root, join2(dir, entry.name))),
+        matched: match.axis === "name" ? match.entry : null
+      });
+      continue;
+    }
+    if (entry.isDirectory()) walk(root, join2(dir, entry.name), out);
+  }
+}
+function scanDeniedEntries(root) {
+  const stat = lstatSync(root, { throwIfNoEntry: false });
+  if (!stat?.isDirectory()) return [];
+  const out = [];
+  walk(root, root, out);
+  out.sort((a, b) => a.path.localeCompare(b.path));
+  return out;
+}
+function scanOrFatal(name, root, state) {
+  try {
+    return scanDeniedEntries(root);
+  } catch (err) {
+    const message = err?.message;
+    const text = typeof message === "string" ? message : String(err);
+    throw new NomadFatal(
+      `cannot adopt ${name}: could not scan ${root} for never-sync content (${text}). ${state()} Check that it is readable and not being written to, then run \`nomad adopt ${name}\` again.`,
+      { code: EXIT.GENERIC_FAILURE }
+    );
+  }
+}
+function describeMatch(hit) {
+  return hit.matched === null ? "matches a credential filename shape" : `matches the never-sync name "${hit.matched}"`;
+}
+function remedies(hits, root, name) {
+  const subject = hits.length === 1 ? "that path" : "those paths";
+  let out = ` Move ${subject} out of ${root} and run \`nomad adopt ${name}\` again.`;
+  if (hits.some((hit) => hit.matched !== null)) {
+    out += " A never-sync name is matched by spelling alone and never by content, so renaming a path listed above as a never-sync name clears the refusal just as well.";
+  }
+  if (hits.some((hit) => hit.matched === null)) {
+    out += " A credential filename shape is matched by the extension or by the whole filename, so renaming a path listed above as a credential filename shape clears the refusal only if the new name falls outside that shape too.";
+  }
+  return out;
+}
+function deniedEntriesRefusal(name, root, hits, clauses) {
+  const lines = hits.map((hit) => `  ${hit.path} (${describeMatch(hit)})`).join("\n");
+  return new NomadFatal(
+    `cannot adopt ${name}: ${clauses.found}:
+${lines}
+${clauses.state}${remedies(hits, root, name)}`,
+    { code: EXIT.GENERIC_FAILURE }
+  );
+}
+function refuseDeniedEntries(name, root) {
+  const nothingChanged = "Nothing was changed.";
+  const hits = scanOrFatal(name, root, () => nothingChanged);
+  if (hits.length === 0) return;
+  throw deniedEntriesRefusal(name, root, hits, {
+    found: `${root} contains never-sync content`,
+    state: nothingChanged
+  });
+}
+
+// src/commands.adopt.recover.ts
+init_config();
+init_exit_codes();
+
+// src/extras-sync.core.ts
+init_config();
+import { cpSync as cpSync2, existsSync as existsSync2, lstatSync as lstatSync3, readdirSync as readdirSync3, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
+import { basename as basename2, join as join4, relative as relative2 } from "node:path";
+
+// src/extras-sync.collision.ts
+init_utils();
+import { cpSync, existsSync, lstatSync as lstatSync2, readdirSync as readdirSync2, rmSync } from "node:fs";
+import { basename, join as join3 } from "node:path";
+function quoted(p) {
+  return `"${p}"`;
+}
+function stripCollidingDstSymlinks(src, dst, isExcluded) {
+  if (!existsSync(dst)) return;
+  for (const name of readdirSync2(src)) {
+    if (isExcluded(name)) continue;
+    const dstPath = join3(dst, name);
+    const dstStat = lstatSync2(dstPath, { throwIfNoEntry: false });
+    if (dstStat === void 0) continue;
+    if (dstStat.isSymbolicLink()) {
+      rmSync(dstPath, { recursive: true, force: true });
+    } else if (dstStat.isDirectory() && lstatSync2(join3(src, name)).isDirectory()) {
+      stripCollidingDstSymlinks(join3(src, name), dstPath, isExcluded);
+    }
+  }
+}
+function cpSyncGuarded(src, dst, filter, label) {
+  try {
+    cpSync(src, dst, { recursive: true, force: true, verbatimSymlinks: true, filter });
+  } catch (err) {
+    const e = err;
+    if (e.code === "EINVAL" || e.code === "ENOTEMPTY" || e.code === "ERR_FS_CP_NON_DIR_TO_DIR" || e.code === "ERR_FS_CP_DIR_TO_NON_DIR" || process.platform === "win32" && e.errno === 145) {
+      throw new NomadFatal(
+        `${label}: type collision copying ${quoted(src)} -> ${quoted(dst)} (${e.path ?? "unknown path"}): a file/directory type changed upstream; run nomad pull --force-remote to recover`
+      );
+    }
+    throw err;
+  }
+}
+function prunePreservingBy(src, dst, isPreserved, isRootPreserved) {
+  for (const name of readdirSync2(dst)) {
+    if (isPreserved(name) || isRootPreserved?.(name) === true) continue;
+    const dstPath = join3(dst, name);
+    const srcStat = lstatSync2(join3(src, name), { throwIfNoEntry: false });
+    if (srcStat === void 0) {
+      rmSync(dstPath, { recursive: true, force: true });
+      continue;
+    }
+    const dstStat = lstatSync2(dstPath);
+    if (srcStat.isDirectory() && dstStat.isDirectory()) {
+      prunePreservingBy(join3(src, name), dstPath, isPreserved);
+    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
+      rmSync(dstPath, { recursive: true, force: true });
+    }
+  }
+}
+function copyExtrasFilteredPreservingBy(src, dst, isPreserved, isRootPreserved) {
+  const dstStat = lstatSync2(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0) {
+    if (dstStat.isDirectory()) {
+      const srcStat = lstatSync2(src, { throwIfNoEntry: false });
+      if (srcStat !== void 0 && !srcStat.isDirectory()) {
+        throw new NomadFatal(
+          `copyExtrasFilteredPreservingBy: type mismatch copying ${quoted(src)} -> ${quoted(dst)}: the repo entry is a file but the local entry is a directory; run nomad pull --force-remote to recover`
+        );
+      }
+      prunePreservingBy(src, dst, isPreserved, isRootPreserved);
+    } else {
+      rmSync(dst, { recursive: true, force: true });
+    }
+  }
+  stripCollidingDstSymlinks(src, dst, isPreserved);
+  cpSync(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isPreserved(basename(srcEntry))
+  });
+}
+
+// src/extras-sync.guards.ts
+init_utils();
+init_config_sharedDirs_guard();
+import { isAbsolute, normalize, sep } from "node:path";
+function assertSafeLocalRoot(localRoot, logical) {
+  if (!isAbsolute(localRoot)) {
+    throw new NomadFatal(
+      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be absolute)`
+    );
+  }
+  const canonical = process.platform === "win32" ? localRoot.split("/").join(sep) : localRoot;
+  if (canonical !== normalize(canonical)) {
+    throw new NomadFatal(
+      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be already-normalized; no '..' or redundant segments)`
+    );
+  }
+}
+
+// src/extras-sync.core.ts
+init_utils();
+init_utils_json();
+function loadValidatedExtras(opts) {
+  const repo = repoHome();
+  const mapPath = join4(repo, "path-map.json");
+  const repoExtras = join4(repo, "shared", "extras");
+  if (!existsSync2(mapPath) || opts.requireRepoExtras === true && !existsSync2(repoExtras)) {
+    if (opts.missingMsg !== void 0) log(opts.missingMsg);
+    return null;
+  }
+  const map = readPathMap(mapPath);
+  const extrasMap = map.extras ?? {};
+  if (Object.keys(extrasMap).length === 0) return null;
+  for (const logical of Object.keys(extrasMap)) {
+    assertSafeLogical(logical);
+    const localRoot = map.projects[logical]?.[HOST];
+    if (localRoot && localRoot !== "TBD") assertSafeLocalRoot(localRoot, logical);
+  }
+  return { map, extrasMap };
+}
+function* eachExtrasTarget(v, counts) {
+  const whitelist = SUPPORTED_EXTRAS;
+  for (const [logical, dirnames] of Object.entries(v.extrasMap)) {
+    const localRoot = v.map.projects[logical]?.[HOST];
+    if (!localRoot || localRoot === "TBD") {
+      counts.unmapped++;
+      continue;
+    }
+    for (const dirname15 of dirnames) {
+      if (!whitelist.includes(dirname15)) {
+        counts.skipped++;
+        continue;
+      }
+      yield { logical, localRoot, dirname: dirname15 };
+    }
+  }
+}
+function copyExtrasOverlayFiltered(src, dst, blockSet) {
+  const dstStat = lstatSync3(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0 && !dstStat.isDirectory()) {
+    rmSync2(dst, { recursive: true, force: true });
+  }
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSyncGuarded(
+    src,
+    dst,
+    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry)),
+    "copyExtrasOverlayFiltered"
+  );
+}
+function copyExtrasOverlaySkipDiverged(src, dst, blockSet, divergedSet) {
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSyncGuarded(
+    src,
+    dst,
+    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry)) && !divergedSet.has(relative2(src, srcEntry)),
+    "copyExtrasOverlaySkipDiverged"
+  );
+}
+function copyExtras(src, dst) {
+  rmSync2(dst, { recursive: true, force: true });
+  cpSync2(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
+}
+function copyExtrasFileSkipDiverged(src, dst) {
+  if (existsSync2(dst)) {
+    let dstBuf;
+    try {
+      dstBuf = readFileSync2(dst);
+    } catch {
+      return;
+    }
+    if (!readFileSync2(src).equals(dstBuf)) return;
+  }
+  copyExtras(src, dst);
+}
+function extrasDenySet(dirname15) {
+  return isClaudeExtraName(dirname15) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+}
+function copyExtrasFiltered(src, dst, blockSet) {
+  rmSync2(dst, { recursive: true, force: true });
+  cpSync2(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry))
+  });
+}
+function prunePreservingDenied(src, dst, blockSet) {
+  for (const name of readdirSync3(dst)) {
+    if (isDeniedName(blockSet, name)) continue;
+    const dstPath = join4(dst, name);
+    const srcStat = lstatSync3(join4(src, name), { throwIfNoEntry: false });
+    if (srcStat === void 0) {
+      rmSync2(dstPath, { recursive: true, force: true });
+      continue;
+    }
+    const dstStat = lstatSync3(dstPath);
+    if (srcStat.isDirectory() && dstStat.isDirectory()) {
+      prunePreservingDenied(join4(src, name), dstPath, blockSet);
+    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
+      rmSync2(dstPath, { recursive: true, force: true });
+    }
+  }
+}
+function copyExtrasFilteredPreserving(src, dst, blockSet) {
+  const dstStat = lstatSync3(dst, { throwIfNoEntry: false });
+  if (dstStat !== void 0) {
+    if (dstStat.isDirectory()) prunePreservingDenied(src, dst, blockSet);
+    else rmSync2(dst, { recursive: true, force: true });
+  }
+  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
+  cpSync2(src, dst, {
+    recursive: true,
+    force: true,
+    verbatimSymlinks: true,
+    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry))
+  });
+}
 
 // src/links.ts
 init_config();
-import { existsSync as existsSync4, lstatSync as lstatSync4, rmSync as rmSync3 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync4, lstatSync as lstatSync5, rmSync as rmSync3 } from "node:fs";
+import { join as join6 } from "node:path";
 
 // src/hooks-filter.ts
 init_config();
@@ -1829,225 +2151,7 @@ function buildCaptureSubset(merged, settings, opts) {
   return out;
 }
 
-// src/extras-sync.core.ts
-init_config();
-import { cpSync as cpSync2, existsSync as existsSync2, lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
-import { basename as basename2, join as join3, relative } from "node:path";
-
-// src/extras-sync.collision.ts
-init_utils();
-import { cpSync, existsSync, lstatSync, readdirSync, rmSync } from "node:fs";
-import { basename, join as join2 } from "node:path";
-function quoted(p) {
-  return `"${p}"`;
-}
-function stripCollidingDstSymlinks(src, dst, isExcluded) {
-  if (!existsSync(dst)) return;
-  for (const name of readdirSync(src)) {
-    if (isExcluded(name)) continue;
-    const dstPath = join2(dst, name);
-    const dstStat = lstatSync(dstPath, { throwIfNoEntry: false });
-    if (dstStat === void 0) continue;
-    if (dstStat.isSymbolicLink()) {
-      rmSync(dstPath, { recursive: true, force: true });
-    } else if (dstStat.isDirectory() && lstatSync(join2(src, name)).isDirectory()) {
-      stripCollidingDstSymlinks(join2(src, name), dstPath, isExcluded);
-    }
-  }
-}
-function cpSyncGuarded(src, dst, filter, label) {
-  try {
-    cpSync(src, dst, { recursive: true, force: true, verbatimSymlinks: true, filter });
-  } catch (err) {
-    const e = err;
-    if (e.code === "EINVAL" || e.code === "ENOTEMPTY" || e.code === "ERR_FS_CP_NON_DIR_TO_DIR" || e.code === "ERR_FS_CP_DIR_TO_NON_DIR" || process.platform === "win32" && e.errno === 145) {
-      throw new NomadFatal(
-        `${label}: type collision copying ${quoted(src)} -> ${quoted(dst)} (${e.path ?? "unknown path"}): a file/directory type changed upstream; run nomad pull --force-remote to recover`
-      );
-    }
-    throw err;
-  }
-}
-function prunePreservingBy(src, dst, isPreserved, isRootPreserved) {
-  for (const name of readdirSync(dst)) {
-    if (isPreserved(name) || isRootPreserved?.(name) === true) continue;
-    const dstPath = join2(dst, name);
-    const srcStat = lstatSync(join2(src, name), { throwIfNoEntry: false });
-    if (srcStat === void 0) {
-      rmSync(dstPath, { recursive: true, force: true });
-      continue;
-    }
-    const dstStat = lstatSync(dstPath);
-    if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingBy(join2(src, name), dstPath, isPreserved);
-    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync(dstPath, { recursive: true, force: true });
-    }
-  }
-}
-function copyExtrasFilteredPreservingBy(src, dst, isPreserved, isRootPreserved) {
-  const dstStat = lstatSync(dst, { throwIfNoEntry: false });
-  if (dstStat !== void 0) {
-    if (dstStat.isDirectory()) {
-      const srcStat = lstatSync(src, { throwIfNoEntry: false });
-      if (srcStat !== void 0 && !srcStat.isDirectory()) {
-        throw new NomadFatal(
-          `copyExtrasFilteredPreservingBy: type mismatch copying ${quoted(src)} -> ${quoted(dst)}: the repo entry is a file but the local entry is a directory; run nomad pull --force-remote to recover`
-        );
-      }
-      prunePreservingBy(src, dst, isPreserved, isRootPreserved);
-    } else {
-      rmSync(dst, { recursive: true, force: true });
-    }
-  }
-  stripCollidingDstSymlinks(src, dst, isPreserved);
-  cpSync(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isPreserved(basename(srcEntry))
-  });
-}
-
-// src/extras-sync.guards.ts
-init_utils();
-init_config_sharedDirs_guard();
-import { isAbsolute, normalize, sep } from "node:path";
-function assertSafeLocalRoot(localRoot, logical) {
-  if (!isAbsolute(localRoot)) {
-    throw new NomadFatal(
-      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be absolute)`
-    );
-  }
-  const canonical = process.platform === "win32" ? localRoot.split("/").join(sep) : localRoot;
-  if (canonical !== normalize(canonical)) {
-    throw new NomadFatal(
-      `invalid localRoot for ${logical} in path-map.json: ${JSON.stringify(localRoot)} (must be already-normalized; no '..' or redundant segments)`
-    );
-  }
-}
-
-// src/extras-sync.core.ts
-init_utils();
-init_utils_json();
-function loadValidatedExtras(opts) {
-  const repo = repoHome();
-  const mapPath = join3(repo, "path-map.json");
-  const repoExtras = join3(repo, "shared", "extras");
-  if (!existsSync2(mapPath) || opts.requireRepoExtras === true && !existsSync2(repoExtras)) {
-    if (opts.missingMsg !== void 0) log(opts.missingMsg);
-    return null;
-  }
-  const map = readPathMap(mapPath);
-  const extrasMap = map.extras ?? {};
-  if (Object.keys(extrasMap).length === 0) return null;
-  for (const logical of Object.keys(extrasMap)) {
-    assertSafeLogical(logical);
-    const localRoot = map.projects[logical]?.[HOST];
-    if (localRoot && localRoot !== "TBD") assertSafeLocalRoot(localRoot, logical);
-  }
-  return { map, extrasMap };
-}
-function* eachExtrasTarget(v, counts) {
-  const whitelist = SUPPORTED_EXTRAS;
-  for (const [logical, dirnames] of Object.entries(v.extrasMap)) {
-    const localRoot = v.map.projects[logical]?.[HOST];
-    if (!localRoot || localRoot === "TBD") {
-      counts.unmapped++;
-      continue;
-    }
-    for (const dirname14 of dirnames) {
-      if (!whitelist.includes(dirname14)) {
-        counts.skipped++;
-        continue;
-      }
-      yield { logical, localRoot, dirname: dirname14 };
-    }
-  }
-}
-function copyExtrasOverlayFiltered(src, dst, blockSet) {
-  const dstStat = lstatSync2(dst, { throwIfNoEntry: false });
-  if (dstStat !== void 0 && !dstStat.isDirectory()) {
-    rmSync2(dst, { recursive: true, force: true });
-  }
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  cpSyncGuarded(
-    src,
-    dst,
-    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry)),
-    "copyExtrasOverlayFiltered"
-  );
-}
-function copyExtrasOverlaySkipDiverged(src, dst, blockSet, divergedSet) {
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  cpSyncGuarded(
-    src,
-    dst,
-    (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry)) && !divergedSet.has(relative(src, srcEntry)),
-    "copyExtrasOverlaySkipDiverged"
-  );
-}
-function copyExtras(src, dst) {
-  rmSync2(dst, { recursive: true, force: true });
-  cpSync2(src, dst, { recursive: true, force: true, verbatimSymlinks: true });
-}
-function copyExtrasFileSkipDiverged(src, dst) {
-  if (existsSync2(dst)) {
-    let dstBuf;
-    try {
-      dstBuf = readFileSync2(dst);
-    } catch {
-      return;
-    }
-    if (!readFileSync2(src).equals(dstBuf)) return;
-  }
-  copyExtras(src, dst);
-}
-function extrasDenySet(dirname14) {
-  return isClaudeExtraName(dirname14) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
-}
-function copyExtrasFiltered(src, dst, blockSet) {
-  rmSync2(dst, { recursive: true, force: true });
-  cpSync2(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry))
-  });
-}
-function prunePreservingDenied(src, dst, blockSet) {
-  for (const name of readdirSync2(dst)) {
-    if (isDeniedName(blockSet, name)) continue;
-    const dstPath = join3(dst, name);
-    const srcStat = lstatSync2(join3(src, name), { throwIfNoEntry: false });
-    if (srcStat === void 0) {
-      rmSync2(dstPath, { recursive: true, force: true });
-      continue;
-    }
-    const dstStat = lstatSync2(dstPath);
-    if (srcStat.isDirectory() && dstStat.isDirectory()) {
-      prunePreservingDenied(join3(src, name), dstPath, blockSet);
-    } else if (srcStat.isDirectory() !== dstStat.isDirectory()) {
-      rmSync2(dstPath, { recursive: true, force: true });
-    }
-  }
-}
-function copyExtrasFilteredPreserving(src, dst, blockSet) {
-  const dstStat = lstatSync2(dst, { throwIfNoEntry: false });
-  if (dstStat !== void 0) {
-    if (dstStat.isDirectory()) prunePreservingDenied(src, dst, blockSet);
-    else rmSync2(dst, { recursive: true, force: true });
-  }
-  stripCollidingDstSymlinks(src, dst, (name) => isDeniedName(blockSet, name));
-  cpSync2(src, dst, {
-    recursive: true,
-    force: true,
-    verbatimSymlinks: true,
-    filter: (srcEntry) => srcEntry === src || !isDeniedName(blockSet, basename2(srcEntry))
-  });
-}
-
-// src/links.ts
+// src/links.ts
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -2073,14 +2177,14 @@ function emitCopy(onPreview, from, to) {
   }
 }
 function isAlreadySymlink(linkPath) {
-  return existsSync4(linkPath) && lstatSync4(linkPath).isSymbolicLink();
+  return existsSync4(linkPath) && lstatSync5(linkPath).isSymbolicLink();
 }
 function runAutoMovePasses(linkNames, claude, repo, ts, dryRun, onPreview) {
   for (const name of linkNames) {
-    const linkPath = join5(claude, name);
-    const target = join5(repo, "shared", name);
+    const linkPath = join6(claude, name);
+    const target = join6(repo, "shared", name);
     if (!existsSync4(linkPath)) continue;
-    if (lstatSync4(linkPath).isSymbolicLink()) continue;
+    if (lstatSync5(linkPath).isSymbolicLink()) continue;
     if (!existsSync4(target)) continue;
     if (dryRun) {
       emitAutoMove(onPreview, linkPath, ts, name);
@@ -2093,23 +2197,58 @@ function runAutoMovePasses(linkNames, claude, repo, ts, dryRun, onPreview) {
 function copySharedLinkPull(src, dst) {
   copyExtrasFilteredPreservingBy(src, dst, (name) => isDeniedName(ALWAYS_NEVER_SYNC, name));
 }
+function stillOccupied(abs) {
+  try {
+    return lstatSync5(abs, { throwIfNoEntry: false }) !== void 0;
+  } catch {
+    return true;
+  }
+}
+function snapshotBeforeWin32Copy(linkPath, ts) {
+  try {
+    return backupBeforeWrite(linkPath, ts) ? "snapshotted" : "nothing-to-snapshot";
+  } catch (err) {
+    warn(
+      `could not snapshot ${linkPath} before updating it (${err.message}), so it was left as it is. The rest of the pull continues`
+    );
+    return "failed";
+  }
+}
+function warnWin32ApplyFailed(linkPath, ts, err, snapshotted) {
+  const state = stillOccupied(linkPath) ? "it may be unchanged, or partly updated" : "nothing is at that path now";
+  const recover = snapshotted ? ` A copy of what it held before this pull is under backup/${ts}/.` : "";
+  warn(
+    `${linkPath} could not be updated (${err.message}), so ${state}.${recover} The rest of the pull continues. Check its permissions, or whether another program has it open, then run 'nomad pull' again to update it`
+  );
+}
+function applyOneSharedLinkWin32(target, linkPath, ts) {
+  let snapshotted = false;
+  try {
+    const stat = lstatSync5(linkPath, { throwIfNoEntry: false });
+    if (stat !== void 0) {
+      const snapshot = snapshotBeforeWin32Copy(linkPath, ts);
+      if (snapshot === "failed") return;
+      snapshotted = snapshot === "snapshotted";
+      if (stat.isSymbolicLink()) {
+        rmSync3(linkPath, { recursive: true, force: true });
+      }
+    }
+    copySharedLinkPull(target, linkPath);
+  } catch (err) {
+    if (err instanceof NomadFatal) throw err;
+    warnWin32ApplyFailed(linkPath, ts, err, snapshotted);
+  }
+}
 function applySharedLinksWin32(linkNames, claude, repo, ts, dryRun, onPreview) {
   for (const name of linkNames) {
-    const target = join5(repo, "shared", name);
+    const target = join6(repo, "shared", name);
     if (!existsSync4(target)) continue;
-    const linkPath = join5(claude, name);
+    const linkPath = join6(claude, name);
     if (dryRun) {
       emitCopy(onPreview, linkPath, target);
       continue;
     }
-    const stat = lstatSync4(linkPath, { throwIfNoEntry: false });
-    if (stat !== void 0) {
-      backupBeforeWrite(linkPath, ts);
-      if (stat.isSymbolicLink()) {
-        rmSync3(linkPath, { recursive: true, force: true });
-      }
-    }
-    copySharedLinkPull(target, linkPath);
+    applyOneSharedLinkWin32(target, linkPath, ts);
   }
 }
 function applySharedLinks(ts, map, opts = {}) {
@@ -2123,9 +2262,9 @@ function applySharedLinks(ts, map, opts = {}) {
   }
   runAutoMovePasses(linkNames, claude, repo, ts, dryRun, opts.onPreview);
   for (const name of linkNames) {
-    const target = join5(repo, "shared", name);
+    const target = join6(repo, "shared", name);
     if (!existsSync4(target)) continue;
-    const linkPath = join5(claude, name);
+    const linkPath = join6(claude, name);
     if (isAlreadySymlink(linkPath)) continue;
     if (dryRun) {
       emitCreate(opts.onPreview, linkPath, target);
@@ -2167,8 +2306,8 @@ function regenerateSettings(ts, opts = {}) {
   const suppressDriftWarn = opts.suppressDriftWarn === true;
   const repo = repoHome();
   const claude = claudeHome();
-  const basePath = join5(repo, "shared", "settings.base.json");
-  const hostPath = join5(repo, "hosts", `${HOST}.json`);
+  const basePath = join6(repo, "shared", "settings.base.json");
+  const hostPath = join6(repo, "hosts", `${HOST}.json`);
   if (!existsSync4(basePath)) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
@@ -2176,7 +2315,7 @@ function regenerateSettings(ts, opts = {}) {
   const hasOverrides = existsSync4(hostPath);
   const overrides = hasOverrides ? readJson(hostPath) : {};
   const merged = deepMerge(base, overrides);
-  const settingsPath = join5(claude, "settings.json");
+  const settingsPath = join6(claude, "settings.json");
   const { existing, present, malformed } = readExistingSettings(settingsPath);
   if (!suppressDriftWarn && present) {
     if (malformed) {
@@ -2198,56 +2337,318 @@ function regenerateSettings(ts, opts = {}) {
   return { label: overrideLabel };
 }
 
-// src/commands.adopt.ts
+// src/commands.adopt.recover.ts
 init_utils();
-init_utils_fs();
-init_utils_json();
-var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
+function errorText(err) {
+  const message = err?.message;
+  return typeof message === "string" ? message : String(err);
+}
 function lexists(p) {
   try {
-    lstatSync5(p);
+    lstatSync6(p);
     return true;
   } catch {
     return false;
   }
 }
-function readMapIfPresent(repoHome2) {
-  const mapPath = join6(repoHome2, "path-map.json");
-  return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
+function isDirectChildOf(root, abs) {
+  return dirname2(resolve2(abs)) === resolve2(root);
 }
-function isConfiguredTarget(name, map) {
-  return SHARED_LINKS.includes(name) || sharedDirEntries(map).includes(name);
+function clearPartialCopy(linkPath) {
+  return clearIfDirectChild(claudeHome(), linkPath);
 }
-function isValidAdoptName(name) {
-  if (SHARED_LINKS.includes(name)) return true;
-  return isValidSharedDir(name);
+function clearPartialShared(sharedTarget, repo) {
+  return clearIfDirectChild(join7(repo, "shared"), sharedTarget);
 }
-function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
-  const ts = freshBackupTs(backup);
-  backupBeforeWrite(linkPath, ts);
-  cpSync4(linkPath, sharedTarget, { recursive: true, force: true, preserveTimestamps: true });
-  rmSync4(linkPath, { recursive: true, force: true });
-  if (process.platform === "win32") {
-    copySharedLinkPull(sharedTarget, linkPath);
-  } else {
-    ensureSymlink(linkPath, sharedTarget);
+function clearIfDirectChild(root, target) {
+  const resolved = resolve2(target);
+  if (!isDirectChildOf(root, resolved)) return false;
+  try {
+    rmSync4(resolved, { recursive: true, force: true });
+  } catch {
+    return false;
   }
-  const rel = join6("shared", name);
-  gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
-  log(`adopted ${name}; ${ADOPT_PUSH_HINT}`);
+  return !lexists(resolved);
 }
-function cmdAdopt(name, opts = {}) {
-  const dryRun = opts.dryRun === true;
-  const rejection = validateSharedDirEntry(name);
-  if (rejection !== null && rejection.reason === "secret-shaped") {
+function stageOrReport(stage) {
+  try {
+    stage();
+    return "";
+  } catch (err) {
+    return ` Staging it failed too (${errorText(err)}), so it is in the repo but not staged.`;
+  }
+}
+function describeLeftoverAt(name, linkPath, sourceRemoved) {
+  if (!sourceRemoved) {
+    return ` The original is still at ${linkPath}, because removing it failed too (warned above), so this host keeps a complete local copy and a later \`nomad push\` publishes it.`;
+  }
+  if (clearPartialCopy(linkPath)) return "";
+  return ` A partial copy may still be at that path, so do NOT run \`nomad push\` or \`nomad sync\` yet: either one copies that path back over shared/${name}, and \`nomad sync\` pushes in the same run. Pull first, and check it does not warn about ${name} again, because a pull that cannot read the path warns and still exits 0.`;
+}
+function restoreWin32LocalCopy(name, linkPath, sharedTarget, ts, stage, opts) {
+  try {
+    copySharedLinkPull(sharedTarget, linkPath);
+  } catch (err) {
+    if (err instanceof NomadFatal) {
+      const fatalStageFailure = stageOrReport(stage);
+      if (fatalStageFailure !== "") warn(`${name}:${fatalStageFailure}`);
+      throw err;
+    }
+    const leftover = describeLeftoverAt(name, linkPath, opts.sourceRemoved);
+    const stageFailure = stageOrReport(stage);
+    const staged = stageFailure === "" ? " and staged." : `.${stageFailure}`;
+    const recover = opts.snapshotted ? ` A copy of what it held before is under backup/${ts}/.` : "";
     throw new NomadFatal(
-      `cannot adopt ${JSON.stringify(name)}: ${rejection.message}. If it is listed in sharedDirs in path-map.json, remove it there too.`,
+      `adopted ${name} into shared/${name}, but could not restore the local copy at ${linkPath} (${errorText(err)}). The content is safe in the repo${staged}${recover} Check its permissions, or whether another program has it open, then run \`nomad pull\` to recreate the local copy before your next \`nomad push\`.${leftover}`,
       { code: EXIT.GENERIC_FAILURE }
     );
   }
-  if (!isValidAdoptName(name)) {
-    fail(`invalid name: ${JSON.stringify(name)}`);
-    process.exit(1);
+}
+function describePartialShared(name, linkPath) {
+  if (process.platform === "win32") {
+    return ` A partial shared/${name} may still be in the repo. Remove it before re-running: adopt reports any name whose shared/${name} already exists as adopted and does nothing, and the \`nomad pull\` it suggests would copy that fragment over ${linkPath}, which is still whole.`;
+  }
+  return ` A partial shared/${name} may still be in the repo; remove it first, because adopt refuses to run while it is there.`;
+}
+function copyIntoSharedOrFatal(name, linkPath, sharedTarget, repo) {
+  try {
+    copyExtrasFiltered(linkPath, sharedTarget, ALWAYS_NEVER_SYNC);
+  } catch (err) {
+    const leftover = clearPartialShared(sharedTarget, repo) ? "" : describePartialShared(name, linkPath);
+    throw new NomadFatal(
+      `could not copy ${linkPath} into shared/${name} (${errorText(err)}). Nothing was removed from ${linkPath}. Check its permissions, or whether another program has it open, then run \`nomad adopt ${name}\` again.${leftover}`,
+      { code: EXIT.GENERIC_FAILURE }
+    );
+  }
+}
+function refuseLateDeniedEntries(name, linkPath, sharedTarget, repo, opts) {
+  const snapshot = opts.snapshotted ? ` A plain snapshot of ${linkPath} taken before the copy is under backup/${opts.ts}/; it is unfiltered, so any never-sync entry under that path is in it too.` : "";
+  const stateNow = () => clearPartialShared(sharedTarget, repo) ? `shared/${name} was cleared, and nothing was removed from ${linkPath}.${snapshot}` : `Nothing was removed from ${linkPath}.${describePartialShared(name, linkPath)}${snapshot}`;
+  const late = scanOrFatal(name, linkPath, stateNow);
+  if (late.length === 0) return;
+  throw deniedEntriesRefusal(name, linkPath, late, {
+    found: `never-sync content appeared under ${linkPath} after the preflight scan`,
+    state: stateNow()
+  });
+}
+function removeAdoptSource(linkPath) {
+  const resolved = resolve2(linkPath);
+  if (!isDirectChildOf(claudeHome(), resolved)) {
+    return { ok: false, message: "it is not a direct child of the configured Claude home" };
+  }
+  try {
+    rmSync4(resolved, { recursive: true, force: true });
+  } catch (err) {
+    return { ok: false, message: errorText(err) };
+  }
+  if (lexists(resolved)) {
+    return { ok: false, message: "the delete was accepted but the entry is still there" };
+  }
+  return { ok: true };
+}
+function reportSourceRemovalFailure(name, linkPath, message, stage) {
+  if (process.platform === "win32") {
+    warn(
+      `${name}: could not remove ${linkPath} (${message}); refreshing it from shared/${name} instead, which leaves the same result`
+    );
+    return;
+  }
+  const stageFailure = stageOrReport(stage);
+  const staged = stageFailure === "" ? " and staged." : `.${stageFailure}`;
+  throw new NomadFatal(
+    `adopted ${name} into shared/${name}, but could not remove the original at ${linkPath} (${message}). It is a real directory where a symlink belongs, so nothing links to shared/${name} yet. The content is safe in the repo${staged} Check its permissions, or whether another program has it open, then run \`nomad pull\`, which backs that directory up and replaces it with the symlink. Remove it by hand only if the same problem blocks the pull.`,
+    { code: EXIT.GENERIC_FAILURE }
+  );
+}
+
+// src/commands.adopt.ts
+init_config();
+init_config_sharedDirs_guard();
+init_exit_codes();
+init_utils();
+init_utils_fs();
+
+// src/utils.lockfile.ts
+init_config();
+init_utils();
+import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join8 } from "node:path";
+function lockFilePath() {
+  return join8(home(), ".cache", "claude-nomad", "nomad.lock");
+}
+function acquireLock(verb) {
+  const lp = lockFilePath();
+  mkdirSync2(dirname3(lp), { recursive: true });
+  try {
+    const fd = openSync2(lp, "wx");
+    try {
+      writeFileSync2(fd, String(process.pid));
+    } catch (writeErr) {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+      try {
+        unlinkSync(lp);
+      } catch {
+      }
+      throw writeErr;
+    }
+    return { fd, path: lp };
+  } catch (err) {
+    const code = err.code;
+    if (code !== "EEXIST") throw err;
+    return checkStaleAndRetry(verb, lp);
+  }
+}
+function releaseLock(handle) {
+  if (handle === null) return;
+  const lp = handle.path;
+  try {
+    closeSync2(handle.fd);
+  } catch {
+  }
+  try {
+    unlinkSync(lp);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+function unlinkIfSamePid(expectedPidStr, lp) {
+  let current;
+  try {
+    current = readFileSync3(lp, "utf8").trim();
+  } catch {
+    return false;
+  }
+  if (current !== expectedPidStr) return false;
+  try {
+    unlinkSync(lp);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function checkStaleAndRetry(verb, lp) {
+  let pidStr;
+  try {
+    pidStr = readFileSync3(lp, "utf8").trim();
+  } catch {
+    pidStr = "";
+  }
+  const pid = Number.parseInt(pidStr, 10);
+  if (!Number.isFinite(pid) || pid <= 0) {
+    if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+  try {
+    process.kill(pid, 0);
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH") {
+      if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
+      warn(`another nomad ${verb} running, skipping`);
+      return null;
+    }
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+}
+function retryOnce(verb, lp) {
+  try {
+    const fd = openSync2(lp, "wx");
+    try {
+      writeFileSync2(fd, String(process.pid));
+    } catch {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+      try {
+        unlinkSync(lp);
+      } catch {
+      }
+      warn(`another nomad ${verb} running, skipping`);
+      return null;
+    }
+    return { fd, path: lp };
+  } catch {
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+}
+
+// src/commands.adopt.ts
+init_utils_json();
+var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
+function readMapIfPresent(repoHome2) {
+  const mapPath = join9(repoHome2, "path-map.json");
+  return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
+}
+function isConfiguredTarget(name, map) {
+  return SHARED_LINKS.includes(name) || sharedDirEntries(map).includes(name);
+}
+function isValidAdoptName(name) {
+  if (SHARED_LINKS.includes(name)) return true;
+  return isValidSharedDir(name);
+}
+function reportWin32AlreadyAdopted(name, sharedTarget) {
+  if (process.platform !== "win32" || !lexists(sharedTarget)) return false;
+  log(`${name}: already adopted (win32 copy-sync); run \`nomad pull\` to refresh the local copy`);
+  return true;
+}
+function adoptStopsEarly(name, linkPath, sharedTarget) {
+  if (!existsSync5(linkPath)) {
+    if (reportWin32AlreadyAdopted(name, sharedTarget)) return true;
+    log(`${name}: nothing to adopt (not present in ~/.claude/)`);
+    return true;
+  }
+  if (lstatSync7(linkPath).isSymbolicLink()) {
+    log(`${name}: already adopted (already a symlink)`);
+    return true;
+  }
+  if (reportWin32AlreadyAdopted(name, sharedTarget)) return true;
+  if (lexists(sharedTarget)) {
+    fail(`${name}: shared/${name} already exists; would clobber. Remove it first.`);
+    process.exit(1);
+  }
+  return false;
+}
+function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
+  const ts = freshBackupTs(backup);
+  const snapshotted = backupBeforeWrite(linkPath, ts);
+  const rel = join9("shared", name);
+  const stage = () => gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
+  copyIntoSharedOrFatal(name, linkPath, sharedTarget, repo);
+  refuseLateDeniedEntries(name, linkPath, sharedTarget, repo, { snapshotted, ts });
+  const removal = removeAdoptSource(linkPath);
+  if (!removal.ok) reportSourceRemovalFailure(name, linkPath, removal.message, stage);
+  if (process.platform === "win32") {
+    restoreWin32LocalCopy(name, linkPath, sharedTarget, ts, stage, {
+      snapshotted,
+      sourceRemoved: removal.ok
+    });
+  } else {
+    ensureSymlink(linkPath, sharedTarget);
+  }
+  stage();
+  log(`adopted ${name}; ${ADOPT_PUSH_HINT}`);
+}
+function cmdAdopt(name, opts = {}) {
+  const dryRun = opts.dryRun === true;
+  const rejection = validateSharedDirEntry(name);
+  if (rejection !== null && rejection.reason === "secret-shaped") {
+    throw new NomadFatal(
+      `cannot adopt ${JSON.stringify(name)}: ${rejection.message}. If it is listed in sharedDirs in path-map.json, remove it there too.`,
+      { code: EXIT.GENERIC_FAILURE }
+    );
+  }
+  if (!isValidAdoptName(name)) {
+    fail(`invalid name: ${JSON.stringify(name)}`);
+    process.exit(1);
   }
   const repo = repoHome();
   const claude = claudeHome();
@@ -2259,24 +2660,23 @@ function cmdAdopt(name, opts = {}) {
     );
     process.exit(1);
   }
-  const linkPath = join6(claude, name);
-  const sharedTarget = join6(repo, "shared", name);
-  if (!existsSync5(linkPath)) {
-    log(`${name}: nothing to adopt (not present in ~/.claude/)`);
-    return;
-  }
-  if (lstatSync5(linkPath).isSymbolicLink()) {
-    log(`${name}: already adopted (already a symlink)`);
-    return;
-  }
-  if (process.platform === "win32" && lexists(sharedTarget)) {
-    log(`${name}: already adopted (win32 copy-sync); run \`nomad pull\` to refresh the local copy`);
+  const linkPath = join9(claude, name);
+  const sharedTarget = join9(repo, "shared", name);
+  if (dryRun) {
+    adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, true);
     return;
   }
-  if (lexists(sharedTarget)) {
-    fail(`${name}: shared/${name} already exists; would clobber. Remove it first.`);
-    process.exit(1);
+  const handle = acquireLock("adopt");
+  if (handle === null) process.exit(EXIT.SUCCESS);
+  try {
+    adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, false);
+  } finally {
+    releaseLock(handle);
   }
+}
+function adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, dryRun) {
+  if (adoptStopsEarly(name, linkPath, sharedTarget)) return;
+  refuseDeniedEntries(name, linkPath);
   if (dryRun) {
     const ts = freshBackupTs(backup);
     log(`would backup: ${linkPath} -> backup/${ts}/${name}`);
@@ -2301,8 +2701,8 @@ init_config();
 import { existsSync as existsSync6 } from "node:fs";
 
 // src/commands.redact.core.ts
-import { appendFileSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join7 } from "node:path";
+import { appendFileSync, readFileSync as readFileSync4 } from "node:fs";
+import { join as join10 } from "node:path";
 function collectMatchIntervals(content, findings) {
   const intervals = [];
   for (const f of findings) {
@@ -2340,182 +2740,67 @@ function applyRedactions(content, findings) {
   const merged = mergeIntervals(raw);
   let result = content;
   for (let i = merged.length - 1; i >= 0; i--) {
-    const { start, end, ruleId } = merged[i];
-    result = result.slice(0, start) + `[REDACTED:${ruleId}]` + result.slice(end);
-  }
-  return result;
-}
-function formatFingerprint(fingerprint) {
-  return fingerprint.replace(/[\r\n]/g, "") + "\n";
-}
-function isRecentlyModified(mtimeMs, nowMs, thresholdMs = 5 * 60 * 1e3) {
-  return nowMs - mtimeMs < thresholdMs;
-}
-function isValidFingerprint(fingerprint) {
-  return fingerprint.trim().length > 0 && fingerprint.length <= 512 && /^[^\r\n]+$/.test(fingerprint);
-}
-function isAlreadyPresent(line, lines) {
-  return lines.includes(line);
-}
-function appendGitleaksIgnore(fingerprint, repo) {
-  const sanitized = fingerprint.replace(/[\r\n]/g, "").trim();
-  if (sanitized.length === 0) return;
-  const ignPath = join7(repo, ".gitleaksignore");
-  let raw;
-  try {
-    raw = readFileSync3(ignPath, "utf8");
-  } catch {
-    raw = "";
-  }
-  const existing = raw.split("\n").filter((l) => l.length > 0);
-  if (isAlreadyPresent(sanitized, existing)) return;
-  const needsLeadingNewline = raw.length > 0 && !raw.endsWith("\n");
-  const prefix = needsLeadingNewline ? "\n" : "";
-  appendFileSync(ignPath, prefix + formatFingerprint(sanitized), "utf8");
-}
-
-// src/commands.allow.ts
-init_exit_codes();
-init_utils();
-function cmdAllow(fingerprints) {
-  const repo = repoHome();
-  if (!existsSync6(repo)) die(`repo not cloned at ${repo}`);
-  for (const fp of fingerprints) {
-    if (!isValidFingerprint(fp)) {
-      const shown = fp.replaceAll("\r", String.raw`\r`).replaceAll("\n", String.raw`\n`);
-      fail(`invalid fingerprint: ${shown}`);
-      process.exit(EXIT.USAGE);
-    }
-  }
-  for (const fp of fingerprints) {
-    appendGitleaksIgnore(fp, repo);
-    item(`allowed: ${fp}`);
-  }
-  log(`allowed ${fingerprints.length} fingerprint(s)`);
-}
-
-// src/commands.capture-settings.ts
-init_config();
-import { existsSync as existsSync7 } from "node:fs";
-import { join as join9 } from "node:path";
-import { createInterface } from "node:readline/promises";
-init_utils_fs();
-init_utils_json();
-
-// src/utils.lockfile.ts
-init_config();
-init_utils();
-import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join8 } from "node:path";
-function lockFilePath() {
-  return join8(home(), ".cache", "claude-nomad", "nomad.lock");
-}
-function acquireLock(verb) {
-  const lp = lockFilePath();
-  mkdirSync2(dirname2(lp), { recursive: true });
-  try {
-    const fd = openSync2(lp, "wx");
-    try {
-      writeFileSync2(fd, String(process.pid));
-    } catch (writeErr) {
-      try {
-        closeSync2(fd);
-      } catch {
-      }
-      try {
-        unlinkSync(lp);
-      } catch {
-      }
-      throw writeErr;
-    }
-    return { fd, path: lp };
-  } catch (err) {
-    const code = err.code;
-    if (code !== "EEXIST") throw err;
-    return checkStaleAndRetry(verb, lp);
-  }
-}
-function releaseLock(handle) {
-  if (handle === null) return;
-  const lp = handle.path;
-  try {
-    closeSync2(handle.fd);
-  } catch {
-  }
-  try {
-    unlinkSync(lp);
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-  }
-}
-function unlinkIfSamePid(expectedPidStr, lp) {
-  let current;
-  try {
-    current = readFileSync4(lp, "utf8").trim();
-  } catch {
-    return false;
-  }
-  if (current !== expectedPidStr) return false;
-  try {
-    unlinkSync(lp);
-    return true;
-  } catch {
-    return false;
+    const { start, end, ruleId } = merged[i];
+    result = result.slice(0, start) + `[REDACTED:${ruleId}]` + result.slice(end);
   }
+  return result;
 }
-function checkStaleAndRetry(verb, lp) {
-  let pidStr;
+function formatFingerprint(fingerprint) {
+  return fingerprint.replace(/[\r\n]/g, "") + "\n";
+}
+function isRecentlyModified(mtimeMs, nowMs, thresholdMs = 5 * 60 * 1e3) {
+  return nowMs - mtimeMs < thresholdMs;
+}
+function isValidFingerprint(fingerprint) {
+  return fingerprint.trim().length > 0 && fingerprint.length <= 512 && /^[^\r\n]+$/.test(fingerprint);
+}
+function isAlreadyPresent(line, lines) {
+  return lines.includes(line);
+}
+function appendGitleaksIgnore(fingerprint, repo) {
+  const sanitized = fingerprint.replace(/[\r\n]/g, "").trim();
+  if (sanitized.length === 0) return;
+  const ignPath = join10(repo, ".gitleaksignore");
+  let raw;
   try {
-    pidStr = readFileSync4(lp, "utf8").trim();
+    raw = readFileSync4(ignPath, "utf8");
   } catch {
-    pidStr = "";
-  }
-  const pid = Number.parseInt(pidStr, 10);
-  if (!Number.isFinite(pid) || pid <= 0) {
-    if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  }
-  try {
-    process.kill(pid, 0);
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  } catch (err) {
-    const code = err.code;
-    if (code === "ESRCH") {
-      if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
-      warn(`another nomad ${verb} running, skipping`);
-      return null;
-    }
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
+    raw = "";
   }
+  const existing = raw.split("\n").filter((l) => l.length > 0);
+  if (isAlreadyPresent(sanitized, existing)) return;
+  const needsLeadingNewline = raw.length > 0 && !raw.endsWith("\n");
+  const prefix = needsLeadingNewline ? "\n" : "";
+  appendFileSync(ignPath, prefix + formatFingerprint(sanitized), "utf8");
 }
-function retryOnce(verb, lp) {
-  try {
-    const fd = openSync2(lp, "wx");
-    try {
-      writeFileSync2(fd, String(process.pid));
-    } catch {
-      try {
-        closeSync2(fd);
-      } catch {
-      }
-      try {
-        unlinkSync(lp);
-      } catch {
-      }
-      warn(`another nomad ${verb} running, skipping`);
-      return null;
+
+// src/commands.allow.ts
+init_exit_codes();
+init_utils();
+function cmdAllow(fingerprints) {
+  const repo = repoHome();
+  if (!existsSync6(repo)) die(`repo not cloned at ${repo}`);
+  for (const fp of fingerprints) {
+    if (!isValidFingerprint(fp)) {
+      const shown = fp.replaceAll("\r", String.raw`\r`).replaceAll("\n", String.raw`\n`);
+      fail(`invalid fingerprint: ${shown}`);
+      process.exit(EXIT.USAGE);
     }
-    return { fd, path: lp };
-  } catch {
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
   }
+  for (const fp of fingerprints) {
+    appendGitleaksIgnore(fp, repo);
+    item(`allowed: ${fp}`);
+  }
+  log(`allowed ${fingerprints.length} fingerprint(s)`);
 }
 
 // src/commands.capture-settings.ts
+init_config();
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join11 } from "node:path";
+import { createInterface } from "node:readline/promises";
+init_utils_fs();
+init_utils_json();
 init_utils();
 async function confirmCapture(destLabel, keys) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -2534,7 +2819,7 @@ async function confirmCapture(destLabel, keys) {
   }
 }
 function resolveCaptureDestination(repo, useHost) {
-  const destPath = useHost ? join9(repo, "hosts", `${HOST}.json`) : join9(repo, "shared", "settings.base.json");
+  const destPath = useHost ? join11(repo, "hosts", `${HOST}.json`) : join11(repo, "shared", "settings.base.json");
   const existing = existsSync7(destPath) ? readJson(destPath) : {};
   return { destPath, existing };
 }
@@ -2546,17 +2831,17 @@ async function cmdCaptureSettings(opts) {
   if (handle === null) process.exit(0);
   try {
     const claude = claudeHome();
-    const basePath = join9(repo, "shared", "settings.base.json");
+    const basePath = join11(repo, "shared", "settings.base.json");
     if (!existsSync7(basePath)) {
       die("repo not initialized; run 'nomad init' to scaffold");
     }
-    const settingsPath = join9(claude, "settings.json");
+    const settingsPath = join11(claude, "settings.json");
     if (!existsSync7(settingsPath)) {
       log("no ~/.claude/settings.json found; nothing to capture");
       return;
     }
     const base = readJson(basePath);
-    const hostPath = join9(repo, "hosts", `${HOST}.json`);
+    const hostPath = join11(repo, "hosts", `${HOST}.json`);
     const overrides = existsSync7(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
@@ -2595,12 +2880,15 @@ async function cmdCaptureSettings(opts) {
 init_config();
 init_exit_codes();
 init_utils();
-import { existsSync as existsSync8, lstatSync as lstatSync6, readdirSync as readdirSync3, rmSync as rmSync5, statSync as statSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync8, lstatSync as lstatSync8, readdirSync as readdirSync4, rmSync as rmSync5, statSync as statSync2 } from "node:fs";
+import { join as join12 } from "node:path";
 var TS_SHAPE = /^\d{8}-\d{6}(-\d+)?$/;
 var DURATION_RE = /^(\d+)([dhm])$/;
 var UNIT_MS = { d: 864e5, h: 36e5, m: 6e4 };
 var CLEAN_DEFAULT_OLDER_THAN_MS = 14 * 24 * 60 * 60 * 1e3;
+function nameOf(d) {
+  return d.name;
+}
 function isTsDir(name) {
   return TS_SHAPE.test(name);
 }
@@ -2611,7 +2899,20 @@ function parseDuration(s) {
 }
 function listBackupDirs(backupBase2) {
   if (!existsSync8(backupBase2)) return [];
-  return readdirSync3(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join10(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return readdirSync4(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join12(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+function holdsNoContent(dir) {
+  let entries;
+  try {
+    entries = readdirSync4(dir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) return false;
+    if (!holdsNoContent(join12(dir, entry.name))) return false;
+  }
+  return true;
 }
 function prunableByAge(dirs, olderThanMs, nowMs) {
   return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
@@ -2621,8 +2922,8 @@ function prunableByCount(dirs, keep) {
 }
 function safeDelete(backupBase2, name) {
   if (!isTsDir(name)) return;
-  const full = join10(backupBase2, name);
-  const st = lstatSync6(full, { throwIfNoEntry: false });
+  const full = join12(backupBase2, name);
+  const st = lstatSync8(full, { throwIfNoEntry: false });
   if (!st || st.isSymbolicLink() || !st.isDirectory()) return;
   rmSync5(full, { recursive: true, force: true });
 }
@@ -2645,8 +2946,30 @@ function cmdClean(opts, backupBase2 = backupBase()) {
     }
     olderThanMs = parsed;
   }
+  if (dryRun) {
+    pruneBackups({ dryRun, olderThanMs, keep }, backupBase2);
+    return;
+  }
+  const handle = acquireLock("clean");
+  if (handle === null) process.exit(EXIT.SUCCESS);
+  try {
+    pruneBackups({ dryRun, olderThanMs, keep }, backupBase2);
+  } finally {
+    releaseLock(handle);
+  }
+}
+function pruneBackups(opts, backupBase2) {
+  const { dryRun, olderThanMs, keep } = opts;
   const dirs = listBackupDirs(backupBase2);
-  const targets = resolveTargets(dirs, olderThanMs, keep);
+  const empty = new Set(dirs.filter((d) => holdsNoContent(join12(backupBase2, d.name))).map(nameOf));
+  const aged = new Set(
+    resolveTargets(
+      dirs.filter((d) => !empty.has(d.name)),
+      olderThanMs,
+      keep
+    )
+  );
+  const targets = dirs.filter((d) => empty.has(d.name) || aged.has(d.name)).map(nameOf);
   if (dryRun) {
     for (const name of targets) item(name);
     log(`dry-run: ${targets.length} backup(s) would be removed`);
@@ -2662,8 +2985,8 @@ init_config_sharedDirs_guard();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { cpSync as cpSync5, existsSync as existsSync9, lstatSync as lstatSync7, realpathSync, rmSync as rmSync6 } from "node:fs";
-import { join as join11, sep as sep3 } from "node:path";
+import { cpSync as cpSync4, existsSync as existsSync9, lstatSync as lstatSync9, realpathSync, rmSync as rmSync6 } from "node:fs";
+import { join as join13, sep as sep3 } from "node:path";
 function ejectChecklist() {
   return [
     "Manual steps remaining to finish leaving claude-nomad on this host:",
@@ -2679,28 +3002,28 @@ function errMessage(err) {
 }
 function lexists2(p) {
   try {
-    lstatSync7(p);
+    lstatSync9(p);
     return true;
   } catch {
     return false;
   }
 }
 function readMapIfPresent2(repoHome2) {
-  const mapPath = join11(repoHome2, "path-map.json");
+  const mapPath = join13(repoHome2, "path-map.json");
   return existsSync9(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function classifyName(linkPath) {
   if (!lexists2(linkPath)) return "absent";
-  if (!lstatSync7(linkPath).isSymbolicLink()) return "skip-real";
+  if (!lstatSync9(linkPath).isSymbolicLink()) return "skip-real";
   if (!existsSync9(linkPath)) return "dangling";
   return "materialize";
 }
 function resolveSharedRoot(repoHome2) {
   try {
-    return realpathSync(join11(repoHome2, "shared"));
+    return realpathSync(join13(repoHome2, "shared"));
   } catch {
     return die(
-      `cannot resolve ${join11(repoHome2, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
+      `cannot resolve ${join13(repoHome2, "shared")} (repo checkout incomplete). run \`nomad pull\` first, then re-run \`nomad eject\``
     );
   }
 }
@@ -2716,7 +3039,7 @@ function materializeOne(name, linkPath, sharedRoot) {
   const tmp = `${linkPath}.eject.tmp.${process.pid}.${Date.now()}`;
   try {
     rmSync6(tmp, { recursive: true, force: true });
-    cpSync5(target, tmp, {
+    cpSync4(target, tmp, {
       recursive: true,
       force: true,
       dereference: true,
@@ -2740,7 +3063,7 @@ function skipRealMessage(name) {
 function previewDryRun(names, classifications, claudeHome2, sharedRoot) {
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join11(claudeHome2, name);
+    const linkPath = join13(claudeHome2, name);
     if (cls === "absent") {
       item(`skipped (absent): ${name}`);
     } else if (cls === "skip-real") {
@@ -2770,7 +3093,7 @@ function runLiveEject(names, classifications, claudeHome2, sharedRoot) {
   let skipped = 0;
   for (const name of names) {
     const cls = classifications.get(name);
-    const linkPath = join11(claudeHome2, name);
+    const linkPath = join13(claudeHome2, name);
     if (cls === "absent") {
       item(`skipped (absent): ${name}`);
       skipped++;
@@ -2819,7 +3142,7 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   const names = ejectNames(map);
   const classifications = /* @__PURE__ */ new Map();
   for (const name of names) {
-    classifications.set(name, classifyName(join11(claudeHome2, name)));
+    classifications.set(name, classifyName(join13(claudeHome2, name)));
   }
   const base = new Set(allSharedLinks(map, { quiet: true }));
   for (const name of names) {
@@ -2857,14 +3180,14 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
 }
 
 // src/commands.doctor.ts
-import { existsSync as existsSync35 } from "node:fs";
-import { join as join45 } from "node:path";
+import { existsSync as existsSync36 } from "node:fs";
+import { join as join48 } from "node:path";
 
 // src/commands.doctor.checks.repo.ts
 init_color();
 init_config();
-import { existsSync as existsSync11, lstatSync as lstatSync8, readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
-import { join as join13, win32 as win32Path } from "node:path";
+import { existsSync as existsSync12, lstatSync as lstatSync10, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
+import { join as join16 } from "node:path";
 
 // src/commands.doctor.format.ts
 init_color();
@@ -2939,10 +3262,16 @@ function readJsonSafe(path, label, section2) {
   }
 }
 
+// src/commands.doctor.checks.repo.win32.ts
+init_color();
+init_config();
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join14, win32 as win32Path } from "node:path";
+
 // src/extras-sync.diff.ts
 init_utils();
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { relative as relative3 } from "node:path";
+import { relative as relative4 } from "node:path";
 var NAME_STATUS_DIFF_TIMEOUT_MS = 3e3;
 function parseNameStatus(stdout) {
   const fields = stdout.split("\0").filter((f) => f.length > 0);
@@ -2961,7 +3290,7 @@ function parseDiffOutput(stdout) {
   return parseNameStatus(stdout).map(labelEntry);
 }
 function parseModifiedPaths(stdout, a) {
-  return parseNameStatus(stdout).filter((entry) => entry.status === "M").map((entry) => relative3(a, entry.path));
+  return parseNameStatus(stdout).filter((entry) => entry.status === "M").map((entry) => relative4(a, entry.path));
 }
 function runNameStatusDiff(a, b, parse) {
   try {
@@ -2994,18 +3323,56 @@ function listDivergingModified(a, b) {
   return runNameStatusDiff(a, b, (stdout) => parseModifiedPaths(stdout, a));
 }
 
+// src/commands.doctor.checks.repo.win32.ts
+function win32CopyOkRow(name, exempt = 0) {
+  const note = exempt > 0 ? dim(` (${exempt} never-synced path(s) not compared)`) : "";
+  return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)${note}`, fail: false };
+}
+function win32CopyUnpublishedRow(name) {
+  return {
+    line: `${dim(infoGlyph)} ${name}: real local copy, not published (run \`nomad adopt ${name}\` to share it)`,
+    fail: false
+  };
+}
+function relativeUnder(root, path) {
+  const rel = win32Path.relative(root, path);
+  const segments = rel.split(win32Path.sep);
+  if (rel === "" || segments[0] === ".." || win32Path.isAbsolute(rel)) return null;
+  return segments.join("/");
+}
+function divergingRepoPath(line, name, local, shared) {
+  const path = line.replace(/ \((?:local|repo) only\)$/, "");
+  const rel = relativeUnder(local, path) ?? relativeUnder(shared, path);
+  return rel === null ? `shared/${name}` : `shared/${name}/${rel}`;
+}
+function classifyWin32Copy(name, p) {
+  const sharedPath = join14(repoHome(), "shared", name);
+  if (!existsSync10(sharedPath)) return win32CopyUnpublishedRow(name);
+  const compared = listDivergingFiles(p, sharedPath);
+  const diverging = compared.filter(
+    (line) => deniedSegmentFor(divergingRepoPath(line, name, p, sharedPath)) === null
+  );
+  const exempt = compared.length - diverging.length;
+  if (diverging.length === 0) return win32CopyOkRow(name, exempt);
+  return {
+    line: `${yellow(warnGlyph)} ${name}: ${diverging.length} file(s) diverge from shared/${name}`,
+    fail: false,
+    children: diverging
+  };
+}
+
 // src/init.classify.ts
 init_config();
 init_utils_json();
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join15 } from "node:path";
 function classifyRepoState(repoHome2, host) {
-  const basePath = join12(repoHome2, "shared", "settings.base.json");
-  const mapPath = join12(repoHome2, "path-map.json");
-  const hostPath = join12(repoHome2, "hosts", `${host}.json`);
-  const hasBase = existsSync10(basePath);
-  const hasMap = existsSync10(mapPath);
-  const hasHost = existsSync10(hostPath);
+  const basePath = join15(repoHome2, "shared", "settings.base.json");
+  const mapPath = join15(repoHome2, "path-map.json");
+  const hostPath = join15(repoHome2, "hosts", `${host}.json`);
+  const hasBase = existsSync11(basePath);
+  const hasMap = existsSync11(mapPath);
+  const hasHost = existsSync11(hostPath);
   let mapEntryCount = 0;
   if (hasMap) {
     try {
@@ -3020,11 +3387,11 @@ function classifyRepoState(repoHome2, host) {
   return "partial";
 }
 function reasonForPartial(repoHome2, host) {
-  const basePath = join12(repoHome2, "shared", "settings.base.json");
-  const mapPath = join12(repoHome2, "path-map.json");
-  const hostPath = join12(repoHome2, "hosts", `${host}.json`);
-  if (!existsSync10(basePath)) return "- shared/settings.base.json missing";
-  if (!existsSync10(mapPath)) return "- path-map.json missing";
+  const basePath = join15(repoHome2, "shared", "settings.base.json");
+  const mapPath = join15(repoHome2, "path-map.json");
+  const hostPath = join15(repoHome2, "hosts", `${host}.json`);
+  if (!existsSync11(basePath)) return "- shared/settings.base.json missing";
+  if (!existsSync11(mapPath)) return "- path-map.json missing";
   let mapEntryCount;
   try {
     const map = readJson(mapPath);
@@ -3033,7 +3400,7 @@ function reasonForPartial(repoHome2, host) {
     mapEntryCount = 0;
   }
   if (mapEntryCount === 0) return "- path-map.json.projects has no entries";
-  if (!existsSync10(hostPath)) return `- hosts/${host}.json missing`;
+  if (!existsSync11(hostPath)) return `- hosts/${host}.json missing`;
   return "- partial state (unknown gap)";
 }
 
@@ -3050,15 +3417,15 @@ function reportHostAndPaths(section2) {
   if (isOverrideActive()) {
     addItem(section2, `${dim(infoGlyph)} NOMAD_REPO: ${blue(repo)}`);
   }
-  addItem(section2, `${existsSync11(repo) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(repo)}`);
+  addItem(section2, `${existsSync12(repo) ? green(okGlyph) : yellow(warnGlyph)} repo: ${blue(repo)}`);
   addItem(
     section2,
-    `${existsSync11(claude) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(claude)}`
+    `${existsSync12(claude) ? green(okGlyph) : yellow(warnGlyph)} claude home: ${blue(claude)}`
   );
 }
 function pathMapHostKeys() {
-  const mapPath = join13(repoHome(), "path-map.json");
-  if (!existsSync11(mapPath)) return /* @__PURE__ */ new Set();
+  const mapPath = join16(repoHome(), "path-map.json");
+  if (!existsSync12(mapPath)) return /* @__PURE__ */ new Set();
   let raw;
   try {
     raw = readJson(mapPath);
@@ -3075,7 +3442,7 @@ function pathMapHostKeys() {
 function hostOverrideLabels() {
   let entries;
   try {
-    entries = readdirSync4(join13(repoHome(), "hosts"));
+    entries = readdirSync5(join16(repoHome(), "hosts"));
   } catch {
     return /* @__PURE__ */ new Set();
   }
@@ -3116,42 +3483,12 @@ function reportRepoState(section2) {
   }
 }
 function repoHasSharedSource(name) {
-  return existsSync11(join13(repoHome(), "shared", name));
-}
-function win32CopyOkRow(name, exempt = 0) {
-  const note = exempt > 0 ? dim(` (${exempt} never-synced path(s) not compared)`) : "";
-  return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)${note}`, fail: false };
-}
-function relativeUnder(root, path) {
-  const rel = win32Path.relative(root, path);
-  const segments = rel.split(win32Path.sep);
-  if (rel === "" || segments[0] === ".." || win32Path.isAbsolute(rel)) return null;
-  return segments.join("/");
-}
-function divergingRepoPath(line, name, local, shared) {
-  const path = line.replace(/ \((?:local|repo) only\)$/, "");
-  const rel = relativeUnder(local, path) ?? relativeUnder(shared, path);
-  return rel === null ? `shared/${name}` : `shared/${name}/${rel}`;
-}
-function classifyWin32Copy(name, p) {
-  const sharedPath = join13(repoHome(), "shared", name);
-  if (!existsSync11(sharedPath)) return win32CopyOkRow(name);
-  const compared = listDivergingFiles(p, sharedPath);
-  const diverging = compared.filter(
-    (line) => deniedSegmentFor(divergingRepoPath(line, name, p, sharedPath)) === null
-  );
-  const exempt = compared.length - diverging.length;
-  if (diverging.length === 0) return win32CopyOkRow(name, exempt);
-  return {
-    line: `${yellow(warnGlyph)} ${name}: ${diverging.length} file(s) diverge from shared/${name}`,
-    fail: false,
-    children: diverging
-  };
+  return existsSync12(join16(repoHome(), "shared", name));
 }
 function classifySharedLink(name, p) {
   let stat;
   try {
-    stat = lstatSync8(p);
+    stat = lstatSync10(p);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -3197,7 +3534,7 @@ function classifySymlinkTarget(name, p) {
 function reportSharedLinks(section2, map) {
   const claude = claudeHome();
   for (const name of allSharedLinks(map, { quiet: true })) {
-    const p = join13(claude, name);
+    const p = join16(claude, name);
     const { line, fail: fail2, children } = classifySharedLink(name, p);
     addItem(section2, line);
     if (fail2) process.exitCode = 1;
@@ -3209,10 +3546,10 @@ function reportSharedLinks(section2, map) {
 function reportDroppedNamesMigration(section2) {
   const claude = claudeHome();
   for (const name of GSD_DROPPED_NAMES) {
-    const p = join13(claude, name);
+    const p = join16(claude, name);
     let stat;
     try {
-      stat = lstatSync8(p);
+      stat = lstatSync10(p);
     } catch {
       continue;
     }
@@ -3227,11 +3564,11 @@ function reportDroppedNamesMigration(section2) {
 // src/commands.doctor.checks.settings.ts
 init_color();
 init_config();
-import { existsSync as existsSync12, readdirSync as readdirSync5 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
+import { join as join17 } from "node:path";
 function loadBaseSettings(section2) {
-  const basePath = join14(repoHome(), "shared", "settings.base.json");
-  if (!existsSync12(basePath)) {
+  const basePath = join17(repoHome(), "shared", "settings.base.json");
+  if (!existsSync13(basePath)) {
     addItem(section2, `${red(failGlyph)} shared/settings.base.json missing at ${blue(basePath)}`);
     process.exitCode = 1;
     return null;
@@ -3239,8 +3576,8 @@ function loadBaseSettings(section2) {
   return readJsonSafe(basePath, basePath, section2);
 }
 function loadAndReportSettings(section2) {
-  const settingsPath = join14(claudeHome(), "settings.json");
-  if (!existsSync12(settingsPath)) return null;
+  const settingsPath = join17(claudeHome(), "settings.json");
+  if (!existsSync13(settingsPath)) return null;
   const settings = readJsonSafe(settingsPath, settingsPath, section2);
   if (settings === null) return null;
   const unknownKeys = Object.keys(settings).filter((k) => !KNOWN_SETTINGS_KEYS.has(k));
@@ -3256,13 +3593,13 @@ function loadAndReportSettings(section2) {
 }
 function reportHostOverrides(section2, base, settings) {
   const repo = repoHome();
-  const hostFile = join14(repo, "hosts", `${HOST}.json`);
+  const hostFile = join17(repo, "hosts", `${HOST}.json`);
   let drift = [];
   if (base !== null && settings !== null) {
     const baseKeys = new Set(Object.keys(base));
     drift = Object.keys(settings).filter((k) => !baseKeys.has(k));
   }
-  if (existsSync12(hostFile)) {
+  if (existsSync13(hostFile)) {
     if (readJsonSafe(hostFile, hostFile, section2) !== null) {
       addItem(section2, `${green(okGlyph)} host overrides: ${blue(hostFile)}`);
     }
@@ -3271,9 +3608,9 @@ function reportHostOverrides(section2, base, settings) {
       section2,
       `${red(failGlyph)} no hosts/${HOST}.json AND settings.json has unbased keys ${JSON.stringify(drift)}`
     );
-    const hostsDir = join14(repo, "hosts");
-    if (existsSync12(hostsDir)) {
-      const cands = readdirSync5(hostsDir).filter((f) => f.endsWith(".json"));
+    const hostsDir = join17(repo, "hosts");
+    if (existsSync13(hostsDir)) {
+      const cands = readdirSync6(hostsDir).filter((f) => f.endsWith(".json"));
       if (cands.length > 0) addItem(section2, `${dim(infoGlyph)} candidates: ${cands.join(", ")}`);
     }
     process.exitCode = 1;
@@ -3289,8 +3626,8 @@ function reportHostOverrides(section2, base, settings) {
 init_color();
 init_config();
 init_config_sharedDirs_guard();
-import { existsSync as existsSync13, lstatSync as lstatSync9, readdirSync as readdirSync6, realpathSync as realpathSync2 } from "node:fs";
-import { join as join15, sep as sep4 } from "node:path";
+import { existsSync as existsSync14, lstatSync as lstatSync11, readdirSync as readdirSync7, realpathSync as realpathSync2 } from "node:fs";
+import { join as join18, sep as sep4 } from "node:path";
 init_utils_json();
 function reportMappedProjects(section2, map) {
   const mapped = Object.entries(map.projects).filter(([, hosts]) => hosts[HOST]);
@@ -3300,11 +3637,11 @@ function reportMappedProjects(section2, map) {
   }
 }
 function reportUnmappedProjects(section2, map) {
-  const localProjects = join15(claudeHome(), "projects");
-  if (!existsSync13(localProjects)) return;
+  const localProjects = join18(claudeHome(), "projects");
+  if (!existsSync14(localProjects)) return;
   let localDirs;
   try {
-    localDirs = readdirSync6(localProjects);
+    localDirs = readdirSync7(localProjects);
   } catch {
     return;
   }
@@ -3322,7 +3659,7 @@ function reportCurrentHostPathsMissing(section2, map) {
   for (const [name, hosts] of Object.entries(map.projects)) {
     const abspath = hosts[HOST];
     if (!abspath || abspath === "TBD") continue;
-    if (!existsSync13(abspath)) {
+    if (!existsSync14(abspath)) {
       addItem(
         section2,
         `${yellow(warnGlyph)} path-map: ${name} local path missing on ${HOST}: ${blue(abspath)}`
@@ -3332,7 +3669,7 @@ function reportCurrentHostPathsMissing(section2, map) {
 }
 function hasSharedLeftover(entry) {
   try {
-    return lstatSync9(join15(repoHome(), "shared", entry), { throwIfNoEntry: false }) !== void 0;
+    return lstatSync11(join18(repoHome(), "shared", entry), { throwIfNoEntry: false }) !== void 0;
   } catch {
     return false;
   }
@@ -3342,10 +3679,10 @@ var PROBEABLE_REASONS = /* @__PURE__ */ new Set([
   "secret-shaped"
 ]);
 function classifyLocalLink(entry) {
-  const linkPath = join15(claudeHome(), entry);
+  const linkPath = join18(claudeHome(), entry);
   let stat;
   try {
-    stat = lstatSync9(linkPath, { throwIfNoEntry: false });
+    stat = lstatSync11(linkPath, { throwIfNoEntry: false });
   } catch {
     return "absent";
   }
@@ -3358,7 +3695,7 @@ function classifyLocalLink(entry) {
   }
   let root;
   try {
-    root = realpathSync2(join15(repoHome(), "shared"));
+    root = realpathSync2(join18(repoHome(), "shared"));
   } catch {
     return "foreign";
   }
@@ -3442,8 +3779,8 @@ function reportPathCollisions(section2, map) {
   else addItem(section2, `${green(okGlyph)} path-encoding: no collisions`);
 }
 function reportPathMap(section2) {
-  const mapPath = join15(repoHome(), "path-map.json");
-  if (!existsSync13(mapPath)) {
+  const mapPath = join18(repoHome(), "path-map.json");
+  if (!existsSync14(mapPath)) {
     addItem(section2, `${red(failGlyph)} path-map.json missing at ${blue(mapPath)}`);
     process.exitCode = 1;
     return;
@@ -3473,8 +3810,8 @@ function reportNeverSync(section2) {
 
 // src/commands.doctor.checks.skills.ts
 init_color();
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join19 } from "node:path";
 init_config();
 function stripSideIndicator(line) {
   if (line.endsWith(" (local only)")) return line.slice(0, -" (local only)".length);
@@ -3483,24 +3820,24 @@ function stripSideIndicator(line) {
 }
 function isGsdDiffLine(line, localBase, sharedBase) {
   const bare = stripSideIndicator(line);
-  let relative11;
+  let relative12;
   if (bare.startsWith(localBase + "/")) {
-    relative11 = bare.slice(localBase.length + 1);
+    relative12 = bare.slice(localBase.length + 1);
   } else if (bare.startsWith(sharedBase + "/")) {
-    relative11 = bare.slice(sharedBase.length + 1);
+    relative12 = bare.slice(sharedBase.length + 1);
   } else {
-    relative11 = bare;
+    relative12 = bare;
   }
-  return relative11.split("/")[0].startsWith(GSD_PREFIX);
+  return relative12.split("/")[0].startsWith(GSD_PREFIX);
 }
 function reportSkillsDivergence(section2) {
-  const sharedSkills = join16(repoHome(), "shared", "skills");
-  const localSkills = join16(claudeHome(), "skills");
-  if (!existsSync14(sharedSkills)) {
+  const sharedSkills = join19(repoHome(), "shared", "skills");
+  const localSkills = join19(claudeHome(), "skills");
+  if (!existsSync15(sharedSkills)) {
     addItem(section2, `${dim(infoGlyph)} skills: no shared/skills/ to compare`);
     return;
   }
-  if (!existsSync14(localSkills)) {
+  if (!existsSync15(localSkills)) {
     addItem(section2, `${dim(infoGlyph)} skills: no local skills/ to compare`);
     return;
   }
@@ -3523,8 +3860,8 @@ function reportSkillsDivergence(section2) {
 init_color();
 init_config();
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join20, relative as relative4 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join23, relative as relative5 } from "node:path";
 init_commands_pull_wedge();
 init_push_checks();
 init_utils();
@@ -3547,11 +3884,11 @@ function reportGitleaksProbe(section2) {
 }
 function reportGitlinks(section2) {
   const repo = repoHome();
-  const sharedDir = join20(repo, "shared");
-  if (existsSync17(sharedDir)) {
+  const sharedDir = join23(repo, "shared");
+  if (existsSync18(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
-      const rel = relative4(repo, p).replaceAll("\\", "/");
+      const rel = relative5(repo, p).replaceAll("\\", "/");
       addItem(
         section2,
         `${red(failGlyph)} gitlink: ${blue(rel)} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`
@@ -3646,13 +3983,13 @@ function reportGitIdentity(section2) {
 
 // src/commands.doctor.checks.backups.ts
 init_color();
-import { existsSync as existsSync18, lstatSync as lstatSync10, readdirSync as readdirSync8 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync19, lstatSync as lstatSync12, readdirSync as readdirSync9 } from "node:fs";
+import { join as join24 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
 function safeReaddir(dir) {
   try {
-    return readdirSync8(dir);
+    return readdirSync9(dir);
   } catch {
     return [];
   }
@@ -3663,8 +4000,8 @@ var BYTES_PER_MB = 1024 * 1024;
 function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
-    const full = join21(dir, entry);
-    const st = lstatSync10(full, { throwIfNoEntry: false });
+    const full = join24(dir, entry);
+    const st = lstatSync12(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) bytes += dirSizeBytes(full);
@@ -3674,18 +4011,18 @@ function dirSizeBytes(dir) {
 }
 function totalSizeMb(backupBase2, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join21(backupBase2, name));
+  for (const name of dirs) bytes += dirSizeBytes(join24(backupBase2, name));
   return bytes / BYTES_PER_MB;
 }
 function reportBackupsCheck(section2, backupBase2 = backupBase()) {
-  if (!existsSync18(backupBase2)) return;
+  if (!existsSync19(backupBase2)) return;
   const dirs = safeReaddir(backupBase2).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
   const sizeMb = totalSizeMb(backupBase2, dirs);
   if (count > DOCTOR_BACKUP_COUNT_WARN || sizeMb > DOCTOR_BACKUP_SIZE_WARN_MB) {
     addItem(
       section2,
-      `${yellow(warnGlyph)} backups: ${count} dirs / ${sizeMb.toFixed(1)} MB (run 'nomad clean --backups --keep <N>'; bare --backups only prunes dirs older than 14d)`
+      `${yellow(warnGlyph)} backups: ${count} dirs / ${sizeMb.toFixed(1)} MB (run 'nomad clean --backups --keep <N>'; bare --backups prunes empty dirs plus those older than 14d)`
     );
   }
 }
@@ -3759,8 +4096,8 @@ function reportCheckRemote(section2) {
 
 // src/commands.doctor.check-schema.ts
 init_color();
-import { existsSync as existsSync19 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { join as join25 } from "node:path";
 init_config();
 
 // src/http-fetch.ts
@@ -3797,8 +4134,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join22(claudeHome(), "settings.json");
-  if (!existsSync19(settingsPath)) {
+  const settingsPath = join25(claudeHome(), "settings.json");
+  if (!existsSync20(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -3828,9 +4165,9 @@ function reportCheckSchema(section2) {
 init_color();
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync11, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync8, readdirSync as readdirSync12, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join29 } from "node:path";
+import { join as join32 } from "node:path";
 
 // src/commands.doctor.check-shared.memory.ts
 init_color();
@@ -3838,7 +4175,7 @@ import { execFileSync as execFileSync9 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { mkdirSync as mkdirSync4, rmSync as rmSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, join as join24 } from "node:path";
+import { dirname as dirname4, join as join27 } from "node:path";
 init_config();
 init_push_gitleaks();
 init_utils_fs();
@@ -3871,8 +4208,8 @@ function buildMemoryScanTree(tmpRoot) {
       incomplete = true;
       continue;
     }
-    const dest = join24(tmpRoot, rel);
-    mkdirSync4(dirname3(dest), { recursive: true });
+    const dest = join27(tmpRoot, rel);
+    mkdirSync4(dirname4(dest), { recursive: true });
     writeFileSync4(dest, blob);
     logicals.add(m[1]);
   }
@@ -3890,10 +4227,10 @@ function reportMemoryFindings(section2, findings) {
 function reportCommittedMemory(section2) {
   let tmpRoot;
   try {
-    const cacheDir = join24(homedir4(), ".cache", "claude-nomad");
+    const cacheDir = join27(homedir4(), ".cache", "claude-nomad");
     mkdirSync4(cacheDir, { recursive: true });
     const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-    tmpRoot = join24(cacheDir, `check-shared-memory-tree-${stamp}`);
+    tmpRoot = join27(cacheDir, `check-shared-memory-tree-${stamp}`);
     mkdirSync4(tmpRoot, { recursive: true, mode: 448 });
     const { staged, incomplete } = buildMemoryScanTree(tmpRoot);
     if (incomplete) {
@@ -3940,12 +4277,12 @@ function reportCommittedMemory(section2) {
 
 // src/commands.doctor.check-shared.scan.ts
 init_color();
-import { join as join25 } from "node:path";
+import { join as join28 } from "node:path";
 init_config();
 init_push_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join25(claudeHome(), "projects", encoded, `${sid}.jsonl`);
+  return join28(claudeHome(), "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -4034,7 +4371,7 @@ import { execFileSync as execFileSync10 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdirSync as mkdirSync5, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname4, join as join26 } from "node:path";
+import { dirname as dirname5, join as join29 } from "node:path";
 init_config();
 init_push_gitleaks();
 init_utils_fs();
@@ -4067,8 +4404,8 @@ function buildSkillScanTree(tmpRoot) {
       incomplete = true;
       continue;
     }
-    const dest = join26(tmpRoot, rel);
-    mkdirSync5(dirname4(dest), { recursive: true });
+    const dest = join29(tmpRoot, rel);
+    mkdirSync5(dirname5(dest), { recursive: true });
     writeFileSync5(dest, blob);
     names.add(m[1]);
   }
@@ -4090,10 +4427,10 @@ function reportSkillFindings(section2, findings) {
 function reportCommittedSkills(section2) {
   let tmpRoot;
   try {
-    const cacheDir = join26(homedir5(), ".cache", "claude-nomad");
+    const cacheDir = join29(homedir5(), ".cache", "claude-nomad");
     mkdirSync5(cacheDir, { recursive: true });
     const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-    tmpRoot = join26(cacheDir, `check-shared-skills-tree-${stamp}`);
+    tmpRoot = join29(cacheDir, `check-shared-skills-tree-${stamp}`);
     mkdirSync5(tmpRoot, { recursive: true, mode: 448 });
     const { staged, incomplete } = buildSkillScanTree(tmpRoot);
     if (incomplete) {
@@ -4143,8 +4480,8 @@ init_config();
 
 // src/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync6, existsSync as existsSync21, lstatSync as lstatSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync10, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join28, relative as relative5, sep as sep5 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync22, lstatSync as lstatSync13, mkdirSync as mkdirSync7, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
+import { dirname as dirname7, join as join31, relative as relative6, sep as sep5 } from "node:path";
 init_config();
 
 // src/push-manifest.ts
@@ -4152,8 +4489,8 @@ init_config();
 init_push_gitleaks_config();
 init_utils_fs();
 import { createHash } from "node:crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync9, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
-import { dirname as dirname5, join as join27 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync10, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import { dirname as dirname6, join as join30 } from "node:path";
 function isChanged(prev, cur, hash) {
   if (prev === void 0) return true;
   if (prev.size !== cur.size) return true;
@@ -4193,8 +4530,8 @@ function hashFile(absPath) {
   return createHash("sha256").update(readFileSync7(absPath)).digest("hex");
 }
 function enumerateDir(dir, results) {
-  for (const entry of readdirSync9(dir)) {
-    const fullPath = join27(dir, entry);
+  for (const entry of readdirSync10(dir)) {
+    const fullPath = join30(dir, entry);
     const st = statSync4(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -4205,8 +4542,8 @@ function enumerateDir(dir, results) {
 }
 function enumerateSourceFiles(projectDir) {
   const results = [];
-  for (const entry of readdirSync9(projectDir)) {
-    const fullPath = join27(projectDir, entry);
+  for (const entry of readdirSync10(projectDir)) {
+    const fullPath = join30(projectDir, entry);
     const st = statSync4(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -4218,15 +4555,15 @@ function enumerateSourceFiles(projectDir) {
 }
 function fileIdentity(p) {
   if (p === null) return "none::absent";
-  if (!existsSync20(p)) return `${p}::absent`;
+  if (!existsSync21(p)) return `${p}::absent`;
   return `${p}::${createHash("sha256").update(readFileSync7(p)).digest("hex")}`;
 }
 function computeConfigHash() {
   const repo = repoHome();
   const parts = [
     fileIdentity(resolveTomlPath(repo)),
-    fileIdentity(join27(repo, ".gitleaks.overlay.toml")),
-    fileIdentity(join27(repo, ".gitleaksignore"))
+    fileIdentity(join30(repo, ".gitleaks.overlay.toml")),
+    fileIdentity(join30(repo, ".gitleaksignore"))
   ];
   return createHash("sha256").update(parts.join("\n")).digest("hex");
 }
@@ -4246,7 +4583,7 @@ function readManifest(path) {
   }
 }
 function writeManifest(path, manifest) {
-  mkdirSync6(dirname5(path), { recursive: true });
+  mkdirSync6(dirname6(path), { recursive: true });
   writeJsonAtomic(path, manifest);
 }
 function buildManifest(files, scannerVersion, configHash) {
@@ -4261,7 +4598,7 @@ var TMP_SUFFIX = ".nomad-tmp";
 function atomicMirror(src, dst, options) {
   const tmp = `${dst}${TMP_SUFFIX}`;
   rmSync11(tmp, { recursive: true, force: true });
-  cpSync6(src, tmp, options);
+  cpSync5(src, tmp, options);
   rmSync11(dst, { recursive: true, force: true });
   renameAtomicRetry(tmp, dst);
 }
@@ -4270,9 +4607,9 @@ function overlaySessionDir(src, dst) {
   cpSyncGuarded(src, dst, void 0, "overlaySessionDir");
 }
 function copyFileAtomic(src, dst) {
-  mkdirSync7(dirname6(dst), { recursive: true });
+  mkdirSync7(dirname7(dst), { recursive: true });
   const tmp = `${dst}.tmp.${process.pid}`;
-  cpSync6(src, tmp, { force: true, preserveTimestamps: true });
+  cpSync5(src, tmp, { force: true, preserveTimestamps: true });
   renameAtomicRetry(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
@@ -4288,12 +4625,12 @@ function applySelective(sel, localDir, repoDst) {
   const prefix = `${localDir}${sep5}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
-    copyFileAtomic(src, join28(repoDst, relative5(localDir, src)));
+    copyFileAtomic(src, join31(repoDst, relative6(localDir, src)));
   }
   for (const src of sel.deleted) {
     if (!src.startsWith(prefix)) continue;
-    const dst = join28(repoDst, relative5(localDir, src));
-    if (existsSync21(dst)) rmSync11(dst);
+    const dst = join31(repoDst, relative6(localDir, src));
+    if (existsSync22(dst)) rmSync11(dst);
   }
 }
 function copyDirJsonlOnly(src, dst) {
@@ -4301,7 +4638,7 @@ function copyDirJsonlOnly(src, dst) {
     recursive: true,
     force: true,
     filter: (srcPath) => {
-      const rel = relative5(src, srcPath);
+      const rel = relative6(src, srcPath);
       if (rel === "") return true;
       if (rel.split(sep5).length > 1) return true;
       if (statSync5(srcPath).isDirectory()) return true;
@@ -4322,15 +4659,15 @@ function remapPull(ts, opts = {}) {
   const wouldPull = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join28(repo, "path-map.json");
-  const repoProjects = join28(repo, "shared", "projects");
-  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) {
+  const mapPath = join31(repo, "path-map.json");
+  const repoProjects = join31(repo, "shared", "projects");
+  if (!existsSync22(mapPath) || !existsSync22(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join28(claude, "projects");
+  const localProjects = join31(claude, "projects");
   if (!dryRun) mkdirSync7(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -4340,9 +4677,9 @@ function remapPull(ts, opts = {}) {
       continue;
     }
     assertSafeLocalRoot(localPath, logical);
-    const src = join28(repoProjects, logical);
-    if (!existsSync21(src)) continue;
-    const dst = join28(localProjects, encodePath(localPath));
+    const src = join31(repoProjects, logical);
+    if (!existsSync22(src)) continue;
+    const dst = join31(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -4360,12 +4697,12 @@ function remapPull(ts, opts = {}) {
 }
 function countLocalOnly(src, dst) {
   let count = 0;
-  for (const name of readdirSync10(dst)) {
-    const dstPath = join28(dst, name);
-    const srcPath = join28(src, name);
-    if (lstatSync11(dstPath).isDirectory()) {
+  for (const name of readdirSync11(dst)) {
+    const dstPath = join31(dst, name);
+    const srcPath = join31(src, name);
+    if (lstatSync13(dstPath).isDirectory()) {
       count += countLocalOnly(srcPath, dstPath);
-    } else if (lstatSync11(srcPath, { throwIfNoEntry: false }) === void 0) {
+    } else if (lstatSync13(srcPath, { throwIfNoEntry: false }) === void 0) {
       count++;
     }
   }
@@ -4374,20 +4711,20 @@ function countLocalOnly(src, dst) {
 function scanLocalOnly() {
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join28(repo, "path-map.json");
-  const repoProjects = join28(repo, "shared", "projects");
-  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) return 0;
+  const mapPath = join31(repo, "path-map.json");
+  const repoProjects = join31(repo, "shared", "projects");
+  if (!existsSync22(mapPath) || !existsSync22(repoProjects)) return 0;
   const map = readPathMap(mapPath);
-  const localProjects = join28(claude, "projects");
+  const localProjects = join31(claude, "projects");
   let count = 0;
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const localPath = hosts[HOST];
     if (!localPath || localPath === "TBD") continue;
     assertSafeLocalRoot(localPath, logical);
-    const dst = join28(localProjects, encodePath(localPath));
-    if (!existsSync21(dst)) continue;
-    count += countLocalOnly(join28(repoProjects, logical), dst);
+    const dst = join31(localProjects, encodePath(localPath));
+    if (!existsSync22(dst)) continue;
+    count += countLocalOnly(join31(repoProjects, logical), dst);
   }
   return count;
 }
@@ -4422,26 +4759,26 @@ function remapPush(ts, opts = {}) {
   const wouldPush = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join28(repo, "path-map.json");
-  if (!existsSync21(mapPath)) {
+  const mapPath = join31(repo, "path-map.json");
+  if (!existsSync22(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join28(claude, "projects");
-  const repoProjects = join28(repo, "shared", "projects");
+  const localProjects = join31(claude, "projects");
+  const repoProjects = join31(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync21(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync22(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync7(repoProjects, { recursive: true });
-  for (const dir of readdirSync10(localProjects)) {
+  for (const dir of readdirSync11(localProjects)) {
     if (dir.endsWith(TMP_SUFFIX)) continue;
     const logical = reverse.get(dir);
     if (!logical) {
       unmapped++;
       continue;
     }
-    const localDir = join28(localProjects, dir);
-    const repoDst = join28(repoProjects, logical);
+    const localDir = join31(localProjects, dir);
+    const repoDst = join31(repoProjects, logical);
     if (skipForSelection(opts.selection, localDir)) continue;
     if (dryRun) {
       wouldPush.push(logical);
@@ -4465,8 +4802,8 @@ function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
   const repo = repoHome();
-  const mapPath = join29(repo, "path-map.json");
-  if (!existsSync22(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join32(repo, "path-map.json");
+  if (!existsSync23(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -4483,12 +4820,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join29(claudeHome(), "projects");
-  if (!existsSync22(localProjects)) return { logicalToEncoded, staged, malformed: false };
-  for (const dir of readdirSync11(localProjects)) {
+  const localProjects = join32(claudeHome(), "projects");
+  if (!existsSync23(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  for (const dir of readdirSync12(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join29(localProjects, dir), join29(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join32(localProjects, dir), join32(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -4518,11 +4855,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
   return true;
 }
 function runLocalPreviewScan(section2) {
-  const cacheDir = join29(homedir6(), ".cache", "claude-nomad");
+  const cacheDir = join32(homedir6(), ".cache", "claude-nomad");
   mkdirSync8(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes3(4).toString("hex")}`;
-  const reportPath = join29(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join29(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join32(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join32(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -4555,8 +4892,8 @@ function reportCheckShared(section2, gitleaksReady) {
 
 // src/commands.doctor.checks.hooks.scope.ts
 init_color();
-import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync12, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname7, extname, join as join30 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync8, readdirSync as readdirSync13, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname8, extname, join as join33 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
@@ -4576,11 +4913,11 @@ function effectiveType(hookPath) {
   } catch {
     return null;
   }
-  let dir = dirname7(real);
+  let dir = dirname8(real);
   for (; ; ) {
-    const pkg = join30(dir, "package.json");
-    if (existsSync23(pkg)) return typeFromPackageJson(pkg);
-    const parent = dirname7(dir);
+    const pkg = join33(dir, "package.json");
+    if (existsSync24(pkg)) return typeFromPackageJson(pkg);
+    const parent = dirname8(dir);
     if (parent === dir) return "cjs";
     dir = parent;
   }
@@ -4608,7 +4945,7 @@ function remedy(family) {
 }
 function safeReaddir2(dir) {
   try {
-    return readdirSync12(dir);
+    return readdirSync13(dir);
   } catch {
     return [];
   }
@@ -4621,15 +4958,15 @@ function safeRead(path) {
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join30(claudeHome(), "hooks");
-  if (!existsSync23(hooksDir)) {
+  const hooksDir = join33(claudeHome(), "hooks");
+  if (!existsSync24(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join30(hooksDir, name);
+    const abs = join33(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -4649,8 +4986,8 @@ function reportHookScopeCheck(section2) {
 
 // src/commands.doctor.checks.hooks.ts
 init_color();
-import { existsSync as existsSync24 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync25 } from "node:fs";
+import { join as join34 } from "node:path";
 init_config();
 function expandHome(token) {
   const h2 = home();
@@ -4693,7 +5030,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync24(resolved)) continue;
+        if (existsSync25(resolved)) continue;
         addItem(
           section2,
           `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
@@ -4706,8 +5043,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join31(claudeHome(), "settings.json");
-  if (!existsSync24(settingsPath)) {
+  const settingsPath = join34(claudeHome(), "settings.json");
+  if (!existsSync25(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -4730,12 +5067,12 @@ function reportHooksTargetCheck(section2) {
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.ts
 init_color();
-import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync9 } from "node:fs";
+import { join as join36 } from "node:path";
 
 // src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
-import { dirname as dirname8, join as join32, resolve as resolve2 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync26, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
+import { dirname as dirname9, join as join35, resolve as resolve3 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
   const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
@@ -4766,13 +5103,13 @@ function topRelativeSpecifiers(src) {
   return specifiers;
 }
 function specifierIsMissing(specifier, baseDir) {
-  const base = resolve2(baseDir, specifier);
-  if (existsSync25(base)) return false;
+  const base = resolve3(baseDir, specifier);
+  if (existsSync26(base)) return false;
   for (const ext of [".js", ".cjs", ".mjs"]) {
-    if (existsSync25(base + ext)) return false;
+    if (existsSync26(base + ext)) return false;
   }
   for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
-    if (existsSync25(join32(base, idx))) return false;
+    if (existsSync26(join35(base, idx))) return false;
   }
   return true;
 }
@@ -4798,7 +5135,7 @@ function relativeRequireTargetsBroken(scriptPath) {
   }
   const specifiers = topRelativeSpecifiers(raw);
   if (specifiers.length === 0) return false;
-  const baseDir = dirname8(realPath);
+  const baseDir = dirname9(realPath);
   for (const spec of specifiers) {
     if (specifierIsMissing(spec, baseDir)) return true;
   }
@@ -4827,8 +5164,8 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join33(repoHome(), "path-map.json");
-  if (!existsSync26(mapPath)) return { projects: {} };
+  const mapPath = join36(repoHome(), "path-map.json");
+  if (!existsSync27(mapPath)) return { projects: {} };
   try {
     return JSON.parse(readFileSync9(mapPath, "utf8"));
   } catch {
@@ -4902,8 +5239,8 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join33(claudeHome(), "settings.json");
-  if (!existsSync26(settingsPath)) {
+  const settingsPath = join36(claudeHome(), "settings.json");
+  if (!existsSync27(settingsPath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
@@ -4936,8 +5273,8 @@ function reportPreserveSymlinksCheck(section2) {
 
 // src/commands.doctor.checks.settings-drift.ts
 init_color();
-import { existsSync as existsSync27, readFileSync as readFileSync10 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync10 } from "node:fs";
+import { join as join37 } from "node:path";
 init_config();
 init_utils_json();
 function diffMergedSettings(merged, settings) {
@@ -4955,7 +5292,7 @@ function tryReadJson(filePath) {
   }
 }
 function reportHooksBaseSelfCleanNote(section2) {
-  const basePath = join34(repoHome(), "shared", "settings.base.json");
+  const basePath = join37(repoHome(), "shared", "settings.base.json");
   const base = tryReadJson(basePath);
   if (base === null) return;
   if (!baseHasGsdHookEntries(base)) return;
@@ -4968,14 +5305,14 @@ function reportSettingsDriftCheck(section2) {
   const claude = claudeHome();
   const repo = repoHome();
   const host = HOST;
-  const settingsPath = join34(claude, "settings.json");
-  const basePath = join34(repo, "shared", "settings.base.json");
-  const hostPath = join34(repo, "hosts", `${host}.json`);
-  if (!existsSync27(settingsPath)) {
+  const settingsPath = join37(claude, "settings.json");
+  const basePath = join37(repo, "shared", "settings.base.json");
+  const hostPath = join37(repo, "hosts", `${host}.json`);
+  if (!existsSync28(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
     return;
   }
-  if (!existsSync27(basePath)) {
+  if (!existsSync28(basePath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
@@ -4994,7 +5331,7 @@ function reportSettingsDriftCheck(section2) {
   if (settings === null) {
     return;
   }
-  const hostExists = existsSync27(hostPath);
+  const hostExists = existsSync28(hostPath);
   const hostObj = hostExists ? tryReadJson(hostPath) : null;
   if (hostExists && hostObj === null) {
     addItem(
@@ -5211,15 +5548,15 @@ function reportSyncModality(section2) {
 // src/commands.doctor.checks.crlf.ts
 init_color();
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync28, readFileSync as readFileSync13 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync13 } from "node:fs";
+import { join as join38 } from "node:path";
 init_config();
 var PROBE_TIMEOUT_MS2 = 3e3;
 var GUARD_LINE = /^\*\s+-text\b/;
 function hasGitattributesGuard(repo) {
   try {
-    const path = join35(repo, ".gitattributes");
-    if (!existsSync28(path)) return false;
+    const path = join38(repo, ".gitattributes");
+    if (!existsSync29(path)) return false;
     const content = readFileSync13(path, "utf8");
     return content.split("\n").map((line) => line.trim()).some((line) => line !== "" && !line.startsWith("#") && GUARD_LINE.test(line));
   } catch {
@@ -5260,34 +5597,34 @@ function reportCrlfGuardCheck(section2, run = execFileSync13) {
 
 // src/spinner.ts
 init_color();
-import { existsSync as existsSync33 } from "node:fs";
+import { existsSync as existsSync34 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/commands.push.recovery.ts
 init_config();
 import { readFileSync as readFileSync18, rmSync as rmSync15, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join43 } from "node:path";
+import { join as join46 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/commands.push.recovery.actions.ts
 init_config();
 import { readFileSync as readFileSync17 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve3, sep as sep9 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve4, sep as sep9 } from "node:path";
 
 // src/commands.push.recovery.memory.ts
 init_config();
 init_config_sharedDirs_guard();
 import {
-  cpSync as cpSync7,
-  lstatSync as lstatSync12,
+  cpSync as cpSync6,
+  lstatSync as lstatSync14,
   mkdirSync as mkdirSync9,
   readFileSync as readFileSync14,
   realpathSync as realpathSync5,
   statSync as statSync6,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname9, join as join36, sep as sep6 } from "node:path";
+import { dirname as dirname10, join as join39, sep as sep6 } from "node:path";
 init_push_gitleaks_scan();
 
 // src/rel-path-guard.ts
@@ -5316,11 +5653,11 @@ function resolveMemoryLocalPath(logical, relPath, map) {
   if (!isSafeRelPath(relPath)) return null;
   const abs = map.projects[logical]?.[HOST];
   if (abs === void 0) return null;
-  const memoryRoot = join36(claudeHome(), "projects", encodePath(abs), "memory");
-  const localPath = join36(memoryRoot, ...relPath.split("/"));
+  const memoryRoot = join39(claudeHome(), "projects", encodePath(abs), "memory");
+  const localPath = join39(memoryRoot, ...relPath.split("/"));
   if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep6)) return null;
   try {
-    if (lstatSync12(localPath).isSymbolicLink()) return null;
+    if (lstatSync14(localPath).isSymbolicLink()) return null;
     const realLocal = realpathSync5(localPath);
     const realRoot = realpathSync5(memoryRoot);
     if (!realLocal.startsWith(realRoot + sep6)) return null;
@@ -5371,29 +5708,29 @@ function applyMemoryRedact(f, ts, map, scan = scanFile) {
     );
   }
   writeFileSync6(localPath, after, "utf8");
-  const dest = join36(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
-  mkdirSync9(dirname9(dest), { recursive: true });
-  cpSync7(localPath, dest, { force: true });
+  const dest = join39(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
+  mkdirSync9(dirname10(dest), { recursive: true });
+  cpSync6(localPath, dest, { force: true });
   return true;
 }
 
 // src/commands.push.recovery.skills.ts
 init_config();
 import {
-  cpSync as cpSync8,
-  lstatSync as lstatSync14,
+  cpSync as cpSync7,
+  lstatSync as lstatSync16,
   mkdirSync as mkdirSync11,
   readFileSync as readFileSync15,
   realpathSync as realpathSync6,
   statSync as statSync7,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname10, join as join38, sep as sep7 } from "node:path";
+import { dirname as dirname11, join as join41, sep as sep7 } from "node:path";
 
 // src/skills-sync.ts
 init_config();
-import { existsSync as existsSync29, lstatSync as lstatSync13, mkdirSync as mkdirSync10, readdirSync as readdirSync13, rmSync as rmSync13 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync30, lstatSync as lstatSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync14, rmSync as rmSync13 } from "node:fs";
+import { join as join40 } from "node:path";
 
 // src/skills-sync.tracked.ts
 init_utils();
@@ -5417,7 +5754,7 @@ function isSkillExcluded(name) {
   return isGsdOwned(name) || isDeniedName(ALWAYS_NEVER_SYNC, name);
 }
 function copySkillsPush(src, dst) {
-  const srcNames = readdirSync13(src, { encoding: "utf8" });
+  const srcNames = readdirSync14(src, { encoding: "utf8" });
   const blockSet = /* @__PURE__ */ new Set([
     ...srcNames.filter((n) => isGsdOwned(n)),
     ...ALWAYS_NEVER_SYNC
@@ -5428,11 +5765,11 @@ function copySkillsPull(src, dst, isRootPreserved) {
   copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded, isRootPreserved);
 }
 function syncSkillsPull(ts, prePostHeads) {
-  const sharedSkills = join37(repoHome(), "shared", "skills");
-  if (!existsSync29(sharedSkills)) return;
-  const localSkills = join37(claudeHome(), "skills");
+  const sharedSkills = join40(repoHome(), "shared", "skills");
+  if (!existsSync30(sharedSkills)) return;
+  const localSkills = join40(claudeHome(), "skills");
   backupBeforeWrite(localSkills, ts);
-  const dstStat = lstatSync13(localSkills, { throwIfNoEntry: false });
+  const dstStat = lstatSync15(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
     rmSync13(localSkills, { recursive: true, force: true });
     mkdirSync10(localSkills, { recursive: true });
@@ -5441,11 +5778,11 @@ function syncSkillsPull(ts, prePostHeads) {
   copySkillsPull(sharedSkills, localSkills, (name) => !tracked.has(name));
 }
 function syncSkillsPush() {
-  const localSkills = join37(claudeHome(), "skills");
-  const stat = lstatSync13(localSkills, { throwIfNoEntry: false });
+  const localSkills = join40(claudeHome(), "skills");
+  const stat = lstatSync15(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
-  const sharedSkills = join37(repoHome(), "shared", "skills");
+  const sharedSkills = join40(repoHome(), "shared", "skills");
   copySkillsPush(localSkills, sharedSkills);
 }
 
@@ -5468,12 +5805,12 @@ function resolveSkillLocalPath(name, relPath) {
   if (!SAFE_SKILL_NAME.test(name) || name === "." || name === "..") return null;
   if (isGsdOwned(name)) return null;
   if (!isSafeRelPath(relPath)) return null;
-  const skillsRoot = join38(claudeHome(), "skills");
-  const skillRoot = join38(skillsRoot, name);
-  const localPath = join38(skillRoot, ...relPath.split("/"));
+  const skillsRoot = join41(claudeHome(), "skills");
+  const skillRoot = join41(skillsRoot, name);
+  const localPath = join41(skillRoot, ...relPath.split("/"));
   if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep7)) return null;
   try {
-    if (lstatSync14(localPath).isSymbolicLink()) return null;
+    if (lstatSync16(localPath).isSymbolicLink()) return null;
     const realLocal = realpathSync6(localPath);
     const realRoot = realpathSync6(skillsRoot);
     if (!realLocal.startsWith(realRoot + sep7)) return null;
@@ -5522,9 +5859,9 @@ function applySkillRedact(f, ts, scan = scanFile) {
     );
   }
   writeFileSync7(localPath, after, "utf8");
-  const dest = join38(repoHome(), "shared", "skills", name, ...relPath.split("/"));
-  mkdirSync11(dirname10(dest), { recursive: true });
-  cpSync8(localPath, dest, { force: true });
+  const dest = join41(repoHome(), "shared", "skills", name, ...relPath.split("/"));
+  mkdirSync11(dirname11(dest), { recursive: true });
+  cpSync7(localPath, dest, { force: true });
   return true;
 }
 
@@ -5600,26 +5937,26 @@ function applyDeferredAllows(findings, state, repo) {
 // src/commands.push.recovery.redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync9, existsSync as existsSync32, mkdirSync as mkdirSync12 } from "node:fs";
-import { dirname as dirname12, join as join41, sep as sep8 } from "node:path";
+import { cpSync as cpSync8, existsSync as existsSync33, mkdirSync as mkdirSync12 } from "node:fs";
+import { dirname as dirname13, join as join44, sep as sep8 } from "node:path";
 
 // src/commands.redact.ts
 init_config();
-import { existsSync as existsSync31 } from "node:fs";
-import { dirname as dirname11, join as join40 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { dirname as dirname12, join as join43 } from "node:path";
 
 // src/commands.redact.subtree.ts
-import { existsSync as existsSync30, lstatSync as lstatSync15, readFileSync as readFileSync16, readdirSync as readdirSync14, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync31, lstatSync as lstatSync17, readFileSync as readFileSync16, readdirSync as readdirSync15, statSync as statSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join42 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
-  if (!existsSync30(dir)) return;
-  const st = lstatSync15(dir);
+  if (!existsSync31(dir)) return;
+  const st = lstatSync17(dir);
   if (!st.isDirectory()) return;
-  for (const entry of readdirSync14(dir)) {
-    const abs = join39(dir, entry);
-    const lst = lstatSync15(abs);
+  for (const entry of readdirSync15(dir)) {
+    const abs = join42(dir, entry);
+    const lst = lstatSync17(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
       collectFiles(abs, out);
@@ -5728,15 +6065,15 @@ init_utils_json();
 init_utils();
 function resolveLiveTranscript(id) {
   try {
-    const mapPath = join40(repoHome(), "path-map.json");
-    if (!existsSync31(mapPath)) return null;
+    const mapPath = join43(repoHome(), "path-map.json");
+    if (!existsSync32(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join40(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync31(live)) return live;
+      const live = join43(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync32(live)) return live;
     }
     return null;
   } catch {
@@ -5756,17 +6093,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync31(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync32(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync31(localPath)) {
+    if (localPath === null || !existsSync32(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join40(dirname11(localPath), id);
+    const sessionDir = join43(dirname12(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
       log(
@@ -5827,8 +6164,8 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join41(claude, "projects", encodePath(abs)) + sep8)) {
-      return join41(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join44(claude, "projects", encodePath(abs)) + sep8)) {
+      return join44(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -5838,7 +6175,7 @@ function preflightRedactable(f, map, nowMs) {
   if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
   const localPath = resolveLiveTranscript(sid);
   if (localPath === null) return `session ${sid}: local transcript not found`;
-  const sessionDir = join41(dirname12(localPath), sid);
+  const sessionDir = join44(dirname13(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return `session ${sid}: looks active (modified within the last 5 minutes)`;
@@ -5867,7 +6204,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join41(dirname12(localPath), sid);
+  const sessionDir = join44(dirname13(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return refuse(
@@ -5900,9 +6237,9 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync12(stagedProjectDir, { recursive: true });
-  cpSync9(localPath, join41(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync32(sessionDir)) {
-    cpSync9(sessionDir, join41(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync8(localPath, join44(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync33(sessionDir)) {
+    cpSync8(sessionDir, join44(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
@@ -5910,14 +6247,14 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
 // src/commands.push.recovery.drop.ts
 init_config();
 import { rmSync as rmSync14 } from "node:fs";
-import { join as join42 } from "node:path";
+import { join as join45 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join42(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join42(repo, "shared", "projects", logical, sid);
+    const jsonl = join45(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join45(repo, "shared", "projects", logical, sid);
     rmSync14(jsonl, { force: true });
     rmSync14(dir, { recursive: true, force: true });
   }
@@ -6189,8 +6526,8 @@ function makeDefaultReadLine(repo) {
   const cache = /* @__PURE__ */ new Map();
   return (file, line) => {
     try {
-      const repoRoot = resolve3(repo);
-      const target = resolve3(repoRoot, file);
+      const repoRoot = resolve4(repo);
+      const target = resolve4(repoRoot, file);
       if (isAbsolute2(file) || target !== repoRoot && !target.startsWith(repoRoot + sep9)) {
         return null;
       }
@@ -6402,7 +6739,7 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join43(repoHome2, ".gitleaksignore");
+  const ignPath = join46(repoHome2, ".gitleaksignore");
   let before;
   try {
     before = readFileSync18(ignPath, "utf8");
@@ -6508,7 +6845,7 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync33;
+  const check = deps.existsSyncFn ?? existsSync34;
   const base = deps.baseUrl ?? import.meta.url;
   const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
@@ -6575,8 +6912,8 @@ function withSpinner(label, fn, deps) {
 // src/commands.doctor.gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync15 } from "node:child_process";
-import { existsSync as existsSync34 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync35 } from "node:fs";
+import { join as join47 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -6585,7 +6922,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join44(repoHome(), ".gitleaks.toml");
+  const tomlPath = join47(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -6597,7 +6934,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists = existsSync34) {
+function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists = existsSync35) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -6854,8 +7191,8 @@ function gatherDoctorSections(opts) {
   reportLongPathsCheck(host);
   reportCrlfGuardCheck(host);
   const links = section("Shared links");
-  const mapPath = join45(repoHome(), "path-map.json");
-  const rawMap = existsSync35(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join48(repoHome(), "path-map.json");
+  const rawMap = existsSync36(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   reportDroppedNamesMigration(links);
@@ -6953,8 +7290,8 @@ function parseDoctorArgs(args) {
 // src/commands.drop-session.ts
 init_config();
 import { execFileSync as execFileSync20 } from "node:child_process";
-import { existsSync as existsSync37, readdirSync as readdirSync15, statSync as statSync9 } from "node:fs";
-import { join as join47, relative as relative6 } from "node:path";
+import { existsSync as existsSync38, readdirSync as readdirSync16, statSync as statSync9 } from "node:fs";
+import { join as join50, relative as relative7 } from "node:path";
 
 // src/commands.drop-session.git.ts
 import { execFileSync as execFileSync19 } from "node:child_process";
@@ -6997,8 +7334,8 @@ function isInIndex(rel, repo) {
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync36 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync37 } from "node:fs";
+import { join as join49 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript2(id, matches);
@@ -7014,8 +7351,8 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript2(id, matches) {
   try {
-    const mapPath = join46(repoHome(), "path-map.json");
-    if (!existsSync36(mapPath)) return null;
+    const mapPath = join49(repoHome(), "path-map.json");
+    if (!existsSync37(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
@@ -7023,8 +7360,8 @@ function resolveLiveTranscript2(id, matches) {
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join46(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync36(live)) return live;
+      const live = join49(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync37(live)) return live;
     }
     return null;
   } catch {
@@ -7040,12 +7377,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync37(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync38(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join47(repo, "shared", "projects");
-    if (!existsSync37(repoProjects)) {
+    const repoProjects = join50(repo, "shared", "projects");
+    if (!existsSync38(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -7067,14 +7404,14 @@ function cmdDropSession(id) {
 }
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
-  for (const logical of readdirSync15(repoProjects)) {
-    const candidate = join47(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync37(candidate)) {
-      matches.push(relative6(repo, candidate));
-    }
-    const dir = join47(repoProjects, logical, id);
-    if (existsSync37(dir) && statSync9(dir).isDirectory()) {
-      const dirRel = relative6(repo, dir);
+  for (const logical of readdirSync16(repoProjects)) {
+    const candidate = join50(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync38(candidate)) {
+      matches.push(relative7(repo, candidate));
+    }
+    const dir = join50(repoProjects, logical, id);
+    if (existsSync38(dir) && statSync9(dir).isDirectory()) {
+      const dirRel = relative7(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
       else matches.push(dirRel);
@@ -7109,8 +7446,8 @@ function unstageOne(rel, repo) {
 
 // src/commands.pull.ts
 init_autostash_guard();
-import { existsSync as existsSync46, mkdirSync as mkdirSync14 } from "node:fs";
-import { join as join58 } from "node:path";
+import { existsSync as existsSync47, mkdirSync as mkdirSync14 } from "node:fs";
+import { join as join61 } from "node:path";
 
 // src/commands.push.sections.ts
 init_color();
@@ -7218,18 +7555,18 @@ init_config();
 
 // src/extras-sync.ts
 init_config();
-import { existsSync as existsSync39, statSync as statSync10 } from "node:fs";
-import { join as join50 } from "node:path";
+import { existsSync as existsSync40, statSync as statSync10 } from "node:fs";
+import { join as join53 } from "node:path";
 init_utils();
 init_utils_json();
 
 // src/extras-sync.remap.ts
 init_config();
-import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync16, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
-import { dirname as dirname13, join as join49, sep as sep11 } from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync13, readdirSync as readdirSync17, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
+import { dirname as dirname14, join as join52, sep as sep11 } from "node:path";
 
 // src/extras-sync.planning-diff.ts
-import { join as join48, normalize as normalize2, sep as sep10 } from "node:path";
+import { join as join51, normalize as normalize2, sep as sep10 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -7281,7 +7618,7 @@ function planningDeleteTargets(opts) {
   const { deleted } = parsePlanningDiff(raw);
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
-  const planningRoot = join48(localRoot, ".planning");
+  const planningRoot = join51(localRoot, ".planning");
   const planningRootBoundary = planningRoot + sep10;
   const targets = [];
   for (const repoPath of deleted) {
@@ -7289,7 +7626,7 @@ function planningDeleteTargets(opts) {
       continue;
     }
     const remainder = repoPath.slice(logicalPrefix.length);
-    const candidate = join48(localRoot, remainder);
+    const candidate = join51(localRoot, remainder);
     const resolved = normalize2(candidate);
     if (!resolved.startsWith(planningRootBoundary)) {
       throw new NomadFatal(
@@ -7310,7 +7647,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync38(src)) continue;
+    if (!existsSync39(src)) continue;
     const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item2);
@@ -7323,15 +7660,15 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   return { ...counts, done, would };
 }
 function pruneEmptyAncestors(target, planningRoot) {
-  let dir = dirname13(target);
+  let dir = dirname14(target);
   while (dir !== planningRoot && dir.startsWith(planningRoot + sep11)) {
     try {
-      if (readdirSync16(dir).length > 0) break;
+      if (readdirSync17(dir).length > 0) break;
       rmSync16(dir, { recursive: true, force: true });
     } catch {
       break;
     }
-    dir = dirname13(dir);
+    dir = dirname14(dir);
   }
 }
 function tryRealpath(dir) {
@@ -7345,8 +7682,8 @@ function isInsidePlanningRoot(parentReal, rootReal) {
   return parentReal === rootReal || parentReal.startsWith(rootReal + sep11);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
-  if (existsSync38(repoCounterpart)) return;
-  const parentReal = tryRealpath(dirname13(target));
+  if (existsSync39(repoCounterpart)) return;
+  const parentReal = tryRealpath(dirname14(target));
   if (parentReal === void 0) return;
   const rootReal = tryRealpath(planningRoot);
   if (rootReal === void 0) return;
@@ -7355,7 +7692,7 @@ function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   pruneEmptyAncestors(target, planningRoot);
 }
 function localDivergesFromPreDelete(target, pre, repoRel, repo) {
-  if (!existsSync38(target)) return false;
+  if (!existsSync39(target)) return false;
   try {
     const preBlob = gitCaptureBuffer(["show", `${pre}:${repoRel}`], repo);
     return !readFileSync19(target).equals(preBlob);
@@ -7400,7 +7737,7 @@ function keptDeletePreview(v, prePostHeads, repo) {
   return kept;
 }
 function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
-  const repoExtras = join49(repo, "shared", "extras");
+  const repoExtras = join52(repo, "shared", "extras");
   for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
     if (t.dirname !== ".planning") continue;
     let raw;
@@ -7415,14 +7752,14 @@ function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
     }
     const pairs = deletePairsFor(t, raw);
     if (pairs.length === 0) continue;
-    backupExtrasWrite(join49(t.localRoot, t.dirname), ts, t.localRoot);
-    const planningRoot = join49(t.localRoot, ".planning");
+    backupExtrasWrite(join52(t.localRoot, t.dirname), ts, t.localRoot);
+    const planningRoot = join52(t.localRoot, ".planning");
     for (const { target, relToLocal, repoRel } of pairs) {
       if (localDivergesFromPreDelete(target, prePostHeads.pre, repoRel, repo)) {
         warn(keptDeleteWarnLine(t.logical, relToLocal));
         continue;
       }
-      deletePlanningTarget(target, planningRoot, join49(repoExtras, t.logical, relToLocal));
+      deletePlanningTarget(target, planningRoot, join52(repoExtras, t.logical, relToLocal));
     }
   }
 }
@@ -7431,14 +7768,14 @@ function remapExtrasPush(ts, opts = {}) {
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
   const repo = repoHome();
-  const repoExtras = join49(repo, "shared", "extras");
+  const repoExtras = join52(repo, "shared", "extras");
   if (!dryRun) mkdirSync13(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname14 }) => ({
-      src: join49(localRoot, dirname14),
-      dst: join49(repoExtras, logical, dirname14)
+    ({ localRoot, logical, dirname: dirname15 }) => ({
+      src: join52(localRoot, dirname15),
+      dst: join52(repoExtras, logical, dirname15)
     }),
     (dst) => backupRepoWrite(dst, ts, repo),
     // Push copy routing per extra type:
@@ -7451,7 +7788,7 @@ function remapExtrasPush(ts, opts = {}) {
     //     config.never-sync.ts)
     //     remains the hard security boundary.
     //   All others: copyExtrasFiltered with per-extra denylist.
-    (src, dst, dirname14) => dirname14 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname14)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname14))
+    (src, dst, dirname15) => dirname15 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname15)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname15))
   );
   return { unmapped, skipped, pushed: done, wouldPush: would };
 }
@@ -7467,9 +7804,9 @@ function remapExtrasPull(ts, opts = {}) {
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname14 }) => ({
-      src: join49(repo, "shared", "extras", logical, dirname14),
-      dst: join49(localRoot, dirname14)
+    ({ localRoot, logical, dirname: dirname15 }) => ({
+      src: join52(repo, "shared", "extras", logical, dirname15),
+      dst: join52(localRoot, dirname15)
     }),
     // Snapshot the host-side dst BEFORE the copy step touches it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -7487,12 +7824,12 @@ function remapExtrasPull(ts, opts = {}) {
     //     copyExtrasFileSkipDiverged keeps a locally-edited file rather than
     //     clobbering it, so the divergence WARN's keep-local promise holds for
     //     every extra, not just `.planning`.
-    (src, dst, dirname14) => {
-      if (dirname14 === ".claude")
-        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname14));
-      if (dirname14 === ".planning") {
+    (src, dst, dirname15) => {
+      if (dirname15 === ".claude")
+        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname15));
+      if (dirname15 === ".planning") {
         const divergedSet = new Set(listDivergingModified(dst, src));
-        return copyExtrasOverlaySkipDiverged(src, dst, extrasDenySet(dirname14), divergedSet);
+        return copyExtrasOverlaySkipDiverged(src, dst, extrasDenySet(dirname15), divergedSet);
       }
       return copyExtrasFileSkipDiverged(src, dst);
     }
@@ -7516,20 +7853,20 @@ function divergenceCheckExtras(ts, prePostHeads) {
   const v = loadValidatedExtras({});
   if (v === null) return 0;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join50(backupBase(), ts, "extras");
+  const backupRoot = join53(backupBase(), ts, "extras");
   const repo = repoHome();
   let divergedCount = 0;
-  for (const { logical, localRoot, dirname: dirname14 } of eachExtrasTarget(v, counts)) {
-    const local = join50(localRoot, dirname14);
-    const repoEntry = join50(repo, "shared", "extras", logical, dirname14);
-    if (!existsSync39(local) || !existsSync39(repoEntry)) continue;
+  for (const { logical, localRoot, dirname: dirname15 } of eachExtrasTarget(v, counts)) {
+    const local = join53(localRoot, dirname15);
+    const repoEntry = join53(repo, "shared", "extras", logical, dirname15);
+    if (!existsSync40(local) || !existsSync40(repoEntry)) continue;
     const modified = listDivergingModified(local, repoEntry);
     if (modified.length === 0) continue;
     divergedCount += modified.length;
-    const projectBackupRoot = join50(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join53(backupRoot, encodePath(localRoot));
     warn(
       divergenceWarnLine({
-        dirname: dirname14,
+        dirname: dirname15,
         logical,
         isDir: statSync10(local).isDirectory(),
         count: modified.length,
@@ -7548,8 +7885,8 @@ function divergenceCheckExtras(ts, prePostHeads) {
 
 // src/links.baseline.ts
 init_config();
-import { lstatSync as lstatSync16, readdirSync as readdirSync17 } from "node:fs";
-import { join as join51, relative as relative7, sep as sep12 } from "node:path";
+import { lstatSync as lstatSync18, readdirSync as readdirSync18 } from "node:fs";
+import { join as join54, relative as relative8, sep as sep12 } from "node:path";
 init_utils();
 var SHARED_BASELINE_KIND = "shared-links-baseline/1";
 var SHARED_BASELINE_CONFIG_HASH = "not-applicable";
@@ -7560,13 +7897,13 @@ function readSharedBaseline() {
   return parsed;
 }
 function baselineKey(claude, abs) {
-  return relative7(claude, abs).split(sep12).join("/");
+  return relative8(claude, abs).split(sep12).join("/");
 }
 function addLocalPath(abs, claude, scan) {
   const key = baselineKey(claude, abs);
   let st;
   try {
-    st = lstatSync16(abs, { throwIfNoEntry: false });
+    st = lstatSync18(abs, { throwIfNoEntry: false });
   } catch {
     scan.declined.push(key);
     return;
@@ -7585,13 +7922,13 @@ function addLocalPath(abs, claude, scan) {
 function collectSharedFiles(dir, claude, scan) {
   let entries;
   try {
-    entries = readdirSync17(dir);
+    entries = readdirSync18(dir);
   } catch {
     scan.declined.push(baselineKey(claude, dir));
     return;
   }
   for (const entry of entries) {
-    const abs = join51(dir, entry);
+    const abs = join54(dir, entry);
     if (isDeniedName(ALWAYS_NEVER_SYNC, entry)) {
       scan.declined.push(baselineKey(claude, abs));
       continue;
@@ -7607,7 +7944,7 @@ function enumerateLocalSharedScan(map, opts = {}) {
       scan.declined.push(name);
       continue;
     }
-    addLocalPath(join51(claude, name), claude, scan);
+    addLocalPath(join54(claude, name), claude, scan);
   }
   return scan;
 }
@@ -7619,7 +7956,7 @@ function buildSharedBaseline(map, opts = {}) {
   const files = {};
   for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map, opts))) {
     try {
-      files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join51(claude, key)) };
+      files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join54(claude, key)) };
     } catch {
     }
   }
@@ -7636,8 +7973,8 @@ function writeSharedBaseline(map, opts = {}) {
 
 // src/commands.pull.win32.ts
 init_color();
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join56 } from "node:path";
+import { existsSync as existsSync45 } from "node:fs";
+import { join as join59 } from "node:path";
 
 // src/commands.pull.recovery.git.ts
 init_utils();
@@ -7700,8 +8037,8 @@ function gitProbe(args, repo) {
 
 // src/links.deletions.ts
 init_config();
-import { existsSync as existsSync40, lstatSync as lstatSync17, rmSync as rmSync17 } from "node:fs";
-import { join as join52, relative as relative8, resolve as resolve4, sep as sep13 } from "node:path";
+import { existsSync as existsSync41, lstatSync as lstatSync19, rmSync as rmSync17 } from "node:fs";
+import { join as join55, relative as relative9, resolve as resolve5, sep as sep13 } from "node:path";
 init_utils();
 init_utils_fs();
 function isUnknown(declined, key) {
@@ -7711,15 +8048,15 @@ function deletionFor(key, names, claude, sharedRoot) {
   const segments = key.split("/");
   const name = segments[0];
   if (!names.has(name)) return null;
-  if (!existsSync40(join52(claude, name))) return null;
+  if (!existsSync41(join55(claude, name))) return null;
   if (segments.some((segment) => isDeniedName(ALWAYS_NEVER_SYNC, segment))) return null;
-  const repoPath = resolve4(sharedRoot, key);
-  const rel = relative8(join52(sharedRoot, name), repoPath);
+  const repoPath = resolve5(sharedRoot, key);
+  const rel = relative9(join55(sharedRoot, name), repoPath);
   if (rel === "" || rel === ".." || rel.startsWith(`..${sep13}`)) return null;
   if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
     return null;
-  if (!existsSync40(repoPath)) return null;
-  return { kind: "deletion", name, localPath: join52(claude, key), repoPath };
+  if (!existsSync41(repoPath)) return null;
+  return { kind: "deletion", name, localPath: join55(claude, key), repoPath };
 }
 function planSharedLinkDeletions(map, opts = {}) {
   if (process.platform !== "win32") return [];
@@ -7727,7 +8064,7 @@ function planSharedLinkDeletions(map, opts = {}) {
   const baseline = readSharedBaseline();
   if (baseline === null) return [];
   const claude = claudeHome();
-  const sharedRoot = join52(repoHome(), "shared");
+  const sharedRoot = join55(repoHome(), "shared");
   const linkNames = opts.linkNames ?? allSharedLinks(map);
   const scan = enumerateLocalSharedScan(map, { linkNames });
   const present = new Set(Object.keys(scan.files).map((key) => key.toLowerCase()));
@@ -7748,7 +8085,7 @@ function applySharedLinkDeletions(map, ts, opts = {}) {
   const removed = [];
   for (const entry of planSharedLinkDeletions(map, opts)) {
     try {
-      if (!lstatSync17(entry.repoPath).isFile()) continue;
+      if (!lstatSync19(entry.repoPath).isFile()) continue;
       backupRepoWrite(entry.repoPath, ts, repo);
       rmSync17(entry.repoPath, { force: true });
       removed.push(entry);
@@ -7761,8 +8098,8 @@ function applySharedLinkDeletions(map, ts, opts = {}) {
 
 // src/links.mirror.ts
 init_config();
-import { existsSync as existsSync41, lstatSync as lstatSync18, rmSync as rmSync18 } from "node:fs";
-import { join as join53 } from "node:path";
+import { existsSync as existsSync42, lstatSync as lstatSync20, rmSync as rmSync18 } from "node:fs";
+import { join as join56 } from "node:path";
 init_utils();
 init_utils_fs();
 function emitMirror(onPreview, name, localPath, repoPath) {
@@ -7776,16 +8113,22 @@ function emitMirrorWet(onPreview, name, localPath, repoPath) {
   if (onPreview) onPreview({ kind: "mirror", name, localPath, repoPath });
 }
 function notShared(policy, target) {
-  return !policy.adoptNew && !existsSync41(target);
+  return !policy.adoptNew && !existsSync42(target);
 }
 function mirrorOneSharedName(name, claude, repo, policy, opts) {
-  const localPath = join53(claude, name);
-  const target = join53(repo, "shared", name);
+  const localPath = join56(claude, name);
+  const target = join56(repo, "shared", name);
   let stat;
   try {
-    stat = lstatSync18(localPath, { throwIfNoEntry: false });
+    stat = lstatSync20(localPath, { throwIfNoEntry: false });
   } catch (err) {
     if (notShared(policy, target)) return;
+    if (opts.dryRun === true) {
+      warn(
+        `${name} could not be read (${err.message}), so nothing was captured for it and nothing was written. A pull that captures shared edits would skip it too. Check its permissions, or whether another program has it open`
+      );
+      return;
+    }
     warn(
       `${name} could not be read (${err.message}), so it was left out of shared/ this run. Check its permissions, or whether another program has it open`
     );
@@ -7800,9 +8143,9 @@ function mirrorOneSharedName(name, claude, repo, policy, opts) {
   }
   if (policy.backupTs !== void 0) backupRepoWrite(target, policy.backupTs, repo);
   if (policy.overlay && stat.isDirectory()) {
-    copyExtrasOverlayFiltered(localPath, target, NEVER_SYNC);
+    copyExtrasOverlayFiltered(localPath, target, ALWAYS_NEVER_SYNC);
   } else {
-    copyExtrasFiltered(localPath, target, NEVER_SYNC);
+    copyExtrasFiltered(localPath, target, ALWAYS_NEVER_SYNC);
   }
   emitMirrorWet(opts.onPreview, name, localPath, target);
 }
@@ -7817,20 +8160,20 @@ function mirrorSharedNames(map, policy, opts = {}) {
   }
 }
 function syncSharedLinksPush(map, opts = {}) {
-  mirrorSharedNames(map, { adoptNew: true, overlay: false }, opts);
+  mirrorSharedNames(map, { adoptNew: false, overlay: false }, opts);
 }
 function stageLocalSharedEdits(map, ts, opts = {}) {
   mirrorSharedNames(map, { adoptNew: false, overlay: true, backupTs: ts }, opts);
 }
 function presentAt(abs) {
   try {
-    return lstatSync18(abs, { throwIfNoEntry: false }) !== void 0;
+    return lstatSync20(abs, { throwIfNoEntry: false }) !== void 0;
   } catch {
     return true;
   }
 }
 function removeUntrackedDenied(repo, path, segment, ts) {
-  const abs = join53(repo, path);
+  const abs = join56(repo, path);
   const denied = `the path segment "${segment}" is on the never-sync list`;
   if (!presentAt(abs)) {
     warn(
@@ -7838,7 +8181,7 @@ function removeUntrackedDenied(repo, path, segment, ts) {
     );
     return;
   }
-  const snapshotted = existsSync41(abs);
+  const snapshotted = existsSync42(abs);
   try {
     backupRepoWrite(abs, ts, repo);
   } catch (err) {
@@ -7874,7 +8217,7 @@ function reportTrackedDenied(repo, path, segment) {
     );
     return;
   }
-  if (!existsSync41(join53(repo, path))) return;
+  if (!existsSync42(join56(repo, path))) return;
   warn(
     `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run "git checkout HEAD -- ${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: "git rm -- ${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
   );
@@ -7892,8 +8235,8 @@ function revertDeniedMirrorPaths(repo, status, ts) {
 
 // src/preview.ts
 init_config();
-import { existsSync as existsSync43 } from "node:fs";
-import { join as join55 } from "node:path";
+import { existsSync as existsSync44 } from "node:fs";
+import { join as join58 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -8168,16 +8511,16 @@ function diffLinesToUnified(oldStr, newStr) {
 
 // src/preview.skills.ts
 init_config();
-import { existsSync as existsSync42, readdirSync as readdirSync18 } from "node:fs";
-import { join as join54 } from "node:path";
+import { existsSync as existsSync43, readdirSync as readdirSync19 } from "node:fs";
+import { join as join57 } from "node:path";
 function buildSkillsPreviewSection() {
   const s = section("Skills");
-  const sharedSkills = join54(repoHome(), "shared", "skills");
-  if (!existsSync42(sharedSkills)) return s;
-  const sharedNames = readdirSync18(sharedSkills, { encoding: "utf8" }).filter((name) => !isSkillExcluded(name)).sort((a, b) => a.localeCompare(b, "en"));
+  const sharedSkills = join57(repoHome(), "shared", "skills");
+  if (!existsSync43(sharedSkills)) return s;
+  const sharedNames = readdirSync19(sharedSkills, { encoding: "utf8" }).filter((name) => !isSkillExcluded(name)).sort((a, b) => a.localeCompare(b, "en"));
   for (const name of sharedNames) addItem(s, name);
-  const localSkills = join54(claudeHome(), "skills");
-  const localOnly = existsSync42(localSkills) ? readdirSync18(localSkills, { encoding: "utf8" }).filter(
+  const localSkills = join57(claudeHome(), "skills");
+  const localOnly = existsSync43(localSkills) ? readdirSync19(localSkills, { encoding: "utf8" }).filter(
     (name) => !isSkillExcluded(name) && !sharedNames.includes(name)
   ).length : 0;
   if (localOnly > 0) {
@@ -8199,7 +8542,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync43(path)) return null;
+  if (!existsSync44(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -8213,12 +8556,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync43(hostPath)) {
+  if (hostOverrides === null && existsSync44(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = stripGsdHookEntries(deepMerge(base, hostOverrides ?? {}));
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync43(settingsPath)) {
+  if (current === null && existsSync44(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const strippedCurrent = stripGsdHookEntries(current ?? {});
@@ -8285,9 +8628,9 @@ function computePreview(ts, map, verb = "pull", plans) {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join55(repo, "shared", "settings.base.json"),
-    join55(repo, "hosts", `${HOST}.json`),
-    join55(claude, "settings.json")
+    join58(repo, "shared", "settings.base.json"),
+    join58(repo, "hosts", `${HOST}.json`),
+    join58(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -8303,7 +8646,7 @@ function computePreview(ts, map, verb = "pull", plans) {
   const extras = section("Extras");
   let extrasSkipped = 0;
   let extrasUnmapped = 0;
-  if (existsSync43(join55(repo, "path-map.json")) && existsSync43(join55(repo, "shared", "extras"))) {
+  if (existsSync44(join58(repo, "path-map.json")) && existsSync44(join58(repo, "shared", "extras"))) {
     const extrasResult = remapExtrasPull(ts, { dryRun: true });
     for (const entry of extrasResult.wouldPull) {
       addItem(extras, entry);
@@ -8324,7 +8667,7 @@ function computePreview(ts, map, verb = "pull", plans) {
 init_utils();
 init_utils_json();
 function readMapForMirror(mapPath) {
-  if (!existsSync44(mapPath)) return { projects: {} };
+  if (!existsSync45(mapPath)) return { projects: {} };
   try {
     return readPathMap(mapPath);
   } catch {
@@ -8371,7 +8714,7 @@ function reconcileSharedLinksBeforePull(repo, ts) {
   let namesDerived = false;
   let derivedSharedDirs;
   try {
-    const map = readMapForMirror(join56(repo, "path-map.json"));
+    const map = readMapForMirror(join59(repo, "path-map.json"));
     if (map !== null) {
       linkNames = allSharedLinks(map);
       namesDerived = true;
@@ -8410,7 +8753,7 @@ function buildMirrorSection(events, discard) {
 function describeSkippedMirrorDiscard(repo, ts) {
   if (process.platform !== "win32") return null;
   try {
-    const map = readMapForMirror(join56(repo, "path-map.json"));
+    const map = readMapForMirror(join59(repo, "path-map.json"));
     const linkNames = map !== null ? allSharedLinks(map, { quiet: true }) : void 0;
     const captures = [];
     stageLocalSharedEdits(map, ts, {
@@ -8419,13 +8762,13 @@ function describeSkippedMirrorDiscard(repo, ts) {
       linkNames
     });
     if (captures.length === 0) return null;
-    return { count: captures.length, backupPath: join56(backupBase(), ts) };
+    return { count: captures.length, backupPath: join59(backupBase(), ts) };
   } catch {
     return null;
   }
 }
 function planSharedReconcileBeforePull(repo, ts) {
-  const map = readMapForMirror(join56(repo, "path-map.json"));
+  const map = readMapForMirror(join59(repo, "path-map.json"));
   const captures = [];
   const linkNames = process.platform === "win32" && map !== null ? allSharedLinks(map) : void 0;
   stageLocalSharedEdits(map, ts, { dryRun: true, onPreview: (e) => captures.push(e), linkNames });
@@ -8440,8 +8783,8 @@ function planSharedReconcileBeforePull(repo, ts) {
 // src/commands.pull.collision.ts
 init_config();
 init_exit_codes();
-import { existsSync as existsSync45, lstatSync as lstatSync19, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
-import { join as join57 } from "node:path";
+import { existsSync as existsSync46, lstatSync as lstatSync21, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
+import { join as join60 } from "node:path";
 init_utils();
 var SHARED_PREFIX = /^shared\//;
 var EXTENSION = /(\.[^.]+)?$/;
@@ -8497,24 +8840,24 @@ function isContainedMirrorPath(rel) {
 }
 function matchesLocalOriginal(repo, rel) {
   try {
-    const local = join57(claudeHome(), rel.replace(SHARED_PREFIX, ""));
-    return readFileSync20(join57(repo, rel)).equals(readFileSync20(local));
+    const local = join60(claudeHome(), rel.replace(SHARED_PREFIX, ""));
+    return readFileSync20(join60(repo, rel)).equals(readFileSync20(local));
   } catch {
     return false;
   }
 }
 function removeMirroredCopies(repo, repoRelPaths) {
   for (const rel of repoRelPaths.filter(isContainedMirrorPath)) {
-    const abs = join57(repo, rel);
+    const abs = join60(repo, rel);
     try {
-      if (lstatSync19(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
+      if (lstatSync21(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
       if (!matchesLocalOriginal(repo, rel)) continue;
       rmSync19(abs, { force: true });
     } catch (err) {
       warn(`could not remove nomad's copy at ${abs}: ${err.message}`);
     }
   }
-  return repoRelPaths.every((rel) => !existsSync45(join57(repo, rel)));
+  return repoRelPaths.every((rel) => !existsSync46(join60(repo, rel)));
 }
 function pullWithCollisionRunbook(repo, mirrored) {
   try {
@@ -8596,7 +8939,27 @@ function recoverForceRemote(mode, repo) {
   const { synced } = classifyTouched(allTouched);
   if (synced.length > 0) {
     die(
-      "force-remote refused: stranded or dirty tracked changes touch synced config.\nAt-risk paths:\n" + synced.map((p) => `  ${p}`).join("\n") + "\nCopy or cherry-pick those changes out before retrying."
+      "force-remote refused: the sync repo's synced config differs from origin/main.\nDiffering paths:\n" + // Quoted for display only: `-z` hands back raw names, and a path
+      // carrying a newline or a terminal control sequence would otherwise
+      // split or rewrite the recovery steps printed below it. The
+      // classification above uses the raw value.
+      synced.map((p) => `  ${JSON.stringify(p)}`).join("\n") + `
+The comparison runs both ways, so a path can be listed because origin/main is ahead of
+you, with nothing of yours at risk on it.
+
+Manual recovery. Step 1 is not optional: this refusal happens BEFORE recovery parks your
+local commits, so nothing has been saved for you yet and step 3 discards whatever is not
+on another ref.
+  1. git branch nomad-rescue HEAD   (keeps every local commit)
+  2. copy any uncommitted work above OUT of the repo (it exists nowhere else)
+  3. git reset --hard origin/main   (this is what clears the refusal)
+  4. nomad pull
+
+Copying or moving the files alone does not clear it: git still reports a moved file as a
+deletion, and a committed change is still ahead of origin/main. The in-progress rebase or
+merge has ALREADY been aborted, so re-running 'nomad pull --force-remote' now behaves as
+an ordinary pull.
+(see FAQ: "Every pull fails with unmerged files")`
     );
   }
   const branchName = freshStrandedBranch(repo);
@@ -8696,15 +9059,23 @@ function handleWedge(repo, forceRemote) {
   return die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
 }
 function runPullCore(opts = {}) {
+  const backup = backupBase();
+  const ts = freshBackupTs(backup);
+  try {
+    return runPullWithBackupTs(ts, opts);
+  } finally {
+    discardEmptyBackupDir(join61(backup, ts));
+  }
+}
+function runPullWithBackupTs(ts, opts) {
   const dryRun = opts.dryRun === true;
   const forceRemote = opts.forceRemote === true;
   const compose = opts.compose === true;
   const repo = repoHome();
   const backup = backupBase();
-  const ts = freshBackupTs(backup);
   const recovered = handleWedge(repo, forceRemote);
   if (!dryRun) {
-    const backupRoot = join58(backup, ts);
+    const backupRoot = join61(backup, ts);
     try {
       mkdirSync14(backupRoot, { recursive: true });
     } catch (err) {
@@ -8727,8 +9098,8 @@ function runPullCore(opts = {}) {
     pullWithCollisionRunbook(repo, mirrored);
   });
   assertNoAutostashConflict(repo, "nomad pull");
-  const mapPath = join58(repo, "path-map.json");
-  const map = existsSync46(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join61(repo, "path-map.json");
+  const map = existsSync47(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
     computePreview(ts, map, "pull", plansAgainst(sharedPlans, map));
@@ -8755,8 +9126,8 @@ function runPullCore(opts = {}) {
 }
 function cmdPull(opts = {}) {
   const repo = repoHome();
-  if (!existsSync46(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync46(join58(repo, "shared", "settings.base.json"))) {
+  if (!existsSync47(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync47(join61(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -8779,13 +9150,13 @@ function cmdPull(opts = {}) {
 
 // src/commands.push.ts
 init_config();
-import { existsSync as existsSync50 } from "node:fs";
-import { join as join63 } from "node:path";
+import { existsSync as existsSync51 } from "node:fs";
+import { join as join66 } from "node:path";
 
 // src/commands.push.selection.ts
 init_config();
-import { existsSync as existsSync47, statSync as statSync11 } from "node:fs";
-import { join as join59 } from "node:path";
+import { existsSync as existsSync48, statSync as statSync11 } from "node:fs";
+import { join as join62 } from "node:path";
 init_utils_json();
 function buildCurrentMap(map) {
   const current = {};
@@ -8794,8 +9165,8 @@ function buildCurrentMap(map) {
   for (const [, hostMap] of Object.entries(map.projects)) {
     const localPath = hostMap[HOST];
     if (!localPath) continue;
-    const localDir = join59(claude, "projects", encodePath(localPath));
-    if (!existsSync47(localDir)) continue;
+    const localDir = join62(claude, "projects", encodePath(localPath));
+    if (!existsSync48(localDir)) continue;
     for (const f of enumerateSourceFiles(localDir)) {
       const st = statSync11(f);
       current[f] = { size: st.size, mtime: st.mtimeMs };
@@ -8826,7 +9197,7 @@ function computePushSelection(map, old, scannerVersion, configHash, fullScan) {
   };
 }
 function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan) {
-  const map = existsSync47(mapPath) ? readPathMap(mapPath) : null;
+  const map = existsSync48(mapPath) ? readPathMap(mapPath) : null;
   const { selection, newManifest } = computePushSelection(
     map,
     old,
@@ -8919,14 +9290,14 @@ function enforceAllowList(statusPorcelain, map) {
 
 // src/commands.push.settings.ts
 init_config();
-import { existsSync as existsSync48 } from "node:fs";
-import { join as join60 } from "node:path";
+import { existsSync as existsSync49 } from "node:fs";
+import { join as join63 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function stripGsdHooksFromBase(repo, backup) {
-  const basePath = join60(repo, "shared", "settings.base.json");
-  if (!existsSync48(basePath)) return;
+  const basePath = join63(repo, "shared", "settings.base.json");
+  if (!existsSync49(basePath)) return;
   let base;
   try {
     base = readJson(basePath);
@@ -8940,14 +9311,14 @@ function stripGsdHooksFromBase(repo, backup) {
   writeJsonAtomic(basePath, stripped);
 }
 function reportSettingsAheadDrift(repo) {
-  const basePath = join60(repo, "shared", "settings.base.json");
-  if (!existsSync48(basePath)) return;
-  const settingsPath = join60(claudeHome(), "settings.json");
-  if (!existsSync48(settingsPath)) return;
+  const basePath = join63(repo, "shared", "settings.base.json");
+  if (!existsSync49(basePath)) return;
+  const settingsPath = join63(claudeHome(), "settings.json");
+  if (!existsSync49(settingsPath)) return;
   try {
     const base = readJson(basePath);
-    const hostPath = join60(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync48(hostPath) ? readJson(hostPath) : {};
+    const hostPath = join63(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync49(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
     const { ahead } = classifySettingsDrift(merged, settings);
@@ -8964,12 +9335,12 @@ function reportSettingsAheadDrift(repo) {
 // src/commands.push.guards.ts
 init_push_checks();
 init_utils();
-import { join as join61, relative as relative9 } from "node:path";
+import { join as join64, relative as relative10 } from "node:path";
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join61(repo, "shared"));
+  const gitlinks = findGitlinks(join64(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
-    const rel = relative9(repo, p).replaceAll("\\", "/");
+    const rel = relative10(repo, p).replaceAll("\\", "/");
     fail(`gitlink: ${rel} would push as submodule (run: rm -rf ${rel} or remove the nested repo)`);
   }
   const noun = gitlinks.length === 1 ? "entry" : "entries";
@@ -9076,9 +9447,9 @@ init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync20, mkdirSync as mkdirSync15, readdirSync as readdirSync19, rmSync as rmSync20 } from "node:fs";
+import { copyFileSync, existsSync as existsSync50, lstatSync as lstatSync22, mkdirSync as mkdirSync15, readdirSync as readdirSync20, rmSync as rmSync20 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join62, relative as relative10, sep as sep14 } from "node:path";
+import { join as join65, relative as relative11, sep as sep14 } from "node:path";
 init_push_leak_verdict();
 init_push_gitleaks();
 init_utils_fs();
@@ -9090,7 +9461,7 @@ function stageSessionDir(localDir, dstDir, changed) {
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
-      copyFileAtomic(src, join62(dstDir, relative10(localDir, src)));
+      copyFileAtomic(src, join65(dstDir, relative11(localDir, src)));
     }
     return true;
   }
@@ -9106,14 +9477,14 @@ function stageSessions(tmpRoot, map, changed) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join62(claudeHome(), "projects");
-  if (!existsSync49(localProjects)) return 0;
+  const localProjects = join65(claudeHome(), "projects");
+  if (!existsSync50(localProjects)) return 0;
   let staged = 0;
-  for (const dir of readdirSync19(localProjects)) {
+  for (const dir of readdirSync20(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    const localDir = join62(localProjects, dir);
-    const dstDir = join62(tmpRoot, "shared", "projects", logical);
+    const localDir = join65(localProjects, dir);
+    const dstDir = join65(tmpRoot, "shared", "projects", logical);
     if (stageSessionDir(localDir, dstDir, changed)) staged++;
   }
   return staged;
@@ -9127,11 +9498,11 @@ function stageExtras(tmpRoot, map) {
     assertSafeLogical(logical);
     const localRoot = map.projects[logical]?.[HOST];
     if (!localRoot || localRoot === "TBD") continue;
-    for (const dirname14 of dirnames) {
-      if (!whitelist.includes(dirname14)) continue;
-      const src = join62(localRoot, dirname14);
-      if (!existsSync49(src)) continue;
-      const dst = join62(tmpRoot, "shared", "extras", logical, dirname14);
+    for (const dirname15 of dirnames) {
+      if (!whitelist.includes(dirname15)) continue;
+      const src = join65(localRoot, dirname15);
+      if (!existsSync50(src)) continue;
+      const dst = join65(tmpRoot, "shared", "extras", logical, dirname15);
       copyExtras(src, dst);
       staged++;
     }
@@ -9139,19 +9510,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function stageSkills(tmpRoot) {
-  const localSkills = join62(claudeHome(), "skills");
-  const stat = lstatSync20(localSkills, { throwIfNoEntry: false });
+  const localSkills = join65(claudeHome(), "skills");
+  const stat = lstatSync22(localSkills, { throwIfNoEntry: false });
   if (stat === void 0 || stat.isSymbolicLink()) return 0;
-  const names = readdirSync19(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
+  const names = readdirSync20(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
   if (names.length === 0) return 0;
-  copySkillsPush(localSkills, join62(tmpRoot, "shared", "skills"));
+  copySkillsPush(localSkills, join65(tmpRoot, "shared", "skills"));
   return names.length;
 }
 function previewPushLeaks(map, opts = {}) {
-  const cacheDir = join62(homedir7(), ".cache", "claude-nomad");
+  const cacheDir = join65(homedir7(), ".cache", "claude-nomad");
   mkdirSync15(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes4(4).toString("hex")}`;
-  const tmpRoot = join62(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join65(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map, opts.selection?.changed);
     const extrasCount = stageExtras(tmpRoot, map);
@@ -9159,9 +9530,9 @@ function previewPushLeaks(map, opts = {}) {
     if (sessionCount + extrasCount + skillCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join62(repoHome(), ".gitleaksignore");
-    if (existsSync49(ignoreFile)) {
-      copyFileSync(ignoreFile, join62(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join65(repoHome(), ".gitleaksignore");
+    if (existsSync50(ignoreFile)) {
+      copyFileSync(ignoreFile, join65(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -9289,7 +9660,7 @@ async function runPushCore(opts = {}) {
   const scannerVersion = probeGitleaks();
   const configHash = computeConfigHash();
   const old = readManifest(manifestPath());
-  const mapPath = join63(repo, "path-map.json");
+  const mapPath = join66(repo, "path-map.json");
   const { map, selection, newManifest } = loadSelectionForPush(
     mapPath,
     old,
@@ -9342,7 +9713,7 @@ async function cmdPush(opts = {}) {
     opts.allowRule
   );
   const repo = repoHome();
-  if (!existsSync50(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync51(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -9360,8 +9731,8 @@ async function cmdPush(opts = {}) {
 }
 
 // src/commands.sync.ts
-import { existsSync as existsSync51 } from "node:fs";
-import { join as join64 } from "node:path";
+import { existsSync as existsSync52 } from "node:fs";
+import { join as join67 } from "node:path";
 init_config();
 init_color();
 init_utils();
@@ -9502,8 +9873,8 @@ async function cmdSync(opts = {}) {
   const dryRun = opts.dryRun === true;
   const verbose = opts.verbose === true;
   const repo = repoHome();
-  if (!existsSync51(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync51(join64(repo, "shared", "settings.base.json"))) {
+  if (!existsSync52(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync52(join67(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("sync");
@@ -9579,8 +9950,8 @@ init_config();
 // src/crash-report.write.ts
 init_config();
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { mkdirSync as mkdirSync16, readdirSync as readdirSync20, statSync as statSync12, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join66 } from "node:path";
+import { mkdirSync as mkdirSync16, readdirSync as readdirSync21, statSync as statSync12, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join69 } from "node:path";
 
 // src/crash-report.ts
 var CRASH_MAX_STACK_LINES = 50;
@@ -9665,15 +10036,15 @@ function buildCrashReport(input) {
 // src/crash-report.redact.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync21, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join65 } from "node:path";
+import { join as join68 } from "node:path";
 init_push_gitleaks_scan();
 var CRASH_SCAN_TIMEOUT_MS = 3e3;
 var SCAN_UNAVAILABLE_ADVISORY = "\n\n[gitleaks value-based scan unavailable; only structural redaction applied. Review before sharing this file publicly.]\n";
 function redactWithGitleaks(text, scan = scanFile) {
   let dir;
   try {
-    dir = mkdtempSync3(join65(tmpdir2(), "nomad-crash-scan-"));
-    const tmp = join65(dir, "crash.txt");
+    dir = mkdtempSync3(join68(tmpdir2(), "nomad-crash-scan-"));
+    const tmp = join68(dir, "crash.txt");
     writeFileSync10(tmp, text, { mode: 384 });
     const findings = scan(tmp, false, CRASH_SCAN_TIMEOUT_MS);
     if (findings === null) return text + SCAN_UNAVAILABLE_ADVISORY;
@@ -9696,9 +10067,9 @@ init_utils();
 var CRASH_RETENTION_KEEP = 20;
 function listCrashFiles(dir = crashDir()) {
   try {
-    return readdirSync20(dir).flatMap((name) => {
+    return readdirSync21(dir).flatMap((name) => {
       try {
-        return [{ name, mtimeMs: statSync12(join66(dir, name)).mtimeMs }];
+        return [{ name, mtimeMs: statSync12(join69(dir, name)).mtimeMs }];
       } catch {
         return [];
       }
@@ -9712,7 +10083,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
   const targets = prunableByCount(files, keep);
   for (const name of targets) {
     try {
-      unlinkSync2(join66(dir, name));
+      unlinkSync2(join69(dir, name));
     } catch {
     }
   }
@@ -9720,7 +10091,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
 function writeCrashReport(text, dir = crashDir()) {
   mkdirSync16(dir, { recursive: true, mode: 448 });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes5(4).toString("hex")}`;
-  const path = join66(dir, `crash-${stamp}.txt`);
+  const path = join69(dir, `crash-${stamp}.txt`);
   writeFileSync11(path, text, { mode: 384 });
   pruneCrashDir(dir);
   return path;
@@ -9752,18 +10123,18 @@ function handleCrash(err, argv, opts) {
 
 // src/diff.ts
 init_config();
-import { existsSync as existsSync52 } from "node:fs";
-import { join as join67 } from "node:path";
+import { existsSync as existsSync53 } from "node:fs";
+import { join as join70 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync52(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync53(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join67(repo, "path-map.json");
-    const map = existsSync52(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join70(repo, "path-map.json");
+    const map = existsSync53(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     computePreview(ts, map, "diff");
   } catch (err) {
@@ -9778,8 +10149,8 @@ function cmdDiff() {
 
 // src/init.ts
 init_config();
-import { existsSync as existsSync54, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join69 } from "node:path";
+import { existsSync as existsSync55, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join72 } from "node:path";
 
 // src/init.gh-onboard.ts
 init_config();
@@ -9861,33 +10232,33 @@ init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync10, existsSync as existsSync53, rmSync as rmSync22, statSync as statSync13 } from "node:fs";
-import { join as join68 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync9, existsSync as existsSync54, rmSync as rmSync22, statSync as statSync13 } from "node:fs";
+import { join as join71 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join68(claude, name);
-    if (!existsSync53(src)) continue;
-    const dst = join68(repo, "shared", name);
+    const src = join71(claude, name);
+    if (!existsSync54(src)) continue;
+    const dst = join71(repo, "shared", name);
     if (statSync13(src).isDirectory()) {
-      const gk = join68(dst, ".gitkeep");
-      if (existsSync53(gk)) rmSync22(gk);
-      cpSync10(src, dst, { recursive: true, force: false, errorOnExist: true });
+      const gk = join71(dst, ".gitkeep");
+      if (existsSync54(gk)) rmSync22(gk);
+      cpSync9(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join68(claude, "settings.json");
-  if (existsSync53(userSettings)) {
+  const userSettings = join71(claude, "settings.json");
+  if (existsSync54(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join68(repo, "hosts", `${HOST}.json`);
+    const hostFile = join71(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
@@ -9901,14 +10272,14 @@ var GITATTRIBUTES = "# nomad: sync content is byte-managed, disable all line-end
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join69(repoHome2, "shared", "settings.base.json"),
-    join69(repoHome2, "shared", "CLAUDE.md"),
-    join69(repoHome2, "path-map.json"),
-    join69(repoHome2, "hosts"),
-    join69(repoHome2, "shared")
+    join72(repoHome2, "shared", "settings.base.json"),
+    join72(repoHome2, "shared", "CLAUDE.md"),
+    join72(repoHome2, "path-map.json"),
+    join72(repoHome2, "hosts"),
+    join72(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync54(c)) return c;
+    if (existsSync55(c)) return c;
   }
   return null;
 }
@@ -9926,27 +10297,27 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync17(join69(repo, "shared"), { recursive: true });
-  mkdirSync17(join69(repo, "hosts"), { recursive: true });
+  mkdirSync17(join72(repo, "shared"), { recursive: true });
+  mkdirSync17(join72(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync17(join69(repo, "shared", name), { recursive: true });
+    mkdirSync17(join72(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join69(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync54(userClaudeMd)) {
-    writeFileSync12(join69(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join72(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync55(userClaudeMd)) {
+    writeFileSync12(join72(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync12(join69(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync12(join72(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync12(join69(repo, "hosts", ".gitkeep"), "");
+  writeFileSync12(join72(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join69(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join72(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join69(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join72(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
-  writeFileSync12(join69(repo, ".gitattributes"), GITATTRIBUTES);
+  writeFileSync12(join72(repo, ".gitattributes"), GITATTRIBUTES);
   item("created .gitattributes");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -10012,21 +10383,21 @@ function maybeDisableRepoActions(repoHome2, run) {
 // src/init.prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync55, readdirSync as readdirSync21, statSync as statSync14 } from "node:fs";
-import { join as join70 } from "node:path";
+import { existsSync as existsSync56, readdirSync as readdirSync22, statSync as statSync14 } from "node:fs";
+import { join as join73 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync55(path)) return false;
+  if (!existsSync56(path)) return false;
   try {
-    if (statSync14(path).isDirectory()) return readdirSync21(path).length > 0;
+    if (statSync14(path).isDirectory()) return readdirSync22(path).length > 0;
     return true;
   } catch {
     return false;
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync55(join70(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join70(claudeHome2, name)));
+  if (existsSync56(join73(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join73(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -10333,7 +10704,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.65.0",
+  version: "0.67.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -10562,7 +10933,9 @@ var DEFAULT_HELP = [
   row("       --backups", "Required: confirm backup pruning is the intended target."),
   row("       --dry-run", "List the snapshots that would be removed without deleting."),
   row("       --older-than <dur>", "Delete snapshots older than a duration (e.g. 14d, 24h, 30m)."),
-  cont("Default when no retention flag is given: 14d."),
+  cont("Default when no retention flag is given: 14d. A snapshot holding"),
+  cont("nothing is removed in every mode, whatever its age, and never"),
+  cont("uses up one of the --keep slots."),
   row("       --keep <N>", "Keep the N most-recent snapshots, delete the rest. Mutually"),
   cont("exclusive with --older-than."),
   "",
@@ -10578,15 +10951,15 @@ var DEFAULT_HELP = [
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync56, readFileSync as readFileSync21, readdirSync as readdirSync22 } from "node:fs";
-import { join as join71 } from "node:path";
+import { existsSync as existsSync57, readFileSync as readFileSync21, readdirSync as readdirSync23 } from "node:fs";
+import { join as join74 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join71(claudeHome(), "projects");
-  if (!existsSync56(projectsRoot)) {
+  const projectsRoot = join74(claudeHome(), "projects");
+  if (!existsSync57(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -10600,8 +10973,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join71(repoHome(), "path-map.json");
-  if (!existsSync56(mapPath)) {
+  const mapPath = join74(repoHome(), "path-map.json");
+  if (!existsSync57(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -10623,9 +10996,9 @@ function resumeCmd(sessionId) {
   console.log(`cd ${shQuote(hit.localPath)} && claude --resume ${shQuote(sessionId)}`);
 }
 function findTranscriptPath(projectsRoot, sessionId) {
-  for (const dir of readdirSync22(projectsRoot)) {
-    const candidate = join71(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync56(candidate)) return candidate;
+  for (const dir of readdirSync23(projectsRoot)) {
+    const candidate = join74(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync57(candidate)) return candidate;
   }
   return null;
 }