claude-nomad 0.67.2 → 0.67.3

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [0.67.3](https://github.com/funkadelic/claude-nomad/compare/v0.67.2...v0.67.3) (2026-08-29)
+
+### What's new
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and this does not apply to it.
+
+- **`nomad pull` now warns about a file that should never be synced, even when your gitignore hides it.** Before a pull, nomad checks your sync repo for files that have no business travelling between machines, such as credentials or per-host settings, and warns when one turns up under `shared/`. A file covered by a gitignore rule was invisible to that check, so it could sit there unmentioned. Nomad now names the file, along with the `git check-ignore` command that tells you which rule hid it, which is often a rule in your global git config rather than anything you wrote for this repo. It only warns. Nothing is deleted, because nomad cannot publish a file git ignores, so there is nothing to undo.
+
+The rest of this release is internal: a regression test for the Windows `nomad sync` path, a stricter check on the test suite's own mock handling, and test-result reporting in CI. Nothing else changes what nomad does.
+
+
+
+### Fixed
+
+* **pull:** report gitignored denylisted paths under shared/ ([#553](https://github.com/funkadelic/claude-nomad/issues/553)) ([b226902](https://github.com/funkadelic/claude-nomad/commit/b226902e4361a3325a2fd0495e5abbd532f7d806))
+
+
+### Changed
+
+* report test results to Codecov Test Analytics ([#551](https://github.com/funkadelic/claude-nomad/issues/551)) ([a1fb555](https://github.com/funkadelic/claude-nomad/commit/a1fb5558185e6a97a8a026eeb05d3ef6a9834f28))
+
+
+### Documentation
+
+* clean up the documentation prose ([#549](https://github.com/funkadelic/claude-nomad/issues/549)) ([cd8c40d](https://github.com/funkadelic/claude-nomad/commit/cd8c40d2f2877a868876e9ab338f4884060e90d9))
+
+
+### Testing
+
+* scope the doMock/doUnmock symmetry guard to every describe ([#552](https://github.com/funkadelic/claude-nomad/issues/552)) ([ebe4af9](https://github.com/funkadelic/claude-nomad/commit/ebe4af988fed37b9ced1a3a42dd736fb1901c888))
+* **sync:** add a cross-platform parity journey for nomad sync ([f87464d](https://github.com/funkadelic/claude-nomad/commit/f87464dcf7bf23341f1b8b8d4ae2eaefe0cc4e08))
+
 ## [0.67.2](https://github.com/funkadelic/claude-nomad/compare/v0.67.1...v0.67.2) (2026-08-24)
 
 ### What's new

package/README.md

@@ -17,8 +17,8 @@ private Git repo you control. Run `nomad sync` on any machine and everything is
 included; it pulls in your latest config first, then publishes your local changes, so you never have
 to remember which one to run first.
 
-Not dotfiles, not rsync. **claude-nomad** understands Claude Code's state, so your session history
-survives different file paths and your secrets never ride along.
+Dotfiles managers and rsync copy files. **claude-nomad** understands Claude Code's state, so your
+session history survives different file paths and your secrets never ride along.
 
 **Full documentation: <https://funkadelic.github.io/claude-nomad/>**
 
@@ -81,7 +81,7 @@ opt-in per-project sync, transcript redaction, backup pruning, and more.
 
 ## Quickstart
 
-nomad works with two directories, and the difference is the one thing worth learning up front:
+nomad works with two directories:
 
 - **`~/claude-nomad/`** is your private sync repo. This is the one you edit.
 - **`~/.claude/`** is Claude Code's live config. nomad regenerates it on every `pull`.
@@ -222,18 +222,17 @@ log output remains grep-stable.
 When `nomad push` detects a potential secret, it drops into an interactive menu (TTY) or aborts with
 a recovery hint (non-TTY/CI). Three non-interactive recovery paths are available without the menu:
 
-- `nomad push --full-scan` -- ignore the per-host push manifest and rescan all transcripts, then
+- `nomad push --full-scan`: ignore the per-host push manifest and rescan all transcripts, then
   rewrite the manifest on success. Use this after upgrading gitleaks, after editing a gitleaks
   config file, or whenever you want to be certain nothing slipped through an incremental scan.
   Composes freely with `--dry-run` and all resolution modes.
-- `nomad push --redact-all` -- scrub every finding from the local transcript in place, then push.
+- `nomad push --redact-all`: scrub every finding from the local transcript in place, then push.
   All-or-nothing: if any finding cannot be redacted (an active session, or one that does not map to
   a synced transcript), nothing is changed and the push stops so you can handle those sessions.
-- `nomad push --allow <rule>` -- record findings matching one gitleaks rule id as false positives
+- `nomad push --allow <rule>`: record findings matching one gitleaks rule id as false positives
   (appends their fingerprints to `.gitleaksignore`), then re-scan and push.
-- `nomad push --allow-all` -- record every current finding as a false positive, then re-scan and
-  push.
-- `nomad allow <fingerprint>...` -- pre-record specific fingerprints in `.gitleaksignore` without
+- `nomad push --allow-all`: record every current finding as a false positive, then re-scan and push.
+- `nomad allow <fingerprint>...`: pre-record specific fingerprints in `.gitleaksignore` without
   going through a push cycle.
 
 All allow paths always re-scan after writing the allowlist; a surviving finding still aborts the
@@ -314,16 +313,16 @@ false alarm from a concurrent run. Value `3` is reserved for future use.
 
 ## Crash reports
 
-If `nomad` ever hits an unexpected bug, it no longer dumps a raw stack trace at you. Instead it
-prints a short "this looks like a bug" banner (with a link to the issue tracker) and writes a small
-report you can attach to a bug report if you choose. The exit code is unchanged: an unexpected crash
-exits `1`, and a documented failure still exits with its own code from the table above. A prompt you
-cancel yourself is not a crash: it exits `130` and writes no report.
+If `nomad` ever hits an unexpected bug, it does not dump a raw stack trace. It prints a short "this
+looks like a bug" banner (with a link to the issue tracker) and writes a small report you can attach
+to a bug report if you choose. The exit code is unchanged: an unexpected crash exits `1`, and a
+documented failure still exits with its own code from the table above. A prompt you cancel yourself
+is not a crash: it exits `130` and writes no report.
 
 What this means for you:
 
 - **The report stays on your machine.** It is written to `~/.cache/claude-nomad/crash/` and nothing
-  is ever uploaded anywhere. The file just sits there until you decide to share it or delete it.
+  is ever uploaded anywhere. The file sits there until you decide to share it or delete it.
 - **The saved report is scrubbed twice.** First a structural pass rewrites your home directory to
   `~` and your hostname to a placeholder (absolute paths are personal information a secret scanner
   would not catch), and redacts credential-shaped tokens it recognizes (GitHub, GitLab, Slack, and
@@ -342,24 +341,24 @@ What this means for you:
   contents of any file.
 - **The directory manages itself.** Only the most recent reports are kept; older ones are pruned
   automatically on the next crash. There is no `nomad clean` flag for the crash directory, by
-  design: it self-manages.
+  design.
 
 ## Learn more
 
-- [How it works](https://funkadelic.github.io/claude-nomad/how-it-works/) -- path remapping,
-  settings merge, what syncs and what doesn't
-- [GSD-aware sync](https://funkadelic.github.io/claude-nomad/gsd-aware-sync/) -- what nomad does for
+- [How it works](https://funkadelic.github.io/claude-nomad/how-it-works/): path remapping, settings
+  merge, what syncs and what doesn't
+- [GSD-aware sync](https://funkadelic.github.io/claude-nomad/gsd-aware-sync/): what nomad does for
   GSD users out of the box
-- [Setup and migration](https://funkadelic.github.io/claude-nomad/quickstart/) -- full setup
+- [Setup and migration](https://funkadelic.github.io/claude-nomad/quickstart/): full setup
   walkthrough, migrating an existing `~/.claude/`
-- [Recipes](https://funkadelic.github.io/claude-nomad/recipes/) -- copy-pasteable example configs
-  for common setups, from scratch to cross-OS remapping and GSD integration
-- [Commands reference](https://funkadelic.github.io/claude-nomad/commands/) -- all CLI flags
-- [Claude Code plugin](https://funkadelic.github.io/claude-nomad/plugin/) -- /nomad slash commands
-  and the session-start drift check
-- [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/) -- backups, drop-session,
+- [Recipes](https://funkadelic.github.io/claude-nomad/recipes/): copy-pasteable example configs for
+  common setups, from scratch to cross-OS remapping and GSD integration
+- [Commands reference](https://funkadelic.github.io/claude-nomad/commands/): all CLI flags
+- [Claude Code plugin](https://funkadelic.github.io/claude-nomad/plugin/): /nomad slash commands and
+  the session-start drift check
+- [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/): backups, drop-session,
   redact, gitleaks allowlist, non-interactive allow
-- [FAQ](https://funkadelic.github.io/claude-nomad/faq/) -- common questions, like the right
-  push/pull order when both sides have changes
+- [FAQ](https://funkadelic.github.io/claude-nomad/faq/): common questions, like the right push/pull
+  order when both sides have changes
 - [Contributing](https://funkadelic.github.io/claude-nomad/contributing/)
 - [Security policy](https://funkadelic.github.io/claude-nomad/security/)

package/dist/nomad.mjs

@@ -8891,13 +8891,30 @@ function newlyUntracked(before, after) {
   if (before === null || after === null) return [];
   return [...after].filter((p) => !before.has(p));
 }
+function ignoredPathsUnderShared(repo) {
+  const out = gitProbe(
+    ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--ignored", "--", "shared/"],
+    repo
+  );
+  if (out === null) return [];
+  return out.split("\0").filter((record) => record.startsWith("!! ")).map((record) => record.slice(3));
+}
+function reportIgnoredDenied(repo) {
+  for (const path of new Set(ignoredPathsUnderShared(repo))) {
+    const segment = deniedSegmentFor(path);
+    if (segment === null) continue;
+    warn(
+      `${path} is inside shared/ but git ignores it: the path segment "${segment}" is on the never-sync list. Nothing was changed, and nothing published it: nomad only ever stages with "git add -A", which skips an ignored path, so it has not reached the index or the remote. It stays invisible to the rest of this gate for the same reason, so move it outside shared/ if you want it kept, or delete it. Note the ignore rule may come from your global core.excludesFile rather than from this repo; run git check-ignore -v -- "${path}" to see which file and line the rule came from`
+    );
+  }
+}
 function revertDeniedUnderShared(repo, ts) {
   const out = gitProbe(
     ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "shared/"],
     repo
   );
-  if (out === null) return;
-  revertDeniedMirrorPaths(repo, parsePorcelainZ(out), ts);
+  if (out !== null) revertDeniedMirrorPaths(repo, parsePorcelainZ(out), ts);
+  reportIgnoredDenied(repo);
 }
 function reconcileSharedLinksBeforePull(repo, ts) {
   if (process.platform !== "win32") {
@@ -10899,7 +10916,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.67.2",
+  version: "0.67.3",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.67.2",
+  "version": "0.67.3",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [