claude-nomad 0.66.0 → 0.67.1

package/CHANGELOG.md

@@ -1,58 +1,77 @@
 # Changelog
 
+## [0.67.1](https://github.com/funkadelic/claude-nomad/compare/v0.67.0...v0.67.1) (2026-08-20)
+
+### What's new
+
+**On all supported platforms, i.e. \*nix, Mac, WSL2, and native Windows.**
+
+- **A project in a folder named `sessions`, `tasks`, `plans`, or `cache` now syncs its own history.** Those names, along with `debug`, `jobs`, `security`, and a few more, belong to nomad's own working folders, so a project of yours that happened to share one was refused as though it held something private. Nothing in it was, and the name alone decided it. Those projects now sync like any other, and nomad still checks what is actually inside a folder exactly as before.
+- **A per-host settings file sitting at the very top of a folder you share now stays out of your sync repo.** Inside a folder you opted into sharing, nomad already blocked `settings.local.json` and anything else shaped like a credential file at every level except the very top, where one could slip past and reach your other machines. The top level is now covered too.
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and none of these apply to it.
+
+- **A pull no longer removes that project's transcripts from your sync repo.** The same name check ran during a pull, where it deleted rather than refused, so every pull stripped that project's saved history out of the sync repo. Each one left a backup under `~/.cache/claude-nomad/backup/`, but never put anything back. Pulls now leave those projects alone.
+- **When a sync cannot remove or back up a file, it now tells you why.** These warnings sometimes printed the word `undefined` where the reason belongs, so you got a filename and nothing else. They now carry the real reason. A failure arriving in an unexpected form could also stop the cleanup partway through, leaving the files after the first problem unhandled and unmentioned. The pass now runs to the end and reports everything it did.
+
+
+### Fixed
+
+* **config:** stop a project's own folder name from blocking its history ([#536](https://github.com/funkadelic/claude-nomad/issues/536)) ([1994c55](https://github.com/funkadelic/claude-nomad/commit/1994c55a32c62220e8d7291554f95099b2c12eba))
+* **mirror:** name the reason in sync warnings instead of undefined ([#537](https://github.com/funkadelic/claude-nomad/issues/537)) ([e973ff3](https://github.com/funkadelic/claude-nomad/commit/e973ff392e369694e517c5aabfb26c996836378f))
+
+
+### Changed
+
+* **codeql:** exclude test files from security scanning ([#534](https://github.com/funkadelic/claude-nomad/issues/534)) ([c86a6d3](https://github.com/funkadelic/claude-nomad/commit/c86a6d3c80a640e0a251181c8c0461edef2375da))
+
+
+### Dependencies
+
+* bump fast-uri from 3.1.4 to 3.1.5 ([#527](https://github.com/funkadelic/claude-nomad/issues/527)) ([6a8f6ba](https://github.com/funkadelic/claude-nomad/commit/6a8f6baa534dae9d9e6786acf96627c85bb8d400))
+* bump js-yaml from 4.3.0 to 4.3.1 in /docs-site ([#529](https://github.com/funkadelic/claude-nomad/issues/529)) ([a4e541f](https://github.com/funkadelic/claude-nomad/commit/a4e541fd74100527306ebaa713a2a730ffe98af7))
+* bump nanoid from 3.3.15 to 3.3.18 in /docs-site ([#531](https://github.com/funkadelic/claude-nomad/issues/531)) ([0a0f53e](https://github.com/funkadelic/claude-nomad/commit/0a0f53ee46e3b69babd82b84e39c6982791f8896))
+* bump postcss from 8.5.15 to 8.5.26 in /docs-site ([#530](https://github.com/funkadelic/claude-nomad/issues/530)) ([413f75d](https://github.com/funkadelic/claude-nomad/commit/413f75db6c292785f6b7d67fbd629680d5b39e04))
+* bump postcss from 8.5.16 to 8.5.26 ([#532](https://github.com/funkadelic/claude-nomad/issues/532)) ([b03bd62](https://github.com/funkadelic/claude-nomad/commit/b03bd62ab77249bdcc31c78ac2440da434b2de39))
+* bump svgo from 4.0.1 to 4.0.2 in /docs-site ([#528](https://github.com/funkadelic/claude-nomad/issues/528)) ([a424693](https://github.com/funkadelic/claude-nomad/commit/a4246932d01a79082383d6a09e08e7542eb7a873))
+
+## [0.67.0](https://github.com/funkadelic/claude-nomad/compare/v0.66.0...v0.67.0) (2026-08-18)
+
+### What's new
+
+**On all supported platforms, i.e. \*nix, Mac, WSL2, and native Windows.**
+
+- **Your backup cache no longer collects empty folders.** Every sync saves a copy of anything it is about to overwrite into a dated folder under `~/.cache/claude-nomad/backup/`, and it creates that folder before it touches your files so a full disk or a permissions problem stops the sync before it has changed anything. A sync that turns out to have nothing to save now clears its own folder instead of leaving an empty one behind, and so does one that stops early.
+- **`nomad clean --backups` removes empty backup folders whatever their age.** They hold nothing to recover, so neither the 14-day default nor `--keep <N>` keeps one alive, and they no longer use up the slots `--keep <N>` reserves: ask for the five newest and you get the five newest that actually hold something. Backups holding anything at all, a file or even a link, are left exactly as before. `nomad clean --backups --dry-run` always prints its preview, since it changes nothing and never waits on another command.
+- **`nomad adopt` no longer runs at the same time as a pull, push, or sync.** It waits its turn the way those commands already wait for each other, so a cleanup or a sync running in another terminal cannot remove or overwrite a backup that adopt is still writing. If another one is already running, adopt says so and does nothing rather than starting a move it cannot finish safely. Previewing with `nomad adopt <name> --dry-run` never waits, since it only reads and prints.
+
+
+### Added
+
+* clean up the empty folders in your backup cache ([#525](https://github.com/funkadelic/claude-nomad/issues/525)) ([3f5ae92](https://github.com/funkadelic/claude-nomad/commit/3f5ae92e46173364f5e9c66e4963bcc716c813e6))
+
+
+### Fixed
+
+* **ci:** base the drift branch on main on a dispatch run ([#524](https://github.com/funkadelic/claude-nomad/issues/524)) ([3e94c1e](https://github.com/funkadelic/claude-nomad/commit/3e94c1e2df9296a539c71eac873058cb69225d78))
+
 ## [0.66.0](https://github.com/funkadelic/claude-nomad/compare/v0.65.0...v0.66.0) (2026-08-17)
 
 ### What's new
 
 **On all supported platforms, i.e. \*nix, Mac, WSL2, and native Windows.**
 
-- **A folder you share now carries everything inside it.** If you share a folder through
-  `sharedDirs`, its subfolders travel with it, including ones with everyday names like `sessions`,
-  `plans`, `tasks`, and `cache`. Those names used to be refused wherever they appeared, so a push
-  could fail, or `nomad adopt` could turn you away, over a folder holding nothing sensitive. Your
-  Claude login, your credential files, your per-host settings, and your local history still never
-  leave the machine, in either direction.
-- **`nomad adopt` checks the whole folder before it moves anything.** It used to copy everything,
-  so a file that never syncs between machines could land in your repo and fail your next push, on
-  content you never chose to add. Adopt now stops before touching anything and names every path it
-  objected to and why: a name that collides with the never-sync list, which renaming clears, or a
-  name that looks like a credential file, where renaming only helps if the new name looks different
-  too. `--dry-run` gives exactly the same answer as the real run, so you can check a folder before
-  committing to it.
-- **An interrupted `nomad adopt` now explains itself instead of writing a crash report.** If
-  another program has the directory open, or its permissions block the move partway through, the
-  command says what happened, where your content ended up, and what to run next. Your content is
-  safe in every one of these cases: either it was never touched on this machine, or it is already
-  in the repo.
-
-**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and none of these apply to
-it.
-
-- **A push no longer publishes a folder you never asked to share.** Windows keeps your shared
-  config as real file copies rather than symlinks, and a push used to pick up any folder sitting in
-  your Claude directory and publish it to your other machines. Sharing is now the same deliberate
-  step it has always been on macOS and Linux: run `nomad adopt <name>` once, then push. Your
-  existing shared folders keep syncing exactly as before.
-- **`nomad doctor --verbose` names a folder your repo does not carry yet.** It lists the local
-  copies that are still private to this machine, and the command that shares one.
-- **One unreadable file no longer ends your pull.** A single config file that another program has
-  open, or that your account cannot read, used to stop the whole pull with a crash report. Nomad
-  now names the file and the reason, then carries on: your settings, your skills, and your session
-  history all still sync, and the command finishes normally. The warning also says whether the file
-  is still there or has been removed, and points at the backup copy when there is one.
-- **`nomad adopt` recovers cleanly when it cannot restore your local copy.** Adopt finishes by
-  copying the folder back out of the sync repo so this machine keeps a usable copy. If that copy
-  was blocked, the command used to end in a crash report, with the folder gone from your Claude
-  directory and nothing staged for publishing. It now stops with a plain message naming the folder
-  and the reason, stages the adopted content either way, and tells you to run `nomad pull` before
-  your next push and why that order matters. A half written folder left behind by the interrupted
-  copy is removed, so a later push cannot replace your adopted folder with the partial one.
-- **A refused `nomad pull --force-remote` now tells you what actually clears it.** The old advice
-  did not work, and would land you back on the same refusal. The message now gives the steps that
-  finish the job and names the one that clears the check, and it says that the stuck rebase has
-  already been undone by that point, so retrying is now just an ordinary pull. It no longer calls
-  every listed file at risk, since the list can include files where the shared repo is simply ahead
-  of yours. The quickstart says the same thing and links to the matching recovery steps in the FAQ.
+- **A folder you share now carries everything inside it.** If you share a folder through `sharedDirs`, its subfolders travel with it, including ones with everyday names like `sessions`, `plans`, `tasks`, and `cache`. Those names used to be refused wherever they appeared, so a push could fail, or `nomad adopt` could turn you away, over a folder holding nothing sensitive. Your Claude login, your credential files, your per-host settings, and your local history still never leave the machine, in either direction.
+- **`nomad adopt` checks the whole folder before it moves anything.** It used to copy everything, so a file that never syncs between machines could land in your repo and fail your next push, on content you never chose to add. Adopt now stops before touching anything and names every path it objected to and why: a name that collides with the never-sync list, which renaming clears, or a name that looks like a credential file, where renaming only helps if the new name looks different too. `--dry-run` gives exactly the same answer as the real run, so you can check a folder before committing to it.
+- **An interrupted `nomad adopt` now explains itself instead of writing a crash report.** If another program has the directory open, or its permissions block the move partway through, the command says what happened, where your content ended up, and what to run next. Your content is safe in every one of these cases: either it was never touched on this machine, or it is already in the repo.
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and none of these apply to it.
+
+- **A push no longer publishes a folder you never asked to share.** Windows keeps your shared config as real file copies rather than symlinks, and a push used to pick up any folder sitting in your Claude directory and publish it to your other machines. Sharing is now the same deliberate step it has always been on macOS and Linux: run `nomad adopt <name>` once, then push. Your existing shared folders keep syncing exactly as before.
+- **`nomad doctor --verbose` names a folder your repo does not carry yet.** It lists the local copies that are still private to this machine, and the command that shares one.
+- **One unreadable file no longer ends your pull.** A single config file that another program has open, or that your account cannot read, used to stop the whole pull with a crash report. Nomad now names the file and the reason, then carries on: your settings, your skills, and your session history all still sync, and the command finishes normally. The warning also says whether the file is still there or has been removed, and points at the backup copy when there is one.
+- **`nomad adopt` recovers cleanly when it cannot restore your local copy.** Adopt finishes by copying the folder back out of the sync repo so this machine keeps a usable copy. If that copy was blocked, the command used to end in a crash report, with the folder gone from your Claude directory and nothing staged for publishing. It now stops with a plain message naming the folder and the reason, stages the adopted content either way, and tells you to run `nomad pull` before your next push and why that order matters. A half written folder left behind by the interrupted copy is removed, so a later push cannot replace your adopted folder with the partial one.
+- **A refused `nomad pull --force-remote` now tells you what actually clears it.** The old advice did not work, and would land you back on the same refusal. The message now gives the steps that finish the job and names the one that clears the check, and it says that the stuck rebase has already been undone by that point, so retrying is now just an ordinary pull. It no longer calls every listed file at risk, since the list can include files where the shared repo is simply ahead of yours. The quickstart says the same thing and links to the matching recovery steps in the FAQ.
 
 
 ### Added
@@ -81,39 +100,16 @@ it.
 
 ### What's new
 
-**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and none of these apply to
-it.
-
-- **`nomad pull --force-remote` no longer discards edits you have not published.** The flag exists
-  to rescue a sync repo that got stuck part-way through an update. On native Windows it also skipped
-  the step that saves your local shared-config edits into the repo, every time it ran, even on a
-  healthy machine with nothing to rescue. That was the flag's only visible effect on a healthy repo,
-  and nothing told you it had happened. It now rescues a stuck repo and nothing else, and when a
-  rescue genuinely does replace your copies, the pull says how many and where your previous ones
-  were saved.
-- **A pull now says what it did to your shared config.** On Windows your shared config is kept as
-  real file copies rather than symlinks, so every pull starts by copying your local edits into the
-  sync repo. That step used to be silent. It now prints a `Symlinks` section naming each file it
-  picked up, and each file it removed from the repo because you deleted it here. If a file cannot be
-  read at all, because another program is holding it open or its permissions changed, the pull names
-  it and says why rather than leaving a silent gap. `nomad diff` and `nomad pull --dry-run` read
-  from the same place, so a preview now matches what a real pull does.
-- **Windows keeps the same things out of your sync repo that your other machines do.** The Windows
-  copy step used to hold back only files whose names looked like passwords or keys. It now skips
-  everything on the never-sync list, so the folders Claude Code uses for its own state, named things
-  like `sessions`, `tasks`, `plans`, and `cache`, stay on the machine even when they sit inside a
-  folder you share. If one of them is already sitting in your sync repo, the pull tells you, and
-  takes a backup copy before removing it.
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and none of these apply to it.
+
+- **`nomad pull --force-remote` no longer discards edits you have not published.** The flag exists to rescue a sync repo that got stuck part-way through an update. On native Windows it also skipped the step that saves your local shared-config edits into the repo, every time it ran, even on a healthy machine with nothing to rescue. That was the flag's only visible effect on a healthy repo, and nothing told you it had happened. It now rescues a stuck repo and nothing else, and when a rescue genuinely does replace your copies, the pull says how many and where your previous ones were saved.
+- **A pull now says what it did to your shared config.** On Windows your shared config is kept as real file copies rather than symlinks, so every pull starts by copying your local edits into the sync repo. That step used to be silent. It now prints a `Symlinks` section naming each file it picked up, and each file it removed from the repo because you deleted it here. If a file cannot be read at all, because another program is holding it open or its permissions changed, the pull names it and says why rather than leaving a silent gap. `nomad diff` and `nomad pull --dry-run` read from the same place, so a preview now matches what a real pull does.
+- **Windows keeps the same things out of your sync repo that your other machines do.** The Windows copy step used to hold back only files whose names looked like passwords or keys. It now skips everything on the never-sync list, so the folders Claude Code uses for its own state, named things like `sessions`, `tasks`, `plans`, and `cache`, stay on the machine even when they sit inside a folder you share. If one of them is already sitting in your sync repo, the pull tells you, and takes a backup copy before removing it.
 
 **On all supported platforms, i.e. \*nix, Mac, WSL2, and native Windows.**
 
-- **`nomad doctor` names the files that have drifted.** When it reports that your skills or your
-  shared config no longer match the repo, it lists them. Before, you got a count and had to run it
-  again with `--verbose` to find out which files it meant.
-- **`nomad pull --force-remote` tells you when there was nothing to rescue.** On a repo that is not
-  stuck it now says so and pulls normally, instead of appearing to do nothing. If it cannot tell
-  whether the repo is stuck, it says that too rather than reporting a clean repo. The help text,
-  README, and docs site now agree on what the flag does.
+- **`nomad doctor` names the files that have drifted.** When it reports that your skills or your shared config no longer match the repo, it lists them. Before, you got a count and had to run it again with `--verbose` to find out which files it meant.
+- **`nomad pull --force-remote` tells you when there was nothing to rescue.** On a repo that is not stuck it now says so and pulls normally, instead of appearing to do nothing. If it cannot tell whether the repo is stuck, it says that too rather than reporting a clean repo. The help text, README, and docs site now agree on what the flag does.
 
 
 ### Added
@@ -152,21 +148,9 @@ it.
 
 ### What's new
 
-- **A stray dot or space at the end of a file name no longer hides a secret.** nomad never copies
-  password and key files (things like `.env`, `id_rsa`, or `server.pem`) out of the project folders
-  you sync. It spots them by name, and a name with an extra dot or space on the end, such as
-  `.env.`, did not match, so a file like that could end up in your sync repo. It matches now, and so
-  do the other files nomad always keeps out, such as `settings.local.json`. Nothing changes in how
-  you use nomad. It simply catches more ways of writing the same names it already blocked.
-- **A `.claude` folder is recognized however it is capitalized.** If a project had a folder named
-  `.Claude` instead of `.claude`, nomad checked what was inside it less carefully than it should
-  have. Both are treated the same now.
-- **A folder name nomad will never sync is turned down as soon as you add it.** You can ask nomad to
-  sync extra folders by listing their names in `path-map.json`. If a name you list is one nomad
-  refuses to sync, because it looks like a password file, or because it is a name that causes
-  trouble on one of the machines you sync to, you are told straight away and told why. Before,
-  nothing was said until a later `nomad push` stopped without explaining itself. `nomad doctor` also
-  lists any names in this situation and what to do about them.
+- **A stray dot or space at the end of a file name no longer hides a secret.** nomad never copies password and key files (things like `.env`, `id_rsa`, or `server.pem`) out of the project folders you sync. It spots them by name, and a name with an extra dot or space on the end, such as `.env.`, did not match, so a file like that could end up in your sync repo. It matches now, and so do the other files nomad always keeps out, such as `settings.local.json`. Nothing changes in how you use nomad. It simply catches more ways of writing the same names it already blocked.
+- **A `.claude` folder is recognized however it is capitalized.** If a project had a folder named `.Claude` instead of `.claude`, nomad checked what was inside it less carefully than it should have. Both are treated the same now.
+- **A folder name nomad will never sync is turned down as soon as you add it.** You can ask nomad to sync extra folders by listing their names in `path-map.json`. If a name you list is one nomad refuses to sync, because it looks like a password file, or because it is a name that causes trouble on one of the machines you sync to, you are told straight away and told why. Before, nothing was said until a later `nomad push` stopped without explaining itself. `nomad doctor` also lists any names in this situation and what to do about them.
 
 All of this applies on macOS, Linux, WSL2, and native Windows.
 
@@ -185,31 +169,11 @@ All of this applies on macOS, Linux, WSL2, and native Windows.
 
 ### What's new
 
-- **Native Windows: deleting a shared config file now sticks.** On native Windows (PowerShell or
-  cmd), deleting a file inside a synced folder, say `~/.claude/commands/old.md`, used to leave it
-  sitting in the sync repo, and the next `nomad pull` put it straight back. The deletion is now
-  carried into the sync repo instead, so it survives the pull and reaches your other machines.
-  Nothing is removed unless this machine's own record shows it had the file, and every removed file
-  is copied to the backup directory first. The first pull after upgrading has no record yet, so
-  deletions start propagating from the pull after that. macOS, Linux, and WSL2 were never affected:
-  they symlink shared config, so deleting the file was always a deletion in the repo.
-- **Native Windows: a name clash during a pull now explains itself.** If a file you created inside a
-  synced folder has the same name as one an incoming update adds, the pull stops before changing
-  anything. You used to be left with git's own error, which pointed at a copy inside the sync repo
-  and told you to move it, and following that advice looped, because the next pull copied your file
-  back over it. You now get the file under `~/.claude/` to act on and the two ways to finish, keep
-  the incoming version or keep both and merge them, and nomad clears its own copy out of the way for
-  you. Your file is untouched either way.
-- **Native Windows shared-config changes show up in a preview first.** `nomad pull --dry-run` and
-  `nomad diff` now list both the edits being carried into the repo and the files being removed from
-  it, worked out before the pull so the preview and the real run agree.
-- **`nomad doctor` notices a native Windows shared file that has drifted.** When a synced copy under
-  `~/.claude/` no longer matches the one in the repo, doctor warns about it instead of reporting the
-  machine as healthy. On the symlink platforms there is only ever one file, so there is nothing to
-  drift.
-- **`nomad doctor` no longer recognizes `leftArrowOpensAgents`.** Claude Code dropped it from its
-  settings schema, so doctor will flag it as an unknown key if you still have it set. This one
-  applies everywhere, not just on Windows.
+- **Native Windows: deleting a shared config file now sticks.** On native Windows (PowerShell or cmd), deleting a file inside a synced folder, say `~/.claude/commands/old.md`, used to leave it sitting in the sync repo, and the next `nomad pull` put it straight back. The deletion is now carried into the sync repo instead, so it survives the pull and reaches your other machines. Nothing is removed unless this machine's own record shows it had the file, and every removed file is copied to the backup directory first. The first pull after upgrading has no record yet, so deletions start propagating from the pull after that. macOS, Linux, and WSL2 were never affected: they symlink shared config, so deleting the file was always a deletion in the repo.
+- **Native Windows: a name clash during a pull now explains itself.** If a file you created inside a synced folder has the same name as one an incoming update adds, the pull stops before changing anything. You used to be left with git's own error, which pointed at a copy inside the sync repo and told you to move it, and following that advice looped, because the next pull copied your file back over it. You now get the file under `~/.claude/` to act on and the two ways to finish, keep the incoming version or keep both and merge them, and nomad clears its own copy out of the way for you. Your file is untouched either way.
+- **Native Windows shared-config changes show up in a preview first.** `nomad pull --dry-run` and `nomad diff` now list both the edits being carried into the repo and the files being removed from it, worked out before the pull so the preview and the real run agree.
+- **`nomad doctor` notices a native Windows shared file that has drifted.** When a synced copy under `~/.claude/` no longer matches the one in the repo, doctor warns about it instead of reporting the machine as healthy. On the symlink platforms there is only ever one file, so there is nothing to drift.
+- **`nomad doctor` no longer recognizes `leftArrowOpensAgents`.** Claude Code dropped it from its settings schema, so doctor will flag it as an unknown key if you still have it set. This one applies everywhere, not just on Windows.
 
 
 ### Added
@@ -235,17 +199,9 @@ All of this applies on macOS, Linux, WSL2, and native Windows.
 
 ### What's new
 
-- **`nomad doctor` stops warning about settings you legitimately set.** The list of settings it
-  recognizes has been updated and synced with the current Claude Code settings schema, so settings
-  the app actually writes (quiet hours, the break reminder, the token-usage reminder, and others)
-  are no longer reported as unknown keys on an otherwise healthy machine. Entries that were never
-  settings at all have been dropped at the same time.
-- **A new Claude Code setting is recognized within a day.** The job that tracks the official
-  settings list ran once a week, so a setting added on a Tuesday could be reported as unknown until
-  the following Monday. It now runs daily.
-- **The list keeps its own bookkeeping straight from here.** When a setting Claude Code writes
-  ahead of its published documentation is later documented, it now moves across on its own instead
-  of being recorded in two places at once.
+- **`nomad doctor` stops warning about settings you legitimately set.** The list of settings it recognizes has been updated and synced with the current Claude Code settings schema, so settings the app actually writes (quiet hours, the break reminder, the token-usage reminder, and others) are no longer reported as unknown keys on an otherwise healthy machine. Entries that were never settings at all have been dropped at the same time.
+- **A new Claude Code setting is recognized within a day.** The job that tracks the official settings list ran once a week, so a setting added on a Tuesday could be reported as unknown until the following Monday. It now runs daily.
+- **The list keeps its own bookkeeping straight from here.** When a setting Claude Code writes ahead of its published documentation is later documented, it now moves across on its own instead of being recorded in two places at once.
 
 
 ### Fixed
@@ -276,18 +232,9 @@ All of this applies on macOS, Linux, WSL2, and native Windows.
 
 ### What's new
 
-- **Windows: your own edits to shared config are no longer reverted.** On Windows, editing a synced
-  file like `~/.claude/CLAUDE.md` and then running `nomad pull` overwrote it from the repo, and
-  `nomad sync` went on to publish the reverted version, silently undoing the change you ran sync to
-  publish. Your edit is now carried into the sync repo first, so it survives the pull and gets
-  published instead.
-- **The secret prompt on push is readable and asks once per secret.** When a push finds a possible
-  secret it used to ask the same question several times over for one secret, and the snippet it
-  showed was mostly noise. It now asks once per secret and describes what was actually found, so you
-  can tell a real credential from a false positive at a glance.
-- **Three ways that prompt could show you a secret it meant to hide are closed**, along with a case
-  where allowing one false positive could quietly let a real secret through beside it on the same
-  line.
+- **Windows: your own edits to shared config are no longer reverted.** On Windows, editing a synced file like `~/.claude/CLAUDE.md` and then running `nomad pull` overwrote it from the repo, and `nomad sync` went on to publish the reverted version, silently undoing the change you ran sync to publish. Your edit is now carried into the sync repo first, so it survives the pull and gets published instead.
+- **The secret prompt on push is readable and asks once per secret.** When a push finds a possible secret it used to ask the same question several times over for one secret, and the snippet it showed was mostly noise. It now asks once per secret and describes what was actually found, so you can tell a real credential from a false positive at a glance.
+- **Three ways that prompt could show you a secret it meant to hide are closed**, along with a case where allowing one false positive could quietly let a real secret through beside it on the same line.
 
 
 ### Added

package/dist/nomad.mjs

@@ -70,6 +70,9 @@ function regionKey(segment) {
 function isExtrasScoped(segments) {
   return segments[0] === "shared" && segments.length > 1 && regionKey(segments[1]) === "extras";
 }
+function isLogicalNameScoped(segments) {
+  return segments[0] === "shared" && segments.length > 1 && UNFILTERED_SHARED_REGIONS.has(regionKey(segments[1]));
+}
 function isSharedNameScoped(segments) {
   return segments[0] === "shared" && segments.length > 1 && !UNFILTERED_SHARED_REGIONS.has(regionKey(segments[1]));
 }
@@ -83,7 +86,7 @@ function blockSetFor(segments) {
 function deniedSegmentFor(path) {
   const segments = path.split("/");
   const blockSet = blockSetFor(segments);
-  const scan = isExtrasScoped(segments) ? segments.slice(4) : segments;
+  const scan = isLogicalNameScoped(segments) && segments.length > 3 ? segments.slice(3) : segments;
   for (const segment of scan) {
     if (isDeniedName(blockSet, segment)) return segment;
   }
@@ -807,6 +810,7 @@ import {
   mkdirSync,
   openSync,
   renameSync,
+  rmdirSync,
   statSync,
   symlinkSync,
   writeFileSync
@@ -867,6 +871,12 @@ function freshBackupTs(backupRoot) {
   while (existsSync3(join5(backupRoot, `${base}-${n}`))) n++;
   return `${base}-${n}`;
 }
+function discardEmptyBackupDir(backupRoot) {
+  try {
+    rmdirSync(backupRoot);
+  } catch {
+  }
+}
 function ensureSymlink(linkPath, target) {
   if (existsSync3(linkPath)) {
     if (lstatSync4(linkPath).isSymbolicLink()) return;
@@ -1549,7 +1559,7 @@ var init_push_leak_verdict = __esm({
 
 // src/commands.adopt.ts
 import { existsSync as existsSync5, lstatSync as lstatSync7 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/commands.adopt.recover.ts
 import { lstatSync as lstatSync6, rmSync as rmSync4 } from "node:fs";
@@ -1557,10 +1567,22 @@ import { dirname as dirname2, join as join7, resolve as resolve2 } from "node:pa
 
 // src/commands.adopt.scan.ts
 init_config();
-init_exit_codes();
-init_utils();
 import { lstatSync, readdirSync } from "node:fs";
 import { join as join2, relative } from "node:path";
+
+// src/error-text.ts
+function errorText(err) {
+  try {
+    const message = err?.message;
+    return typeof message === "string" ? message : String(err);
+  } catch {
+    return "unprintable error value";
+  }
+}
+
+// src/commands.adopt.scan.ts
+init_exit_codes();
+init_utils();
 function toForwardSlash(p) {
   return p.replaceAll("\\", "/");
 }
@@ -1589,10 +1611,8 @@ function scanOrFatal(name, root, state) {
   try {
     return scanDeniedEntries(root);
   } catch (err) {
-    const message = err?.message;
-    const text = typeof message === "string" ? message : String(err);
     throw new NomadFatal(
-      `cannot adopt ${name}: could not scan ${root} for never-sync content (${text}). ${state()} Check that it is readable and not being written to, then run \`nomad adopt ${name}\` again.`,
+      `cannot adopt ${name}: could not scan ${root} for never-sync content (${errorText(err)}). ${state()} Check that it is readable and not being written to, then run \`nomad adopt ${name}\` again.`,
       { code: EXIT.GENERIC_FAILURE }
     );
   }
@@ -2332,10 +2352,6 @@ function regenerateSettings(ts, opts = {}) {
 
 // src/commands.adopt.recover.ts
 init_utils();
-function errorText(err) {
-  const message = err?.message;
-  return typeof message === "string" ? message : String(err);
-}
 function lexists(p) {
   try {
     lstatSync6(p);
@@ -2460,10 +2476,125 @@ init_config_sharedDirs_guard();
 init_exit_codes();
 init_utils();
 init_utils_fs();
+
+// src/utils.lockfile.ts
+init_config();
+init_utils();
+import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join8 } from "node:path";
+function lockFilePath() {
+  return join8(home(), ".cache", "claude-nomad", "nomad.lock");
+}
+function acquireLock(verb) {
+  const lp = lockFilePath();
+  mkdirSync2(dirname3(lp), { recursive: true });
+  try {
+    const fd = openSync2(lp, "wx");
+    try {
+      writeFileSync2(fd, String(process.pid));
+    } catch (writeErr) {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+      try {
+        unlinkSync(lp);
+      } catch {
+      }
+      throw writeErr;
+    }
+    return { fd, path: lp };
+  } catch (err) {
+    const code = err.code;
+    if (code !== "EEXIST") throw err;
+    return checkStaleAndRetry(verb, lp);
+  }
+}
+function releaseLock(handle) {
+  if (handle === null) return;
+  const lp = handle.path;
+  try {
+    closeSync2(handle.fd);
+  } catch {
+  }
+  try {
+    unlinkSync(lp);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+function unlinkIfSamePid(expectedPidStr, lp) {
+  let current;
+  try {
+    current = readFileSync3(lp, "utf8").trim();
+  } catch {
+    return false;
+  }
+  if (current !== expectedPidStr) return false;
+  try {
+    unlinkSync(lp);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function checkStaleAndRetry(verb, lp) {
+  let pidStr;
+  try {
+    pidStr = readFileSync3(lp, "utf8").trim();
+  } catch {
+    pidStr = "";
+  }
+  const pid = Number.parseInt(pidStr, 10);
+  if (!Number.isFinite(pid) || pid <= 0) {
+    if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+  try {
+    process.kill(pid, 0);
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH") {
+      if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
+      warn(`another nomad ${verb} running, skipping`);
+      return null;
+    }
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+}
+function retryOnce(verb, lp) {
+  try {
+    const fd = openSync2(lp, "wx");
+    try {
+      writeFileSync2(fd, String(process.pid));
+    } catch {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+      try {
+        unlinkSync(lp);
+      } catch {
+      }
+      warn(`another nomad ${verb} running, skipping`);
+      return null;
+    }
+    return { fd, path: lp };
+  } catch {
+    warn(`another nomad ${verb} running, skipping`);
+    return null;
+  }
+}
+
+// src/commands.adopt.ts
 init_utils_json();
 var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
 function readMapIfPresent(repoHome2) {
-  const mapPath = join8(repoHome2, "path-map.json");
+  const mapPath = join9(repoHome2, "path-map.json");
   return existsSync5(mapPath) ? readPathMap(mapPath) : { projects: {} };
 }
 function isConfiguredTarget(name, map) {
@@ -2498,7 +2629,7 @@ function adoptStopsEarly(name, linkPath, sharedTarget) {
 function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
   const ts = freshBackupTs(backup);
   const snapshotted = backupBeforeWrite(linkPath, ts);
-  const rel = join8("shared", name);
+  const rel = join9("shared", name);
   const stage = () => gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
   copyIntoSharedOrFatal(name, linkPath, sharedTarget, repo);
   refuseLateDeniedEntries(name, linkPath, sharedTarget, repo, { snapshotted, ts });
@@ -2538,8 +2669,21 @@ function cmdAdopt(name, opts = {}) {
     );
     process.exit(1);
   }
-  const linkPath = join8(claude, name);
-  const sharedTarget = join8(repo, "shared", name);
+  const linkPath = join9(claude, name);
+  const sharedTarget = join9(repo, "shared", name);
+  if (dryRun) {
+    adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, true);
+    return;
+  }
+  const handle = acquireLock("adopt");
+  if (handle === null) process.exit(EXIT.SUCCESS);
+  try {
+    adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, false);
+  } finally {
+    releaseLock(handle);
+  }
+}
+function adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, dryRun) {
   if (adoptStopsEarly(name, linkPath, sharedTarget)) return;
   refuseDeniedEntries(name, linkPath);
   if (dryRun) {
@@ -2566,8 +2710,8 @@ init_config();
 import { existsSync as existsSync6 } from "node:fs";
 
 // src/commands.redact.core.ts
-import { appendFileSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join9 } from "node:path";
+import { appendFileSync, readFileSync as readFileSync4 } from "node:fs";
+import { join as join10 } from "node:path";
 function collectMatchIntervals(content, findings) {
   const intervals = [];
   for (const f of findings) {
@@ -2625,10 +2769,10 @@ function isAlreadyPresent(line, lines) {
 function appendGitleaksIgnore(fingerprint, repo) {
   const sanitized = fingerprint.replace(/[\r\n]/g, "").trim();
   if (sanitized.length === 0) return;
-  const ignPath = join9(repo, ".gitleaksignore");
+  const ignPath = join10(repo, ".gitleaksignore");
   let raw;
   try {
-    raw = readFileSync3(ignPath, "utf8");
+    raw = readFileSync4(ignPath, "utf8");
   } catch {
     raw = "";
   }
@@ -2666,121 +2810,6 @@ import { join as join11 } from "node:path";
 import { createInterface } from "node:readline/promises";
 init_utils_fs();
 init_utils_json();
-
-// src/utils.lockfile.ts
-init_config();
-init_utils();
-import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join10 } from "node:path";
-function lockFilePath() {
-  return join10(home(), ".cache", "claude-nomad", "nomad.lock");
-}
-function acquireLock(verb) {
-  const lp = lockFilePath();
-  mkdirSync2(dirname3(lp), { recursive: true });
-  try {
-    const fd = openSync2(lp, "wx");
-    try {
-      writeFileSync2(fd, String(process.pid));
-    } catch (writeErr) {
-      try {
-        closeSync2(fd);
-      } catch {
-      }
-      try {
-        unlinkSync(lp);
-      } catch {
-      }
-      throw writeErr;
-    }
-    return { fd, path: lp };
-  } catch (err) {
-    const code = err.code;
-    if (code !== "EEXIST") throw err;
-    return checkStaleAndRetry(verb, lp);
-  }
-}
-function releaseLock(handle) {
-  if (handle === null) return;
-  const lp = handle.path;
-  try {
-    closeSync2(handle.fd);
-  } catch {
-  }
-  try {
-    unlinkSync(lp);
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-  }
-}
-function unlinkIfSamePid(expectedPidStr, lp) {
-  let current;
-  try {
-    current = readFileSync4(lp, "utf8").trim();
-  } catch {
-    return false;
-  }
-  if (current !== expectedPidStr) return false;
-  try {
-    unlinkSync(lp);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function checkStaleAndRetry(verb, lp) {
-  let pidStr;
-  try {
-    pidStr = readFileSync4(lp, "utf8").trim();
-  } catch {
-    pidStr = "";
-  }
-  const pid = Number.parseInt(pidStr, 10);
-  if (!Number.isFinite(pid) || pid <= 0) {
-    if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  }
-  try {
-    process.kill(pid, 0);
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  } catch (err) {
-    const code = err.code;
-    if (code === "ESRCH") {
-      if (unlinkIfSamePid(pidStr, lp)) return retryOnce(verb, lp);
-      warn(`another nomad ${verb} running, skipping`);
-      return null;
-    }
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  }
-}
-function retryOnce(verb, lp) {
-  try {
-    const fd = openSync2(lp, "wx");
-    try {
-      writeFileSync2(fd, String(process.pid));
-    } catch {
-      try {
-        closeSync2(fd);
-      } catch {
-      }
-      try {
-        unlinkSync(lp);
-      } catch {
-      }
-      warn(`another nomad ${verb} running, skipping`);
-      return null;
-    }
-    return { fd, path: lp };
-  } catch {
-    warn(`another nomad ${verb} running, skipping`);
-    return null;
-  }
-}
-
-// src/commands.capture-settings.ts
 init_utils();
 async function confirmCapture(destLabel, keys) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -2866,6 +2895,9 @@ var TS_SHAPE = /^\d{8}-\d{6}(-\d+)?$/;
 var DURATION_RE = /^(\d+)([dhm])$/;
 var UNIT_MS = { d: 864e5, h: 36e5, m: 6e4 };
 var CLEAN_DEFAULT_OLDER_THAN_MS = 14 * 24 * 60 * 60 * 1e3;
+function nameOf(d) {
+  return d.name;
+}
 function isTsDir(name) {
   return TS_SHAPE.test(name);
 }
@@ -2878,6 +2910,19 @@ function listBackupDirs(backupBase2) {
   if (!existsSync8(backupBase2)) return [];
   return readdirSync4(backupBase2).filter(isTsDir).map((name) => ({ name, mtimeMs: statSync2(join12(backupBase2, name)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
+function holdsNoContent(dir) {
+  let entries;
+  try {
+    entries = readdirSync4(dir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) return false;
+    if (!holdsNoContent(join12(dir, entry.name))) return false;
+  }
+  return true;
+}
 function prunableByAge(dirs, olderThanMs, nowMs) {
   return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
 }
@@ -2910,8 +2955,30 @@ function cmdClean(opts, backupBase2 = backupBase()) {
     }
     olderThanMs = parsed;
   }
+  if (dryRun) {
+    pruneBackups({ dryRun, olderThanMs, keep }, backupBase2);
+    return;
+  }
+  const handle = acquireLock("clean");
+  if (handle === null) process.exit(EXIT.SUCCESS);
+  try {
+    pruneBackups({ dryRun, olderThanMs, keep }, backupBase2);
+  } finally {
+    releaseLock(handle);
+  }
+}
+function pruneBackups(opts, backupBase2) {
+  const { dryRun, olderThanMs, keep } = opts;
   const dirs = listBackupDirs(backupBase2);
-  const targets = resolveTargets(dirs, olderThanMs, keep);
+  const empty = new Set(dirs.filter((d) => holdsNoContent(join12(backupBase2, d.name))).map(nameOf));
+  const aged = new Set(
+    resolveTargets(
+      dirs.filter((d) => !empty.has(d.name)),
+      olderThanMs,
+      keep
+    )
+  );
+  const targets = dirs.filter((d) => empty.has(d.name) || aged.has(d.name)).map(nameOf);
   if (dryRun) {
     for (const name of targets) item(name);
     log(`dry-run: ${targets.length} backup(s) would be removed`);
@@ -3964,7 +4031,7 @@ function reportBackupsCheck(section2, backupBase2 = backupBase()) {
   if (count > DOCTOR_BACKUP_COUNT_WARN || sizeMb > DOCTOR_BACKUP_SIZE_WARN_MB) {
     addItem(
       section2,
-      `${yellow(warnGlyph)} backups: ${count} dirs / ${sizeMb.toFixed(1)} MB (run 'nomad clean --backups --keep <N>'; bare --backups only prunes dirs older than 14d)`
+      `${yellow(warnGlyph)} backups: ${count} dirs / ${sizeMb.toFixed(1)} MB (run 'nomad clean --backups --keep <N>'; bare --backups prunes empty dirs plus those older than 14d)`
     );
   }
 }
@@ -8054,8 +8121,8 @@ function emitMirror(onPreview, name, localPath, repoPath) {
 function emitMirrorWet(onPreview, name, localPath, repoPath) {
   if (onPreview) onPreview({ kind: "mirror", name, localPath, repoPath });
 }
-function notShared(policy, target) {
-  return !policy.adoptNew && !existsSync42(target);
+function notShared(target) {
+  return !existsSync42(target);
 }
 function mirrorOneSharedName(name, claude, repo, policy, opts) {
   const localPath = join56(claude, name);
@@ -8064,21 +8131,21 @@ function mirrorOneSharedName(name, claude, repo, policy, opts) {
   try {
     stat = lstatSync20(localPath, { throwIfNoEntry: false });
   } catch (err) {
-    if (notShared(policy, target)) return;
+    if (notShared(target)) return;
     if (opts.dryRun === true) {
       warn(
-        `${name} could not be read (${err.message}), so nothing was captured for it and nothing was written. A pull that captures shared edits would skip it too. Check its permissions, or whether another program has it open`
+        `${name} could not be read (${errorText(err)}), so nothing was captured for it and nothing was written. A pull that captures shared edits would skip it too. Check its permissions, or whether another program has it open`
       );
       return;
     }
     warn(
-      `${name} could not be read (${err.message}), so it was left out of shared/ this run. Check its permissions, or whether another program has it open`
+      `${name} could not be read (${errorText(err)}), so it was left out of shared/ this run. Check its permissions, or whether another program has it open`
     );
     return;
   }
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
-  if (notShared(policy, target)) return;
+  if (notShared(target)) return;
   if (opts.dryRun === true) {
     emitMirror(opts.onPreview, name, localPath, target);
     return;
@@ -8102,10 +8169,10 @@ function mirrorSharedNames(map, policy, opts = {}) {
   }
 }
 function syncSharedLinksPush(map, opts = {}) {
-  mirrorSharedNames(map, { adoptNew: false, overlay: false }, opts);
+  mirrorSharedNames(map, { overlay: false }, opts);
 }
 function stageLocalSharedEdits(map, ts, opts = {}) {
-  mirrorSharedNames(map, { adoptNew: false, overlay: true, backupTs: ts }, opts);
+  mirrorSharedNames(map, { overlay: true, backupTs: ts }, opts);
 }
 function presentAt(abs) {
   try {
@@ -8128,7 +8195,7 @@ function removeUntrackedDenied(repo, path, segment, ts) {
     backupRepoWrite(abs, ts, repo);
   } catch (err) {
     warn(
-      `could not snapshot ${abs} before removing it (${err.message}), so it was left in place: ${denied}, so remove it by hand`
+      `could not snapshot ${abs} before removing it (${errorText(err)}), so it was left in place: ${denied}, so remove it by hand`
     );
     return;
   }
@@ -8141,7 +8208,7 @@ function removeUntrackedDenied(repo, path, segment, ts) {
     const where = snapshotted ? `. A copy was snapshotted under backup/${ts}/repo/ first` : "";
     warn(`removed ${path} from the sync repo working tree: ${denied}${where}`);
   } catch (err) {
-    warn(`could not remove ${abs}: ${err.message}`);
+    warn(`could not remove ${abs}: ${errorText(err)}`);
   }
 }
 function reportTrackedDenied(repo, path, segment) {
@@ -9001,12 +9068,20 @@ function handleWedge(repo, forceRemote) {
   return die(wedgeMarkerRunbookText(state), { code: EXIT.CONFLICT });
 }
 function runPullCore(opts = {}) {
+  const backup = backupBase();
+  const ts = freshBackupTs(backup);
+  try {
+    return runPullWithBackupTs(ts, opts);
+  } finally {
+    discardEmptyBackupDir(join61(backup, ts));
+  }
+}
+function runPullWithBackupTs(ts, opts) {
   const dryRun = opts.dryRun === true;
   const forceRemote = opts.forceRemote === true;
   const compose = opts.compose === true;
   const repo = repoHome();
   const backup = backupBase();
-  const ts = freshBackupTs(backup);
   const recovered = handleWedge(repo, forceRemote);
   if (!dryRun) {
     const backupRoot = join61(backup, ts);
@@ -10638,7 +10713,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.66.0",
+  version: "0.67.1",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -10867,7 +10942,9 @@ var DEFAULT_HELP = [
   row("       --backups", "Required: confirm backup pruning is the intended target."),
   row("       --dry-run", "List the snapshots that would be removed without deleting."),
   row("       --older-than <dur>", "Delete snapshots older than a duration (e.g. 14d, 24h, 30m)."),
-  cont("Default when no retention flag is given: 14d."),
+  cont("Default when no retention flag is given: 14d. A snapshot holding"),
+  cont("nothing is removed in every mode, whatever its age, and never"),
+  cont("uses up one of the --keep slots."),
   row("       --keep <N>", "Keep the N most-recent snapshots, delete the rest. Mutually"),
   cont("exclusive with --older-than."),
   "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.66.0",
+  "version": "0.67.1",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [