claude-nomad 0.67.3 → 0.68.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [0.68.0](https://github.com/funkadelic/claude-nomad/compare/v0.67.3...v0.68.0) (2026-09-03)
+
+
+### What's new
+
+**On native Windows (PowerShell or cmd).** Note: WSL2 behaves like Linux and this does not apply to it.
+
+- **A never-sync warning during `nomad pull` now suggests commands you can paste as they are.** Before a pull, nomad warns when a file that should never travel between machines turns up in your sync repo, and the warning names the git commands to deal with it. A filename containing a space split the suggested command in two, so pasting it acted on neither half. The paths are now quoted.
+
+**On every platform.**
+
+- **`nomad doctor` now warns when your sync repo is carrying a file that should never sync**, such as a credential or a per-machine settings file. Until now one of those was only noticed while it was new or changed, so a file that was committed and then left alone went unmentioned, and the check that did look ran only on Windows. Doctor names the file and the command that stops tracking it without deleting your copy. It only warns.
+- **`nomad adopt` no longer fails on a deeply nested folder.** Adopting a shared folder scans it first, and a very deep tree could crash that scan. The scan handles any depth now.
+- **A backup nomad cannot write is now reported as a plain error.** Nomad copies anything it is about to overwrite into a backup first. When that copy fails, say a full disk or a permissions problem, you get one message naming what it was copying, where it was going, and why it failed, instead of a crash report file. The message also says a partial copy may be left behind.
+
+Everything else in this release is dependency updates.
+
+
+### Added
+
+* **doctor:** warn when the sync repo tracks a never-synced file ([#562](https://github.com/funkadelic/claude-nomad/issues/562)) ([a1b3f71](https://github.com/funkadelic/claude-nomad/commit/a1b3f71a0a3deecac81e0bcc9e8ee214c1e50a4e))
+
+
+### Fixed
+
+* **adopt:** handle deep directories and report a failed backup ([#560](https://github.com/funkadelic/claude-nomad/issues/560)) ([2b19ccb](https://github.com/funkadelic/claude-nomad/commit/2b19ccba5959efb7b42d16ee0db862df4d92a0ac))
+* **backup:** report a failed backup instead of writing a crash report ([#561](https://github.com/funkadelic/claude-nomad/issues/561)) ([9d8484c](https://github.com/funkadelic/claude-nomad/commit/9d8484cdb59eb5a5905dfb0a3e16ae952acead5f))
+* **pull:** quote file paths in the never-sync warning's suggested commands ([#559](https://github.com/funkadelic/claude-nomad/issues/559)) ([070cc17](https://github.com/funkadelic/claude-nomad/commit/070cc1709263d46cc50d01e99c345b3955d729ed))
+
+
+### Dependencies
+
+* bump fast-uri from 3.1.5 to 3.1.7 ([#563](https://github.com/funkadelic/claude-nomad/issues/563)) ([7bf62e3](https://github.com/funkadelic/claude-nomad/commit/7bf62e3e481246b7c8125e31fb2df6654241dd54))
+* bump the codeql-action group across 1 directory with 2 updates ([#556](https://github.com/funkadelic/claude-nomad/issues/556)) ([ad3ae73](https://github.com/funkadelic/claude-nomad/commit/ad3ae739043ae24f560d0ddd56baff79bb6b6ad6))
+* bump the dev-dependencies group across 1 directory with 3 updates ([#555](https://github.com/funkadelic/claude-nomad/issues/555)) ([02aebe2](https://github.com/funkadelic/claude-nomad/commit/02aebe2a6407dcd4be67fe9e33723c735a1c44cd))
+* bump the prod-dependencies group in /docs-site with 3 updates ([#557](https://github.com/funkadelic/claude-nomad/issues/557)) ([b6b5c8a](https://github.com/funkadelic/claude-nomad/commit/b6b5c8aebebcc8e4c73ac12d511bc972bda553d7))
+
 ## [0.67.3](https://github.com/funkadelic/claude-nomad/compare/v0.67.2...v0.67.3) (2026-08-29)
 
 ### What's new
@@ -560,14 +597,7 @@ All of this applies on macOS, Linux, WSL2, and native Windows.
 
 * **pull:** retain unpushed local work and surface it in the preview ([#376](https://github.com/funkadelic/claude-nomad/issues/376)) ([3f70019](https://github.com/funkadelic/claude-nomad/commit/3f70019c89ccd77726e6330d9623e106bb9ff69c))
 
-  What this means: `nomad pull` no longer discards work you have not pushed
-  yet. Chat sessions, subagent history, and memory files that exist only on
-  this machine now survive a pull, and a synced file you have edited locally
-  (a project's `.planning` notes or its `CLAUDE.md`) is kept instead of being
-  overwritten when it differs from the incoming copy, with a note to push and
-  reconcile. `nomad diff` and `pull --dry-run` now show the count of retained
-  local-only items and the keep-local warning, where before they reported
-  `clean` / `0 collisions`.
+  What this means: `nomad pull` no longer discards work you have not pushed yet. Chat sessions, subagent history, and memory files that exist only on this machine now survive a pull, and a synced file you have edited locally (a project's `.planning` notes or its `CLAUDE.md`) is kept instead of being overwritten when it differs from the incoming copy, with a note to push and reconcile. `nomad diff` and `pull --dry-run` now show the count of retained local-only items and the keep-local warning, where before they reported `clean` / `0 collisions`.
 
 ## [0.56.1](https://github.com/funkadelic/claude-nomad/compare/v0.56.0...v0.56.1) (2026-06-30)
 

package/README.md

@@ -54,18 +54,20 @@ session history survives different file paths and your secrets never ride along.
 - **One command tells you what is wrong.** `nomad doctor` is a read-only health check: wedged sync
   repo, broken hook references, hooks that would crash on session start because of a missing
   `--preserve-symlinks-main` flag, version drift, oversized backup cache, missing git committer
-  identity in the sync repo (a push fails at commit time without one), path-map entries whose local
-  project folder no longer exists on this machine, a multi-host repo where this machine's
-  hostname-derived key matches no `hosts/<HOST>.json` or path-map entry (a sign `NOMAD_HOST` is
-  unset here, so per-host settings and session sync will not line up with the other hosts), synced
-  skills with local edits that differ from the shared copy, a native Windows shared-config copy that
-  has drifted from the repo's copy (a warning, not a failure), and settings drift in both
-  directions: keys present in the repo merge but absent from your live `settings.json` (behind; the
-  next `nomad pull` will restore them, fix: `nomad pull`) and keys present locally but not yet in
-  the repo (ahead; local-only additions, fix: `nomad capture-settings`). Each issue includes a fix
-  hint. By default the report is compact: it shows only checks that need action plus a one-line
-  verdict. Add `--verbose` (or `--all` / `-v`) to see the full per-check tree, including everything
-  that passed.
+  identity in the sync repo (a push fails at commit time without one), a never-synced file such as a
+  credential or a per-host settings file that Git already tracks inside the repo's `shared/` folder
+  (once it is committed the pull-side guard can no longer see it, so doctor names the file and the
+  folder name that blocks it), path-map entries whose local project folder no longer exists on this
+  machine, a multi-host repo where this machine's hostname-derived key matches no
+  `hosts/<HOST>.json` or path-map entry (a sign `NOMAD_HOST` is unset here, so per-host settings and
+  session sync will not line up with the other hosts), synced skills with local edits that differ
+  from the shared copy, a native Windows shared-config copy that has drifted from the repo's copy (a
+  warning, not a failure), and settings drift in both directions: keys present in the repo merge but
+  absent from your live `settings.json` (behind; the next `nomad pull` will restore them, fix:
+  `nomad pull`) and keys present locally but not yet in the repo (ahead; local-only additions, fix:
+  `nomad capture-settings`). Each issue includes a fix hint. By default the report is compact: it
+  shows only checks that need action plus a one-line verdict. Add `--verbose` (or `--all` / `-v`) to
+  see the full per-check tree, including everything that passed.
 - **Self-healing sync.** Every overwrite is backed up first, and `nomad pull --force-remote`
   recovers two kinds of stuck sync repo: a repo stuck mid-rebase or mid-merge (aborts the operation,
   parks stranded work on a branch, refuses if shared config is at risk), and a repo where the rebase

package/dist/nomad.mjs

@@ -721,6 +721,21 @@ var init_config = __esm({
   }
 });
 
+// src/error-text.ts
+function errorText(err) {
+  try {
+    const message = err?.message;
+    return typeof message === "string" ? message : String(err);
+  } catch {
+    return "unprintable error value";
+  }
+}
+var init_error_text = __esm({
+  "src/error-text.ts"() {
+    "use strict";
+  }
+});
+
 // src/utils.json.ts
 import { readFileSync } from "node:fs";
 function readJson(path) {
@@ -886,17 +901,22 @@ function ensureSymlink(linkPath, target) {
   symlinkSync(target, linkPath);
   log(`linked ${linkPath} -> ${target}`);
 }
-function backupUnder(absPath, anchor, destRoot) {
+function backupUnder(absPath, anchor, destRoot, hint) {
   if (!existsSync3(absPath)) return false;
   const rel = relative3(anchor, absPath);
   if (rel === "" || rel === ".." || rel.startsWith(`..${sep2}`)) return false;
   const dst = join5(destRoot, rel);
-  mkdirSync(dirname(dst), { recursive: true });
-  cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  try {
+    mkdirSync(dirname(dst), { recursive: true });
+    cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  } catch (err) {
+    const fragment = `could not back up ${absPath} into ${dst} (${errorText(err)}); a partial copy may be left there`;
+    throw new NomadFatal(hint === void 0 ? fragment : `${fragment}. ${hint}`);
+  }
   return true;
 }
-function backupBeforeWrite(absPath, ts) {
-  return backupUnder(absPath, claudeHome(), join5(backupBase(), ts));
+function backupBeforeWrite(absPath, ts, hint) {
+  return backupUnder(absPath, claudeHome(), join5(backupBase(), ts), hint);
 }
 function backupRepoWrite(absPath, ts, repoHome2) {
   backupUnder(absPath, repoHome2, join5(backupBase(), ts, "repo"));
@@ -909,6 +929,7 @@ var init_utils_fs = __esm({
   "src/utils.fs.ts"() {
     "use strict";
     init_config();
+    init_error_text();
     init_utils_json();
     init_utils();
     RENAME_RETRY_MAX_ATTEMPTS = 5;
@@ -1134,7 +1155,7 @@ var init_autostash_guard = __esm({
 });
 
 // src/push-checks.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { readdirSync as readdirSync8, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
 import { delimiter, join as join23 } from "node:path";
@@ -1201,7 +1222,7 @@ function probeGitleaks() {
   const args = ["version"];
   if (toml !== null) args.push("--config", toml);
   try {
-    return execFileSync4("gitleaks", args, { stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
+    return execFileSync5("gitleaks", args, { stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") throw new NomadFatal(gitleaksInstallHint());
@@ -1221,7 +1242,7 @@ function rebaseBeforePush(repo) {
   const wedge = classifyWedge(repo);
   if (wedge !== null) throw new NomadFatal(wedgePreflight(wedge), { code: EXIT.CONFLICT });
   try {
-    execFileSync4("git", ["pull", "--rebase", "--autostash"], {
+    execFileSync5("git", ["pull", "--rebase", "--autostash"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -1246,7 +1267,7 @@ var init_push_checks = __esm({
 });
 
 // src/push-gitleaks.scan.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync9 } from "node:child_process";
 import { mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join27 } from "node:path";
@@ -1313,9 +1334,9 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   const opts = { cwd: repoDir, stdio: ["ignore", "pipe", "pipe"] };
   const gitleaksOpts = { ...opts, timeout: GITLEAKS_SCAN_TIMEOUT_MS };
   try {
-    execFileSync8("git", ["init", "-q"], opts);
-    execFileSync8("git", ["add", "-A"], opts);
-    execFileSync8("gitleaks", args, gitleaksOpts);
+    execFileSync9("git", ["init", "-q"], opts);
+    execFileSync9("git", ["add", "-A"], opts);
+    execFileSync9("gitleaks", args, gitleaksOpts);
     return [];
   } catch (err) {
     const e = err;
@@ -1348,7 +1369,7 @@ function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TI
       stdio: ["ignore", "pipe", "pipe"],
       timeout: timeoutMs
     };
-    execFileSync8("gitleaks", args, opts);
+    execFileSync9("gitleaks", args, opts);
     return [];
   } catch (err) {
     const e = err;
@@ -1567,43 +1588,37 @@ import { dirname as dirname2, join as join7, resolve as resolve2 } from "node:pa
 
 // src/commands.adopt.scan.ts
 init_config();
-import { lstatSync, readdirSync } from "node:fs";
-import { join as join2, relative } from "node:path";
-
-// src/error-text.ts
-function errorText(err) {
-  try {
-    const message = err?.message;
-    return typeof message === "string" ? message : String(err);
-  } catch {
-    return "unprintable error value";
-  }
-}
-
-// src/commands.adopt.scan.ts
+init_error_text();
 init_exit_codes();
 init_utils();
+import { lstatSync, readdirSync } from "node:fs";
+import { join as join2, relative } from "node:path";
 function toForwardSlash(p) {
   return p.replaceAll("\\", "/");
 }
-function walk(root, dir, out) {
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const match = matchDeniedName(ALWAYS_NEVER_SYNC, entry.name);
-    if (match !== null) {
-      out.push({
-        path: toForwardSlash(relative(root, join2(dir, entry.name))),
-        matched: match.axis === "name" ? match.entry : null
-      });
-      continue;
+function walk(root) {
+  const out = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const match = matchDeniedName(ALWAYS_NEVER_SYNC, entry.name);
+      if (match !== null) {
+        out.push({
+          path: toForwardSlash(relative(root, join2(dir, entry.name))),
+          matched: match.axis === "name" ? match.entry : null
+        });
+        continue;
+      }
+      if (entry.isDirectory()) stack.push(join2(dir, entry.name));
     }
-    if (entry.isDirectory()) walk(root, join2(dir, entry.name), out);
   }
+  return out;
 }
 function scanDeniedEntries(root) {
   const stat = lstatSync(root, { throwIfNoEntry: false });
   if (!stat?.isDirectory()) return [];
-  const out = [];
-  walk(root, root, out);
+  const out = walk(root);
   out.sort((a, b) => a.path.localeCompare(b.path));
   return out;
 }
@@ -1652,6 +1667,7 @@ function refuseDeniedEntries(name, root) {
 
 // src/commands.adopt.recover.ts
 init_config();
+init_error_text();
 init_exit_codes();
 
 // src/extras-sync.core.ts
@@ -2689,7 +2705,11 @@ function adoptStopsEarly(name, linkPath, sharedTarget) {
 }
 function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
   const ts = freshBackupTs(backup);
-  const snapshotted = backupBeforeWrite(linkPath, ts);
+  const snapshotted = backupBeforeWrite(
+    linkPath,
+    ts,
+    `Nothing was removed from ${linkPath} and nothing was written to the repo. Fix what the error names, then run \`nomad adopt ${name}\` again.`
+  );
   const rel = join9("shared", name);
   const stage = () => gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
   copyIntoSharedOrFatal(name, linkPath, sharedTarget, repo);
@@ -3996,15 +4016,34 @@ function reportSkillsDivergence(section2) {
 // src/commands.doctor.checks.git-state.ts
 init_color();
 init_config();
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { existsSync as existsSync17 } from "node:fs";
 import { join as join24, relative as relative5 } from "node:path";
 init_commands_pull_wedge();
+
+// src/git-probe.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+var PROBE_TIMEOUT_MS = 1e4;
+var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
+function gitProbe(args, repo) {
+  try {
+    return execFileSync4("git", args, {
+      cwd: repo,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: PROBE_TIMEOUT_MS,
+      maxBuffer: PROBE_MAX_BUFFER
+    }).toString();
+  } catch {
+    return null;
+  }
+}
+
+// src/commands.doctor.checks.git-state.ts
 init_push_checks();
 init_utils();
 function reportGitleaksProbe(section2) {
   try {
-    execFileSync5("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync6("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch (err) {
     if (err.code === "ENOENT") {
@@ -4040,7 +4079,7 @@ function reportGitlinks(section2) {
 }
 function reportRemote(section2) {
   try {
-    const url = execFileSync5("git", ["remote", "get-url", "origin"], {
+    const url = execFileSync6("git", ["remote", "get-url", "origin"], {
       cwd: repoHome(),
       stdio: ["ignore", "pipe", "pipe"]
     }).toString().trim();
@@ -4097,7 +4136,7 @@ function reportGitIdentity(section2) {
   const missing = [];
   for (const field of ["user.name", "user.email"]) {
     try {
-      const val = execFileSync5("git", ["config", field], {
+      const val = execFileSync6("git", ["config", field], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       }).toString().trim();
@@ -4117,6 +4156,45 @@ function reportGitIdentity(section2) {
     addItem(section2, `${green(okGlyph)} git identity: user.name and user.email configured`);
   }
 }
+var MAX_TRACKED_DENIED_ROWS = 5;
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function renderable(text) {
+  return text.replace(CONTROL_CHARS, " ");
+}
+function reportTrackedDeniedShared(section2) {
+  const out = gitProbe(["ls-files", "-z", "--", ":(icase)shared/"], repoHome());
+  if (out === null) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} never-sync scan: git could not list shared/, so nothing was scanned`
+    );
+    return;
+  }
+  const hits = /* @__PURE__ */ new Map();
+  for (const path of out.split("\0")) {
+    const segment = path === "" ? null : deniedSegmentFor(path);
+    if (segment !== null) hits.set(path, segment);
+  }
+  if (hits.size === 0) {
+    addItem(
+      section2,
+      `${green(okGlyph)} never-sync scan: no tracked path under shared/ is denylisted`
+    );
+    return;
+  }
+  for (const [path, segment] of [...hits].slice(0, MAX_TRACKED_DENIED_ROWS)) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} never-sync: git tracks ${blue(renderable(path))} (the path segment "${renderable(segment)}" is blocked by the never-sync boundary)`
+    );
+  }
+  const overflow = hits.size - MAX_TRACKED_DENIED_ROWS;
+  const more = overflow > 0 ? `${overflow} more not listed, run git ls-files -- ":(icase)shared/" in the sync repo to see them all. ` : "";
+  addItem(
+    section2,
+    `${yellow(warnGlyph)} never-sync: ${more}Run git rm --cached -- "<path>" and commit to stop tracking each one; that leaves the file on disk, so move it outside shared/ if you want to keep it. If one holds a real secret, rotate it and rewrite history too, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent`
+  );
+}
 
 // src/commands.doctor.checks.backups.ts
 init_color();
@@ -4166,14 +4244,14 @@ function reportBackupsCheck(section2, backupBase2 = backupBase()) {
 
 // src/commands.doctor.check-remote.ts
 init_color();
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 init_config();
 init_utils_json();
 var GIT_REMOTE_TIMEOUT_MS = 3e3;
 function readRemotePathMap(sec, repo) {
   let rawJson;
   try {
-    rawJson = execFileSync6("git", ["show", "origin/main:path-map.json"], {
+    rawJson = execFileSync7("git", ["show", "origin/main:path-map.json"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: GIT_REMOTE_TIMEOUT_MS
@@ -4206,7 +4284,7 @@ function reportCheckRemote(section2) {
   const repo = repoHome();
   let names;
   try {
-    const out = execFileSync6("git", ["ls-tree", "--name-only", "origin/main"], {
+    const out = execFileSync7("git", ["ls-tree", "--name-only", "origin/main"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: GIT_REMOTE_TIMEOUT_MS
@@ -4238,9 +4316,9 @@ import { join as join26 } from "node:path";
 init_config();
 
 // src/http-fetch.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync8 } from "node:child_process";
 var FETCH_TIMEOUT_MS = 3e3;
-function fetchUrl(url, run = execFileSync7) {
+function fetchUrl(url, run = execFileSync8) {
   try {
     return run("curl", ["-fsSL", "-m", "3", url], {
       stdio: ["ignore", "pipe", "pipe"],
@@ -4301,14 +4379,14 @@ function reportCheckSchema(section2) {
 // src/commands.doctor.check-shared.ts
 init_color();
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 import { existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync12, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join33 } from "node:path";
 
 // src/commands.doctor.check-shared.memory.ts
 init_color();
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { mkdirSync as mkdirSync4, rmSync as rmSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
@@ -4320,7 +4398,7 @@ var MEMORY_MD_PATH = /^shared\/projects\/([^/]+)\/memory\/[^/]+\.md$/;
 function buildMemoryScanTree(tmpRoot) {
   let paths;
   try {
-    const out = execFileSync9(
+    const out = execFileSync10(
       "git",
       ["-C", repoHome(), "ls-tree", "-r", "-z", "--name-only", "HEAD", "--", "shared/projects"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }
@@ -4336,7 +4414,7 @@ function buildMemoryScanTree(tmpRoot) {
     if (m?.[1] === void 0) continue;
     let blob;
     try {
-      blob = execFileSync9("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
+      blob = execFileSync10("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
         stdio: ["ignore", "pipe", "ignore"],
         maxBuffer: 67108864,
         timeout: 1e4
@@ -4504,7 +4582,7 @@ function scanAndReport(section2, tmpRoot, staged, logicalToEncoded) {
 
 // src/commands.doctor.check-shared.skills.ts
 init_color();
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdirSync as mkdirSync5, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
@@ -4516,7 +4594,7 @@ var SKILL_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
 function buildSkillScanTree(tmpRoot) {
   let paths;
   try {
-    const out = execFileSync10(
+    const out = execFileSync11(
       "git",
       ["-C", repoHome(), "ls-tree", "-r", "-z", "--name-only", "HEAD", "--", "shared/skills"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }
@@ -4532,7 +4610,7 @@ function buildSkillScanTree(tmpRoot) {
     if (m?.[1] === void 0) continue;
     let blob;
     try {
-      blob = execFileSync10("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
+      blob = execFileSync11("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
         stdio: ["ignore", "pipe", "ignore"],
         maxBuffer: 67108864,
         timeout: 1e4
@@ -4970,7 +5048,7 @@ function buildScanTree(tmpRoot) {
 }
 function probeGitleaksForScan() {
   try {
-    execFileSync11("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync12("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
     return "ok";
   } catch (err) {
     if (err.code === "ENOENT") return "missing";
@@ -5626,16 +5704,16 @@ function reportNodeEngineCheck(section2) {
 
 // src/commands.doctor.checks.longpaths.ts
 init_color();
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync13 } from "node:child_process";
 init_config();
-var PROBE_TIMEOUT_MS = 3e3;
+var PROBE_TIMEOUT_MS2 = 3e3;
 var LONGPATHS_REG_KEY = String.raw`HKLM\SYSTEM\CurrentControlSet\Control\FileSystem`;
 var LONGPATHS_REG_VALUE = "LongPathsEnabled";
 function probeGitLongpaths(run) {
   try {
     const out = run("git", ["-C", repoHome(), "config", "--get", "core.longpaths"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS
+      timeout: PROBE_TIMEOUT_MS2
     }).toString().trim();
     return out === "true" || out === "1";
   } catch {
@@ -5646,7 +5724,7 @@ function probeRegistryLongpaths(run) {
   try {
     const out = run("reg", ["query", LONGPATHS_REG_KEY, "/v", LONGPATHS_REG_VALUE], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS
+      timeout: PROBE_TIMEOUT_MS2
     }).toString();
     return /0x1\b/.test(out);
   } catch {
@@ -5660,7 +5738,7 @@ function addLongpathsRow(section2, label, enabled2, remediation) {
   }
   addItem(section2, `${yellow(warnGlyph)} ${label}: not enabled (${remediation})`);
 }
-function reportLongPathsCheck(section2, run = execFileSync12) {
+function reportLongPathsCheck(section2, run = execFileSync13) {
   if (process.platform !== "win32") return;
   addLongpathsRow(
     section2,
@@ -5684,11 +5762,11 @@ function reportSyncModality(section2) {
 
 // src/commands.doctor.checks.crlf.ts
 init_color();
-import { execFileSync as execFileSync13 } from "node:child_process";
+import { execFileSync as execFileSync14 } from "node:child_process";
 import { existsSync as existsSync28, readFileSync as readFileSync13 } from "node:fs";
 import { join as join39 } from "node:path";
 init_config();
-var PROBE_TIMEOUT_MS2 = 3e3;
+var PROBE_TIMEOUT_MS3 = 3e3;
 var GUARD_LINE = /^\*\s+-text\b/;
 function hasGitattributesGuard(repo) {
   try {
@@ -5704,7 +5782,7 @@ function probeAutocrlf(repo, run) {
   try {
     const out = run("git", ["-C", repo, "config", "core.autocrlf"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS2
+      timeout: PROBE_TIMEOUT_MS3
     }).toString().trim();
     if (out === "true" || out === "input") return "active";
     if (out === "false") return "disabled";
@@ -5723,7 +5801,7 @@ function addExposedRow(section2, repo, verdict) {
   const remediation = `add a .gitattributes with a \`* -text\` line, or run \`git config core.autocrlf false\`, in ${repo}`;
   addItem(section2, `${yellow(warnGlyph)} CRLF guard: ${risk}; ${remediation}`);
 }
-function reportCrlfGuardCheck(section2, run = execFileSync13) {
+function reportCrlfGuardCheck(section2, run = execFileSync14) {
   const repo = repoHome();
   if (hasGitattributesGuard(repo)) {
     addItem(section2, `${green(okGlyph)} CRLF guard: .gitattributes (* -text) present`);
@@ -6148,10 +6226,10 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
 
 // src/commands.pushed-history.ts
 init_utils();
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 function pushedRef(repo) {
   try {
-    const ref = execFileSync14("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+    const ref = execFileSync15("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
@@ -6164,7 +6242,7 @@ function sessionInPushedHistory(id, repo) {
   const ref = pushedRef(repo);
   if (ref === null) return false;
   try {
-    const out = execFileSync14(
+    const out = execFileSync15(
       "git",
       [
         "log",
@@ -6497,7 +6575,7 @@ var FRAGMENT_SEP = "...";
 var NEAR_WINDOW = 40;
 var VALUE_PAD = 16;
 var SIBLING_PAD = 2;
-var CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
+var CONTROL_CHARS2 = /[\x00-\x1f\x7f]/g;
 function classifyCharset(value) {
   if (/^[0-9a-fA-F]+$/.test(value)) return "hex";
   if (/^[0-9a-zA-Z]+$/.test(value)) return "alphanumeric";
@@ -6571,7 +6649,7 @@ function resolveSpanContext(finding, readLine, siblings = []) {
   return { value: aligned.value, near: emptyToNull(near), exact: aligned.exact };
 }
 function formatNear(text) {
-  const stripped = elideTokenRuns(text.replace(CONTROL_CHARS, ""));
+  const stripped = elideTokenRuns(text.replace(CONTROL_CHARS2, ""));
   const truncated = stripped.length > NEAR_WINDOW;
   const window = stripped.slice(-NEAR_WINDOW).trim();
   if (window.length === 0) return null;
@@ -7048,7 +7126,7 @@ function withSpinner(label, fn, deps) {
 
 // src/commands.doctor.gitleaks-version.ts
 init_color();
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 import { existsSync as existsSync34 } from "node:fs";
 import { join as join48 } from "node:path";
 init_config();
@@ -7071,7 +7149,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists = existsSync34) {
+function reportGitleaksVersionCheck(section2, run = execFileSync16, tomlExists = existsSync34) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -7091,9 +7169,9 @@ function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists =
 
 // src/commands.doctor.checks.deps.ts
 init_color();
-import { execFileSync as execFileSync16 } from "node:child_process";
+import { execFileSync as execFileSync17 } from "node:child_process";
 var VERSION_TOKEN = /(\d{1,9}\.\d{1,9}\.\d{1,9})/;
-var PROBE_TIMEOUT_MS3 = 3e3;
+var PROBE_TIMEOUT_MS4 = 3e3;
 var FETCHER_BASE = "HTTP fetcher";
 function parseFirstVersion(line) {
   const m = VERSION_TOKEN.exec(line);
@@ -7103,7 +7181,7 @@ function probeOptionalDep(bin, run) {
   try {
     const firstLine = run(bin, ["--version"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS3
+      timeout: PROBE_TIMEOUT_MS4
     }).toString().split("\n")[0].trim();
     const version = parseFirstVersion(firstLine);
     return { status: "present", version };
@@ -7128,7 +7206,7 @@ function reportFetcherRow(section2, run) {
     );
   }
 }
-function reportOptionalDeps(section2, run = execFileSync16) {
+function reportOptionalDeps(section2, run = execFileSync17) {
   const gh = probeOptionalDep("gh", run);
   if (gh.status === "present") {
     addItem(section2, `${green(okGlyph)} gh: ${gh.version ?? "present"}`);
@@ -7143,11 +7221,11 @@ function reportOptionalDeps(section2, run = execFileSync16) {
 
 // src/commands.doctor.actions-drift.ts
 init_color();
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 init_config();
 
 // src/gh-actions.ts
-import { execFileSync as execFileSync17 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 var GH_TIMEOUT_MS = 5e3;
 function parseGitHubRemote(remoteUrl) {
   const normalized = remoteUrl.trim().replace(/\/$/, "");
@@ -7155,7 +7233,7 @@ function parseGitHubRemote(remoteUrl) {
   if (m === null) return null;
   return { owner: m[1], repo: m[2] };
 }
-function ghAuthStatus(run = execFileSync17) {
+function ghAuthStatus(run = execFileSync18) {
   try {
     run("gh", ["auth", "status"], {
       stdio: ["ignore", "ignore", "ignore"],
@@ -7169,7 +7247,7 @@ function ghAuthStatus(run = execFileSync17) {
     return "gh-probe-error";
   }
 }
-function isRepoPrivate(ref, run = execFileSync17) {
+function isRepoPrivate(ref, run = execFileSync18) {
   const out = run("gh", ["repo", "view", `${ref.owner}/${ref.repo}`, "--json", "isPrivate"], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: GH_TIMEOUT_MS
@@ -7177,7 +7255,7 @@ function isRepoPrivate(ref, run = execFileSync17) {
   const parsed = JSON.parse(out);
   return parsed.isPrivate === true;
 }
-function isActionsEnabled(ref, run = execFileSync17) {
+function isActionsEnabled(ref, run = execFileSync18) {
   const out = run(
     "gh",
     ["api", `repos/${ref.owner}/${ref.repo}/actions/permissions`, "--jq", ".enabled"],
@@ -7185,7 +7263,7 @@ function isActionsEnabled(ref, run = execFileSync17) {
   ).toString().trim();
   return out === "true";
 }
-function disableActions(ref, run = execFileSync17) {
+function disableActions(ref, run = execFileSync18) {
   run(
     "gh",
     [
@@ -7199,7 +7277,7 @@ function disableActions(ref, run = execFileSync17) {
     { stdio: ["ignore", "ignore", "pipe"], timeout: GH_TIMEOUT_MS }
   );
 }
-function readOriginRemote(cwd, run = execFileSync17) {
+function readOriginRemote(cwd, run = execFileSync18) {
   return run("git", ["remote", "get-url", "origin"], {
     cwd,
     stdio: ["ignore", "pipe", "ignore"]
@@ -7207,7 +7285,7 @@ function readOriginRemote(cwd, run = execFileSync17) {
 }
 
 // src/commands.doctor.actions-drift.ts
-function reportActionsDrift(section2, run = execFileSync18) {
+function reportActionsDrift(section2, run = execFileSync19) {
   let remote;
   try {
     remote = readOriginRemote(repoHome(), run);
@@ -7347,6 +7425,7 @@ function gatherDoctorSections(opts) {
   reportPathMap(pathMap);
   const neverSync = section("Never-sync");
   reportNeverSync(neverSync);
+  reportTrackedDeniedShared(neverSync);
   const skills = section("Skills");
   reportSkillsDivergence(skills);
   const repository = section("Repository");
@@ -7426,15 +7505,15 @@ function parseDoctorArgs(args) {
 
 // src/commands.drop-session.ts
 init_config();
-import { execFileSync as execFileSync20 } from "node:child_process";
+import { execFileSync as execFileSync21 } from "node:child_process";
 import { existsSync as existsSync37, readdirSync as readdirSync16, statSync as statSync10 } from "node:fs";
 import { join as join51, relative as relative7 } from "node:path";
 
 // src/commands.drop-session.git.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 function expandStagedDir(dirRel, repo) {
   try {
-    const out = execFileSync19("git", ["ls-files", "-z", "--", dirRel], {
+    const out = execFileSync20("git", ["ls-files", "-z", "--", dirRel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7446,7 +7525,7 @@ function expandStagedDir(dirRel, repo) {
 function isTrackedInHead(rel, repo) {
   try {
     const treePath = process.platform === "win32" ? rel.replaceAll("\\", "/") : rel;
-    execFileSync19("git", ["cat-file", "-e", `HEAD:${treePath}`], {
+    execFileSync20("git", ["cat-file", "-e", `HEAD:${treePath}`], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7457,7 +7536,7 @@ function isTrackedInHead(rel, repo) {
 }
 function isInIndex(rel, repo) {
   try {
-    const out = execFileSync19("git", ["ls-files", "--", rel], {
+    const out = execFileSync20("git", ["ls-files", "--", rel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7563,12 +7642,12 @@ function unstageOne(rel, repo) {
   }
   try {
     if (isTrackedInHead(rel, repo)) {
-      execFileSync20("git", ["restore", "--staged", "--worktree", "--", rel], {
+      execFileSync21("git", ["restore", "--staged", "--worktree", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
     } else {
-      execFileSync20("git", ["rm", "--cached", "-f", "--", rel], {
+      execFileSync21("git", ["rm", "--cached", "-f", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -8115,9 +8194,9 @@ import { join as join60 } from "node:path";
 
 // src/commands.pull.recovery.git.ts
 init_utils();
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 function gitCapture(args, cwd) {
-  return execFileSync21("git", args, {
+  return execFileSync22("git", args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     maxBuffer: 64 * 1024 * 1024
@@ -8155,23 +8234,6 @@ function parseDirtyPaths(repo, opts = {}) {
 // src/commands.pull.win32.ts
 init_config();
 
-// src/git-probe.ts
-import { execFileSync as execFileSync22 } from "node:child_process";
-var PROBE_TIMEOUT_MS4 = 1e4;
-var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
-function gitProbe(args, repo) {
-  try {
-    return execFileSync22("git", args, {
-      cwd: repo,
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS4,
-      maxBuffer: PROBE_MAX_BUFFER
-    }).toString();
-  } catch {
-    return null;
-  }
-}
-
 // src/links.deletions.ts
 init_config();
 import { existsSync as existsSync40, lstatSync as lstatSync19, rmSync as rmSync17 } from "node:fs";
@@ -8235,6 +8297,7 @@ function applySharedLinkDeletions(map, ts, opts = {}) {
 
 // src/links.mirror.ts
 init_config();
+init_error_text();
 import { existsSync as existsSync41, lstatSync as lstatSync20, rmSync as rmSync18, statSync as statSync12 } from "node:fs";
 import { join as join57 } from "node:path";
 init_utils();
@@ -8402,19 +8465,19 @@ function reportTrackedDenied(repo, path, segment) {
   const denied = `the path segment "${segment}" is on the never-sync list`;
   if (inHead === null) {
     warn(
-      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it with "git status -- ${path}" and take it out of shared/ before committing`
+      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it by running git status -- "${path}" and take it out of shared/ before committing`
     );
     return;
   }
   if (inHead.trim() === "") {
     warn(
-      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run "git rm --cached -- ${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, "git diff --cached --name-status" names the source, whose content IS committed, so restore that half with "git checkout HEAD -- <source>" rather than leaving its deletion staged`
+      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run git rm --cached -- "${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, run git diff --cached --name-status to name the source, whose content IS committed, so restore that half with git checkout HEAD -- "<source>" rather than leaving its deletion staged`
     );
     return;
   }
   if (!existsSync41(join57(repo, path))) return;
   warn(
-    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run "git checkout HEAD -- ${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: "git rm -- ${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
+    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run git checkout HEAD -- "${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: git rm -- "${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
   );
 }
 function revertDeniedMirrorPaths(repo, status, ts) {
@@ -10916,7 +10979,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.67.3",
+  version: "0.68.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nomad",
-  "version": "0.67.3",
+  "version": "0.68.0",
   "type": "module",
   "description": "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   "keywords": [