claude-nomad 0.67.2 → 0.68.0

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # Changelog
 
+## [0.68.0](https://github.com/funkadelic/claude-nomad/compare/v0.67.3...v0.68.0) (2026-09-03)
+
+
+### What's new
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and this does not apply to it.
+
+- **A never-sync warning during `nomad pull` now suggests commands you can paste as they are.** Before a pull, nomad warns when a file that should never travel between machines turns up in your sync repo, and the warning names the git commands to deal with it. A filename containing a space split the suggested command in two, so pasting it acted on neither half. The paths are now quoted.
+
+**On every platform.**
+
+- **`nomad doctor` now warns when your sync repo is carrying a file that should never sync**, such as a credential or a per-machine settings file. Until now one of those was only noticed while it was new or changed, so a file that was committed and then left alone went unmentioned, and the check that did look ran only on Windows. Doctor names the file and the command that stops tracking it without deleting your copy. It only warns.
+- **`nomad adopt` no longer fails on a deeply nested folder.** Adopting a shared folder scans it first, and a very deep tree could crash that scan. The scan handles any depth now.
+- **A backup nomad cannot write is now reported as a plain error.** Nomad copies anything it is about to overwrite into a backup first. When that copy fails, say a full disk or a permissions problem, you get one message naming what it was copying, where it was going, and why it failed, instead of a crash report file. The message also says a partial copy may be left behind.
+
+Everything else in this release is dependency updates.
+
+
+### Added
+
+* **doctor:** warn when the sync repo tracks a never-synced file ([#562](https://github.com/funkadelic/claude-nomad/issues/562)) ([a1b3f71](https://github.com/funkadelic/claude-nomad/commit/a1b3f71a0a3deecac81e0bcc9e8ee214c1e50a4e))
+
+
+### Fixed
+
+* **adopt:** handle deep directories and report a failed backup ([#560](https://github.com/funkadelic/claude-nomad/issues/560)) ([2b19ccb](https://github.com/funkadelic/claude-nomad/commit/2b19ccba5959efb7b42d16ee0db862df4d92a0ac))
+* **backup:** report a failed backup instead of writing a crash report ([#561](https://github.com/funkadelic/claude-nomad/issues/561)) ([9d8484c](https://github.com/funkadelic/claude-nomad/commit/9d8484cdb59eb5a5905dfb0a3e16ae952acead5f))
+* **pull:** quote file paths in the never-sync warning's suggested commands ([#559](https://github.com/funkadelic/claude-nomad/issues/559)) ([070cc17](https://github.com/funkadelic/claude-nomad/commit/070cc1709263d46cc50d01e99c345b3955d729ed))
+
+
+### Dependencies
+
+* bump fast-uri from 3.1.5 to 3.1.7 ([#563](https://github.com/funkadelic/claude-nomad/issues/563)) ([7bf62e3](https://github.com/funkadelic/claude-nomad/commit/7bf62e3e481246b7c8125e31fb2df6654241dd54))
+* bump the codeql-action group across 1 directory with 2 updates ([#556](https://github.com/funkadelic/claude-nomad/issues/556)) ([ad3ae73](https://github.com/funkadelic/claude-nomad/commit/ad3ae739043ae24f560d0ddd56baff79bb6b6ad6))
+* bump the dev-dependencies group across 1 directory with 3 updates ([#555](https://github.com/funkadelic/claude-nomad/issues/555)) ([02aebe2](https://github.com/funkadelic/claude-nomad/commit/02aebe2a6407dcd4be67fe9e33723c735a1c44cd))
+* bump the prod-dependencies group in /docs-site with 3 updates ([#557](https://github.com/funkadelic/claude-nomad/issues/557)) ([b6b5c8a](https://github.com/funkadelic/claude-nomad/commit/b6b5c8aebebcc8e4c73ac12d511bc972bda553d7))
+
+## [0.67.3](https://github.com/funkadelic/claude-nomad/compare/v0.67.2...v0.67.3) (2026-08-29)
+
+### What's new
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and this does not apply to it.
+
+- **`nomad pull` now warns about a file that should never be synced, even when your gitignore hides it.** Before a pull, nomad checks your sync repo for files that have no business travelling between machines, such as credentials or per-host settings, and warns when one turns up under `shared/`. A file covered by a gitignore rule was invisible to that check, so it could sit there unmentioned. Nomad now names the file, along with the `git check-ignore` command that tells you which rule hid it, which is often a rule in your global git config rather than anything you wrote for this repo. It only warns. Nothing is deleted, because nomad cannot publish a file git ignores, so there is nothing to undo.
+
+The rest of this release is internal: a regression test for the Windows `nomad sync` path, a stricter check on the test suite's own mock handling, and test-result reporting in CI. Nothing else changes what nomad does.
+
+
+
+### Fixed
+
+* **pull:** report gitignored denylisted paths under shared/ ([#553](https://github.com/funkadelic/claude-nomad/issues/553)) ([b226902](https://github.com/funkadelic/claude-nomad/commit/b226902e4361a3325a2fd0495e5abbd532f7d806))
+
+
+### Changed
+
+* report test results to Codecov Test Analytics ([#551](https://github.com/funkadelic/claude-nomad/issues/551)) ([a1fb555](https://github.com/funkadelic/claude-nomad/commit/a1fb5558185e6a97a8a026eeb05d3ef6a9834f28))
+
+
+### Documentation
+
+* clean up the documentation prose ([#549](https://github.com/funkadelic/claude-nomad/issues/549)) ([cd8c40d](https://github.com/funkadelic/claude-nomad/commit/cd8c40d2f2877a868876e9ab338f4884060e90d9))
+
+
+### Testing
+
+* scope the doMock/doUnmock symmetry guard to every describe ([#552](https://github.com/funkadelic/claude-nomad/issues/552)) ([ebe4af9](https://github.com/funkadelic/claude-nomad/commit/ebe4af988fed37b9ced1a3a42dd736fb1901c888))
+* **sync:** add a cross-platform parity journey for nomad sync ([f87464d](https://github.com/funkadelic/claude-nomad/commit/f87464dcf7bf23341f1b8b8d4ae2eaefe0cc4e08))
+
 ## [0.67.2](https://github.com/funkadelic/claude-nomad/compare/v0.67.1...v0.67.2) (2026-08-24)
 
 ### What's new
@@ -528,14 +597,7 @@ All of this applies on macOS, Linux, WSL2, and native Windows.
 
 * **pull:** retain unpushed local work and surface it in the preview ([#376](https://github.com/funkadelic/claude-nomad/issues/376)) ([3f70019](https://github.com/funkadelic/claude-nomad/commit/3f70019c89ccd77726e6330d9623e106bb9ff69c))
 
-  What this means: `nomad pull` no longer discards work you have not pushed
-  yet. Chat sessions, subagent history, and memory files that exist only on
-  this machine now survive a pull, and a synced file you have edited locally
-  (a project's `.planning` notes or its `CLAUDE.md`) is kept instead of being
-  overwritten when it differs from the incoming copy, with a note to push and
-  reconcile. `nomad diff` and `pull --dry-run` now show the count of retained
-  local-only items and the keep-local warning, where before they reported
-  `clean` / `0 collisions`.
+  What this means: `nomad pull` no longer discards work you have not pushed yet. Chat sessions, subagent history, and memory files that exist only on this machine now survive a pull, and a synced file you have edited locally (a project's `.planning` notes or its `CLAUDE.md`) is kept instead of being overwritten when it differs from the incoming copy, with a note to push and reconcile. `nomad diff` and `pull --dry-run` now show the count of retained local-only items and the keep-local warning, where before they reported `clean` / `0 collisions`.
 
 ## [0.56.1](https://github.com/funkadelic/claude-nomad/compare/v0.56.0...v0.56.1) (2026-06-30)
 

package/README.md

@@ -17,8 +17,8 @@ private Git repo you control. Run `nomad sync` on any machine and everything is
 included; it pulls in your latest config first, then publishes your local changes, so you never have
 to remember which one to run first.
 
-Not dotfiles, not rsync. **claude-nomad** understands Claude Code's state, so your session history
-survives different file paths and your secrets never ride along.
+Dotfiles managers and rsync copy files. **claude-nomad** understands Claude Code's state, so your
+session history survives different file paths and your secrets never ride along.
 
 **Full documentation: <https://funkadelic.github.io/claude-nomad/>**
 
@@ -54,18 +54,20 @@ survives different file paths and your secrets never ride along.
 - **One command tells you what is wrong.** `nomad doctor` is a read-only health check: wedged sync
   repo, broken hook references, hooks that would crash on session start because of a missing
   `--preserve-symlinks-main` flag, version drift, oversized backup cache, missing git committer
-  identity in the sync repo (a push fails at commit time without one), path-map entries whose local
-  project folder no longer exists on this machine, a multi-host repo where this machine's
-  hostname-derived key matches no `hosts/<HOST>.json` or path-map entry (a sign `NOMAD_HOST` is
-  unset here, so per-host settings and session sync will not line up with the other hosts), synced
-  skills with local edits that differ from the shared copy, a native Windows shared-config copy that
-  has drifted from the repo's copy (a warning, not a failure), and settings drift in both
-  directions: keys present in the repo merge but absent from your live `settings.json` (behind; the
-  next `nomad pull` will restore them, fix: `nomad pull`) and keys present locally but not yet in
-  the repo (ahead; local-only additions, fix: `nomad capture-settings`). Each issue includes a fix
-  hint. By default the report is compact: it shows only checks that need action plus a one-line
-  verdict. Add `--verbose` (or `--all` / `-v`) to see the full per-check tree, including everything
-  that passed.
+  identity in the sync repo (a push fails at commit time without one), a never-synced file such as a
+  credential or a per-host settings file that Git already tracks inside the repo's `shared/` folder
+  (once it is committed the pull-side guard can no longer see it, so doctor names the file and the
+  folder name that blocks it), path-map entries whose local project folder no longer exists on this
+  machine, a multi-host repo where this machine's hostname-derived key matches no
+  `hosts/<HOST>.json` or path-map entry (a sign `NOMAD_HOST` is unset here, so per-host settings and
+  session sync will not line up with the other hosts), synced skills with local edits that differ
+  from the shared copy, a native Windows shared-config copy that has drifted from the repo's copy (a
+  warning, not a failure), and settings drift in both directions: keys present in the repo merge but
+  absent from your live `settings.json` (behind; the next `nomad pull` will restore them, fix:
+  `nomad pull`) and keys present locally but not yet in the repo (ahead; local-only additions, fix:
+  `nomad capture-settings`). Each issue includes a fix hint. By default the report is compact: it
+  shows only checks that need action plus a one-line verdict. Add `--verbose` (or `--all` / `-v`) to
+  see the full per-check tree, including everything that passed.
 - **Self-healing sync.** Every overwrite is backed up first, and `nomad pull --force-remote`
   recovers two kinds of stuck sync repo: a repo stuck mid-rebase or mid-merge (aborts the operation,
   parks stranded work on a branch, refuses if shared config is at risk), and a repo where the rebase
@@ -81,7 +83,7 @@ opt-in per-project sync, transcript redaction, backup pruning, and more.
 
 ## Quickstart
 
-nomad works with two directories, and the difference is the one thing worth learning up front:
+nomad works with two directories:
 
 - **`~/claude-nomad/`** is your private sync repo. This is the one you edit.
 - **`~/.claude/`** is Claude Code's live config. nomad regenerates it on every `pull`.
@@ -222,18 +224,17 @@ log output remains grep-stable.
 When `nomad push` detects a potential secret, it drops into an interactive menu (TTY) or aborts with
 a recovery hint (non-TTY/CI). Three non-interactive recovery paths are available without the menu:
 
-- `nomad push --full-scan` -- ignore the per-host push manifest and rescan all transcripts, then
+- `nomad push --full-scan`: ignore the per-host push manifest and rescan all transcripts, then
   rewrite the manifest on success. Use this after upgrading gitleaks, after editing a gitleaks
   config file, or whenever you want to be certain nothing slipped through an incremental scan.
   Composes freely with `--dry-run` and all resolution modes.
-- `nomad push --redact-all` -- scrub every finding from the local transcript in place, then push.
+- `nomad push --redact-all`: scrub every finding from the local transcript in place, then push.
   All-or-nothing: if any finding cannot be redacted (an active session, or one that does not map to
   a synced transcript), nothing is changed and the push stops so you can handle those sessions.
-- `nomad push --allow <rule>` -- record findings matching one gitleaks rule id as false positives
+- `nomad push --allow <rule>`: record findings matching one gitleaks rule id as false positives
   (appends their fingerprints to `.gitleaksignore`), then re-scan and push.
-- `nomad push --allow-all` -- record every current finding as a false positive, then re-scan and
-  push.
-- `nomad allow <fingerprint>...` -- pre-record specific fingerprints in `.gitleaksignore` without
+- `nomad push --allow-all`: record every current finding as a false positive, then re-scan and push.
+- `nomad allow <fingerprint>...`: pre-record specific fingerprints in `.gitleaksignore` without
   going through a push cycle.
 
 All allow paths always re-scan after writing the allowlist; a surviving finding still aborts the
@@ -314,16 +315,16 @@ false alarm from a concurrent run. Value `3` is reserved for future use.
 
 ## Crash reports
 
-If `nomad` ever hits an unexpected bug, it no longer dumps a raw stack trace at you. Instead it
-prints a short "this looks like a bug" banner (with a link to the issue tracker) and writes a small
-report you can attach to a bug report if you choose. The exit code is unchanged: an unexpected crash
-exits `1`, and a documented failure still exits with its own code from the table above. A prompt you
-cancel yourself is not a crash: it exits `130` and writes no report.
+If `nomad` ever hits an unexpected bug, it does not dump a raw stack trace. It prints a short "this
+looks like a bug" banner (with a link to the issue tracker) and writes a small report you can attach
+to a bug report if you choose. The exit code is unchanged: an unexpected crash exits `1`, and a
+documented failure still exits with its own code from the table above. A prompt you cancel yourself
+is not a crash: it exits `130` and writes no report.
 
 What this means for you:
 
 - **The report stays on your machine.** It is written to `~/.cache/claude-nomad/crash/` and nothing
-  is ever uploaded anywhere. The file just sits there until you decide to share it or delete it.
+  is ever uploaded anywhere. The file sits there until you decide to share it or delete it.
 - **The saved report is scrubbed twice.** First a structural pass rewrites your home directory to
   `~` and your hostname to a placeholder (absolute paths are personal information a secret scanner
   would not catch), and redacts credential-shaped tokens it recognizes (GitHub, GitLab, Slack, and
@@ -342,24 +343,24 @@ What this means for you:
   contents of any file.
 - **The directory manages itself.** Only the most recent reports are kept; older ones are pruned
   automatically on the next crash. There is no `nomad clean` flag for the crash directory, by
-  design: it self-manages.
+  design.
 
 ## Learn more
 
-- [How it works](https://funkadelic.github.io/claude-nomad/how-it-works/) -- path remapping,
-  settings merge, what syncs and what doesn't
-- [GSD-aware sync](https://funkadelic.github.io/claude-nomad/gsd-aware-sync/) -- what nomad does for
+- [How it works](https://funkadelic.github.io/claude-nomad/how-it-works/): path remapping, settings
+  merge, what syncs and what doesn't
+- [GSD-aware sync](https://funkadelic.github.io/claude-nomad/gsd-aware-sync/): what nomad does for
   GSD users out of the box
-- [Setup and migration](https://funkadelic.github.io/claude-nomad/quickstart/) -- full setup
+- [Setup and migration](https://funkadelic.github.io/claude-nomad/quickstart/): full setup
   walkthrough, migrating an existing `~/.claude/`
-- [Recipes](https://funkadelic.github.io/claude-nomad/recipes/) -- copy-pasteable example configs
-  for common setups, from scratch to cross-OS remapping and GSD integration
-- [Commands reference](https://funkadelic.github.io/claude-nomad/commands/) -- all CLI flags
-- [Claude Code plugin](https://funkadelic.github.io/claude-nomad/plugin/) -- /nomad slash commands
-  and the session-start drift check
-- [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/) -- backups, drop-session,
+- [Recipes](https://funkadelic.github.io/claude-nomad/recipes/): copy-pasteable example configs for
+  common setups, from scratch to cross-OS remapping and GSD integration
+- [Commands reference](https://funkadelic.github.io/claude-nomad/commands/): all CLI flags
+- [Claude Code plugin](https://funkadelic.github.io/claude-nomad/plugin/): /nomad slash commands and
+  the session-start drift check
+- [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/): backups, drop-session,
   redact, gitleaks allowlist, non-interactive allow
-- [FAQ](https://funkadelic.github.io/claude-nomad/faq/) -- common questions, like the right
-  push/pull order when both sides have changes
+- [FAQ](https://funkadelic.github.io/claude-nomad/faq/): common questions, like the right push/pull
+  order when both sides have changes
 - [Contributing](https://funkadelic.github.io/claude-nomad/contributing/)
 - [Security policy](https://funkadelic.github.io/claude-nomad/security/)

package/dist/nomad.mjs

@@ -721,6 +721,21 @@ var init_config = __esm({
   }
 });
 
+// src/error-text.ts
+function errorText(err) {
+  try {
+    const message = err?.message;
+    return typeof message === "string" ? message : String(err);
+  } catch {
+    return "unprintable error value";
+  }
+}
+var init_error_text = __esm({
+  "src/error-text.ts"() {
+    "use strict";
+  }
+});
+
 // src/utils.json.ts
 import { readFileSync } from "node:fs";
 function readJson(path) {
@@ -886,17 +901,22 @@ function ensureSymlink(linkPath, target) {
   symlinkSync(target, linkPath);
   log(`linked ${linkPath} -> ${target}`);
 }
-function backupUnder(absPath, anchor, destRoot) {
+function backupUnder(absPath, anchor, destRoot, hint) {
   if (!existsSync3(absPath)) return false;
   const rel = relative3(anchor, absPath);
   if (rel === "" || rel === ".." || rel.startsWith(`..${sep2}`)) return false;
   const dst = join5(destRoot, rel);
-  mkdirSync(dirname(dst), { recursive: true });
-  cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  try {
+    mkdirSync(dirname(dst), { recursive: true });
+    cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  } catch (err) {
+    const fragment = `could not back up ${absPath} into ${dst} (${errorText(err)}); a partial copy may be left there`;
+    throw new NomadFatal(hint === void 0 ? fragment : `${fragment}. ${hint}`);
+  }
   return true;
 }
-function backupBeforeWrite(absPath, ts) {
-  return backupUnder(absPath, claudeHome(), join5(backupBase(), ts));
+function backupBeforeWrite(absPath, ts, hint) {
+  return backupUnder(absPath, claudeHome(), join5(backupBase(), ts), hint);
 }
 function backupRepoWrite(absPath, ts, repoHome2) {
   backupUnder(absPath, repoHome2, join5(backupBase(), ts, "repo"));
@@ -909,6 +929,7 @@ var init_utils_fs = __esm({
   "src/utils.fs.ts"() {
     "use strict";
     init_config();
+    init_error_text();
     init_utils_json();
     init_utils();
     RENAME_RETRY_MAX_ATTEMPTS = 5;
@@ -1134,7 +1155,7 @@ var init_autostash_guard = __esm({
 });
 
 // src/push-checks.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { readdirSync as readdirSync8, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
 import { delimiter, join as join23 } from "node:path";
@@ -1201,7 +1222,7 @@ function probeGitleaks() {
   const args = ["version"];
   if (toml !== null) args.push("--config", toml);
   try {
-    return execFileSync4("gitleaks", args, { stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
+    return execFileSync5("gitleaks", args, { stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") throw new NomadFatal(gitleaksInstallHint());
@@ -1221,7 +1242,7 @@ function rebaseBeforePush(repo) {
   const wedge = classifyWedge(repo);
   if (wedge !== null) throw new NomadFatal(wedgePreflight(wedge), { code: EXIT.CONFLICT });
   try {
-    execFileSync4("git", ["pull", "--rebase", "--autostash"], {
+    execFileSync5("git", ["pull", "--rebase", "--autostash"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -1246,7 +1267,7 @@ var init_push_checks = __esm({
 });
 
 // src/push-gitleaks.scan.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync9 } from "node:child_process";
 import { mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join27 } from "node:path";
@@ -1313,9 +1334,9 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   const opts = { cwd: repoDir, stdio: ["ignore", "pipe", "pipe"] };
   const gitleaksOpts = { ...opts, timeout: GITLEAKS_SCAN_TIMEOUT_MS };
   try {
-    execFileSync8("git", ["init", "-q"], opts);
-    execFileSync8("git", ["add", "-A"], opts);
-    execFileSync8("gitleaks", args, gitleaksOpts);
+    execFileSync9("git", ["init", "-q"], opts);
+    execFileSync9("git", ["add", "-A"], opts);
+    execFileSync9("gitleaks", args, gitleaksOpts);
     return [];
   } catch (err) {
     const e = err;
@@ -1348,7 +1369,7 @@ function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TI
       stdio: ["ignore", "pipe", "pipe"],
       timeout: timeoutMs
     };
-    execFileSync8("gitleaks", args, opts);
+    execFileSync9("gitleaks", args, opts);
     return [];
   } catch (err) {
     const e = err;
@@ -1567,43 +1588,37 @@ import { dirname as dirname2, join as join7, resolve as resolve2 } from "node:pa
 
 // src/commands.adopt.scan.ts
 init_config();
-import { lstatSync, readdirSync } from "node:fs";
-import { join as join2, relative } from "node:path";
-
-// src/error-text.ts
-function errorText(err) {
-  try {
-    const message = err?.message;
-    return typeof message === "string" ? message : String(err);
-  } catch {
-    return "unprintable error value";
-  }
-}
-
-// src/commands.adopt.scan.ts
+init_error_text();
 init_exit_codes();
 init_utils();
+import { lstatSync, readdirSync } from "node:fs";
+import { join as join2, relative } from "node:path";
 function toForwardSlash(p) {
   return p.replaceAll("\\", "/");
 }
-function walk(root, dir, out) {
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const match = matchDeniedName(ALWAYS_NEVER_SYNC, entry.name);
-    if (match !== null) {
-      out.push({
-        path: toForwardSlash(relative(root, join2(dir, entry.name))),
-        matched: match.axis === "name" ? match.entry : null
-      });
-      continue;
+function walk(root) {
+  const out = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const match = matchDeniedName(ALWAYS_NEVER_SYNC, entry.name);
+      if (match !== null) {
+        out.push({
+          path: toForwardSlash(relative(root, join2(dir, entry.name))),
+          matched: match.axis === "name" ? match.entry : null
+        });
+        continue;
+      }
+      if (entry.isDirectory()) stack.push(join2(dir, entry.name));
     }
-    if (entry.isDirectory()) walk(root, join2(dir, entry.name), out);
   }
+  return out;
 }
 function scanDeniedEntries(root) {
   const stat = lstatSync(root, { throwIfNoEntry: false });
   if (!stat?.isDirectory()) return [];
-  const out = [];
-  walk(root, root, out);
+  const out = walk(root);
   out.sort((a, b) => a.path.localeCompare(b.path));
   return out;
 }
@@ -1652,6 +1667,7 @@ function refuseDeniedEntries(name, root) {
 
 // src/commands.adopt.recover.ts
 init_config();
+init_error_text();
 init_exit_codes();
 
 // src/extras-sync.core.ts
@@ -2689,7 +2705,11 @@ function adoptStopsEarly(name, linkPath, sharedTarget) {
 }
 function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
   const ts = freshBackupTs(backup);
-  const snapshotted = backupBeforeWrite(linkPath, ts);
+  const snapshotted = backupBeforeWrite(
+    linkPath,
+    ts,
+    `Nothing was removed from ${linkPath} and nothing was written to the repo. Fix what the error names, then run \`nomad adopt ${name}\` again.`
+  );
   const rel = join9("shared", name);
   const stage = () => gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
   copyIntoSharedOrFatal(name, linkPath, sharedTarget, repo);
@@ -3996,15 +4016,34 @@ function reportSkillsDivergence(section2) {
 // src/commands.doctor.checks.git-state.ts
 init_color();
 init_config();
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { existsSync as existsSync17 } from "node:fs";
 import { join as join24, relative as relative5 } from "node:path";
 init_commands_pull_wedge();
+
+// src/git-probe.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+var PROBE_TIMEOUT_MS = 1e4;
+var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
+function gitProbe(args, repo) {
+  try {
+    return execFileSync4("git", args, {
+      cwd: repo,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: PROBE_TIMEOUT_MS,
+      maxBuffer: PROBE_MAX_BUFFER
+    }).toString();
+  } catch {
+    return null;
+  }
+}
+
+// src/commands.doctor.checks.git-state.ts
 init_push_checks();
 init_utils();
 function reportGitleaksProbe(section2) {
   try {
-    execFileSync5("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync6("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch (err) {
     if (err.code === "ENOENT") {
@@ -4040,7 +4079,7 @@ function reportGitlinks(section2) {
 }
 function reportRemote(section2) {
   try {
-    const url = execFileSync5("git", ["remote", "get-url", "origin"], {
+    const url = execFileSync6("git", ["remote", "get-url", "origin"], {
       cwd: repoHome(),
       stdio: ["ignore", "pipe", "pipe"]
     }).toString().trim();
@@ -4097,7 +4136,7 @@ function reportGitIdentity(section2) {
   const missing = [];
   for (const field of ["user.name", "user.email"]) {
     try {
-      const val = execFileSync5("git", ["config", field], {
+      const val = execFileSync6("git", ["config", field], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       }).toString().trim();
@@ -4117,6 +4156,45 @@ function reportGitIdentity(section2) {
     addItem(section2, `${green(okGlyph)} git identity: user.name and user.email configured`);
   }
 }
+var MAX_TRACKED_DENIED_ROWS = 5;
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function renderable(text) {
+  return text.replace(CONTROL_CHARS, " ");
+}
+function reportTrackedDeniedShared(section2) {
+  const out = gitProbe(["ls-files", "-z", "--", ":(icase)shared/"], repoHome());
+  if (out === null) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} never-sync scan: git could not list shared/, so nothing was scanned`
+    );
+    return;
+  }
+  const hits = /* @__PURE__ */ new Map();
+  for (const path of out.split("\0")) {
+    const segment = path === "" ? null : deniedSegmentFor(path);
+    if (segment !== null) hits.set(path, segment);
+  }
+  if (hits.size === 0) {
+    addItem(
+      section2,
+      `${green(okGlyph)} never-sync scan: no tracked path under shared/ is denylisted`
+    );
+    return;
+  }
+  for (const [path, segment] of [...hits].slice(0, MAX_TRACKED_DENIED_ROWS)) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} never-sync: git tracks ${blue(renderable(path))} (the path segment "${renderable(segment)}" is blocked by the never-sync boundary)`
+    );
+  }
+  const overflow = hits.size - MAX_TRACKED_DENIED_ROWS;
+  const more = overflow > 0 ? `${overflow} more not listed, run git ls-files -- ":(icase)shared/" in the sync repo to see them all. ` : "";
+  addItem(
+    section2,
+    `${yellow(warnGlyph)} never-sync: ${more}Run git rm --cached -- "<path>" and commit to stop tracking each one; that leaves the file on disk, so move it outside shared/ if you want to keep it. If one holds a real secret, rotate it and rewrite history too, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent`
+  );
+}
 
 // src/commands.doctor.checks.backups.ts
 init_color();
@@ -4166,14 +4244,14 @@ function reportBackupsCheck(section2, backupBase2 = backupBase()) {
 
 // src/commands.doctor.check-remote.ts
 init_color();
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 init_config();
 init_utils_json();
 var GIT_REMOTE_TIMEOUT_MS = 3e3;
 function readRemotePathMap(sec, repo) {
   let rawJson;
   try {
-    rawJson = execFileSync6("git", ["show", "origin/main:path-map.json"], {
+    rawJson = execFileSync7("git", ["show", "origin/main:path-map.json"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: GIT_REMOTE_TIMEOUT_MS
@@ -4206,7 +4284,7 @@ function reportCheckRemote(section2) {
   const repo = repoHome();
   let names;
   try {
-    const out = execFileSync6("git", ["ls-tree", "--name-only", "origin/main"], {
+    const out = execFileSync7("git", ["ls-tree", "--name-only", "origin/main"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: GIT_REMOTE_TIMEOUT_MS
@@ -4238,9 +4316,9 @@ import { join as join26 } from "node:path";
 init_config();
 
 // src/http-fetch.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync8 } from "node:child_process";
 var FETCH_TIMEOUT_MS = 3e3;
-function fetchUrl(url, run = execFileSync7) {
+function fetchUrl(url, run = execFileSync8) {
   try {
     return run("curl", ["-fsSL", "-m", "3", url], {
       stdio: ["ignore", "pipe", "pipe"],
@@ -4301,14 +4379,14 @@ function reportCheckSchema(section2) {
 // src/commands.doctor.check-shared.ts
 init_color();
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 import { existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync12, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join33 } from "node:path";
 
 // src/commands.doctor.check-shared.memory.ts
 init_color();
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { mkdirSync as mkdirSync4, rmSync as rmSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
@@ -4320,7 +4398,7 @@ var MEMORY_MD_PATH = /^shared\/projects\/([^/]+)\/memory\/[^/]+\.md$/;
 function buildMemoryScanTree(tmpRoot) {
   let paths;
   try {
-    const out = execFileSync9(
+    const out = execFileSync10(
       "git",
       ["-C", repoHome(), "ls-tree", "-r", "-z", "--name-only", "HEAD", "--", "shared/projects"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }
@@ -4336,7 +4414,7 @@ function buildMemoryScanTree(tmpRoot) {
     if (m?.[1] === void 0) continue;
     let blob;
     try {
-      blob = execFileSync9("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
+      blob = execFileSync10("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
         stdio: ["ignore", "pipe", "ignore"],
         maxBuffer: 67108864,
         timeout: 1e4
@@ -4504,7 +4582,7 @@ function scanAndReport(section2, tmpRoot, staged, logicalToEncoded) {
 
 // src/commands.doctor.check-shared.skills.ts
 init_color();
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdirSync as mkdirSync5, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
@@ -4516,7 +4594,7 @@ var SKILL_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
 function buildSkillScanTree(tmpRoot) {
   let paths;
   try {
-    const out = execFileSync10(
+    const out = execFileSync11(
       "git",
       ["-C", repoHome(), "ls-tree", "-r", "-z", "--name-only", "HEAD", "--", "shared/skills"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }
@@ -4532,7 +4610,7 @@ function buildSkillScanTree(tmpRoot) {
     if (m?.[1] === void 0) continue;
     let blob;
     try {
-      blob = execFileSync10("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
+      blob = execFileSync11("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
         stdio: ["ignore", "pipe", "ignore"],
         maxBuffer: 67108864,
         timeout: 1e4
@@ -4970,7 +5048,7 @@ function buildScanTree(tmpRoot) {
 }
 function probeGitleaksForScan() {
   try {
-    execFileSync11("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync12("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
     return "ok";
   } catch (err) {
     if (err.code === "ENOENT") return "missing";
@@ -5626,16 +5704,16 @@ function reportNodeEngineCheck(section2) {
 
 // src/commands.doctor.checks.longpaths.ts
 init_color();
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync13 } from "node:child_process";
 init_config();
-var PROBE_TIMEOUT_MS = 3e3;
+var PROBE_TIMEOUT_MS2 = 3e3;
 var LONGPATHS_REG_KEY = String.raw`HKLM\SYSTEM\CurrentControlSet\Control\FileSystem`;
 var LONGPATHS_REG_VALUE = "LongPathsEnabled";
 function probeGitLongpaths(run) {
   try {
     const out = run("git", ["-C", repoHome(), "config", "--get", "core.longpaths"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS
+      timeout: PROBE_TIMEOUT_MS2
     }).toString().trim();
     return out === "true" || out === "1";
   } catch {
@@ -5646,7 +5724,7 @@ function probeRegistryLongpaths(run) {
   try {
     const out = run("reg", ["query", LONGPATHS_REG_KEY, "/v", LONGPATHS_REG_VALUE], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS
+      timeout: PROBE_TIMEOUT_MS2
     }).toString();
     return /0x1\b/.test(out);
   } catch {
@@ -5660,7 +5738,7 @@ function addLongpathsRow(section2, label, enabled2, remediation) {
   }
   addItem(section2, `${yellow(warnGlyph)} ${label}: not enabled (${remediation})`);
 }
-function reportLongPathsCheck(section2, run = execFileSync12) {
+function reportLongPathsCheck(section2, run = execFileSync13) {
   if (process.platform !== "win32") return;
   addLongpathsRow(
     section2,
@@ -5684,11 +5762,11 @@ function reportSyncModality(section2) {
 
 // src/commands.doctor.checks.crlf.ts
 init_color();
-import { execFileSync as execFileSync13 } from "node:child_process";
+import { execFileSync as execFileSync14 } from "node:child_process";
 import { existsSync as existsSync28, readFileSync as readFileSync13 } from "node:fs";
 import { join as join39 } from "node:path";
 init_config();
-var PROBE_TIMEOUT_MS2 = 3e3;
+var PROBE_TIMEOUT_MS3 = 3e3;
 var GUARD_LINE = /^\*\s+-text\b/;
 function hasGitattributesGuard(repo) {
   try {
@@ -5704,7 +5782,7 @@ function probeAutocrlf(repo, run) {
   try {
     const out = run("git", ["-C", repo, "config", "core.autocrlf"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS2
+      timeout: PROBE_TIMEOUT_MS3
     }).toString().trim();
     if (out === "true" || out === "input") return "active";
     if (out === "false") return "disabled";
@@ -5723,7 +5801,7 @@ function addExposedRow(section2, repo, verdict) {
   const remediation = `add a .gitattributes with a \`* -text\` line, or run \`git config core.autocrlf false\`, in ${repo}`;
   addItem(section2, `${yellow(warnGlyph)} CRLF guard: ${risk}; ${remediation}`);
 }
-function reportCrlfGuardCheck(section2, run = execFileSync13) {
+function reportCrlfGuardCheck(section2, run = execFileSync14) {
   const repo = repoHome();
   if (hasGitattributesGuard(repo)) {
     addItem(section2, `${green(okGlyph)} CRLF guard: .gitattributes (* -text) present`);
@@ -6148,10 +6226,10 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
 
 // src/commands.pushed-history.ts
 init_utils();
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 function pushedRef(repo) {
   try {
-    const ref = execFileSync14("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+    const ref = execFileSync15("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
@@ -6164,7 +6242,7 @@ function sessionInPushedHistory(id, repo) {
   const ref = pushedRef(repo);
   if (ref === null) return false;
   try {
-    const out = execFileSync14(
+    const out = execFileSync15(
       "git",
       [
         "log",
@@ -6497,7 +6575,7 @@ var FRAGMENT_SEP = "...";
 var NEAR_WINDOW = 40;
 var VALUE_PAD = 16;
 var SIBLING_PAD = 2;
-var CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
+var CONTROL_CHARS2 = /[\x00-\x1f\x7f]/g;
 function classifyCharset(value) {
   if (/^[0-9a-fA-F]+$/.test(value)) return "hex";
   if (/^[0-9a-zA-Z]+$/.test(value)) return "alphanumeric";
@@ -6571,7 +6649,7 @@ function resolveSpanContext(finding, readLine, siblings = []) {
   return { value: aligned.value, near: emptyToNull(near), exact: aligned.exact };
 }
 function formatNear(text) {
-  const stripped = elideTokenRuns(text.replace(CONTROL_CHARS, ""));
+  const stripped = elideTokenRuns(text.replace(CONTROL_CHARS2, ""));
   const truncated = stripped.length > NEAR_WINDOW;
   const window = stripped.slice(-NEAR_WINDOW).trim();
   if (window.length === 0) return null;
@@ -7048,7 +7126,7 @@ function withSpinner(label, fn, deps) {
 
 // src/commands.doctor.gitleaks-version.ts
 init_color();
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 import { existsSync as existsSync34 } from "node:fs";
 import { join as join48 } from "node:path";
 init_config();
@@ -7071,7 +7149,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists = existsSync34) {
+function reportGitleaksVersionCheck(section2, run = execFileSync16, tomlExists = existsSync34) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -7091,9 +7169,9 @@ function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists =
 
 // src/commands.doctor.checks.deps.ts
 init_color();
-import { execFileSync as execFileSync16 } from "node:child_process";
+import { execFileSync as execFileSync17 } from "node:child_process";
 var VERSION_TOKEN = /(\d{1,9}\.\d{1,9}\.\d{1,9})/;
-var PROBE_TIMEOUT_MS3 = 3e3;
+var PROBE_TIMEOUT_MS4 = 3e3;
 var FETCHER_BASE = "HTTP fetcher";
 function parseFirstVersion(line) {
   const m = VERSION_TOKEN.exec(line);
@@ -7103,7 +7181,7 @@ function probeOptionalDep(bin, run) {
   try {
     const firstLine = run(bin, ["--version"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS3
+      timeout: PROBE_TIMEOUT_MS4
     }).toString().split("\n")[0].trim();
     const version = parseFirstVersion(firstLine);
     return { status: "present", version };
@@ -7128,7 +7206,7 @@ function reportFetcherRow(section2, run) {
     );
   }
 }
-function reportOptionalDeps(section2, run = execFileSync16) {
+function reportOptionalDeps(section2, run = execFileSync17) {
   const gh = probeOptionalDep("gh", run);
   if (gh.status === "present") {
     addItem(section2, `${green(okGlyph)} gh: ${gh.version ?? "present"}`);
@@ -7143,11 +7221,11 @@ function reportOptionalDeps(section2, run = execFileSync16) {
 
 // src/commands.doctor.actions-drift.ts
 init_color();
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 init_config();
 
 // src/gh-actions.ts
-import { execFileSync as execFileSync17 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 var GH_TIMEOUT_MS = 5e3;
 function parseGitHubRemote(remoteUrl) {
   const normalized = remoteUrl.trim().replace(/\/$/, "");
@@ -7155,7 +7233,7 @@ function parseGitHubRemote(remoteUrl) {
   if (m === null) return null;
   return { owner: m[1], repo: m[2] };
 }
-function ghAuthStatus(run = execFileSync17) {
+function ghAuthStatus(run = execFileSync18) {
   try {
     run("gh", ["auth", "status"], {
       stdio: ["ignore", "ignore", "ignore"],
@@ -7169,7 +7247,7 @@ function ghAuthStatus(run = execFileSync17) {
     return "gh-probe-error";
   }
 }
-function isRepoPrivate(ref, run = execFileSync17) {
+function isRepoPrivate(ref, run = execFileSync18) {
   const out = run("gh", ["repo", "view", `${ref.owner}/${ref.repo}`, "--json", "isPrivate"], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: GH_TIMEOUT_MS
@@ -7177,7 +7255,7 @@ function isRepoPrivate(ref, run = execFileSync17) {
   const parsed = JSON.parse(out);
   return parsed.isPrivate === true;
 }
-function isActionsEnabled(ref, run = execFileSync17) {
+function isActionsEnabled(ref, run = execFileSync18) {
   const out = run(
     "gh",
     ["api", `repos/${ref.owner}/${ref.repo}/actions/permissions`, "--jq", ".enabled"],
@@ -7185,7 +7263,7 @@ function isActionsEnabled(ref, run = execFileSync17) {
   ).toString().trim();
   return out === "true";
 }
-function disableActions(ref, run = execFileSync17) {
+function disableActions(ref, run = execFileSync18) {
   run(
     "gh",
     [
@@ -7199,7 +7277,7 @@ function disableActions(ref, run = execFileSync17) {
     { stdio: ["ignore", "ignore", "pipe"], timeout: GH_TIMEOUT_MS }
   );
 }
-function readOriginRemote(cwd, run = execFileSync17) {
+function readOriginRemote(cwd, run = execFileSync18) {
   return run("git", ["remote", "get-url", "origin"], {
     cwd,
     stdio: ["ignore", "pipe", "ignore"]
@@ -7207,7 +7285,7 @@ function readOriginRemote(cwd, run = execFileSync17) {
 }
 
 // src/commands.doctor.actions-drift.ts
-function reportActionsDrift(section2, run = execFileSync18) {
+function reportActionsDrift(section2, run = execFileSync19) {
   let remote;
   try {
     remote = readOriginRemote(repoHome(), run);
@@ -7347,6 +7425,7 @@ function gatherDoctorSections(opts) {
   reportPathMap(pathMap);
   const neverSync = section("Never-sync");
   reportNeverSync(neverSync);
+  reportTrackedDeniedShared(neverSync);
   const skills = section("Skills");
   reportSkillsDivergence(skills);
   const repository = section("Repository");
@@ -7426,15 +7505,15 @@ function parseDoctorArgs(args) {
 
 // src/commands.drop-session.ts
 init_config();
-import { execFileSync as execFileSync20 } from "node:child_process";
+import { execFileSync as execFileSync21 } from "node:child_process";
 import { existsSync as existsSync37, readdirSync as readdirSync16, statSync as statSync10 } from "node:fs";
 import { join as join51, relative as relative7 } from "node:path";
 
 // src/commands.drop-session.git.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 function expandStagedDir(dirRel, repo) {
   try {
-    const out = execFileSync19("git", ["ls-files", "-z", "--", dirRel], {
+    const out = execFileSync20("git", ["ls-files", "-z", "--", dirRel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7446,7 +7525,7 @@ function expandStagedDir(dirRel, repo) {
 function isTrackedInHead(rel, repo) {
   try {
     const treePath = process.platform === "win32" ? rel.replaceAll("\\", "/") : rel;
-    execFileSync19("git", ["cat-file", "-e", `HEAD:${treePath}`], {
+    execFileSync20("git", ["cat-file", "-e", `HEAD:${treePath}`], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7457,7 +7536,7 @@ function isTrackedInHead(rel, repo) {
 }
 function isInIndex(rel, repo) {
   try {
-    const out = execFileSync19("git", ["ls-files", "--", rel], {
+    const out = execFileSync20("git", ["ls-files", "--", rel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7563,12 +7642,12 @@ function unstageOne(rel, repo) {
   }
   try {
     if (isTrackedInHead(rel, repo)) {
-      execFileSync20("git", ["restore", "--staged", "--worktree", "--", rel], {
+      execFileSync21("git", ["restore", "--staged", "--worktree", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
     } else {
-      execFileSync20("git", ["rm", "--cached", "-f", "--", rel], {
+      execFileSync21("git", ["rm", "--cached", "-f", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -8115,9 +8194,9 @@ import { join as join60 } from "node:path";
 
 // src/commands.pull.recovery.git.ts
 init_utils();
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 function gitCapture(args, cwd) {
-  return execFileSync21("git", args, {
+  return execFileSync22("git", args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     maxBuffer: 64 * 1024 * 1024
@@ -8155,23 +8234,6 @@ function parseDirtyPaths(repo, opts = {}) {
 // src/commands.pull.win32.ts
 init_config();
 
-// src/git-probe.ts
-import { execFileSync as execFileSync22 } from "node:child_process";
-var PROBE_TIMEOUT_MS4 = 1e4;
-var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
-function gitProbe(args, repo) {
-  try {
-    return execFileSync22("git", args, {
-      cwd: repo,
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS4,
-      maxBuffer: PROBE_MAX_BUFFER
-    }).toString();
-  } catch {
-    return null;
-  }
-}
-
 // src/links.deletions.ts
 init_config();
 import { existsSync as existsSync40, lstatSync as lstatSync19, rmSync as rmSync17 } from "node:fs";
@@ -8235,6 +8297,7 @@ function applySharedLinkDeletions(map, ts, opts = {}) {
 
 // src/links.mirror.ts
 init_config();
+init_error_text();
 import { existsSync as existsSync41, lstatSync as lstatSync20, rmSync as rmSync18, statSync as statSync12 } from "node:fs";
 import { join as join57 } from "node:path";
 init_utils();
@@ -8402,19 +8465,19 @@ function reportTrackedDenied(repo, path, segment) {
   const denied = `the path segment "${segment}" is on the never-sync list`;
   if (inHead === null) {
     warn(
-      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it with "git status -- ${path}" and take it out of shared/ before committing`
+      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it by running git status -- "${path}" and take it out of shared/ before committing`
     );
     return;
   }
   if (inHead.trim() === "") {
     warn(
-      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run "git rm --cached -- ${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, "git diff --cached --name-status" names the source, whose content IS committed, so restore that half with "git checkout HEAD -- <source>" rather than leaving its deletion staged`
+      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run git rm --cached -- "${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, run git diff --cached --name-status to name the source, whose content IS committed, so restore that half with git checkout HEAD -- "<source>" rather than leaving its deletion staged`
     );
     return;
   }
   if (!existsSync41(join57(repo, path))) return;
   warn(
-    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run "git checkout HEAD -- ${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: "git rm -- ${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
+    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run git checkout HEAD -- "${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: git rm -- "${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
   );
 }
 function revertDeniedMirrorPaths(repo, status, ts) {
@@ -8891,13 +8954,30 @@ function newlyUntracked(before, after) {
   if (before === null || after === null) return [];
   return [...after].filter((p) => !before.has(p));
 }
+function ignoredPathsUnderShared(repo) {
+  const out = gitProbe(
+    ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--ignored", "--", "shared/"],
+    repo
+  );
+  if (out === null) return [];
+  return out.split("\0").filter((record) => record.startsWith("!! ")).map((record) => record.slice(3));
+}
+function reportIgnoredDenied(repo) {
+  for (const path of new Set(ignoredPathsUnderShared(repo))) {
+    const segment = deniedSegmentFor(path);
+    if (segment === null) continue;
+    warn(
+      `${path} is inside shared/ but git ignores it: the path segment "${segment}" is on the never-sync list. Nothing was changed, and nothing published it: nomad only ever stages with "git add -A", which skips an ignored path, so it has not reached the index or the remote. It stays invisible to the rest of this gate for the same reason, so move it outside shared/ if you want it kept, or delete it. Note the ignore rule may come from your global core.excludesFile rather than from this repo; run git check-ignore -v -- "${path}" to see which file and line the rule came from`
+    );
+  }
+}
 function revertDeniedUnderShared(repo, ts) {
   const out = gitProbe(
     ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "shared/"],
     repo
   );
-  if (out === null) return;
-  revertDeniedMirrorPaths(repo, parsePorcelainZ(out), ts);
+  if (out !== null) revertDeniedMirrorPaths(repo, parsePorcelainZ(out), ts);
+  reportIgnoredDenied(repo);
 }
 function reconcileSharedLinksBeforePull(repo, ts) {
   if (process.platform !== "win32") {
@@ -10899,7 +10979,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.67.2",
+  version: "0.68.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.67.2",
+  "version": "0.68.0",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [