claude-nomad 0.67.3 → 0.69.0

package/dist/nomad.mjs

@@ -41,7 +41,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/config.never-sync.ts
+// src/core/config.never-sync.ts
 function stripTrailingDotsAndWhitespace(name) {
   let end = name.length;
   while (end > 0 && (name[end - 1] === "." || /\s/.test(name[end - 1]))) end -= 1;
@@ -97,7 +97,7 @@ function isNeverSync(path) {
 }
 var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, ALWAYS_NEVER_SYNC, SECRET_FILE_PATTERNS, UNFILTERED_SHARED_REGIONS;
 var init_config_never_sync = __esm({
-  "src/config.never-sync.ts"() {
+  "src/core/config.never-sync.ts"() {
     "use strict";
     NEVER_SYNC = /* @__PURE__ */ new Set([
       ".claude.json",
@@ -222,10 +222,10 @@ var require_picocolors = __commonJS({
   }
 });
 
-// src/color.ts
+// src/render/color.ts
 var import_picocolors, enabled, red, yellow, green, cyan, blue, dim, bold, wslNarrowPad, okGlyph, failGlyph, warnGlyph, infoGlyph;
 var init_color = __esm({
-  "src/color.ts"() {
+  "src/render/color.ts"() {
     "use strict";
     import_picocolors = __toESM(require_picocolors(), 1);
     enabled = import_picocolors.default.isColorSupported;
@@ -244,10 +244,10 @@ var init_color = __esm({
   }
 });
 
-// src/exit-codes.ts
+// src/core/exit-codes.ts
 var EXIT;
 var init_exit_codes = __esm({
-  "src/exit-codes.ts"() {
+  "src/core/exit-codes.ts"() {
     "use strict";
     EXIT = {
       /** Completed successfully. Also returned when a held lock causes a no-op skip. */
@@ -269,7 +269,7 @@ var init_exit_codes = __esm({
   }
 });
 
-// src/utils.ts
+// src/core/utils.ts
 import { execFileSync } from "node:child_process";
 function isProcessExit(err) {
   if (typeof err !== "object" || err === null) return false;
@@ -304,7 +304,7 @@ function gitOrFatal(args, context, cwd) {
 }
 var log, ok, warn, fail, item, NomadFatal, PROCESS_EXIT_BRAND, ProcessExit, die, gitStatusPorcelainZ;
 var init_utils = __esm({
-  "src/utils.ts"() {
+  "src/core/utils.ts"() {
     "use strict";
     init_color();
     init_exit_codes();
@@ -349,7 +349,7 @@ var init_utils = __esm({
   }
 });
 
-// src/config.sharedDirs.guard.ts
+// src/core/config.sharedDirs.guard.ts
 function assertSafeLogical(logical) {
   if (!SAFE_LOGICAL.test(logical) || logical === "." || logical === "..") {
     throw new NomadFatal(
@@ -419,7 +419,7 @@ function isValidSharedDir(entry) {
 }
 var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED, RESERVED_SHARED_FOLDED, WIN32_DEVICE_NAMES, UNJOINABLE_REASONS;
 var init_config_sharedDirs_guard = __esm({
-  "src/config.sharedDirs.guard.ts"() {
+  "src/core/config.sharedDirs.guard.ts"() {
     "use strict";
     init_config_never_sync();
     init_utils();
@@ -455,10 +455,10 @@ var init_config_sharedDirs_guard = __esm({
   }
 });
 
-// src/settings-keys.ts
+// src/core/settings-keys.ts
 var SCHEMA_KEYS, APP_ONLY_KEYS, KNOWN_SETTINGS_KEYS;
 var init_settings_keys = __esm({
-  "src/settings-keys.ts"() {
+  "src/core/settings-keys.ts"() {
     "use strict";
     SCHEMA_KEYS = [
       "$schema",
@@ -635,7 +635,7 @@ var init_settings_keys = __esm({
   }
 });
 
-// src/config.ts
+// src/core/config.ts
 import { homedir, hostname } from "node:os";
 import { join, resolve } from "node:path";
 function home() {
@@ -686,7 +686,7 @@ function sharedDirEntries(map) {
 }
 var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
-  "src/config.ts"() {
+  "src/core/config.ts"() {
     "use strict";
     init_config_sharedDirs_guard();
     init_utils();
@@ -721,7 +721,22 @@ var init_config = __esm({
   }
 });
 
-// src/utils.json.ts
+// src/core/error-text.ts
+function errorText(err) {
+  try {
+    const message = err?.message;
+    return typeof message === "string" ? message : String(err);
+  } catch {
+    return "unprintable error value";
+  }
+}
+var init_error_text = __esm({
+  "src/core/error-text.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/utils.json.ts
 import { readFileSync } from "node:fs";
 function readJson(path) {
   const data = JSON.parse(readFileSync(path, "utf8"));
@@ -759,10 +774,13 @@ function validatePathMapShape(raw) {
   }
   return null;
 }
+function isProtoPollutionKey(key) {
+  return key === "__proto__" || key === "constructor" || key === "prototype";
+}
 function deepMerge(target, source) {
   const out = { ...target };
   for (const [key, value] of Object.entries(source)) {
-    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+    if (isProtoPollutionKey(key)) continue;
     const existing = out[key];
     const bothObjects = value !== null && typeof value === "object" && !Array.isArray(value) && existing !== null && typeof existing === "object" && !Array.isArray(existing);
     out[key] = bothObjects ? deepMerge(existing, value) : value;
@@ -774,6 +792,7 @@ function sortKeysDeep(value) {
   if (value !== null && typeof value === "object") {
     const out = {};
     for (const key of Object.keys(value).sort((a, b) => a.localeCompare(b, "en"))) {
+      if (isProtoPollutionKey(key)) continue;
       out[key] = sortKeysDeep(value[key]);
     }
     return out;
@@ -782,7 +801,7 @@ function sortKeysDeep(value) {
 }
 var ENCODE_MAX, hashPath, encodePath;
 var init_utils_json = __esm({
-  "src/utils.json.ts"() {
+  "src/core/utils.json.ts"() {
     "use strict";
     init_config();
     init_utils();
@@ -800,7 +819,7 @@ var init_utils_json = __esm({
   }
 });
 
-// src/utils.fs.ts
+// src/core/utils.fs.ts
 import {
   closeSync,
   cpSync as cpSync3,
@@ -871,6 +890,12 @@ function freshBackupTs(backupRoot) {
   while (existsSync3(join5(backupRoot, `${base}-${n}`))) n++;
   return `${base}-${n}`;
 }
+function prunableByAge(dirs, olderThanMs, nowMs) {
+  return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
+}
+function prunableByCount(dirs, keep) {
+  return dirs.slice(keep).map((d) => d.name);
+}
 function discardEmptyBackupDir(backupRoot) {
   try {
     rmdirSync(backupRoot);
@@ -886,17 +911,22 @@ function ensureSymlink(linkPath, target) {
   symlinkSync(target, linkPath);
   log(`linked ${linkPath} -> ${target}`);
 }
-function backupUnder(absPath, anchor, destRoot) {
+function backupUnder(absPath, anchor, destRoot, hint) {
   if (!existsSync3(absPath)) return false;
   const rel = relative3(anchor, absPath);
   if (rel === "" || rel === ".." || rel.startsWith(`..${sep2}`)) return false;
   const dst = join5(destRoot, rel);
-  mkdirSync(dirname(dst), { recursive: true });
-  cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  try {
+    mkdirSync(dirname(dst), { recursive: true });
+    cpSync3(absPath, dst, { recursive: true, force: false, preserveTimestamps: true });
+  } catch (err) {
+    const fragment = `could not back up ${absPath} into ${dst} (${errorText(err)}); a partial copy may be left there`;
+    throw new NomadFatal(hint === void 0 ? fragment : `${fragment}. ${hint}`);
+  }
   return true;
 }
-function backupBeforeWrite(absPath, ts) {
-  return backupUnder(absPath, claudeHome(), join5(backupBase(), ts));
+function backupBeforeWrite(absPath, ts, hint) {
+  return backupUnder(absPath, claudeHome(), join5(backupBase(), ts), hint);
 }
 function backupRepoWrite(absPath, ts, repoHome2) {
   backupUnder(absPath, repoHome2, join5(backupBase(), ts, "repo"));
@@ -906,9 +936,10 @@ function backupExtrasWrite(absPath, ts, projectRoot) {
 }
 var RENAME_RETRY_MAX_ATTEMPTS, RENAME_RETRY_BACKOFF_MS;
 var init_utils_fs = __esm({
-  "src/utils.fs.ts"() {
+  "src/core/utils.fs.ts"() {
     "use strict";
     init_config();
+    init_error_text();
     init_utils_json();
     init_utils();
     RENAME_RETRY_MAX_ATTEMPTS = 5;
@@ -916,7 +947,7 @@ var init_utils_fs = __esm({
   }
 });
 
-// src/commands.pull.wedge.ts
+// src/commands/pull/wedge.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync15 } from "node:fs";
 import { join as join21 } from "node:path";
@@ -985,23 +1016,54 @@ function orphanedAutostashPresent(repo) {
   return raw.split("\n").some((line) => /:\s*autostash$/.test(line));
 }
 var INDEX_PROBE_TIMEOUT_MS;
-var init_commands_pull_wedge = __esm({
-  "src/commands.pull.wedge.ts"() {
+var init_wedge = __esm({
+  "src/commands/pull/wedge.ts"() {
     "use strict";
     INDEX_PROBE_TIMEOUT_MS = 3e4;
   }
 });
 
-// src/push-gitleaks.config.ts
-import { existsSync as existsSync16, mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join22 } from "node:path";
+// src/core/package-root.ts
+import { existsSync as existsSync16 } from "node:fs";
+import { basename as basename3, dirname as dirname4, join as join22 } from "node:path";
 import { fileURLToPath } from "node:url";
+function packageRoot(from = HERE) {
+  let dir = from;
+  for (; ; ) {
+    if (existsSync16(join22(dir, "package.json"))) return dir;
+    if (basename3(dir) === "node_modules") {
+      throw new Error(`no package.json above ${from} within its own package`);
+    }
+    const parent = dirname4(dir);
+    if (parent === dir) throw new Error(`no package.json above ${from}`);
+    dir = parent;
+  }
+}
+var HERE;
+var init_package_root = __esm({
+  "src/core/package-root.ts"() {
+    "use strict";
+    HERE = dirname4(fileURLToPath(import.meta.url));
+  }
+});
+
+// src/commands/push/gitleaks.config.ts
+import { existsSync as existsSync17, mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join23 } from "node:path";
 function resolveTomlPath(repo = repoHome()) {
-  const repoToml = join22(repo, ".gitleaks.toml");
-  if (existsSync16(repoToml)) return repoToml;
-  const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync16(bundled) ? bundled : null;
+  const repoToml = join23(repo, ".gitleaks.toml");
+  if (existsSync17(repoToml)) return repoToml;
+  let root;
+  try {
+    root = packageRoot();
+  } catch {
+    throw new NomadFatal(
+      "claude-nomad install looks incomplete (no package.json above the CLI); reinstall with `npm i -g claude-nomad`"
+    );
+  }
+  const bundled = join23(root, ".gitleaks.toml");
+  return existsSync17(bundled) ? bundled : null;
 }
 function assertOverlayAllowlistsScoped(overlayBody) {
   if (OVERLAY_INLINE_ALLOWLIST_RE.test(overlayBody)) {
@@ -1039,17 +1101,17 @@ function buildOverlayTempConfig(overlayBody, bundled) {
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join22(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join22(tempPath, "config.toml");
+  const tempPath = mkdtempSync(join23(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join23(tempPath, "config.toml");
   writeFileSync3(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
   const repo = repoHome();
-  const overlayPath = join22(repo, ".gitleaks.overlay.toml");
-  const repoToml = join22(repo, ".gitleaks.toml");
+  const overlayPath = join23(repo, ".gitleaks.overlay.toml");
+  const repoToml = join23(repo, ".gitleaks.toml");
   const bundled = resolveTomlPath(repo);
-  if (!existsSync16(overlayPath)) {
+  if (!existsSync17(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -1080,10 +1142,11 @@ function resolveTomlConfig() {
   }
 }
 var OVERLAY_EXTEND_RE, TABLE_HEADER_RE, OVERLAY_ALLOWLIST_HEADER_RE, OVERLAY_INLINE_ALLOWLIST_RE, PATHS_KEY_RE, CATCH_ALL_RE;
-var init_push_gitleaks_config = __esm({
-  "src/push-gitleaks.config.ts"() {
+var init_gitleaks_config = __esm({
+  "src/commands/push/gitleaks.config.ts"() {
     "use strict";
     init_config();
+    init_package_root();
     init_utils();
     OVERLAY_EXTEND_RE = /^[ \t]*(?:\[[ \t]*extend[ \t]*\]|extend[ \t]*[.=])/m;
     TABLE_HEADER_RE = /^\s*\[/;
@@ -1094,7 +1157,7 @@ var init_push_gitleaks_config = __esm({
   }
 });
 
-// src/autostash-guard.ts
+// src/commands/autostash-guard.ts
 function autostashConflictRunbookText(resumeCmd2, stashRetained) {
   const head = `${resumeCmd2} reported success, but the autostash pop it ran internally conflicted. The working tree now holds conflict markers and the index is unmerged. Nothing has been copied to ~/.claude/ yet, and there is no rebase or merge in progress to abort.`;
   if (stashRetained) {
@@ -1125,19 +1188,19 @@ function assertNoAutostashConflict(repo, resumeCmd2) {
   });
 }
 var init_autostash_guard = __esm({
-  "src/autostash-guard.ts"() {
+  "src/commands/autostash-guard.ts"() {
     "use strict";
-    init_commands_pull_wedge();
+    init_wedge();
     init_exit_codes();
     init_utils();
   }
 });
 
-// src/push-checks.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+// src/commands/push/checks.ts
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { readdirSync as readdirSync8, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { delimiter, join as join23 } from "node:path";
+import { delimiter, join as join24 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -1185,7 +1248,7 @@ function findGitlinks(dir) {
       return;
     }
     for (const e of entries) {
-      const p = join23(current, e.name);
+      const p = join24(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
@@ -1201,7 +1264,7 @@ function probeGitleaks() {
   const args = ["version"];
   if (toml !== null) args.push("--config", toml);
   try {
-    return execFileSync4("gitleaks", args, { stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
+    return execFileSync5("gitleaks", args, { stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") throw new NomadFatal(gitleaksInstallHint());
@@ -1221,7 +1284,7 @@ function rebaseBeforePush(repo) {
   const wedge = classifyWedge(repo);
   if (wedge !== null) throw new NomadFatal(wedgePreflight(wedge), { code: EXIT.CONFLICT });
   try {
-    execFileSync4("git", ["pull", "--rebase", "--autostash"], {
+    execFileSync5("git", ["pull", "--rebase", "--autostash"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -1234,22 +1297,22 @@ function rebaseBeforePush(repo) {
   }
   assertNoAutostashConflict(repo, "nomad push");
 }
-var init_push_checks = __esm({
-  "src/push-checks.ts"() {
+var init_checks = __esm({
+  "src/commands/push/checks.ts"() {
     "use strict";
-    init_push_gitleaks_config();
+    init_gitleaks_config();
     init_autostash_guard();
-    init_commands_pull_wedge();
+    init_wedge();
     init_exit_codes();
     init_utils();
   }
 });
 
-// src/push-gitleaks.scan.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
+// src/commands/push/gitleaks.scan.ts
+import { execFileSync as execFileSync9 } from "node:child_process";
 import { mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 function toFinding(entry) {
   if (typeof entry !== "object" || entry === null) return null;
   const e = entry;
@@ -1297,9 +1360,9 @@ function resolveScanFailure(reportPath, e, forwardStreams) {
   return report;
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join27(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join28(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
-  const reportPath = join27(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join28(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -1313,9 +1376,9 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   const opts = { cwd: repoDir, stdio: ["ignore", "pipe", "pipe"] };
   const gitleaksOpts = { ...opts, timeout: GITLEAKS_SCAN_TIMEOUT_MS };
   try {
-    execFileSync8("git", ["init", "-q"], opts);
-    execFileSync8("git", ["add", "-A"], opts);
-    execFileSync8("gitleaks", args, gitleaksOpts);
+    execFileSync9("git", ["init", "-q"], opts);
+    execFileSync9("git", ["add", "-A"], opts);
+    execFileSync9("gitleaks", args, gitleaksOpts);
     return [];
   } catch (err) {
     const e = err;
@@ -1327,14 +1390,14 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   }
 }
 function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TIMEOUT_MS) {
-  const cacheDir = join27(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join28(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
   const { path: toml, tempPath } = resolveTomlConfig();
   let reportDir;
   let reportPath;
   try {
-    reportDir = mkdtempSync2(join27(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}-`));
-    reportPath = join27(reportDir, "report.json");
+    reportDir = mkdtempSync2(join28(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}-`));
+    reportPath = join28(reportDir, "report.json");
     const args = [
       "detect",
       "--no-git",
@@ -1348,7 +1411,7 @@ function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TI
       stdio: ["ignore", "pipe", "pipe"],
       timeout: timeoutMs
     };
-    execFileSync8("gitleaks", args, opts);
+    execFileSync9("gitleaks", args, opts);
     return [];
   } catch (err) {
     const e = err;
@@ -1359,16 +1422,16 @@ function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TI
     if (reportDir !== void 0) rmSync8(reportDir, { recursive: true, force: true });
   }
 }
-var init_push_gitleaks_scan = __esm({
-  "src/push-gitleaks.scan.ts"() {
+var init_gitleaks_scan = __esm({
+  "src/commands/push/gitleaks.scan.ts"() {
     "use strict";
     init_config();
-    init_push_gitleaks_config();
+    init_gitleaks_config();
     init_utils_fs();
   }
 });
 
-// src/push-gitleaks.ts
+// src/commands/push/gitleaks.ts
 function findingIdentityKey(f) {
   const fp = f.Fingerprint;
   return typeof fp === "string" && fp.length > 0 ? fp : `${f.File}:${f.RuleID}:${f.StartLine}:${f.StartColumn}`;
@@ -1456,13 +1519,13 @@ function buildSessionAwareFatal(bySession, other) {
   return lines.join("\n");
 }
 var SESSION_PATH, SUBAGENT_SESSION_PATH, LEGACY_FATAL;
-var init_push_gitleaks = __esm({
-  "src/push-gitleaks.ts"() {
+var init_gitleaks = __esm({
+  "src/commands/push/gitleaks.ts"() {
     "use strict";
     init_config();
     init_exit_codes();
-    init_push_checks();
-    init_push_gitleaks_scan();
+    init_checks();
+    init_gitleaks_scan();
     init_utils();
     SESSION_PATH = /^shared\/projects\/[^/]+\/([^/]+)\.jsonl$/;
     SUBAGENT_SESSION_PATH = /^shared\/projects\/[^/]+\/([^/]+)\/.*\.jsonl$/;
@@ -1470,9 +1533,9 @@ var init_push_gitleaks = __esm({
   }
 });
 
-// src/push-leak-verdict.ts
-var push_leak_verdict_exports = {};
-__export(push_leak_verdict_exports, {
+// src/commands/push/leak-verdict.ts
+var leak_verdict_exports = {};
+__export(leak_verdict_exports, {
   failRow: () => failRow,
   leakVerdictRow: () => leakVerdictRow,
   noLeaksRow: () => noLeaksRow,
@@ -1545,65 +1608,59 @@ function scanPushVerdict(repo) {
   return leakFound(findings);
 }
 var noLeaksRow, failRow;
-var init_push_leak_verdict = __esm({
-  "src/push-leak-verdict.ts"() {
+var init_leak_verdict = __esm({
+  "src/commands/push/leak-verdict.ts"() {
     "use strict";
     init_color();
     init_exit_codes();
-    init_push_checks();
-    init_push_gitleaks();
+    init_checks();
+    init_gitleaks();
     noLeaksRow = () => `${green(okGlyph)} no leaks`;
     failRow = (text) => `${red(failGlyph)} ${text}`;
   }
 });
 
-// src/commands.adopt.ts
+// src/commands/adopt.ts
 import { existsSync as existsSync5, lstatSync as lstatSync7 } from "node:fs";
 import { join as join9 } from "node:path";
 
-// src/commands.adopt.recover.ts
+// src/commands/adopt.recover.ts
 import { rmSync as rmSync4 } from "node:fs";
 import { dirname as dirname2, join as join7, resolve as resolve2 } from "node:path";
 
-// src/commands.adopt.scan.ts
+// src/commands/adopt.scan.ts
 init_config();
-import { lstatSync, readdirSync } from "node:fs";
-import { join as join2, relative } from "node:path";
-
-// src/error-text.ts
-function errorText(err) {
-  try {
-    const message = err?.message;
-    return typeof message === "string" ? message : String(err);
-  } catch {
-    return "unprintable error value";
-  }
-}
-
-// src/commands.adopt.scan.ts
+init_error_text();
 init_exit_codes();
 init_utils();
+import { lstatSync, readdirSync } from "node:fs";
+import { join as join2, relative } from "node:path";
 function toForwardSlash(p) {
   return p.replaceAll("\\", "/");
 }
-function walk(root, dir, out) {
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const match = matchDeniedName(ALWAYS_NEVER_SYNC, entry.name);
-    if (match !== null) {
-      out.push({
-        path: toForwardSlash(relative(root, join2(dir, entry.name))),
-        matched: match.axis === "name" ? match.entry : null
-      });
-      continue;
+function walk(root) {
+  const out = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const match = matchDeniedName(ALWAYS_NEVER_SYNC, entry.name);
+      if (match !== null) {
+        out.push({
+          path: toForwardSlash(relative(root, join2(dir, entry.name))),
+          matched: match.axis === "name" ? match.entry : null
+        });
+        continue;
+      }
+      if (entry.isDirectory()) stack.push(join2(dir, entry.name));
     }
-    if (entry.isDirectory()) walk(root, join2(dir, entry.name), out);
   }
+  return out;
 }
 function scanDeniedEntries(root) {
   const stat = lstatSync(root, { throwIfNoEntry: false });
   if (!stat?.isDirectory()) return [];
-  const out = [];
-  walk(root, root, out);
+  const out = walk(root);
   out.sort((a, b) => a.path.localeCompare(b.path));
   return out;
 }
@@ -1650,16 +1707,17 @@ function refuseDeniedEntries(name, root) {
   });
 }
 
-// src/commands.adopt.recover.ts
+// src/commands/adopt.recover.ts
 init_config();
+init_error_text();
 init_exit_codes();
 
-// src/extras-sync.core.ts
+// src/sync/extras/core.ts
 init_config();
 import { cpSync as cpSync2, existsSync as existsSync2, lstatSync as lstatSync3, readdirSync as readdirSync3, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
 import { basename as basename2, join as join4, relative as relative2 } from "node:path";
 
-// src/extras-sync.collision.ts
+// src/sync/extras/collision.ts
 init_utils();
 import { cpSync, existsSync, lstatSync as lstatSync2, readdirSync as readdirSync2, rmSync } from "node:fs";
 import { basename, join as join3 } from "node:path";
@@ -1734,7 +1792,7 @@ function copyExtrasFilteredPreservingBy(src, dst, isPreserved, isRootPreserved)
   });
 }
 
-// src/extras-sync.guards.ts
+// src/sync/extras/guards.ts
 init_utils();
 init_config_sharedDirs_guard();
 import { isAbsolute, normalize, sep } from "node:path";
@@ -1752,7 +1810,7 @@ function assertSafeLocalRoot(localRoot, logical) {
   }
 }
 
-// src/extras-sync.core.ts
+// src/sync/extras/core.ts
 init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
@@ -1781,12 +1839,12 @@ function* eachExtrasTarget(v, counts) {
       counts.unmapped++;
       continue;
     }
-    for (const dirname15 of dirnames) {
-      if (!whitelist.includes(dirname15)) {
+    for (const dirname16 of dirnames) {
+      if (!whitelist.includes(dirname16)) {
         counts.skipped++;
         continue;
       }
-      yield { logical, localRoot, dirname: dirname15 };
+      yield { logical, localRoot, dirname: dirname16 };
     }
   }
 }
@@ -1828,8 +1886,8 @@ function copyExtrasFileSkipDiverged(src, dst) {
   }
   copyExtras(src, dst);
 }
-function extrasDenySet(dirname15) {
-  return isClaudeExtraName(dirname15) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+function extrasDenySet(dirname16) {
+  return isClaudeExtraName(dirname16) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function copyExtrasFiltered(src, dst, blockSet) {
   rmSync2(dst, { recursive: true, force: true });
@@ -1872,7 +1930,7 @@ function copyExtrasFilteredPreserving(src, dst, blockSet) {
   });
 }
 
-// src/fs-presence.ts
+// src/core/fs-presence.ts
 import { lstatSync as lstatSync4, statSync } from "node:fs";
 var ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR", "ENAMETOOLONG"]);
 function classifyPresence(p) {
@@ -1897,14 +1955,110 @@ function lexists(p) {
   return classifyPresence(p) !== "absent";
 }
 
-// src/links.ts
+// src/sync/links.ts
 init_config();
 import { existsSync as existsSync4, lstatSync as lstatSync6, rmSync as rmSync3 } from "node:fs";
 import { join as join6 } from "node:path";
 
-// src/hooks-filter.ts
+// src/commands/capture-settings/core.ts
+init_utils_json();
+
+// src/sync/hooks-filter.ts
 init_config();
-var KNOWN_LAUNCHER_BASENAMES = /* @__PURE__ */ new Set(["node", "bash", "sh"]);
+init_utils_json();
+
+// src/sync/hooks-filter.command-sub.ts
+var SUB_START = /^"?(?:\$\(|`)/;
+function opensSubstitution(token) {
+  return SUB_START.test(token);
+}
+function stepChar(token, i, scan) {
+  const c = token[i];
+  const top = scan.stack.at(-1);
+  if (top === "sq") {
+    if (c === "'") scan.stack.pop();
+    return i + 1;
+  }
+  if (scan.escaped) {
+    scan.escaped = false;
+    return i + 1;
+  }
+  if (c === "\\") {
+    scan.escaped = true;
+    return i + 1;
+  }
+  if (c === "$" && token[i + 1] === "(") {
+    scan.stack.push("cmd");
+    scan.depth++;
+    return i + 2;
+  }
+  if (c === "'" && top === "cmd") scan.stack.push("sq");
+  else if (c === "`") toggleBacktick(scan, top);
+  else if (c === '"') toggleDoubleQuote(scan, top);
+  else if (top === "cmd") stepParen(c, scan);
+  return i + 1;
+}
+function toggleBacktick(scan, top) {
+  if (top === "bt") scan.stack.pop();
+  else scan.stack.push("bt");
+}
+function toggleDoubleQuote(scan, top) {
+  if (top === "dq") scan.stack.pop();
+  else scan.stack.push("dq");
+}
+function stepParen(c, scan) {
+  if (c === "(") {
+    scan.stack.push("cmd");
+    scan.depth++;
+  } else if (c === ")") {
+    scan.stack.pop();
+    scan.depth--;
+  }
+}
+function skipDollarParen(tokens, start, from) {
+  const scan = { stack: ["cmd"], depth: 1, escaped: false };
+  let i = from;
+  for (let j = start; j < tokens.length; j++) {
+    const token = tokens[j];
+    while (i < token.length) {
+      i = stepChar(token, i, scan);
+      if (scan.depth === 0) return { next: j + 1, rest: token.slice(i) };
+    }
+    i = 0;
+    scan.escaped = false;
+  }
+  return unterminated(tokens, start);
+}
+function skipBacktick(tokens, start, from) {
+  let i = from;
+  for (let j = start; j < tokens.length; j++) {
+    const token = tokens[j];
+    while (i < token.length) {
+      if (token[i] === "\\") i += 2;
+      else if (token[i] === "`") return { next: j + 1, rest: token.slice(i + 1) };
+      else i++;
+    }
+    i = 0;
+  }
+  return unterminated(tokens, start);
+}
+function unterminated(tokens, start) {
+  return { next: start + 1, rest: tokens[start] };
+}
+function skipSubstitution(tokens, start) {
+  const token = tokens[start] ?? "";
+  const paren = token.indexOf("$(");
+  const tick = token.indexOf("`");
+  if (paren < 0 && tick < 0) return { next: start + 1, rest: token };
+  if (tick >= 0 && (paren < 0 || tick < paren)) return skipBacktick(tokens, start, tick + 1);
+  return skipDollarParen(tokens, start, paren + 2);
+}
+
+// src/sync/hooks-filter.ts
+var KNOWN_LAUNCHER_BASENAMES = /* @__PURE__ */ new Set(["env", "node", "bash", "sh"]);
+var SUBSTITUTION_ARTIFACT = /[`()'"]/;
+var ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/;
+var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", ";", "|", "&"]);
 function scriptBasename(token) {
   const lastSlash = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
   return lastSlash >= 0 ? token.slice(lastSlash + 1) : token;
@@ -1919,25 +2073,56 @@ function stripQuotes(token) {
   }
   return token;
 }
+var NO_CANDIDATE = { index: -1, word: "" };
+function nextScriptWord(tokens, from, inScriptSlot) {
+  let slot = inScriptSlot;
+  let i = from;
+  while (i < tokens.length) {
+    const token = tokens[i];
+    if (SHELL_OPERATORS.has(token)) {
+      slot = false;
+      i++;
+    } else if (token.startsWith("-")) {
+      i++;
+    } else if (!opensSubstitution(token)) {
+      return { index: i, word: token };
+    } else {
+      const end = skipSubstitution(tokens, i);
+      if (end.rest !== "") return { index: end.next - 1, word: end.rest };
+      if (slot && !SHELL_OPERATORS.has(tokens[end.next] ?? "")) return NO_CANDIDATE;
+      i = end.next;
+    }
+  }
+  return NO_CANDIDATE;
+}
+function resolveScriptWord(tokens, from, underEnv) {
+  let candidate = nextScriptWord(tokens, from, true);
+  while (underEnv && candidate.index >= 0) {
+    const word = stripQuotes(candidate.word);
+    const isBareInterpreter = !word.includes("/") && !word.includes("\\") && KNOWN_LAUNCHER_BASENAMES.has(word);
+    if (!isBareInterpreter && !ENV_ASSIGNMENT.test(word)) return candidate;
+    candidate = nextScriptWord(tokens, candidate.index + 1, true);
+  }
+  return candidate;
+}
 function isGsdHookEntry(command) {
   const tokens = command.trim().split(/\s+/);
-  if (tokens.length === 0 || tokens[0] === "") return false;
-  const envAssign = /^[A-Za-z_]\w*=/;
+  if (tokens[0] === "") return false;
   let i = 0;
-  while (i < tokens.length && envAssign.test(tokens[i])) {
+  while (i < tokens.length && ENV_ASSIGNMENT.test(tokens[i])) {
     i++;
   }
-  const first = stripQuotes(tokens[i] ?? "");
+  const launcher = nextScriptWord(tokens, i, false);
+  if (launcher.index < 0) return false;
+  const first = stripQuotes(launcher.word);
   const firstBase = scriptBasename(first);
   const firstHasPath = first.includes("/") || first.includes("\\");
-  if (firstHasPath && !KNOWN_LAUNCHER_BASENAMES.has(firstBase) || first.startsWith(GSD_PREFIX)) {
+  if (!KNOWN_LAUNCHER_BASENAMES.has(firstBase) && (firstHasPath || !SUBSTITUTION_ARTIFACT.test(first))) {
     return firstBase.startsWith(GSD_PREFIX);
   }
-  for (let j = i + 1; j < tokens.length; j++) {
-    if (tokens[j].startsWith("-")) continue;
-    return scriptBasename(stripQuotes(tokens[j])).startsWith(GSD_PREFIX);
-  }
-  return false;
+  const script = resolveScriptWord(tokens, launcher.index + 1, firstBase === "env");
+  if (script.index < 0) return false;
+  return scriptBasename(stripQuotes(script.word)).startsWith(GSD_PREFIX);
 }
 function filterMatcherEntry(entry) {
   if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return entry;
@@ -1965,24 +2150,26 @@ function filterEventMatchers(matchers) {
 function stripGsdHookEntries(settings) {
   const out = {};
   for (const [key, value] of Object.entries(settings)) {
-    if (key !== "hooks") {
+    if (isProtoPollutionKey(key)) continue;
+    const hooksObj = key === "hooks" ? asPlainObject(value) : null;
+    if (hooksObj === null) {
       out[key] = value;
       continue;
     }
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-      out[key] = value;
-      continue;
-    }
-    const hooksObj = value;
-    const filteredHooks = {};
-    for (const [event, matchers] of Object.entries(hooksObj)) {
-      const filtered = filterEventMatchers(matchers);
-      if (filtered !== null) filteredHooks[event] = filtered;
-    }
-    if (Object.keys(filteredHooks).length > 0) out[key] = filteredHooks;
+    const filteredHooks = filterHooksBlock(hooksObj);
+    if (filteredHooks !== null) out[key] = filteredHooks;
   }
   return out;
 }
+function filterHooksBlock(hooksObj) {
+  const filteredHooks = {};
+  for (const [event, matchers] of Object.entries(hooksObj)) {
+    if (isProtoPollutionKey(event)) continue;
+    const filtered = filterEventMatchers(matchers);
+    if (filtered !== null) filteredHooks[event] = filtered;
+  }
+  return Object.keys(filteredHooks).length > 0 ? filteredHooks : null;
+}
 function keepMatcherEntry(entry) {
   if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
   const entryObj = entry;
@@ -2012,6 +2199,7 @@ function keepGsdHookEntries(settings) {
   const hooksObj = hooksVal;
   const keptHooks = {};
   for (const [event, matchers] of Object.entries(hooksObj)) {
+    if (isProtoPollutionKey(event)) continue;
     const kept = keepEventMatchers(matchers);
     if (kept !== null) keptHooks[event] = kept;
   }
@@ -2046,7 +2234,7 @@ function graftGsdHookEntries(base, gsdOnly) {
   const baseHooks = asPlainObject(base.hooks);
   const mergedHooks = baseHooks ? { ...baseHooks } : {};
   for (const [event, gsdMatchers] of Object.entries(gsdHooks)) {
-    if (!Array.isArray(gsdMatchers)) continue;
+    if (isProtoPollutionKey(event) || !Array.isArray(gsdMatchers)) continue;
     const baseMatchers = mergedHooks[event];
     mergedHooks[event] = Array.isArray(baseMatchers) ? unionMatcherArrays(baseMatchers, gsdMatchers) : gsdMatchers;
   }
@@ -2077,7 +2265,7 @@ function baseHasGsdHookEntries(settings) {
   return false;
 }
 
-// src/commands.capture-settings.core.ts
+// src/commands/capture-settings/core.ts
 function arraysEqual(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
@@ -2171,6 +2359,7 @@ function normalizeNodePathsDeep(value) {
   if (value !== null && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
+      if (isProtoPollutionKey(k)) continue;
       out[k] = normalizeNodePathsDeep(v);
     }
     return out;
@@ -2189,7 +2378,7 @@ function buildCaptureSubset(merged, settings, opts) {
   return out;
 }
 
-// src/links.ts
+// src/sync/links.ts
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -2375,7 +2564,7 @@ function regenerateSettings(ts, opts = {}) {
   return { label: overrideLabel };
 }
 
-// src/commands.adopt.recover.ts
+// src/commands/adopt.recover.ts
 init_utils();
 function isDirectChildOf(root, abs) {
   return dirname2(resolve2(abs)) === resolve2(root);
@@ -2487,14 +2676,14 @@ function reportSourceRemovalFailure(name, linkPath, message, stage) {
   );
 }
 
-// src/commands.adopt.ts
+// src/commands/adopt.ts
 init_config();
 init_config_sharedDirs_guard();
 init_exit_codes();
 init_utils();
 init_utils_fs();
 
-// src/utils.lockfile.ts
+// src/core/utils.lockfile.ts
 init_config();
 init_utils();
 import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
@@ -2607,7 +2796,7 @@ function retryOnce(verb, lp) {
   }
 }
 
-// src/commands.adopt.ts
+// src/commands/adopt.ts
 init_utils_json();
 var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
 function readMapIfPresent(repoHome2) {
@@ -2689,7 +2878,11 @@ function adoptStopsEarly(name, linkPath, sharedTarget) {
 }
 function performAdoptMove(name, linkPath, sharedTarget, repo, backup) {
   const ts = freshBackupTs(backup);
-  const snapshotted = backupBeforeWrite(linkPath, ts);
+  const snapshotted = backupBeforeWrite(
+    linkPath,
+    ts,
+    `Nothing was removed from ${linkPath} and nothing was written to the repo. Fix what the error names, then run \`nomad adopt ${name}\` again.`
+  );
   const rel = join9("shared", name);
   const stage = () => gitOrFatal(["add", "--", rel], `git add shared/${name}`, repo);
   copyIntoSharedOrFatal(name, linkPath, sharedTarget, repo);
@@ -2767,11 +2960,11 @@ function adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, dryRu
   }
 }
 
-// src/commands.allow.ts
+// src/commands/allow.ts
 init_config();
 import { existsSync as existsSync6 } from "node:fs";
 
-// src/commands.redact.core.ts
+// src/commands/redact/core.ts
 import { appendFileSync, readFileSync as readFileSync4 } from "node:fs";
 import { join as join10 } from "node:path";
 function collectMatchIntervals(content, findings) {
@@ -2845,7 +3038,7 @@ function appendGitleaksIgnore(fingerprint, repo) {
   appendFileSync(ignPath, prefix + formatFingerprint(sanitized), "utf8");
 }
 
-// src/commands.allow.ts
+// src/commands/allow.ts
 init_exit_codes();
 init_utils();
 function cmdAllow(fingerprints) {
@@ -2865,7 +3058,7 @@ function cmdAllow(fingerprints) {
   log(`allowed ${fingerprints.length} fingerprint(s)`);
 }
 
-// src/commands.capture-settings.ts
+// src/commands/capture-settings/capture-settings.ts
 init_config();
 import { existsSync as existsSync7 } from "node:fs";
 import { join as join11 } from "node:path";
@@ -2947,10 +3140,11 @@ async function cmdCaptureSettings(opts) {
   }
 }
 
-// src/commands.clean.ts
+// src/commands/clean.ts
 init_config();
 init_exit_codes();
 init_utils();
+init_utils_fs();
 import { existsSync as existsSync8, lstatSync as lstatSync8, readdirSync as readdirSync4, rmSync as rmSync5, statSync as statSync3 } from "node:fs";
 import { join as join12 } from "node:path";
 var TS_SHAPE = /^\d{8}-\d{6}(-\d+)?$/;
@@ -2985,12 +3179,6 @@ function holdsNoContent(dir) {
   }
   return true;
 }
-function prunableByAge(dirs, olderThanMs, nowMs) {
-  return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
-}
-function prunableByCount(dirs, keep) {
-  return dirs.slice(keep).map((d) => d.name);
-}
 function safeDelete(backupBase2, name) {
   if (!isTsDir(name)) return;
   const full = join12(backupBase2, name);
@@ -3050,7 +3238,7 @@ function pruneBackups(opts, backupBase2) {
   log(`removed ${targets.length} backup(s)`);
 }
 
-// src/commands.eject.ts
+// src/commands/eject.ts
 init_config();
 init_config_sharedDirs_guard();
 init_utils();
@@ -3250,20 +3438,20 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   }
 }
 
-// src/commands.doctor.ts
-import { existsSync as existsSync35 } from "node:fs";
-import { join as join49 } from "node:path";
+// src/commands/doctor/doctor.ts
+import { existsSync as existsSync36 } from "node:fs";
+import { join as join52 } from "node:path";
 
-// src/commands.doctor.checks.repo.ts
+// src/commands/doctor/checks/repo.ts
 init_color();
 init_config();
 import { existsSync as existsSync11, lstatSync as lstatSync10, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
 import { join as join17 } from "node:path";
 
-// src/commands.doctor.format.ts
+// src/commands/doctor/format.ts
 init_color();
 
-// src/output-tree.ts
+// src/render/output-tree.ts
 init_color();
 var FAIL_GLYPH_BARE = "\u2717";
 function section(header, raw = false) {
@@ -3321,7 +3509,7 @@ function renderTree(sections) {
 }
 var renderDoctor = renderTree;
 
-// src/commands.doctor.format.ts
+// src/commands/doctor/format.ts
 init_utils_json();
 function readJsonSafe(path, label, section2) {
   try {
@@ -3333,12 +3521,12 @@ function readJsonSafe(path, label, section2) {
   }
 }
 
-// src/commands.doctor.checks.repo.win32.ts
+// src/commands/doctor/checks/repo.win32.ts
 init_color();
 init_config();
 import { join as join14, win32 as win32Path } from "node:path";
 
-// src/extras-sync.diff.ts
+// src/sync/extras/diff.ts
 init_utils();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { relative as relative4 } from "node:path";
@@ -3393,7 +3581,7 @@ function listDivergingModified(a, b) {
   return runNameStatusDiff(a, b, (stdout) => parseModifiedPaths(stdout, a));
 }
 
-// src/commands.doctor.checks.repo.win32.ts
+// src/commands/doctor/checks/repo.win32.ts
 function win32CopyOkRow(name, exempt = 0) {
   const note = exempt > 0 ? dim(` (${exempt} never-synced path(s) not compared)`) : "";
   return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)${note}`, fail: false };
@@ -3445,7 +3633,7 @@ function classifyWin32Copy(name, p) {
   };
 }
 
-// src/commands.doctor.checks.repo.source.ts
+// src/commands/doctor/checks/repo.source.ts
 init_color();
 init_config();
 import { join as join15 } from "node:path";
@@ -3496,7 +3684,7 @@ function repoSourceRow(name, present, absent) {
   return state === "resolves" ? present : absent;
 }
 
-// src/init.classify.ts
+// src/commands/init/classify.ts
 init_config();
 init_utils_json();
 import { existsSync as existsSync10 } from "node:fs";
@@ -3539,7 +3727,7 @@ function reasonForPartial(repoHome2, host) {
   return "- partial state (unknown gap)";
 }
 
-// src/commands.doctor.checks.repo.ts
+// src/commands/doctor/checks/repo.ts
 init_utils_json();
 function isOverrideActive() {
   return Boolean(process.env.NOMAD_REPO);
@@ -3698,7 +3886,7 @@ function reportDroppedNamesMigration(section2) {
   }
 }
 
-// src/commands.doctor.checks.settings.ts
+// src/commands/doctor/checks/settings.ts
 init_color();
 init_config();
 import { existsSync as existsSync12, readdirSync as readdirSync6 } from "node:fs";
@@ -3759,7 +3947,7 @@ function reportHostOverrides(section2, base, settings) {
   }
 }
 
-// src/commands.doctor.checks.pathmap.ts
+// src/commands/doctor/checks/pathmap.ts
 init_color();
 init_config();
 init_config_sharedDirs_guard();
@@ -3945,7 +4133,7 @@ function reportNeverSync(section2) {
   );
 }
 
-// src/commands.doctor.checks.skills.ts
+// src/commands/doctor/checks/skills.ts
 init_color();
 import { existsSync as existsSync14 } from "node:fs";
 import { join as join20 } from "node:path";
@@ -3993,18 +4181,37 @@ function reportSkillsDivergence(section2) {
   }
 }
 
-// src/commands.doctor.checks.git-state.ts
+// src/commands/doctor/checks/git-state.ts
 init_color();
 init_config();
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join24, relative as relative5 } from "node:path";
-init_commands_pull_wedge();
-init_push_checks();
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join25, relative as relative5 } from "node:path";
+init_wedge();
+
+// src/core/git-probe.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+var PROBE_TIMEOUT_MS = 1e4;
+var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
+function gitProbe(args, repo) {
+  try {
+    return execFileSync4("git", args, {
+      cwd: repo,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: PROBE_TIMEOUT_MS,
+      maxBuffer: PROBE_MAX_BUFFER
+    }).toString();
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/doctor/checks/git-state.ts
+init_checks();
 init_utils();
 function reportGitleaksProbe(section2) {
   try {
-    execFileSync5("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync6("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch (err) {
     if (err.code === "ENOENT") {
@@ -4021,8 +4228,8 @@ function reportGitleaksProbe(section2) {
 }
 function reportGitlinks(section2) {
   const repo = repoHome();
-  const sharedDir = join24(repo, "shared");
-  if (existsSync17(sharedDir)) {
+  const sharedDir = join25(repo, "shared");
+  if (existsSync18(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
       const rel = relative5(repo, p).replaceAll("\\", "/");
@@ -4040,7 +4247,7 @@ function reportGitlinks(section2) {
 }
 function reportRemote(section2) {
   try {
-    const url = execFileSync5("git", ["remote", "get-url", "origin"], {
+    const url = execFileSync6("git", ["remote", "get-url", "origin"], {
       cwd: repoHome(),
       stdio: ["ignore", "pipe", "pipe"]
     }).toString().trim();
@@ -4097,7 +4304,7 @@ function reportGitIdentity(section2) {
   const missing = [];
   for (const field of ["user.name", "user.email"]) {
     try {
-      const val = execFileSync5("git", ["config", field], {
+      const val = execFileSync6("git", ["config", field], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       }).toString().trim();
@@ -4117,11 +4324,50 @@ function reportGitIdentity(section2) {
     addItem(section2, `${green(okGlyph)} git identity: user.name and user.email configured`);
   }
 }
+var MAX_TRACKED_DENIED_ROWS = 5;
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function renderable(text) {
+  return text.replace(CONTROL_CHARS, " ");
+}
+function reportTrackedDeniedShared(section2) {
+  const out = gitProbe(["ls-files", "-z", "--", ":(icase)shared/"], repoHome());
+  if (out === null) {
+    addItem(
+      section2,
+      `${dim(infoGlyph)} never-sync scan: git could not list shared/, so nothing was scanned`
+    );
+    return;
+  }
+  const hits = /* @__PURE__ */ new Map();
+  for (const path of out.split("\0")) {
+    const segment = path === "" ? null : deniedSegmentFor(path);
+    if (segment !== null) hits.set(path, segment);
+  }
+  if (hits.size === 0) {
+    addItem(
+      section2,
+      `${green(okGlyph)} never-sync scan: no tracked path under shared/ is denylisted`
+    );
+    return;
+  }
+  for (const [path, segment] of [...hits].slice(0, MAX_TRACKED_DENIED_ROWS)) {
+    addItem(
+      section2,
+      `${yellow(warnGlyph)} never-sync: git tracks ${blue(renderable(path))} (the path segment "${renderable(segment)}" is blocked by the never-sync boundary)`
+    );
+  }
+  const overflow = hits.size - MAX_TRACKED_DENIED_ROWS;
+  const more = overflow > 0 ? `${overflow} more not listed, run git ls-files -- ":(icase)shared/" in the sync repo to see them all. ` : "";
+  addItem(
+    section2,
+    `${yellow(warnGlyph)} never-sync: ${more}Run git rm --cached -- "<path>" and commit to stop tracking each one; that leaves the file on disk, so move it outside shared/ if you want to keep it. If one holds a real secret, rotate it and rewrite history too, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent`
+  );
+}
 
-// src/commands.doctor.checks.backups.ts
+// src/commands/doctor/checks/backups.ts
 init_color();
-import { existsSync as existsSync18, lstatSync as lstatSync12, readdirSync as readdirSync9 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync19, lstatSync as lstatSync12, readdirSync as readdirSync9 } from "node:fs";
+import { join as join26 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
 function safeReaddir(dir) {
@@ -4137,7 +4383,7 @@ var BYTES_PER_MB = 1024 * 1024;
 function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
-    const full = join25(dir, entry);
+    const full = join26(dir, entry);
     const st = lstatSync12(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
@@ -4148,11 +4394,11 @@ function dirSizeBytes(dir) {
 }
 function totalSizeMb(backupBase2, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join25(backupBase2, name));
+  for (const name of dirs) bytes += dirSizeBytes(join26(backupBase2, name));
   return bytes / BYTES_PER_MB;
 }
 function reportBackupsCheck(section2, backupBase2 = backupBase()) {
-  if (!existsSync18(backupBase2)) return;
+  if (!existsSync19(backupBase2)) return;
   const dirs = safeReaddir(backupBase2).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
   const sizeMb = totalSizeMb(backupBase2, dirs);
@@ -4164,16 +4410,16 @@ function reportBackupsCheck(section2, backupBase2 = backupBase()) {
   }
 }
 
-// src/commands.doctor.check-remote.ts
+// src/commands/doctor/checks/remote.ts
 init_color();
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 init_config();
 init_utils_json();
 var GIT_REMOTE_TIMEOUT_MS = 3e3;
 function readRemotePathMap(sec, repo) {
   let rawJson;
   try {
-    rawJson = execFileSync6("git", ["show", "origin/main:path-map.json"], {
+    rawJson = execFileSync7("git", ["show", "origin/main:path-map.json"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: GIT_REMOTE_TIMEOUT_MS
@@ -4206,7 +4452,7 @@ function reportCheckRemote(section2) {
   const repo = repoHome();
   let names;
   try {
-    const out = execFileSync6("git", ["ls-tree", "--name-only", "origin/main"], {
+    const out = execFileSync7("git", ["ls-tree", "--name-only", "origin/main"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: GIT_REMOTE_TIMEOUT_MS
@@ -4231,16 +4477,16 @@ function reportCheckRemote(section2) {
   addItem(section2, `${green(okGlyph)} remote: origin/main has shared/ and a valid path-map.json`);
 }
 
-// src/commands.doctor.check-schema.ts
+// src/commands/doctor/checks/schema.ts
 init_color();
-import { existsSync as existsSync19 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { join as join27 } from "node:path";
 init_config();
 
-// src/http-fetch.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+// src/core/http-fetch.ts
+import { execFileSync as execFileSync8 } from "node:child_process";
 var FETCH_TIMEOUT_MS = 3e3;
-function fetchUrl(url, run = execFileSync7) {
+function fetchUrl(url, run = execFileSync8) {
   try {
     return run("curl", ["-fsSL", "-m", "3", url], {
       stdio: ["ignore", "pipe", "pipe"],
@@ -4258,7 +4504,7 @@ function fetchUrl(url, run = execFileSync7) {
   }
 }
 
-// src/commands.doctor.check-schema.ts
+// src/commands/doctor/checks/schema.ts
 function fetchSchemaKeys() {
   try {
     const raw = fetchUrl(SETTINGS_SCHEMA_URL);
@@ -4271,8 +4517,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join26(claudeHome(), "settings.json");
-  if (!existsSync19(settingsPath)) {
+  const settingsPath = join27(claudeHome(), "settings.json");
+  if (!existsSync20(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -4298,29 +4544,29 @@ function reportCheckSchema(section2) {
   }
 }
 
-// src/commands.doctor.check-shared.ts
+// src/commands/doctor/checks/shared.ts
 init_color();
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync12, rmSync as rmSync12 } from "node:fs";
+import { execFileSync as execFileSync12 } from "node:child_process";
+import { existsSync as existsSync23, mkdirSync as mkdirSync8, readdirSync as readdirSync12, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 
-// src/commands.doctor.check-shared.memory.ts
+// src/commands/doctor/checks/shared.memory.ts
 init_color();
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { mkdirSync as mkdirSync4, rmSync as rmSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, join as join28 } from "node:path";
+import { dirname as dirname5, join as join29 } from "node:path";
 init_config();
-init_push_gitleaks();
+init_gitleaks();
 init_utils_fs();
 var MEMORY_MD_PATH = /^shared\/projects\/([^/]+)\/memory\/[^/]+\.md$/;
 function buildMemoryScanTree(tmpRoot) {
   let paths;
   try {
-    const out = execFileSync9(
+    const out = execFileSync10(
       "git",
       ["-C", repoHome(), "ls-tree", "-r", "-z", "--name-only", "HEAD", "--", "shared/projects"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }
@@ -4336,7 +4582,7 @@ function buildMemoryScanTree(tmpRoot) {
     if (m?.[1] === void 0) continue;
     let blob;
     try {
-      blob = execFileSync9("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
+      blob = execFileSync10("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
         stdio: ["ignore", "pipe", "ignore"],
         maxBuffer: 67108864,
         timeout: 1e4
@@ -4345,8 +4591,8 @@ function buildMemoryScanTree(tmpRoot) {
       incomplete = true;
       continue;
     }
-    const dest = join28(tmpRoot, rel);
-    mkdirSync4(dirname4(dest), { recursive: true });
+    const dest = join29(tmpRoot, rel);
+    mkdirSync4(dirname5(dest), { recursive: true });
     writeFileSync4(dest, blob);
     logicals.add(m[1]);
   }
@@ -4364,10 +4610,10 @@ function reportMemoryFindings(section2, findings) {
 function reportCommittedMemory(section2) {
   let tmpRoot;
   try {
-    const cacheDir = join28(homedir4(), ".cache", "claude-nomad");
+    const cacheDir = join29(homedir4(), ".cache", "claude-nomad");
     mkdirSync4(cacheDir, { recursive: true });
     const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-    tmpRoot = join28(cacheDir, `check-shared-memory-tree-${stamp}`);
+    tmpRoot = join29(cacheDir, `check-shared-memory-tree-${stamp}`);
     mkdirSync4(tmpRoot, { recursive: true, mode: 448 });
     const { staged, incomplete } = buildMemoryScanTree(tmpRoot);
     if (incomplete) {
@@ -4412,14 +4658,14 @@ function reportCommittedMemory(section2) {
   }
 }
 
-// src/commands.doctor.check-shared.scan.ts
+// src/commands/doctor/checks/shared.scan.ts
 init_color();
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 init_config();
-init_push_gitleaks();
+init_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join29(claudeHome(), "projects", encoded, `${sid}.jsonl`);
+  return join30(claudeHome(), "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -4502,21 +4748,21 @@ function scanAndReport(section2, tmpRoot, staged, logicalToEncoded) {
   emitDescriptionLegend(section2, findings);
 }
 
-// src/commands.doctor.check-shared.skills.ts
+// src/commands/doctor/checks/shared.skills.ts
 init_color();
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdirSync as mkdirSync5, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname5, join as join30 } from "node:path";
+import { dirname as dirname6, join as join31 } from "node:path";
 init_config();
-init_push_gitleaks();
+init_gitleaks();
 init_utils_fs();
 var SKILL_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
 function buildSkillScanTree(tmpRoot) {
   let paths;
   try {
-    const out = execFileSync10(
+    const out = execFileSync11(
       "git",
       ["-C", repoHome(), "ls-tree", "-r", "-z", "--name-only", "HEAD", "--", "shared/skills"],
       { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }
@@ -4532,7 +4778,7 @@ function buildSkillScanTree(tmpRoot) {
     if (m?.[1] === void 0) continue;
     let blob;
     try {
-      blob = execFileSync10("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
+      blob = execFileSync11("git", ["-C", repoHome(), "cat-file", "blob", `HEAD:${rel}`], {
         stdio: ["ignore", "pipe", "ignore"],
         maxBuffer: 67108864,
         timeout: 1e4
@@ -4541,8 +4787,8 @@ function buildSkillScanTree(tmpRoot) {
       incomplete = true;
       continue;
     }
-    const dest = join30(tmpRoot, rel);
-    mkdirSync5(dirname5(dest), { recursive: true });
+    const dest = join31(tmpRoot, rel);
+    mkdirSync5(dirname6(dest), { recursive: true });
     writeFileSync5(dest, blob);
     names.add(m[1]);
   }
@@ -4564,10 +4810,10 @@ function reportSkillFindings(section2, findings) {
 function reportCommittedSkills(section2) {
   let tmpRoot;
   try {
-    const cacheDir = join30(homedir5(), ".cache", "claude-nomad");
+    const cacheDir = join31(homedir5(), ".cache", "claude-nomad");
     mkdirSync5(cacheDir, { recursive: true });
     const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-    tmpRoot = join30(cacheDir, `check-shared-skills-tree-${stamp}`);
+    tmpRoot = join31(cacheDir, `check-shared-skills-tree-${stamp}`);
     mkdirSync5(tmpRoot, { recursive: true, mode: 448 });
     const { staged, incomplete } = buildSkillScanTree(tmpRoot);
     if (incomplete) {
@@ -4612,22 +4858,22 @@ function reportCommittedSkills(section2) {
   }
 }
 
-// src/commands.doctor.check-shared.ts
+// src/commands/doctor/checks/shared.ts
 init_config();
 
-// src/remap.ts
+// src/sync/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync5, existsSync as existsSync21, lstatSync as lstatSync13, mkdirSync as mkdirSync7, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync6 } from "node:fs";
-import { dirname as dirname7, join as join32, relative as relative6, sep as sep5 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync22, lstatSync as lstatSync13, mkdirSync as mkdirSync7, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync6 } from "node:fs";
+import { dirname as dirname8, join as join33, relative as relative6, sep as sep5 } from "node:path";
 init_config();
 
-// src/push-manifest.ts
+// src/commands/push/manifest.ts
 init_config();
-init_push_gitleaks_config();
+init_gitleaks_config();
 init_utils_fs();
 import { createHash } from "node:crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync10, readFileSync as readFileSync7, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join31 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync10, readFileSync as readFileSync7, statSync as statSync5 } from "node:fs";
+import { dirname as dirname7, join as join32 } from "node:path";
 function isChanged(prev, cur, hash) {
   if (prev === void 0) return true;
   if (prev.size !== cur.size) return true;
@@ -4668,7 +4914,7 @@ function hashFile(absPath) {
 }
 function enumerateDir(dir, results) {
   for (const entry of readdirSync10(dir)) {
-    const fullPath = join31(dir, entry);
+    const fullPath = join32(dir, entry);
     const st = statSync5(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -4680,7 +4926,7 @@ function enumerateDir(dir, results) {
 function enumerateSourceFiles(projectDir) {
   const results = [];
   for (const entry of readdirSync10(projectDir)) {
-    const fullPath = join31(projectDir, entry);
+    const fullPath = join32(projectDir, entry);
     const st = statSync5(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -4692,15 +4938,15 @@ function enumerateSourceFiles(projectDir) {
 }
 function fileIdentity(p) {
   if (p === null) return "none::absent";
-  if (!existsSync20(p)) return `${p}::absent`;
+  if (!existsSync21(p)) return `${p}::absent`;
   return `${p}::${createHash("sha256").update(readFileSync7(p)).digest("hex")}`;
 }
 function computeConfigHash() {
   const repo = repoHome();
   const parts = [
     fileIdentity(resolveTomlPath(repo)),
-    fileIdentity(join31(repo, ".gitleaks.overlay.toml")),
-    fileIdentity(join31(repo, ".gitleaksignore"))
+    fileIdentity(join32(repo, ".gitleaks.overlay.toml")),
+    fileIdentity(join32(repo, ".gitleaksignore"))
   ];
   return createHash("sha256").update(parts.join("\n")).digest("hex");
 }
@@ -4720,14 +4966,14 @@ function readManifest(path) {
   }
 }
 function writeManifest(path, manifest) {
-  mkdirSync6(dirname6(path), { recursive: true });
+  mkdirSync6(dirname7(path), { recursive: true });
   writeJsonAtomic(path, manifest);
 }
 function buildManifest(files, scannerVersion, configHash) {
   return { schema: 1, scannerVersion, configHash, files };
 }
 
-// src/remap.ts
+// src/sync/remap.ts
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -4744,16 +4990,15 @@ function overlaySessionDir(src, dst) {
   cpSyncGuarded(src, dst, void 0, "overlaySessionDir");
 }
 function copyFileAtomic(src, dst) {
-  mkdirSync7(dirname7(dst), { recursive: true });
+  mkdirSync7(dirname8(dst), { recursive: true });
   const tmp = `${dst}.tmp.${process.pid}`;
   cpSync5(src, tmp, { force: true, preserveTimestamps: true });
   renameAtomicRetry(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
   const prefix = `${localDir}${sep5}`;
-  for (const p of sel.changed) if (p.startsWith(prefix)) return true;
-  for (const p of sel.deleted) if (p.startsWith(prefix)) return true;
-  return false;
+  const underDir = (p) => p.startsWith(prefix);
+  return [...sel.changed].some(underDir) || sel.deleted.some(underDir);
 }
 function skipForSelection(sel, localDir) {
   return sel !== void 0 && !hasDeltaForDir(sel, localDir);
@@ -4762,12 +5007,12 @@ function applySelective(sel, localDir, repoDst) {
   const prefix = `${localDir}${sep5}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
-    copyFileAtomic(src, join32(repoDst, relative6(localDir, src)));
+    copyFileAtomic(src, join33(repoDst, relative6(localDir, src)));
   }
   for (const src of sel.deleted) {
     if (!src.startsWith(prefix)) continue;
-    const dst = join32(repoDst, relative6(localDir, src));
-    if (existsSync21(dst)) rmSync11(dst);
+    const dst = join33(repoDst, relative6(localDir, src));
+    if (existsSync22(dst)) rmSync11(dst);
   }
 }
 function copyDirJsonlOnly(src, dst) {
@@ -4796,15 +5041,15 @@ function remapPull(ts, opts = {}) {
   const wouldPull = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join32(repo, "path-map.json");
-  const repoProjects = join32(repo, "shared", "projects");
-  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) {
+  const mapPath = join33(repo, "path-map.json");
+  const repoProjects = join33(repo, "shared", "projects");
+  if (!existsSync22(mapPath) || !existsSync22(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join32(claude, "projects");
+  const localProjects = join33(claude, "projects");
   if (!dryRun) mkdirSync7(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -4814,9 +5059,9 @@ function remapPull(ts, opts = {}) {
       continue;
     }
     assertSafeLocalRoot(localPath, logical);
-    const src = join32(repoProjects, logical);
-    if (!existsSync21(src)) continue;
-    const dst = join32(localProjects, encodePath(localPath));
+    const src = join33(repoProjects, logical);
+    if (!existsSync22(src)) continue;
+    const dst = join33(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -4835,8 +5080,8 @@ function remapPull(ts, opts = {}) {
 function countLocalOnly(src, dst) {
   let count = 0;
   for (const name of readdirSync11(dst)) {
-    const dstPath = join32(dst, name);
-    const srcPath = join32(src, name);
+    const dstPath = join33(dst, name);
+    const srcPath = join33(src, name);
     if (lstatSync13(dstPath).isDirectory()) {
       count += countLocalOnly(srcPath, dstPath);
     } else if (lstatSync13(srcPath, { throwIfNoEntry: false }) === void 0) {
@@ -4848,20 +5093,20 @@ function countLocalOnly(src, dst) {
 function scanLocalOnly() {
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join32(repo, "path-map.json");
-  const repoProjects = join32(repo, "shared", "projects");
-  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) return 0;
+  const mapPath = join33(repo, "path-map.json");
+  const repoProjects = join33(repo, "shared", "projects");
+  if (!existsSync22(mapPath) || !existsSync22(repoProjects)) return 0;
   const map = readPathMap(mapPath);
-  const localProjects = join32(claude, "projects");
+  const localProjects = join33(claude, "projects");
   let count = 0;
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const localPath = hosts[HOST];
     if (!localPath || localPath === "TBD") continue;
     assertSafeLocalRoot(localPath, logical);
-    const dst = join32(localProjects, encodePath(localPath));
-    if (!existsSync21(dst)) continue;
-    count += countLocalOnly(join32(repoProjects, logical), dst);
+    const dst = join33(localProjects, encodePath(localPath));
+    if (!existsSync22(dst)) continue;
+    count += countLocalOnly(join33(repoProjects, logical), dst);
   }
   return count;
 }
@@ -4896,16 +5141,16 @@ function remapPush(ts, opts = {}) {
   const wouldPush = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join32(repo, "path-map.json");
-  if (!existsSync21(mapPath)) {
+  const mapPath = join33(repo, "path-map.json");
+  if (!existsSync22(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join32(claude, "projects");
-  const repoProjects = join32(repo, "shared", "projects");
+  const localProjects = join33(claude, "projects");
+  const repoProjects = join33(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync21(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync22(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync7(repoProjects, { recursive: true });
   for (const dir of readdirSync11(localProjects)) {
     if (dir.endsWith(TMP_SUFFIX)) continue;
@@ -4914,8 +5159,8 @@ function remapPush(ts, opts = {}) {
       unmapped++;
       continue;
     }
-    const localDir = join32(localProjects, dir);
-    const repoDst = join32(repoProjects, logical);
+    const localDir = join33(localProjects, dir);
+    const repoDst = join33(repoProjects, logical);
     if (skipForSelection(opts.selection, localDir)) continue;
     if (dryRun) {
       wouldPush.push(logical);
@@ -4932,15 +5177,15 @@ function remapPush(ts, opts = {}) {
   return { unmapped, collisions: 0, pushed, wouldPush };
 }
 
-// src/commands.doctor.check-shared.ts
+// src/commands/doctor/checks/shared.ts
 init_utils_fs();
 init_utils_json();
 function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
   const repo = repoHome();
-  const mapPath = join33(repo, "path-map.json");
-  if (!existsSync22(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join34(repo, "path-map.json");
+  if (!existsSync23(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -4957,12 +5202,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join33(claudeHome(), "projects");
-  if (!existsSync22(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  const localProjects = join34(claudeHome(), "projects");
+  if (!existsSync23(localProjects)) return { logicalToEncoded, staged, malformed: false };
   for (const dir of readdirSync12(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join33(localProjects, dir), join33(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join34(localProjects, dir), join34(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -4970,7 +5215,7 @@ function buildScanTree(tmpRoot) {
 }
 function probeGitleaksForScan() {
   try {
-    execFileSync11("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync12("gitleaks", ["version"], { stdio: ["ignore", "pipe", "pipe"] });
     return "ok";
   } catch (err) {
     if (err.code === "ENOENT") return "missing";
@@ -4992,11 +5237,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
   return true;
 }
 function runLocalPreviewScan(section2) {
-  const cacheDir = join33(homedir6(), ".cache", "claude-nomad");
+  const cacheDir = join34(homedir6(), ".cache", "claude-nomad");
   mkdirSync8(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes3(4).toString("hex")}`;
-  const reportPath = join33(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join33(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join34(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join34(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -5027,10 +5272,10 @@ function reportCheckShared(section2, gitleaksReady) {
   }
 }
 
-// src/commands.doctor.checks.hooks.scope.ts
+// src/commands/doctor/checks/hooks.scope.ts
 init_color();
-import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync13, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname8, extname, join as join34 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync8, readdirSync as readdirSync13, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname9, extname, join as join35 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
@@ -5050,11 +5295,11 @@ function effectiveType(hookPath) {
   } catch {
     return null;
   }
-  let dir = dirname8(real);
+  let dir = dirname9(real);
   for (; ; ) {
-    const pkg = join34(dir, "package.json");
-    if (existsSync23(pkg)) return typeFromPackageJson(pkg);
-    const parent = dirname8(dir);
+    const pkg = join35(dir, "package.json");
+    if (existsSync24(pkg)) return typeFromPackageJson(pkg);
+    const parent = dirname9(dir);
     if (parent === dir) return "cjs";
     dir = parent;
   }
@@ -5095,15 +5340,15 @@ function safeRead(path) {
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join34(claudeHome(), "hooks");
-  if (!existsSync23(hooksDir)) {
+  const hooksDir = join35(claudeHome(), "hooks");
+  if (!existsSync24(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join34(hooksDir, name);
+    const abs = join35(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -5121,10 +5366,10 @@ function reportHookScopeCheck(section2) {
   }
 }
 
-// src/commands.doctor.checks.hooks.ts
+// src/commands/doctor/checks/hooks.ts
 init_color();
-import { existsSync as existsSync24 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync25 } from "node:fs";
+import { join as join36 } from "node:path";
 init_config();
 function expandHome(token) {
   const h2 = home();
@@ -5167,7 +5412,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync24(resolved)) continue;
+        if (existsSync25(resolved)) continue;
         addItem(
           section2,
           `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
@@ -5180,8 +5425,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join35(claudeHome(), "settings.json");
-  if (!existsSync24(settingsPath)) {
+  const settingsPath = join36(claudeHome(), "settings.json");
+  if (!existsSync25(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -5202,17 +5447,17 @@ function reportHooksTargetCheck(section2) {
   }
 }
 
-// src/commands.doctor.checks.hooks.preserve-symlinks.ts
+// src/commands/doctor/checks/hooks.preserve-symlinks.ts
 init_color();
-import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync9 } from "node:fs";
+import { join as join38 } from "node:path";
 
-// src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
-import { dirname as dirname9, join as join36, resolve as resolve3 } from "node:path";
+// src/commands/doctor/checks/hooks.preserve-symlinks.probe.ts
+import { closeSync as closeSync3, existsSync as existsSync26, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
+import { dirname as dirname10, join as join37, resolve as resolve3 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
-  const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
+  const re = /\/\*[^]*?\*\/|\/\/[^\n]*|(['"`])(?:\\[^]|[^\\])*?\1/g;
   let m;
   while ((m = re.exec(src)) !== null) {
     ranges.push([m.index, m.index + m[0].length]);
@@ -5225,7 +5470,7 @@ function inSuppressedRange(pos, ranges) {
   }
   return false;
 }
-function topRelativeSpecifiers(src) {
+function relativeSpecifiers(src) {
   const ranges = suppressedRanges(src);
   const specifiers = [];
   const reqRe = /\brequire\s*\(\s*(['"])(\.\.?\/[^'"]*)\1\s*\)/g;
@@ -5241,12 +5486,12 @@ function topRelativeSpecifiers(src) {
 }
 function specifierIsMissing(specifier, baseDir) {
   const base = resolve3(baseDir, specifier);
-  if (existsSync25(base)) return false;
+  if (existsSync26(base)) return false;
   for (const ext of [".js", ".cjs", ".mjs"]) {
-    if (existsSync25(base + ext)) return false;
+    if (existsSync26(base + ext)) return false;
   }
   for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
-    if (existsSync25(join36(base, idx))) return false;
+    if (existsSync26(join37(base, idx))) return false;
   }
   return true;
 }
@@ -5270,16 +5515,16 @@ function relativeRequireTargetsBroken(scriptPath) {
   } catch {
     return false;
   }
-  const specifiers = topRelativeSpecifiers(raw);
+  const specifiers = relativeSpecifiers(raw);
   if (specifiers.length === 0) return false;
-  const baseDir = dirname9(realPath);
+  const baseDir = dirname10(realPath);
   for (const spec of specifiers) {
     if (specifierIsMissing(spec, baseDir)) return true;
   }
   return false;
 }
 
-// src/commands.doctor.checks.hooks.preserve-symlinks.ts
+// src/commands/doctor/checks/hooks.preserve-symlinks.ts
 init_config();
 function expandHome2(token) {
   const h2 = home();
@@ -5301,8 +5546,8 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join37(repoHome(), "path-map.json");
-  if (!existsSync26(mapPath)) return { projects: {} };
+  const mapPath = join38(repoHome(), "path-map.json");
+  if (!existsSync27(mapPath)) return { projects: {} };
   try {
     return JSON.parse(readFileSync9(mapPath, "utf8"));
   } catch {
@@ -5376,8 +5621,8 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join37(claudeHome(), "settings.json");
-  if (!existsSync26(settingsPath)) {
+  const settingsPath = join38(claudeHome(), "settings.json");
+  if (!existsSync27(settingsPath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
@@ -5408,10 +5653,10 @@ function reportPreserveSymlinksCheck(section2) {
   }
 }
 
-// src/commands.doctor.checks.settings-drift.ts
+// src/commands/doctor/checks/settings-drift.ts
 init_color();
-import { existsSync as existsSync27, readFileSync as readFileSync10 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync10 } from "node:fs";
+import { join as join39 } from "node:path";
 init_config();
 init_utils_json();
 function diffMergedSettings(merged, settings) {
@@ -5429,7 +5674,7 @@ function tryReadJson(filePath) {
   }
 }
 function reportHooksBaseSelfCleanNote(section2) {
-  const basePath = join38(repoHome(), "shared", "settings.base.json");
+  const basePath = join39(repoHome(), "shared", "settings.base.json");
   const base = tryReadJson(basePath);
   if (base === null) return;
   if (!baseHasGsdHookEntries(base)) return;
@@ -5442,14 +5687,14 @@ function reportSettingsDriftCheck(section2) {
   const claude = claudeHome();
   const repo = repoHome();
   const host = HOST;
-  const settingsPath = join38(claude, "settings.json");
-  const basePath = join38(repo, "shared", "settings.base.json");
-  const hostPath = join38(repo, "hosts", `${host}.json`);
-  if (!existsSync27(settingsPath)) {
+  const settingsPath = join39(claude, "settings.json");
+  const basePath = join39(repo, "shared", "settings.base.json");
+  const hostPath = join39(repo, "hosts", `${host}.json`);
+  if (!existsSync28(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
     return;
   }
-  if (!existsSync27(basePath)) {
+  if (!existsSync28(basePath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
@@ -5468,7 +5713,7 @@ function reportSettingsDriftCheck(section2) {
   if (settings === null) {
     return;
   }
-  const hostExists = existsSync27(hostPath);
+  const hostExists = existsSync28(hostPath);
   const hostObj = hostExists ? tryReadJson(hostPath) : null;
   if (hostExists && hostObj === null) {
     addItem(
@@ -5512,19 +5757,20 @@ function emitDriftRows(section2, missing, changed, promotable, excluded, hostFil
   }
 }
 
-// src/commands.doctor.ts
+// src/commands/doctor/doctor.ts
 init_config();
 
-// src/commands.doctor.engine.ts
+// src/commands/doctor/engine.ts
 init_color();
 import { readFileSync as readFileSync12 } from "node:fs";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { join as join41 } from "node:path";
 
-// src/commands.doctor.version.ts
+// src/commands/doctor/version.ts
 init_color();
 import { readFileSync as readFileSync11 } from "node:fs";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { join as join40 } from "node:path";
 init_config();
+init_package_root();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
 var STRICT_SEMVER_PREFIX = /^(\d+\.\d+\.\d+)(?:[-+]|$)/;
 function compareSemver(a, b) {
@@ -5538,7 +5784,7 @@ function compareSemver(a, b) {
 }
 function readLocalVersion() {
   try {
-    const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
+    const pkgPath = join40(packageRoot(), "package.json");
     const parsed = JSON.parse(readFileSync11(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -5589,7 +5835,8 @@ function reportVersionCheck(section2) {
   }
 }
 
-// src/commands.doctor.engine.ts
+// src/commands/doctor/engine.ts
+init_package_root();
 var ENGINES_GTE = /^>=\s*(\d+\.\d+\.\d+)$/;
 function parseMinVersion(spec) {
   const m = ENGINES_GTE.exec(spec);
@@ -5597,7 +5844,7 @@ function parseMinVersion(spec) {
 }
 function readEnginesNode() {
   try {
-    const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
+    const pkgPath = join41(packageRoot(), "package.json");
     const parsed = JSON.parse(readFileSync12(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
@@ -5624,18 +5871,18 @@ function reportNodeEngineCheck(section2) {
   addItem(section2, `${green(okGlyph)} node: ${process.version}`);
 }
 
-// src/commands.doctor.checks.longpaths.ts
+// src/commands/doctor/checks/longpaths.ts
 init_color();
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync13 } from "node:child_process";
 init_config();
-var PROBE_TIMEOUT_MS = 3e3;
+var PROBE_TIMEOUT_MS2 = 3e3;
 var LONGPATHS_REG_KEY = String.raw`HKLM\SYSTEM\CurrentControlSet\Control\FileSystem`;
 var LONGPATHS_REG_VALUE = "LongPathsEnabled";
 function probeGitLongpaths(run) {
   try {
     const out = run("git", ["-C", repoHome(), "config", "--get", "core.longpaths"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS
+      timeout: PROBE_TIMEOUT_MS2
     }).toString().trim();
     return out === "true" || out === "1";
   } catch {
@@ -5646,7 +5893,7 @@ function probeRegistryLongpaths(run) {
   try {
     const out = run("reg", ["query", LONGPATHS_REG_KEY, "/v", LONGPATHS_REG_VALUE], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS
+      timeout: PROBE_TIMEOUT_MS2
     }).toString();
     return /0x1\b/.test(out);
   } catch {
@@ -5660,7 +5907,7 @@ function addLongpathsRow(section2, label, enabled2, remediation) {
   }
   addItem(section2, `${yellow(warnGlyph)} ${label}: not enabled (${remediation})`);
 }
-function reportLongPathsCheck(section2, run = execFileSync12) {
+function reportLongPathsCheck(section2, run = execFileSync13) {
   if (process.platform !== "win32") return;
   addLongpathsRow(
     section2,
@@ -5682,18 +5929,18 @@ function reportSyncModality(section2) {
   addItem(section2, `${dim(infoGlyph)} sync modality: ${modality}`);
 }
 
-// src/commands.doctor.checks.crlf.ts
+// src/commands/doctor/checks/crlf.ts
 init_color();
-import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync28, readFileSync as readFileSync13 } from "node:fs";
-import { join as join39 } from "node:path";
+import { execFileSync as execFileSync14 } from "node:child_process";
+import { existsSync as existsSync29, readFileSync as readFileSync13 } from "node:fs";
+import { join as join42 } from "node:path";
 init_config();
-var PROBE_TIMEOUT_MS2 = 3e3;
+var PROBE_TIMEOUT_MS3 = 3e3;
 var GUARD_LINE = /^\*\s+-text\b/;
 function hasGitattributesGuard(repo) {
   try {
-    const path = join39(repo, ".gitattributes");
-    if (!existsSync28(path)) return false;
+    const path = join42(repo, ".gitattributes");
+    if (!existsSync29(path)) return false;
     const content = readFileSync13(path, "utf8");
     return content.split("\n").map((line) => line.trim()).some((line) => line !== "" && !line.startsWith("#") && GUARD_LINE.test(line));
   } catch {
@@ -5704,7 +5951,7 @@ function probeAutocrlf(repo, run) {
   try {
     const out = run("git", ["-C", repo, "config", "core.autocrlf"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS2
+      timeout: PROBE_TIMEOUT_MS3
     }).toString().trim();
     if (out === "true" || out === "input") return "active";
     if (out === "false") return "disabled";
@@ -5723,7 +5970,7 @@ function addExposedRow(section2, repo, verdict) {
   const remediation = `add a .gitattributes with a \`* -text\` line, or run \`git config core.autocrlf false\`, in ${repo}`;
   addItem(section2, `${yellow(warnGlyph)} CRLF guard: ${risk}; ${remediation}`);
 }
-function reportCrlfGuardCheck(section2, run = execFileSync13) {
+function reportCrlfGuardCheck(section2, run = execFileSync14) {
   const repo = repoHome();
   if (hasGitattributesGuard(repo)) {
     addItem(section2, `${green(okGlyph)} CRLF guard: .gitattributes (* -text) present`);
@@ -5732,24 +5979,24 @@ function reportCrlfGuardCheck(section2, run = execFileSync13) {
   addExposedRow(section2, repo, probeAutocrlf(repo, run));
 }
 
-// src/spinner.ts
+// src/render/spinner.ts
 init_color();
-import { existsSync as existsSync33 } from "node:fs";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { existsSync as existsSync34 } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { Worker } from "node:worker_threads";
 
-// src/commands.push.recovery.ts
+// src/commands/push/recovery/recovery.ts
 init_config();
 import { readFileSync as readFileSync18, rmSync as rmSync15, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join47 } from "node:path";
+import { join as join50 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
-// src/commands.push.recovery.actions.ts
+// src/commands/push/recovery/actions.ts
 init_config();
 import { readFileSync as readFileSync17 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve4, sep as sep9 } from "node:path";
 
-// src/commands.push.recovery.memory.ts
+// src/commands/push/recovery/memory.ts
 init_config();
 init_config_sharedDirs_guard();
 import {
@@ -5761,17 +6008,17 @@ import {
   statSync as statSync7,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname10, join as join40, sep as sep6 } from "node:path";
-init_push_gitleaks_scan();
+import { dirname as dirname11, join as join43, sep as sep6 } from "node:path";
+init_gitleaks_scan();
 
-// src/rel-path-guard.ts
+// src/core/rel-path-guard.ts
 function isSafeRelPath(relPath) {
   if (relPath.length === 0 || relPath.startsWith("/") || relPath.includes("\\")) return false;
   const segments = relPath.split("/");
   return segments.every((s) => s.length > 0 && s !== "." && s !== "..");
 }
 
-// src/commands.push.recovery.memory.ts
+// src/commands/push/recovery/memory.ts
 init_utils_fs();
 init_utils_json();
 init_utils();
@@ -5790,8 +6037,8 @@ function resolveMemoryLocalPath(logical, relPath, map) {
   if (!isSafeRelPath(relPath)) return null;
   const abs = map.projects[logical]?.[HOST];
   if (abs === void 0) return null;
-  const memoryRoot = join40(claudeHome(), "projects", encodePath(abs), "memory");
-  const localPath = join40(memoryRoot, ...relPath.split("/"));
+  const memoryRoot = join43(claudeHome(), "projects", encodePath(abs), "memory");
+  const localPath = join43(memoryRoot, ...relPath.split("/"));
   if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep6)) return null;
   try {
     if (lstatSync14(localPath).isSymbolicLink()) return null;
@@ -5845,13 +6092,13 @@ function applyMemoryRedact(f, ts, map, scan = scanFile) {
     );
   }
   writeFileSync6(localPath, after, "utf8");
-  const dest = join40(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
-  mkdirSync9(dirname10(dest), { recursive: true });
+  const dest = join43(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
+  mkdirSync9(dirname11(dest), { recursive: true });
   cpSync6(localPath, dest, { force: true });
   return true;
 }
 
-// src/commands.push.recovery.skills.ts
+// src/commands/push/recovery/skills.ts
 init_config();
 import {
   cpSync as cpSync7,
@@ -5862,27 +6109,27 @@ import {
   statSync as statSync8,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname11, join as join42, sep as sep7 } from "node:path";
+import { dirname as dirname12, join as join45, sep as sep7 } from "node:path";
 
-// src/skills-sync.ts
+// src/sync/skills-sync.ts
 init_config();
-import { existsSync as existsSync29, lstatSync as lstatSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync14, rmSync as rmSync13 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync30, lstatSync as lstatSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync14, rmSync as rmSync13 } from "node:fs";
+import { join as join44 } from "node:path";
 
-// src/skills-sync.tracked.ts
+// src/sync/skills-sync.tracked.ts
 init_utils();
-import { basename as basename3 } from "node:path";
+import { basename as basename4 } from "node:path";
 function trackedRootSkillsAt(ref, repo) {
   try {
     const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
     const entries = raw.split("\0").filter((entry) => entry !== "");
-    return new Set(entries.map((entry) => basename3(entry)));
+    return new Set(entries.map((entry) => basename4(entry)));
   } catch {
     return /* @__PURE__ */ new Set();
   }
 }
 
-// src/skills-sync.ts
+// src/sync/skills-sync.ts
 init_utils_fs();
 function isGsdOwned(name) {
   return name.startsWith(GSD_PREFIX);
@@ -5902,9 +6149,9 @@ function copySkillsPull(src, dst, isRootPreserved) {
   copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded, isRootPreserved);
 }
 function syncSkillsPull(ts, prePostHeads) {
-  const sharedSkills = join41(repoHome(), "shared", "skills");
-  if (!existsSync29(sharedSkills)) return;
-  const localSkills = join41(claudeHome(), "skills");
+  const sharedSkills = join44(repoHome(), "shared", "skills");
+  if (!existsSync30(sharedSkills)) return;
+  const localSkills = join44(claudeHome(), "skills");
   backupBeforeWrite(localSkills, ts);
   const dstStat = lstatSync15(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
@@ -5915,16 +6162,16 @@ function syncSkillsPull(ts, prePostHeads) {
   copySkillsPull(sharedSkills, localSkills, (name) => !tracked.has(name));
 }
 function syncSkillsPush() {
-  const localSkills = join41(claudeHome(), "skills");
+  const localSkills = join44(claudeHome(), "skills");
   const stat = lstatSync15(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
-  const sharedSkills = join41(repoHome(), "shared", "skills");
+  const sharedSkills = join44(repoHome(), "shared", "skills");
   copySkillsPush(localSkills, sharedSkills);
 }
 
-// src/commands.push.recovery.skills.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/skills.ts
+init_gitleaks_scan();
 init_utils_fs();
 init_utils();
 var SKILL_FINDING_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
@@ -5942,9 +6189,9 @@ function resolveSkillLocalPath(name, relPath) {
   if (!SAFE_SKILL_NAME.test(name) || name === "." || name === "..") return null;
   if (isGsdOwned(name)) return null;
   if (!isSafeRelPath(relPath)) return null;
-  const skillsRoot = join42(claudeHome(), "skills");
-  const skillRoot = join42(skillsRoot, name);
-  const localPath = join42(skillRoot, ...relPath.split("/"));
+  const skillsRoot = join45(claudeHome(), "skills");
+  const skillRoot = join45(skillsRoot, name);
+  const localPath = join45(skillRoot, ...relPath.split("/"));
   if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep7)) return null;
   try {
     if (lstatSync16(localPath).isSymbolicLink()) return null;
@@ -5996,17 +6243,17 @@ function applySkillRedact(f, ts, scan = scanFile) {
     );
   }
   writeFileSync7(localPath, after, "utf8");
-  const dest = join42(repoHome(), "shared", "skills", name, ...relPath.split("/"));
-  mkdirSync11(dirname11(dest), { recursive: true });
+  const dest = join45(repoHome(), "shared", "skills", name, ...relPath.split("/"));
+  mkdirSync11(dirname12(dest), { recursive: true });
   cpSync7(localPath, dest, { force: true });
   return true;
 }
 
-// src/commands.push.recovery.allow-gate.ts
+// src/commands/push/recovery/allow-gate.ts
 init_utils();
 
-// src/commands.push.recovery.seams.ts
-init_push_gitleaks();
+// src/commands/push/recovery/seams.ts
+init_gitleaks();
 function findingKey(f) {
   return `${f.File}:${f.StartLine}:${f.StartColumn}:${f.RuleID}`;
 }
@@ -6027,7 +6274,7 @@ function parseAction(raw) {
   return "skip";
 }
 
-// src/commands.push.recovery.allow-gate.ts
+// src/commands/push/recovery/allow-gate.ts
 function isCleared(f, state) {
   const action = state.actions.get(findingKey(f)) ?? "skip";
   if (action === "allow") return true;
@@ -6071,28 +6318,28 @@ function applyDeferredAllows(findings, state, repo) {
   }
 }
 
-// src/commands.push.recovery.redact.ts
+// src/commands/push/recovery/redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync8, existsSync as existsSync32, mkdirSync as mkdirSync12 } from "node:fs";
-import { dirname as dirname13, join as join45, sep as sep8 } from "node:path";
+import { cpSync as cpSync8, existsSync as existsSync33, mkdirSync as mkdirSync12 } from "node:fs";
+import { dirname as dirname14, join as join48, sep as sep8 } from "node:path";
 
-// src/commands.redact.ts
+// src/commands/redact/redact.ts
 init_config();
-import { existsSync as existsSync31 } from "node:fs";
-import { dirname as dirname12, join as join44 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { dirname as dirname13, join as join47 } from "node:path";
 
-// src/commands.redact.subtree.ts
-import { existsSync as existsSync30, lstatSync as lstatSync17, readFileSync as readFileSync16, readdirSync as readdirSync15, statSync as statSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join43 } from "node:path";
+// src/commands/redact/subtree.ts
+import { existsSync as existsSync31, lstatSync as lstatSync17, readFileSync as readFileSync16, readdirSync as readdirSync15, statSync as statSync9, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join46 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
-  if (!existsSync30(dir)) return;
+  if (!existsSync31(dir)) return;
   const st = lstatSync17(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync15(dir)) {
-    const abs = join43(dir, entry);
+    const abs = join46(dir, entry);
     const lst = lstatSync17(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
@@ -6146,12 +6393,12 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   return { total, dirty };
 }
 
-// src/commands.pushed-history.ts
+// src/commands/pushed-history.ts
 init_utils();
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 function pushedRef(repo) {
   try {
-    const ref = execFileSync14("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+    const ref = execFileSync15("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
       cwd: repo,
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
@@ -6164,7 +6411,7 @@ function sessionInPushedHistory(id, repo) {
   const ref = pushedRef(repo);
   if (ref === null) return false;
   try {
-    const out = execFileSync14(
+    const out = execFileSync15(
       "git",
       [
         "log",
@@ -6194,23 +6441,23 @@ function warnIfSessionPushed(id, repo) {
   );
 }
 
-// src/commands.redact.ts
-init_push_gitleaks_scan();
+// src/commands/redact/redact.ts
+init_gitleaks_scan();
 init_exit_codes();
 init_utils_fs();
 init_utils_json();
 init_utils();
 function resolveLiveTranscript(id) {
   try {
-    const mapPath = join44(repoHome(), "path-map.json");
-    if (!existsSync31(mapPath)) return null;
+    const mapPath = join47(repoHome(), "path-map.json");
+    if (!existsSync32(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join44(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync31(live)) return live;
+      const live = join47(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync32(live)) return live;
     }
     return null;
   } catch {
@@ -6230,17 +6477,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync31(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync32(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync31(localPath)) {
+    if (localPath === null || !existsSync32(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join44(dirname12(localPath), id);
+    const sessionDir = join47(dirname13(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
       log(
@@ -6292,8 +6539,8 @@ ${lines}`);
   }
 }
 
-// src/commands.push.recovery.redact.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/redact.ts
+init_gitleaks_scan();
 init_utils_json();
 init_utils();
 function resolveStagedDir(localPath, map, claude, repo) {
@@ -6301,8 +6548,8 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join45(claude, "projects", encodePath(abs)) + sep8)) {
-      return join45(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join48(claude, "projects", encodePath(abs)) + sep8)) {
+      return join48(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -6312,7 +6559,7 @@ function preflightRedactable(f, map, nowMs) {
   if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
   const localPath = resolveLiveTranscript(sid);
   if (localPath === null) return `session ${sid}: local transcript not found`;
-  const sessionDir = join45(dirname13(localPath), sid);
+  const sessionDir = join48(dirname14(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return `session ${sid}: looks active (modified within the last 5 minutes)`;
@@ -6341,7 +6588,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join45(dirname13(localPath), sid);
+  const sessionDir = join48(dirname14(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return refuse(
@@ -6374,35 +6621,35 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync12(stagedProjectDir, { recursive: true });
-  cpSync8(localPath, join45(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync32(sessionDir)) {
-    cpSync8(sessionDir, join45(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync8(localPath, join48(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync33(sessionDir)) {
+    cpSync8(sessionDir, join48(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
 
-// src/commands.push.recovery.drop.ts
+// src/commands/push/recovery/drop.ts
 init_config();
 import { rmSync as rmSync14 } from "node:fs";
-import { join as join46 } from "node:path";
+import { join as join49 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join46(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join46(repo, "shared", "projects", logical, sid);
+    const jsonl = join49(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join49(repo, "shared", "projects", logical, sid);
     rmSync14(jsonl, { force: true });
     rmSync14(dir, { recursive: true, force: true });
   }
   return true;
 }
 
-// src/commands.push.recovery.actions.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/actions.ts
+init_gitleaks_scan();
 init_utils();
 
-// src/commands.push.recovery.span-align.ts
+// src/commands/push/recovery/span-align.ts
 var REDACTED_TOKEN = "REDACTED";
 var SHIFT_WINDOW = [0, -1, 1, -2, 2];
 var ENTROPY_TOLERANCE = 1e-4;
@@ -6489,7 +6736,7 @@ function alignFindingSpan(finding, buf) {
   return breakTie(hits, finding);
 }
 
-// src/commands.push.recovery.secret-shape.ts
+// src/commands/push/recovery/secret-shape.ts
 var VALUE_HEAD = 4;
 var VALUE_TAIL = 4;
 var MIN_ELIDE_LEN = 16;
@@ -6497,7 +6744,7 @@ var FRAGMENT_SEP = "...";
 var NEAR_WINDOW = 40;
 var VALUE_PAD = 16;
 var SIBLING_PAD = 2;
-var CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
+var CONTROL_CHARS2 = /[\x00-\x1f\x7f]/g;
 function classifyCharset(value) {
   if (/^[0-9a-fA-F]+$/.test(value)) return "hex";
   if (/^[0-9a-zA-Z]+$/.test(value)) return "alphanumeric";
@@ -6571,7 +6818,7 @@ function resolveSpanContext(finding, readLine, siblings = []) {
   return { value: aligned.value, near: emptyToNull(near), exact: aligned.exact };
 }
 function formatNear(text) {
-  const stripped = elideTokenRuns(text.replace(CONTROL_CHARS, ""));
+  const stripped = elideTokenRuns(text.replace(CONTROL_CHARS2, ""));
   const truncated = stripped.length > NEAR_WINDOW;
   const window = stripped.slice(-NEAR_WINDOW).trim();
   if (window.length === 0) return null;
@@ -6585,15 +6832,15 @@ function elideTokenRuns(text) {
   });
 }
 
-// src/commands.push.recovery.display.ts
+// src/commands/push/recovery/display.ts
 var RULE_PAD = 24;
 var GROUP_SEP = "\0";
 function sessionSuffix(finding) {
   const sid = sessionIdFromFinding(finding);
   if (sid === null) return "";
   const rawBasename = finding.File.replace(/^.*\//, "");
-  const basename4 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
-  return basename4 === sid ? "" : ` (session: ${sid})`;
+  const basename5 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
+  return basename5 === sid ? "" : ` (session: ${sid})`;
 }
 function renderFindingBlock(finding, readLine, siblings = []) {
   const lines = [`  file:  ${finding.File}:${finding.StartLine}${sessionSuffix(finding)}`];
@@ -6643,7 +6890,7 @@ function buildPromptHeader(group, index, total, readLine, peers = 0, siblings =
   return ["", headerLine, ...body, menu, ""].join("\n");
 }
 
-// src/commands.push.recovery.actions.ts
+// src/commands/push/recovery/actions.ts
 function allowAllFindings(findings, repo) {
   for (const f of findings) {
     appendGitleaksIgnore(f.Fingerprint, repo);
@@ -6776,8 +7023,8 @@ function dispatchActions(findings, actions, opts) {
   applyDeferredAllows(findings, ctx, repo);
 }
 
-// src/commands.push.recovery.redact-all.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/redact-all.ts
+init_gitleaks_scan();
 init_utils();
 function redactAllDedupeKey(f) {
   const sid = sessionIdFromFinding(f);
@@ -6842,10 +7089,10 @@ function redactAllFindings(findings, ts, map, nowMs, scan = scanFile) {
   }
 }
 
-// src/commands.push.recovery.ts
+// src/commands/push/recovery/recovery.ts
 init_exit_codes();
-init_push_gitleaks_scan();
-init_push_gitleaks();
+init_gitleaks_scan();
+init_gitleaks();
 init_utils();
 function isTTY(stdin = process.stdin, stdout = process.stdout) {
   return stdin.isTTY === true && stdout.isTTY === true;
@@ -6876,7 +7123,7 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join47(repoHome2, ".gitleaksignore");
+  const ignPath = join50(repoHome2, ".gitleaksignore");
   let before;
   try {
     before = readFileSync18(ignPath, "utf8");
@@ -6920,7 +7167,7 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
     scan = scanFile,
     printLegend = printRecoveryLegend
   } = deps;
-  const scanVerdict = deps.scanVerdict ?? (await Promise.resolve().then(() => (init_push_leak_verdict(), push_leak_verdict_exports))).scanPushVerdict;
+  const scanVerdict = deps.scanVerdict ?? (await Promise.resolve().then(() => (init_leak_verdict(), leak_verdict_exports))).scanPushVerdict;
   const repo = repoHome();
   let current = verdict;
   if (redactAll) {
@@ -6963,7 +7210,7 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
   return current;
 }
 
-// src/spinner.ts
+// src/render/spinner.ts
 function formatElapsed(ms) {
   return `${(ms / 1e3).toFixed(1)}s`;
 }
@@ -6982,11 +7229,11 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync33;
+  const check = deps.existsSyncFn ?? existsSync34;
   const base = deps.baseUrl ?? import.meta.url;
-  const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
+  const mjs = fileURLToPath2(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
-  return fileURLToPath4(new URL("./spinner.worker.ts", base));
+  return fileURLToPath2(new URL("./spinner.worker.ts", base));
 }
 function makeRealWorker() {
   return new Worker(resolveWorkerPath());
@@ -7046,11 +7293,11 @@ function withSpinner(label, fn, deps) {
   }
 }
 
-// src/commands.doctor.gitleaks-version.ts
+// src/commands/doctor/gitleaks-version.ts
 init_color();
-import { execFileSync as execFileSync15 } from "node:child_process";
-import { existsSync as existsSync34 } from "node:fs";
-import { join as join48 } from "node:path";
+import { execFileSync as execFileSync16 } from "node:child_process";
+import { existsSync as existsSync35 } from "node:fs";
+import { join as join51 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -7059,7 +7306,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join48(repoHome(), ".gitleaks.toml");
+  const tomlPath = join51(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -7071,7 +7318,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists = existsSync34) {
+function reportGitleaksVersionCheck(section2, run = execFileSync16, tomlExists = existsSync35) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -7089,11 +7336,11 @@ function reportGitleaksVersionCheck(section2, run = execFileSync15, tomlExists =
   );
 }
 
-// src/commands.doctor.checks.deps.ts
+// src/commands/doctor/checks/deps.ts
 init_color();
-import { execFileSync as execFileSync16 } from "node:child_process";
+import { execFileSync as execFileSync17 } from "node:child_process";
 var VERSION_TOKEN = /(\d{1,9}\.\d{1,9}\.\d{1,9})/;
-var PROBE_TIMEOUT_MS3 = 3e3;
+var PROBE_TIMEOUT_MS4 = 3e3;
 var FETCHER_BASE = "HTTP fetcher";
 function parseFirstVersion(line) {
   const m = VERSION_TOKEN.exec(line);
@@ -7103,7 +7350,7 @@ function probeOptionalDep(bin, run) {
   try {
     const firstLine = run(bin, ["--version"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS3
+      timeout: PROBE_TIMEOUT_MS4
     }).toString().split("\n")[0].trim();
     const version = parseFirstVersion(firstLine);
     return { status: "present", version };
@@ -7128,7 +7375,7 @@ function reportFetcherRow(section2, run) {
     );
   }
 }
-function reportOptionalDeps(section2, run = execFileSync16) {
+function reportOptionalDeps(section2, run = execFileSync17) {
   const gh = probeOptionalDep("gh", run);
   if (gh.status === "present") {
     addItem(section2, `${green(okGlyph)} gh: ${gh.version ?? "present"}`);
@@ -7141,13 +7388,13 @@ function reportOptionalDeps(section2, run = execFileSync16) {
   reportFetcherRow(section2, run);
 }
 
-// src/commands.doctor.actions-drift.ts
+// src/commands/doctor/actions-drift.ts
 init_color();
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 init_config();
 
-// src/gh-actions.ts
-import { execFileSync as execFileSync17 } from "node:child_process";
+// src/commands/init/gh-actions.ts
+import { execFileSync as execFileSync18 } from "node:child_process";
 var GH_TIMEOUT_MS = 5e3;
 function parseGitHubRemote(remoteUrl) {
   const normalized = remoteUrl.trim().replace(/\/$/, "");
@@ -7155,7 +7402,7 @@ function parseGitHubRemote(remoteUrl) {
   if (m === null) return null;
   return { owner: m[1], repo: m[2] };
 }
-function ghAuthStatus(run = execFileSync17) {
+function ghAuthStatus(run = execFileSync18) {
   try {
     run("gh", ["auth", "status"], {
       stdio: ["ignore", "ignore", "ignore"],
@@ -7169,7 +7416,7 @@ function ghAuthStatus(run = execFileSync17) {
     return "gh-probe-error";
   }
 }
-function isRepoPrivate(ref, run = execFileSync17) {
+function isRepoPrivate(ref, run = execFileSync18) {
   const out = run("gh", ["repo", "view", `${ref.owner}/${ref.repo}`, "--json", "isPrivate"], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: GH_TIMEOUT_MS
@@ -7177,7 +7424,7 @@ function isRepoPrivate(ref, run = execFileSync17) {
   const parsed = JSON.parse(out);
   return parsed.isPrivate === true;
 }
-function isActionsEnabled(ref, run = execFileSync17) {
+function isActionsEnabled(ref, run = execFileSync18) {
   const out = run(
     "gh",
     ["api", `repos/${ref.owner}/${ref.repo}/actions/permissions`, "--jq", ".enabled"],
@@ -7185,7 +7432,7 @@ function isActionsEnabled(ref, run = execFileSync17) {
   ).toString().trim();
   return out === "true";
 }
-function disableActions(ref, run = execFileSync17) {
+function disableActions(ref, run = execFileSync18) {
   run(
     "gh",
     [
@@ -7199,15 +7446,15 @@ function disableActions(ref, run = execFileSync17) {
     { stdio: ["ignore", "ignore", "pipe"], timeout: GH_TIMEOUT_MS }
   );
 }
-function readOriginRemote(cwd, run = execFileSync17) {
+function readOriginRemote(cwd, run = execFileSync18) {
   return run("git", ["remote", "get-url", "origin"], {
     cwd,
     stdio: ["ignore", "pipe", "ignore"]
   }).toString().trim();
 }
 
-// src/commands.doctor.actions-drift.ts
-function reportActionsDrift(section2, run = execFileSync18) {
+// src/commands/doctor/actions-drift.ts
+function reportActionsDrift(section2, run = execFileSync19) {
   let remote;
   try {
     remote = readOriginRemote(repoHome(), run);
@@ -7238,7 +7485,7 @@ function reportActionsDrift(section2, run = execFileSync18) {
   );
 }
 
-// src/commands.doctor.verdict.ts
+// src/commands/doctor/verdict.ts
 init_color();
 function isFailLine(item2) {
   return item2.includes(failGlyph);
@@ -7262,7 +7509,7 @@ function buildVerdictSection(sections) {
   return summary;
 }
 
-// src/commands.doctor.banner.ts
+// src/commands/doctor/banner.ts
 var NOMAD_BANNER = [
   "                                        __",
   "   ____   ____   ____ ___   ____ _ ____/ /",
@@ -7276,7 +7523,7 @@ function printBanner(log2, stdout) {
   log2("");
 }
 
-// src/commands.doctor.compact.ts
+// src/commands/doctor/compact.ts
 init_color();
 var ALWAYS_FULL = /* @__PURE__ */ new Set([
   "Nomad Version",
@@ -7318,7 +7565,7 @@ function compactSections(sections) {
   });
 }
 
-// src/commands.doctor.ts
+// src/commands/doctor/doctor.ts
 function gatherDoctorSections(opts) {
   const host = section("Environment");
   reportHostAndPaths(host);
@@ -7328,8 +7575,8 @@ function gatherDoctorSections(opts) {
   reportLongPathsCheck(host);
   reportCrlfGuardCheck(host);
   const links = section("Shared links");
-  const mapPath = join49(repoHome(), "path-map.json");
-  const rawMap = existsSync35(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join52(repoHome(), "path-map.json");
+  const rawMap = existsSync36(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   reportDroppedNamesMigration(links);
@@ -7347,6 +7594,7 @@ function gatherDoctorSections(opts) {
   reportPathMap(pathMap);
   const neverSync = section("Never-sync");
   reportNeverSync(neverSync);
+  reportTrackedDeniedShared(neverSync);
   const skills = section("Skills");
   reportSkillsDivergence(skills);
   const repository = section("Repository");
@@ -7403,7 +7651,7 @@ function cmdDoctor(opts = {}) {
   renderDoctor(opts.verbose === true ? report : compactSections(report));
 }
 
-// src/nomad.dispatch.doctor.ts
+// src/cli/dispatch.doctor.ts
 function parseDoctorArgs(args) {
   if (args[0] === "--resume-cmd") {
     const id = args[1];
@@ -7424,17 +7672,17 @@ function parseDoctorArgs(args) {
   return { kind: "run", checkShared, checkSchema, checkRemote, verbose };
 }
 
-// src/commands.drop-session.ts
+// src/commands/drop-session/drop-session.ts
 init_config();
-import { execFileSync as execFileSync20 } from "node:child_process";
-import { existsSync as existsSync37, readdirSync as readdirSync16, statSync as statSync10 } from "node:fs";
-import { join as join51, relative as relative7 } from "node:path";
+import { execFileSync as execFileSync21 } from "node:child_process";
+import { existsSync as existsSync38, readdirSync as readdirSync16, statSync as statSync10 } from "node:fs";
+import { join as join54, relative as relative7 } from "node:path";
 
-// src/commands.drop-session.git.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+// src/commands/drop-session/git.ts
+import { execFileSync as execFileSync20 } from "node:child_process";
 function expandStagedDir(dirRel, repo) {
   try {
-    const out = execFileSync19("git", ["ls-files", "-z", "--", dirRel], {
+    const out = execFileSync20("git", ["ls-files", "-z", "--", dirRel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7446,7 +7694,7 @@ function expandStagedDir(dirRel, repo) {
 function isTrackedInHead(rel, repo) {
   try {
     const treePath = process.platform === "win32" ? rel.replaceAll("\\", "/") : rel;
-    execFileSync19("git", ["cat-file", "-e", `HEAD:${treePath}`], {
+    execFileSync20("git", ["cat-file", "-e", `HEAD:${treePath}`], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7457,7 +7705,7 @@ function isTrackedInHead(rel, repo) {
 }
 function isInIndex(rel, repo) {
   try {
-    const out = execFileSync19("git", ["ls-files", "--", rel], {
+    const out = execFileSync20("git", ["ls-files", "--", rel], {
       cwd: repo,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7467,12 +7715,12 @@ function isInIndex(rel, repo) {
   }
 }
 
-// src/commands.drop-session.scrub-hint.ts
+// src/commands/drop-session/scrub-hint.ts
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync36 } from "node:fs";
-import { join as join50 } from "node:path";
+import { existsSync as existsSync37 } from "node:fs";
+import { join as join53 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript2(id, matches);
@@ -7488,8 +7736,8 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript2(id, matches) {
   try {
-    const mapPath = join50(repoHome(), "path-map.json");
-    if (!existsSync36(mapPath)) return null;
+    const mapPath = join53(repoHome(), "path-map.json");
+    if (!existsSync37(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
@@ -7497,8 +7745,8 @@ function resolveLiveTranscript2(id, matches) {
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join50(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync36(live)) return live;
+      const live = join53(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync37(live)) return live;
     }
     return null;
   } catch {
@@ -7506,7 +7754,7 @@ function resolveLiveTranscript2(id, matches) {
   }
 }
 
-// src/commands.drop-session.ts
+// src/commands/drop-session/drop-session.ts
 init_utils();
 function cmdDropSession(id) {
   if (id.length === 0 || id.length > 128 || !/^[A-Za-z0-9_-]+$/.test(id)) {
@@ -7514,12 +7762,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync37(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync38(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join51(repo, "shared", "projects");
-    if (!existsSync37(repoProjects)) {
+    const repoProjects = join54(repo, "shared", "projects");
+    if (!existsSync38(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -7542,12 +7790,12 @@ function cmdDropSession(id) {
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
   for (const logical of readdirSync16(repoProjects)) {
-    const candidate = join51(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync37(candidate)) {
+    const candidate = join54(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync38(candidate)) {
       matches.push(relative7(repo, candidate));
     }
-    const dir = join51(repoProjects, logical, id);
-    if (existsSync37(dir) && statSync10(dir).isDirectory()) {
+    const dir = join54(repoProjects, logical, id);
+    if (existsSync38(dir) && statSync10(dir).isDirectory()) {
       const dirRel = relative7(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
@@ -7563,12 +7811,12 @@ function unstageOne(rel, repo) {
   }
   try {
     if (isTrackedInHead(rel, repo)) {
-      execFileSync20("git", ["restore", "--staged", "--worktree", "--", rel], {
+      execFileSync21("git", ["restore", "--staged", "--worktree", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
     } else {
-      execFileSync20("git", ["rm", "--cached", "-f", "--", rel], {
+      execFileSync21("git", ["rm", "--cached", "-f", "--", rel], {
         cwd: repo,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -7581,15 +7829,15 @@ function unstageOne(rel, repo) {
   item(`dropped ${rel}`);
 }
 
-// src/commands.pull.ts
+// src/commands/pull/pull.ts
 init_autostash_guard();
-import { existsSync as existsSync46, mkdirSync as mkdirSync14 } from "node:fs";
-import { join as join62 } from "node:path";
+import { existsSync as existsSync47, mkdirSync as mkdirSync14 } from "node:fs";
+import { join as join65 } from "node:path";
 
-// src/commands.push.sections.ts
+// src/commands/push/sections.ts
 init_color();
 
-// src/summary.ts
+// src/render/summary.ts
 init_utils();
 function summaryText(verb, unmapped, collisions = 0, extrasSkipped = 0, localOnly = 0) {
   const extras = extrasSkipped > 0 ? `, ${extrasSkipped} extras skipped` : "";
@@ -7614,7 +7862,7 @@ function summaryRow(verb, unmapped, collisions = 0, extrasSkipped = 0, localOnly
   return text.replace(/^summary: /, "");
 }
 
-// src/commands.push.sections.ts
+// src/commands/push/sections.ts
 function collapsedSkipRow(n, noun) {
   if (n <= 0) return null;
   return `${dim(infoGlyph)} ${n} ${noun}`;
@@ -7687,23 +7935,23 @@ function renderNoScanTree(st, opts = {}) {
   renderTree(buildNoScanSections(st, opts));
 }
 
-// src/commands.pull.ts
+// src/commands/pull/pull.ts
 init_config();
 
-// src/extras-sync.ts
+// src/sync/extras/extras.ts
 init_config();
-import { existsSync as existsSync39, statSync as statSync11 } from "node:fs";
-import { join as join54 } from "node:path";
+import { existsSync as existsSync40, statSync as statSync11 } from "node:fs";
+import { join as join57 } from "node:path";
 init_utils();
 init_utils_json();
 
-// src/extras-sync.remap.ts
+// src/sync/extras/remap.ts
 init_config();
-import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync17, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
-import { dirname as dirname14, join as join53, sep as sep11 } from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync13, readdirSync as readdirSync17, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
+import { dirname as dirname15, join as join56, sep as sep11 } from "node:path";
 
-// src/extras-sync.planning-diff.ts
-import { join as join52, normalize as normalize2, sep as sep10 } from "node:path";
+// src/sync/extras/planning-diff.ts
+import { join as join55, normalize as normalize2, sep as sep10 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -7755,7 +8003,7 @@ function planningDeleteTargets(opts) {
   const { deleted } = parsePlanningDiff(raw);
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
-  const planningRoot = join52(localRoot, ".planning");
+  const planningRoot = join55(localRoot, ".planning");
   const planningRootBoundary = planningRoot + sep10;
   const targets = [];
   for (const repoPath of deleted) {
@@ -7763,7 +8011,7 @@ function planningDeleteTargets(opts) {
       continue;
     }
     const remainder = repoPath.slice(logicalPrefix.length);
-    const candidate = join52(localRoot, remainder);
+    const candidate = join55(localRoot, remainder);
     const resolved = normalize2(candidate);
     if (!resolved.startsWith(planningRootBoundary)) {
       throw new NomadFatal(
@@ -7775,7 +8023,7 @@ function planningDeleteTargets(opts) {
   return targets;
 }
 
-// src/extras-sync.remap.ts
+// src/sync/extras/remap.ts
 init_utils_fs();
 init_utils();
 function runExtrasOp(v, dryRun, paths, backup, copy) {
@@ -7784,7 +8032,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync38(src)) continue;
+    if (!existsSync39(src)) continue;
     const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item2);
@@ -7797,7 +8045,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   return { ...counts, done, would };
 }
 function pruneEmptyAncestors(target, planningRoot) {
-  let dir = dirname14(target);
+  let dir = dirname15(target);
   while (dir !== planningRoot && dir.startsWith(planningRoot + sep11)) {
     try {
       if (readdirSync17(dir).length > 0) break;
@@ -7805,7 +8053,7 @@ function pruneEmptyAncestors(target, planningRoot) {
     } catch {
       break;
     }
-    dir = dirname14(dir);
+    dir = dirname15(dir);
   }
 }
 function tryRealpath(dir) {
@@ -7819,8 +8067,8 @@ function isInsidePlanningRoot(parentReal, rootReal) {
   return parentReal === rootReal || parentReal.startsWith(rootReal + sep11);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
-  if (existsSync38(repoCounterpart)) return;
-  const parentReal = tryRealpath(dirname14(target));
+  if (existsSync39(repoCounterpart)) return;
+  const parentReal = tryRealpath(dirname15(target));
   if (parentReal === void 0) return;
   const rootReal = tryRealpath(planningRoot);
   if (rootReal === void 0) return;
@@ -7829,7 +8077,7 @@ function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   pruneEmptyAncestors(target, planningRoot);
 }
 function localDivergesFromPreDelete(target, pre, repoRel, repo) {
-  if (!existsSync38(target)) return false;
+  if (!existsSync39(target)) return false;
   try {
     const preBlob = gitCaptureBuffer(["show", `${pre}:${repoRel}`], repo);
     return !readFileSync19(target).equals(preBlob);
@@ -7874,7 +8122,7 @@ function keptDeletePreview(v, prePostHeads, repo) {
   return kept;
 }
 function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
-  const repoExtras = join53(repo, "shared", "extras");
+  const repoExtras = join56(repo, "shared", "extras");
   for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
     if (t.dirname !== ".planning") continue;
     let raw;
@@ -7889,14 +8137,14 @@ function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
     }
     const pairs = deletePairsFor(t, raw);
     if (pairs.length === 0) continue;
-    backupExtrasWrite(join53(t.localRoot, t.dirname), ts, t.localRoot);
-    const planningRoot = join53(t.localRoot, ".planning");
+    backupExtrasWrite(join56(t.localRoot, t.dirname), ts, t.localRoot);
+    const planningRoot = join56(t.localRoot, ".planning");
     for (const { target, relToLocal, repoRel } of pairs) {
       if (localDivergesFromPreDelete(target, prePostHeads.pre, repoRel, repo)) {
         warn(keptDeleteWarnLine(t.logical, relToLocal));
         continue;
       }
-      deletePlanningTarget(target, planningRoot, join53(repoExtras, t.logical, relToLocal));
+      deletePlanningTarget(target, planningRoot, join56(repoExtras, t.logical, relToLocal));
     }
   }
 }
@@ -7905,14 +8153,14 @@ function remapExtrasPush(ts, opts = {}) {
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
   const repo = repoHome();
-  const repoExtras = join53(repo, "shared", "extras");
+  const repoExtras = join56(repo, "shared", "extras");
   if (!dryRun) mkdirSync13(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname15 }) => ({
-      src: join53(localRoot, dirname15),
-      dst: join53(repoExtras, logical, dirname15)
+    ({ localRoot, logical, dirname: dirname16 }) => ({
+      src: join56(localRoot, dirname16),
+      dst: join56(repoExtras, logical, dirname16)
     }),
     (dst) => backupRepoWrite(dst, ts, repo),
     // Push copy routing per extra type:
@@ -7921,11 +8169,11 @@ function remapExtrasPush(ts, opts = {}) {
     //     The filter prevents ALWAYS_NEVER_SYNC files from landing in the repo
     //     working tree before the allow-list gate fires, eliminating the
     //     "residue wedges repeat push" regression. The allow-list gate
-    //     (enforceAllowList in commands.push.allowlist.ts, blockSetFor in
+    //     (enforceAllowList in commands/push/allowlist.ts, blockSetFor in
     //     config.never-sync.ts)
     //     remains the hard security boundary.
     //   All others: copyExtrasFiltered with per-extra denylist.
-    (src, dst, dirname15) => dirname15 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname15)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname15))
+    (src, dst, dirname16) => dirname16 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname16)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname16))
   );
   return { unmapped, skipped, pushed: done, wouldPush: would };
 }
@@ -7941,9 +8189,9 @@ function remapExtrasPull(ts, opts = {}) {
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname15 }) => ({
-      src: join53(repo, "shared", "extras", logical, dirname15),
-      dst: join53(localRoot, dirname15)
+    ({ localRoot, logical, dirname: dirname16 }) => ({
+      src: join56(repo, "shared", "extras", logical, dirname16),
+      dst: join56(localRoot, dirname16)
     }),
     // Snapshot the host-side dst BEFORE the copy step touches it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -7961,12 +8209,12 @@ function remapExtrasPull(ts, opts = {}) {
     //     copyExtrasFileSkipDiverged keeps a locally-edited file rather than
     //     clobbering it, so the divergence WARN's keep-local promise holds for
     //     every extra, not just `.planning`.
-    (src, dst, dirname15) => {
-      if (dirname15 === ".claude")
-        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname15));
-      if (dirname15 === ".planning") {
+    (src, dst, dirname16) => {
+      if (dirname16 === ".claude")
+        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname16));
+      if (dirname16 === ".planning") {
         const divergedSet = new Set(listDivergingModified(dst, src));
-        return copyExtrasOverlaySkipDiverged(src, dst, extrasDenySet(dirname15), divergedSet);
+        return copyExtrasOverlaySkipDiverged(src, dst, extrasDenySet(dirname16), divergedSet);
       }
       return copyExtrasFileSkipDiverged(src, dst);
     }
@@ -7977,7 +8225,7 @@ function remapExtrasPull(ts, opts = {}) {
   return { unmapped, skipped, pulled: done, wouldPull: would };
 }
 
-// src/extras-sync.ts
+// src/sync/extras/extras.ts
 function divergenceWarnLine(o) {
   const kind = o.isDir ? "folder" : "file";
   const name = o.isDir ? `${o.dirname}/` : o.dirname;
@@ -7990,20 +8238,20 @@ function divergenceCheckExtras(ts, prePostHeads) {
   const v = loadValidatedExtras({});
   if (v === null) return 0;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join54(backupBase(), ts, "extras");
+  const backupRoot = join57(backupBase(), ts, "extras");
   const repo = repoHome();
   let divergedCount = 0;
-  for (const { logical, localRoot, dirname: dirname15 } of eachExtrasTarget(v, counts)) {
-    const local = join54(localRoot, dirname15);
-    const repoEntry = join54(repo, "shared", "extras", logical, dirname15);
-    if (!existsSync39(local) || !existsSync39(repoEntry)) continue;
+  for (const { logical, localRoot, dirname: dirname16 } of eachExtrasTarget(v, counts)) {
+    const local = join57(localRoot, dirname16);
+    const repoEntry = join57(repo, "shared", "extras", logical, dirname16);
+    if (!existsSync40(local) || !existsSync40(repoEntry)) continue;
     const modified = listDivergingModified(local, repoEntry);
     if (modified.length === 0) continue;
     divergedCount += modified.length;
-    const projectBackupRoot = join54(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join57(backupRoot, encodePath(localRoot));
     warn(
       divergenceWarnLine({
-        dirname: dirname15,
+        dirname: dirname16,
         logical,
         isDir: statSync11(local).isDirectory(),
         count: modified.length,
@@ -8020,10 +8268,10 @@ function divergenceCheckExtras(ts, prePostHeads) {
   return divergedCount;
 }
 
-// src/links.baseline.ts
+// src/sync/links.baseline.ts
 init_config();
 import { lstatSync as lstatSync18, readdirSync as readdirSync18 } from "node:fs";
-import { join as join55, relative as relative8, sep as sep12 } from "node:path";
+import { join as join58, relative as relative8, sep as sep12 } from "node:path";
 init_utils();
 var SHARED_BASELINE_KIND = "shared-links-baseline/1";
 var SHARED_BASELINE_CONFIG_HASH = "not-applicable";
@@ -8065,7 +8313,7 @@ function collectSharedFiles(dir, claude, scan) {
     return;
   }
   for (const entry of entries) {
-    const abs = join55(dir, entry);
+    const abs = join58(dir, entry);
     if (isDeniedName(ALWAYS_NEVER_SYNC, entry)) {
       scan.declined.push(baselineKey(claude, abs));
       continue;
@@ -8081,7 +8329,7 @@ function enumerateLocalSharedScan(map, opts = {}) {
       scan.declined.push(name);
       continue;
     }
-    addLocalPath(join55(claude, name), claude, scan);
+    addLocalPath(join58(claude, name), claude, scan);
   }
   return scan;
 }
@@ -8093,7 +8341,7 @@ function buildSharedBaseline(map, opts = {}) {
   const files = {};
   for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map, opts))) {
     try {
-      files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join55(claude, key)) };
+      files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join58(claude, key)) };
     } catch {
     }
   }
@@ -8108,16 +8356,16 @@ function writeSharedBaseline(map, opts = {}) {
   }
 }
 
-// src/commands.pull.win32.ts
+// src/commands/pull/win32.ts
 init_color();
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join60 } from "node:path";
+import { existsSync as existsSync45 } from "node:fs";
+import { join as join63 } from "node:path";
 
-// src/commands.pull.recovery.git.ts
+// src/commands/pull/recovery.git.ts
 init_utils();
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 function gitCapture(args, cwd) {
-  return execFileSync21("git", args, {
+  return execFileSync22("git", args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     maxBuffer: 64 * 1024 * 1024
@@ -8152,30 +8400,13 @@ function parseDirtyPaths(repo, opts = {}) {
   return parsePorcelainZ(gitStatusPorcelainZ(repo, opts));
 }
 
-// src/commands.pull.win32.ts
+// src/commands/pull/win32.ts
 init_config();
 
-// src/git-probe.ts
-import { execFileSync as execFileSync22 } from "node:child_process";
-var PROBE_TIMEOUT_MS4 = 1e4;
-var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
-function gitProbe(args, repo) {
-  try {
-    return execFileSync22("git", args, {
-      cwd: repo,
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: PROBE_TIMEOUT_MS4,
-      maxBuffer: PROBE_MAX_BUFFER
-    }).toString();
-  } catch {
-    return null;
-  }
-}
-
-// src/links.deletions.ts
+// src/sync/links.deletions.ts
 init_config();
-import { existsSync as existsSync40, lstatSync as lstatSync19, rmSync as rmSync17 } from "node:fs";
-import { join as join56, relative as relative9, resolve as resolve5, sep as sep13 } from "node:path";
+import { existsSync as existsSync41, lstatSync as lstatSync19, rmSync as rmSync17 } from "node:fs";
+import { join as join59, relative as relative9, resolve as resolve5, sep as sep13 } from "node:path";
 init_utils();
 init_utils_fs();
 function isUnknown(declined, key) {
@@ -8185,15 +8416,15 @@ function deletionFor(key, names, claude, sharedRoot) {
   const segments = key.split("/");
   const name = segments[0];
   if (!names.has(name)) return null;
-  if (!existsSync40(join56(claude, name))) return null;
+  if (!existsSync41(join59(claude, name))) return null;
   if (segments.some((segment) => isDeniedName(ALWAYS_NEVER_SYNC, segment))) return null;
   const repoPath = resolve5(sharedRoot, key);
-  const rel = relative9(join56(sharedRoot, name), repoPath);
+  const rel = relative9(join59(sharedRoot, name), repoPath);
   if (rel === "" || rel === ".." || rel.startsWith(`..${sep13}`)) return null;
   if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
     return null;
-  if (!existsSync40(repoPath)) return null;
-  return { kind: "deletion", name, localPath: join56(claude, key), repoPath };
+  if (!existsSync41(repoPath)) return null;
+  return { kind: "deletion", name, localPath: join59(claude, key), repoPath };
 }
 function planSharedLinkDeletions(map, opts = {}) {
   if (process.platform !== "win32") return [];
@@ -8201,7 +8432,7 @@ function planSharedLinkDeletions(map, opts = {}) {
   const baseline = readSharedBaseline();
   if (baseline === null) return [];
   const claude = claudeHome();
-  const sharedRoot = join56(repoHome(), "shared");
+  const sharedRoot = join59(repoHome(), "shared");
   const linkNames = opts.linkNames ?? allSharedLinks(map);
   const scan = enumerateLocalSharedScan(map, { linkNames });
   const present = new Set(Object.keys(scan.files).map((key) => key.toLowerCase()));
@@ -8233,10 +8464,11 @@ function applySharedLinkDeletions(map, ts, opts = {}) {
   return removed;
 }
 
-// src/links.mirror.ts
+// src/sync/links.mirror.ts
 init_config();
-import { existsSync as existsSync41, lstatSync as lstatSync20, rmSync as rmSync18, statSync as statSync12 } from "node:fs";
-import { join as join57 } from "node:path";
+init_error_text();
+import { existsSync as existsSync42, lstatSync as lstatSync20, rmSync as rmSync18, statSync as statSync12 } from "node:fs";
+import { join as join60 } from "node:path";
 init_utils();
 init_utils_fs();
 function emitMirror(onPreview, name, localPath, repoPath) {
@@ -8250,7 +8482,7 @@ function emitMirrorWet(onPreview, name, localPath, repoPath) {
   if (onPreview) onPreview({ kind: "mirror", name, localPath, repoPath });
 }
 function notShared(target) {
-  return !existsSync41(target);
+  return !existsSync42(target);
 }
 function warnUnusableSharedTarget(name, dryRun, state) {
   const reason = state === "dangling" ? `shared/${name} does not resolve to anything usable in the sync repo. Remove it, or restore what it points at` : `shared/${name} could not be read in the sync repo, so whether it is usable could not be determined. Check its permissions there`;
@@ -8278,8 +8510,8 @@ function warnUnreadableLocalName(name, target, err, dryRun) {
   );
 }
 function mirrorOneSharedName(name, claude, repo, policy, opts) {
-  const localPath = join57(claude, name);
-  const target = join57(repo, "shared", name);
+  const localPath = join60(claude, name);
+  const target = join60(repo, "shared", name);
   let stat;
   try {
     stat = lstatSync20(localPath, { throwIfNoEntry: false });
@@ -8339,7 +8571,7 @@ function mirrorSharedNames(map, policy, opts = {}) {
   if (map === null) return;
   const claude = claudeHome();
   const repo = repoHome();
-  const sharedPath = join57(repo, "shared");
+  const sharedPath = join60(repo, "shared");
   const sharedState = classifyPresence(sharedPath);
   if (isUnusableTarget(sharedState)) {
     warnUnusableSharedDir(opts.dryRun === true, sharedState);
@@ -8368,7 +8600,7 @@ function presentAt(abs) {
   }
 }
 function removeUntrackedDenied(repo, path, segment, ts) {
-  const abs = join57(repo, path);
+  const abs = join60(repo, path);
   const denied = `the path segment "${segment}" is on the never-sync list`;
   if (!presentAt(abs)) {
     warn(
@@ -8376,7 +8608,7 @@ function removeUntrackedDenied(repo, path, segment, ts) {
     );
     return;
   }
-  const snapshotted = existsSync41(abs);
+  const snapshotted = existsSync42(abs);
   try {
     backupRepoWrite(abs, ts, repo);
   } catch (err) {
@@ -8402,19 +8634,19 @@ function reportTrackedDenied(repo, path, segment) {
   const denied = `the path segment "${segment}" is on the never-sync list`;
   if (inHead === null) {
     warn(
-      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it with "git status -- ${path}" and take it out of shared/ before committing`
+      `could not check ${path} against HEAD: ${denied}. Nothing was changed. Inspect it by running git status -- "${path}" and take it out of shared/ before committing`
     );
     return;
   }
   if (inHead.trim() === "") {
     warn(
-      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run "git rm --cached -- ${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, "git diff --cached --name-status" names the source, whose content IS committed, so restore that half with "git checkout HEAD -- <source>" rather than leaving its deletion staged`
+      `${path} is staged and has no committed version: ${denied}. Nothing was changed. Run git rm --cached -- "${path}" to take it out of the index; that leaves the file on disk but makes it untracked, which the next nomad pull removes from the sync repo working tree (snapshotting it into the backup cache first), so move it outside shared/ instead if you want to keep it. If it is the destination half of a staged rename, run git diff --cached --name-status to name the source, whose content IS committed, so restore that half with git checkout HEAD -- "<source>" rather than leaving its deletion staged`
     );
     return;
   }
-  if (!existsSync41(join57(repo, path))) return;
+  if (!existsSync42(join60(repo, path))) return;
   warn(
-    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run "git checkout HEAD -- ${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: "git rm -- ${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
+    `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run git checkout HEAD -- "${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: git rm -- "${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
   );
 }
 function revertDeniedMirrorPaths(repo, status, ts) {
@@ -8428,10 +8660,10 @@ function revertDeniedMirrorPaths(repo, status, ts) {
   }
 }
 
-// src/preview.ts
+// src/render/preview.ts
 init_config();
-import { existsSync as existsSync43 } from "node:fs";
-import { join as join59 } from "node:path";
+import { existsSync as existsSync44 } from "node:fs";
+import { join as join62 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -8683,7 +8915,7 @@ function tokenize(value, options) {
   return retLines;
 }
 
-// src/diff-lines.ts
+// src/render/diff-lines.ts
 init_color();
 function diffLinesToUnified(oldStr, newStr) {
   const parts = diffLines(oldStr, newStr);
@@ -8704,18 +8936,18 @@ function diffLinesToUnified(oldStr, newStr) {
   return lines;
 }
 
-// src/preview.skills.ts
+// src/render/preview.skills.ts
 init_config();
-import { existsSync as existsSync42, readdirSync as readdirSync19 } from "node:fs";
-import { join as join58 } from "node:path";
+import { existsSync as existsSync43, readdirSync as readdirSync19 } from "node:fs";
+import { join as join61 } from "node:path";
 function buildSkillsPreviewSection() {
   const s = section("Skills");
-  const sharedSkills = join58(repoHome(), "shared", "skills");
-  if (!existsSync42(sharedSkills)) return s;
+  const sharedSkills = join61(repoHome(), "shared", "skills");
+  if (!existsSync43(sharedSkills)) return s;
   const sharedNames = readdirSync19(sharedSkills, { encoding: "utf8" }).filter((name) => !isSkillExcluded(name)).sort((a, b) => a.localeCompare(b, "en"));
   for (const name of sharedNames) addItem(s, name);
-  const localSkills = join58(claudeHome(), "skills");
-  const localOnly = existsSync42(localSkills) ? readdirSync19(localSkills, { encoding: "utf8" }).filter(
+  const localSkills = join61(claudeHome(), "skills");
+  const localOnly = existsSync43(localSkills) ? readdirSync19(localSkills, { encoding: "utf8" }).filter(
     (name) => !isSkillExcluded(name) && !sharedNames.includes(name)
   ).length : 0;
   if (localOnly > 0) {
@@ -8724,7 +8956,7 @@ function buildSkillsPreviewSection() {
   return s;
 }
 
-// src/preview.ts
+// src/render/preview.ts
 init_utils_json();
 var CANONICAL_ORDER_NOTE = "settings.json will be rewritten in canonical key order; no value changes";
 function diffJsonStrings(currentJsonText, newJsonText) {
@@ -8737,7 +8969,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync43(path)) return null;
+  if (!existsSync44(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -8751,12 +8983,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync43(hostPath)) {
+  if (hostOverrides === null && existsSync44(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = stripGsdHookEntries(deepMerge(base, hostOverrides ?? {}));
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync43(settingsPath)) {
+  if (current === null && existsSync44(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const strippedCurrent = stripGsdHookEntries(current ?? {});
@@ -8823,9 +9055,9 @@ function computePreview(ts, map, verb = "pull", plans) {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join59(repo, "shared", "settings.base.json"),
-    join59(repo, "hosts", `${HOST}.json`),
-    join59(claude, "settings.json")
+    join62(repo, "shared", "settings.base.json"),
+    join62(repo, "hosts", `${HOST}.json`),
+    join62(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -8841,7 +9073,7 @@ function computePreview(ts, map, verb = "pull", plans) {
   const extras = section("Extras");
   let extrasSkipped = 0;
   let extrasUnmapped = 0;
-  if (existsSync43(join59(repo, "path-map.json")) && existsSync43(join59(repo, "shared", "extras"))) {
+  if (existsSync44(join62(repo, "path-map.json")) && existsSync44(join62(repo, "shared", "extras"))) {
     const extrasResult = remapExtrasPull(ts, { dryRun: true });
     for (const entry of extrasResult.wouldPull) {
       addItem(extras, entry);
@@ -8858,11 +9090,11 @@ function computePreview(ts, map, verb = "pull", plans) {
   return { unmapped: remapResult.unmapped, collisions: 0, localOnly };
 }
 
-// src/commands.pull.win32.ts
+// src/commands/pull/win32.ts
 init_utils();
 init_utils_json();
 function readMapForMirror(mapPath) {
-  if (!existsSync44(mapPath)) return { projects: {} };
+  if (!existsSync45(mapPath)) return { projects: {} };
   try {
     return readPathMap(mapPath);
   } catch {
@@ -8926,7 +9158,7 @@ function reconcileSharedLinksBeforePull(repo, ts) {
   let namesDerived = false;
   let derivedSharedDirs;
   try {
-    const map = readMapForMirror(join60(repo, "path-map.json"));
+    const map = readMapForMirror(join63(repo, "path-map.json"));
     if (map !== null) {
       linkNames = allSharedLinks(map);
       namesDerived = true;
@@ -8965,7 +9197,7 @@ function buildMirrorSection(events, discard) {
 function describeSkippedMirrorDiscard(repo, ts) {
   if (process.platform !== "win32") return null;
   try {
-    const map = readMapForMirror(join60(repo, "path-map.json"));
+    const map = readMapForMirror(join63(repo, "path-map.json"));
     const linkNames = map !== null ? allSharedLinks(map, { quiet: true }) : void 0;
     const captures = [];
     stageLocalSharedEdits(map, ts, {
@@ -8974,13 +9206,13 @@ function describeSkippedMirrorDiscard(repo, ts) {
       linkNames
     });
     if (captures.length === 0) return null;
-    return { count: captures.length, backupPath: join60(backupBase(), ts) };
+    return { count: captures.length, backupPath: join63(backupBase(), ts) };
   } catch {
     return null;
   }
 }
 function planSharedReconcileBeforePull(repo, ts) {
-  const map = readMapForMirror(join60(repo, "path-map.json"));
+  const map = readMapForMirror(join63(repo, "path-map.json"));
   const captures = [];
   const linkNames = process.platform === "win32" && map !== null ? allSharedLinks(map) : void 0;
   stageLocalSharedEdits(map, ts, { dryRun: true, onPreview: (e) => captures.push(e), linkNames });
@@ -8992,11 +9224,11 @@ function planSharedReconcileBeforePull(repo, ts) {
   };
 }
 
-// src/commands.pull.collision.ts
+// src/commands/pull/collision.ts
 init_config();
 init_exit_codes();
-import { existsSync as existsSync45, lstatSync as lstatSync21, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
-import { join as join61 } from "node:path";
+import { existsSync as existsSync46, lstatSync as lstatSync21, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
+import { join as join64 } from "node:path";
 init_utils();
 var SHARED_PREFIX = /^shared\//;
 var EXTENSION = /(\.[^.]+)?$/;
@@ -9052,15 +9284,15 @@ function isContainedMirrorPath(rel) {
 }
 function matchesLocalOriginal(repo, rel) {
   try {
-    const local = join61(claudeHome(), rel.replace(SHARED_PREFIX, ""));
-    return readFileSync20(join61(repo, rel)).equals(readFileSync20(local));
+    const local = join64(claudeHome(), rel.replace(SHARED_PREFIX, ""));
+    return readFileSync20(join64(repo, rel)).equals(readFileSync20(local));
   } catch {
     return false;
   }
 }
 function removeMirroredCopies(repo, repoRelPaths) {
   for (const rel of repoRelPaths.filter(isContainedMirrorPath)) {
-    const abs = join61(repo, rel);
+    const abs = join64(repo, rel);
     try {
       if (lstatSync21(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
       if (!matchesLocalOriginal(repo, rel)) continue;
@@ -9069,7 +9301,7 @@ function removeMirroredCopies(repo, repoRelPaths) {
       warn(`could not remove nomad's copy at ${abs}: ${err.message}`);
     }
   }
-  return repoRelPaths.every((rel) => !existsSync45(join61(repo, rel)));
+  return repoRelPaths.every((rel) => !existsSync46(join64(repo, rel)));
 }
 function pullWithCollisionRunbook(repo, mirrored) {
   try {
@@ -9084,10 +9316,10 @@ function pullWithCollisionRunbook(repo, mirrored) {
   }
 }
 
-// src/commands.pull.ts
-init_commands_pull_wedge();
+// src/commands/pull/pull.ts
+init_wedge();
 
-// src/commands.pull.recovery.ts
+// src/commands/pull/recovery.ts
 init_config();
 init_utils();
 init_utils_fs();
@@ -9181,9 +9413,9 @@ an ordinary pull.
   log(buildRecoverySummary(branchName, strandedLog, untracked));
 }
 
-// src/commands.pull.recovery.unmerged.ts
+// src/commands/pull/recovery.unmerged.ts
 init_exit_codes();
-init_commands_pull_wedge();
+init_wedge();
 init_utils();
 function recoverUnmergedIndex(repo) {
   const conflicted = new Set(
@@ -9206,7 +9438,7 @@ function recoverUnmergedIndex(repo) {
   }
 }
 
-// src/commands.pull.ts
+// src/commands/pull/pull.ts
 init_exit_codes();
 init_utils();
 init_utils_fs();
@@ -9276,7 +9508,7 @@ function runPullCore(opts = {}) {
   try {
     return runPullWithBackupTs(ts, opts);
   } finally {
-    discardEmptyBackupDir(join62(backup, ts));
+    discardEmptyBackupDir(join65(backup, ts));
   }
 }
 function runPullWithBackupTs(ts, opts) {
@@ -9287,7 +9519,7 @@ function runPullWithBackupTs(ts, opts) {
   const backup = backupBase();
   const recovered = handleWedge(repo, forceRemote);
   if (!dryRun) {
-    const backupRoot = join62(backup, ts);
+    const backupRoot = join65(backup, ts);
     try {
       mkdirSync14(backupRoot, { recursive: true });
     } catch (err) {
@@ -9310,8 +9542,8 @@ function runPullWithBackupTs(ts, opts) {
     pullWithCollisionRunbook(repo, mirrored);
   });
   assertNoAutostashConflict(repo, "nomad pull");
-  const mapPath = join62(repo, "path-map.json");
-  const map = existsSync46(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join65(repo, "path-map.json");
+  const map = existsSync47(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
     computePreview(ts, map, "pull", plansAgainst(sharedPlans, map));
@@ -9338,8 +9570,8 @@ function runPullWithBackupTs(ts, opts) {
 }
 function cmdPull(opts = {}) {
   const repo = repoHome();
-  if (!existsSync46(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync46(join62(repo, "shared", "settings.base.json"))) {
+  if (!existsSync47(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync47(join65(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -9360,15 +9592,15 @@ function cmdPull(opts = {}) {
   }
 }
 
-// src/commands.push.ts
+// src/commands/push/push.ts
 init_config();
-import { existsSync as existsSync50 } from "node:fs";
-import { join as join67 } from "node:path";
+import { existsSync as existsSync51 } from "node:fs";
+import { join as join70 } from "node:path";
 
-// src/commands.push.selection.ts
+// src/commands/push/selection.ts
 init_config();
-import { existsSync as existsSync47, statSync as statSync13 } from "node:fs";
-import { join as join63 } from "node:path";
+import { existsSync as existsSync48, statSync as statSync13 } from "node:fs";
+import { join as join66 } from "node:path";
 init_utils_json();
 function buildCurrentMap(map) {
   const current = {};
@@ -9377,8 +9609,8 @@ function buildCurrentMap(map) {
   for (const [, hostMap] of Object.entries(map.projects)) {
     const localPath = hostMap[HOST];
     if (!localPath) continue;
-    const localDir = join63(claude, "projects", encodePath(localPath));
-    if (!existsSync47(localDir)) continue;
+    const localDir = join66(claude, "projects", encodePath(localPath));
+    if (!existsSync48(localDir)) continue;
     for (const f of enumerateSourceFiles(localDir)) {
       const st = statSync13(f);
       current[f] = { size: st.size, mtime: st.mtimeMs };
@@ -9409,7 +9641,7 @@ function computePushSelection(map, old, scannerVersion, configHash, fullScan) {
   };
 }
 function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan) {
-  const map = existsSync47(mapPath) ? readPathMap(mapPath) : null;
+  const map = existsSync48(mapPath) ? readPathMap(mapPath) : null;
   const { selection, newManifest } = computePushSelection(
     map,
     old,
@@ -9420,7 +9652,7 @@ function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan
   return { map, selection, newManifest };
 }
 
-// src/commands.push.allowlist.ts
+// src/commands/push/allowlist.ts
 init_config();
 init_config_sharedDirs_guard();
 init_utils();
@@ -9495,21 +9727,21 @@ function enforceAllowList(statusPorcelain, map) {
     fail(`${p} is in NEVER_SYNC and must never be pushed`);
   }
   for (const p of violations) {
-    fail(`to sync ${p}, add to PUSH_ALLOWED in src/config.ts`);
+    fail(`to sync ${p}, add to PUSH_ALLOWED in src/core/config.ts`);
   }
   throw new NomadFatal("push allow-list violations");
 }
 
-// src/commands.push.settings.ts
+// src/commands/push/settings.ts
 init_config();
-import { existsSync as existsSync48 } from "node:fs";
-import { join as join64 } from "node:path";
+import { existsSync as existsSync49 } from "node:fs";
+import { join as join67 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function stripGsdHooksFromBase(repo, backup) {
-  const basePath = join64(repo, "shared", "settings.base.json");
-  if (!existsSync48(basePath)) return;
+  const basePath = join67(repo, "shared", "settings.base.json");
+  if (!existsSync49(basePath)) return;
   let base;
   try {
     base = readJson(basePath);
@@ -9523,14 +9755,14 @@ function stripGsdHooksFromBase(repo, backup) {
   writeJsonAtomic(basePath, stripped);
 }
 function reportSettingsAheadDrift(repo) {
-  const basePath = join64(repo, "shared", "settings.base.json");
-  if (!existsSync48(basePath)) return;
-  const settingsPath = join64(claudeHome(), "settings.json");
-  if (!existsSync48(settingsPath)) return;
+  const basePath = join67(repo, "shared", "settings.base.json");
+  if (!existsSync49(basePath)) return;
+  const settingsPath = join67(claudeHome(), "settings.json");
+  if (!existsSync49(settingsPath)) return;
   try {
     const base = readJson(basePath);
-    const hostPath = join64(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync48(hostPath) ? readJson(hostPath) : {};
+    const hostPath = join67(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync49(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
     const { ahead } = classifySettingsDrift(merged, settings);
@@ -9544,12 +9776,12 @@ function reportSettingsAheadDrift(repo) {
   }
 }
 
-// src/commands.push.guards.ts
-init_push_checks();
+// src/commands/push/guards.ts
+init_checks();
 init_utils();
-import { join as join65, relative as relative10 } from "node:path";
+import { join as join68, relative as relative10 } from "node:path";
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join65(repo, "shared"));
+  const gitlinks = findGitlinks(join68(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative10(repo, p).replaceAll("\\", "/");
@@ -9576,10 +9808,10 @@ function guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule) {
   }
 }
 
-// src/commands.push.steps.ts
+// src/commands/push/steps.ts
 init_config();
 
-// src/push-global-config.ts
+// src/commands/push/global-config.ts
 init_config();
 import { execFileSync as execFileSync23 } from "node:child_process";
 var STATUS_LABELS = {
@@ -9651,19 +9883,19 @@ function collectGlobalConfigChanges(repoHome2, hostname2, opts) {
   return changes;
 }
 
-// src/commands.push.steps.ts
-init_push_leak_verdict();
+// src/commands/push/steps.ts
+init_leak_verdict();
 
-// src/push-preview.ts
+// src/commands/push/preview.ts
 init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync22, mkdirSync as mkdirSync15, readdirSync as readdirSync20, rmSync as rmSync20 } from "node:fs";
+import { copyFileSync, existsSync as existsSync50, lstatSync as lstatSync22, mkdirSync as mkdirSync15, readdirSync as readdirSync20, rmSync as rmSync20 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join66, relative as relative11, sep as sep14 } from "node:path";
-init_push_leak_verdict();
-init_push_gitleaks();
+import { join as join69, relative as relative11, sep as sep14 } from "node:path";
+init_leak_verdict();
+init_gitleaks();
 init_utils_fs();
 init_utils_json();
 var NOTHING_TO_SCAN_ROW = `${dim(infoGlyph)} nothing to scan, no leaks`;
@@ -9673,7 +9905,7 @@ function stageSessionDir(localDir, dstDir, changed) {
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
-      copyFileAtomic(src, join66(dstDir, relative11(localDir, src)));
+      copyFileAtomic(src, join69(dstDir, relative11(localDir, src)));
     }
     return true;
   }
@@ -9689,14 +9921,14 @@ function stageSessions(tmpRoot, map, changed) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join66(claudeHome(), "projects");
-  if (!existsSync49(localProjects)) return 0;
+  const localProjects = join69(claudeHome(), "projects");
+  if (!existsSync50(localProjects)) return 0;
   let staged = 0;
   for (const dir of readdirSync20(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    const localDir = join66(localProjects, dir);
-    const dstDir = join66(tmpRoot, "shared", "projects", logical);
+    const localDir = join69(localProjects, dir);
+    const dstDir = join69(tmpRoot, "shared", "projects", logical);
     if (stageSessionDir(localDir, dstDir, changed)) staged++;
   }
   return staged;
@@ -9710,11 +9942,11 @@ function stageExtras(tmpRoot, map) {
     assertSafeLogical(logical);
     const localRoot = map.projects[logical]?.[HOST];
     if (!localRoot || localRoot === "TBD") continue;
-    for (const dirname15 of dirnames) {
-      if (!whitelist.includes(dirname15)) continue;
-      const src = join66(localRoot, dirname15);
-      if (!existsSync49(src)) continue;
-      const dst = join66(tmpRoot, "shared", "extras", logical, dirname15);
+    for (const dirname16 of dirnames) {
+      if (!whitelist.includes(dirname16)) continue;
+      const src = join69(localRoot, dirname16);
+      if (!existsSync50(src)) continue;
+      const dst = join69(tmpRoot, "shared", "extras", logical, dirname16);
       copyExtras(src, dst);
       staged++;
     }
@@ -9722,19 +9954,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function stageSkills(tmpRoot) {
-  const localSkills = join66(claudeHome(), "skills");
+  const localSkills = join69(claudeHome(), "skills");
   const stat = lstatSync22(localSkills, { throwIfNoEntry: false });
   if (stat === void 0 || stat.isSymbolicLink()) return 0;
   const names = readdirSync20(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
   if (names.length === 0) return 0;
-  copySkillsPush(localSkills, join66(tmpRoot, "shared", "skills"));
+  copySkillsPush(localSkills, join69(tmpRoot, "shared", "skills"));
   return names.length;
 }
 function previewPushLeaks(map, opts = {}) {
-  const cacheDir = join66(homedir7(), ".cache", "claude-nomad");
+  const cacheDir = join69(homedir7(), ".cache", "claude-nomad");
   mkdirSync15(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes4(4).toString("hex")}`;
-  const tmpRoot = join66(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join69(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map, opts.selection?.changed);
     const extrasCount = stageExtras(tmpRoot, map);
@@ -9742,9 +9974,9 @@ function previewPushLeaks(map, opts = {}) {
     if (sessionCount + extrasCount + skillCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join66(repoHome(), ".gitleaksignore");
-    if (existsSync49(ignoreFile)) {
-      copyFileSync(ignoreFile, join66(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join69(repoHome(), ".gitleaksignore");
+    if (existsSync50(ignoreFile)) {
+      copyFileSync(ignoreFile, join69(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -9761,7 +9993,7 @@ function previewPushLeaks(map, opts = {}) {
   }
 }
 
-// src/commands.push.steps.ts
+// src/commands/push/steps.ts
 init_utils();
 async function commitAndPush(st, ts, map, resolution, repo, newManifest, render) {
   gitOrFatal(["add", "-A"], "git add", repo);
@@ -9813,8 +10045,8 @@ function runDryRunPreview(st, map, repo, selection) {
   if (verdict.recovery !== null) fail(verdict.recovery);
 }
 
-// src/commands.push.ts
-init_push_checks();
+// src/commands/push/push.ts
+init_checks();
 init_utils();
 init_utils_fs();
 function aheadOfUpstream(repo) {
@@ -9872,7 +10104,7 @@ async function runPushCore(opts = {}) {
   const scannerVersion = probeGitleaks();
   const configHash = computeConfigHash();
   const old = readManifest(manifestPath());
-  const mapPath = join67(repo, "path-map.json");
+  const mapPath = join70(repo, "path-map.json");
   const { map, selection, newManifest } = loadSelectionForPush(
     mapPath,
     old,
@@ -9925,7 +10157,7 @@ async function cmdPush(opts = {}) {
     opts.allowRule
   );
   const repo = repoHome();
-  if (!existsSync50(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync51(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -9942,9 +10174,9 @@ async function cmdPush(opts = {}) {
   }
 }
 
-// src/commands.sync.ts
-import { existsSync as existsSync51 } from "node:fs";
-import { join as join68 } from "node:path";
+// src/commands/sync.ts
+import { existsSync as existsSync52 } from "node:fs";
+import { join as join71 } from "node:path";
 init_config();
 init_color();
 init_utils();
@@ -10085,8 +10317,8 @@ async function cmdSync(opts = {}) {
   const dryRun = opts.dryRun === true;
   const verbose = opts.verbose === true;
   const repo = repoHome();
-  if (!existsSync51(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync51(join68(repo, "shared", "settings.base.json"))) {
+  if (!existsSync52(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync52(join71(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("sync");
@@ -10109,9 +10341,11 @@ async function cmdSync(opts = {}) {
   }
 }
 
-// src/commands.update.ts
-import { execFileSync as execFileSync24 } from "node:child_process";
+// src/commands/update.ts
 init_utils();
+import { execFileSync as execFileSync24 } from "node:child_process";
+var RELEASE_NOTES_TAG_URL = "https://github.com/funkadelic/claude-nomad/releases/tag";
+var SEMVER = /^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/;
 function readInstalledVersion(run = execFileSync24) {
   const isWin = process.platform === "win32";
   try {
@@ -10123,6 +10357,10 @@ function readInstalledVersion(run = execFileSync24) {
     return null;
   }
 }
+function readOwnVersion(run) {
+  const version = readInstalledVersion(run);
+  return version !== null && SEMVER.test(version) ? version : null;
+}
 function cmdUpdate(currentVersion, run = execFileSync24) {
   console.log(`Updating claude-nomad v${currentVersion}...`);
   const isWin = process.platform === "win32";
@@ -10146,26 +10384,27 @@ function cmdUpdate(currentVersion, run = execFileSync24) {
 ${detail}` : "";
     throw new NomadFatal(`npm update -g claude-nomad failed: ${e.message}${suffix}`);
   }
-  const version = readInstalledVersion(run);
+  const version = readOwnVersion(run);
   if (!version) {
     console.log('Update complete. Run "nomad --version" to confirm the new version.');
-  } else if (version === currentVersion) {
-    console.log(`claude-nomad is already at the latest version (v${version}).`);
-  } else {
-    console.log(`claude-nomad is now at v${version}`);
+    return;
   }
+  console.log(
+    version === currentVersion ? `claude-nomad is already at the latest version (v${version}).` : `claude-nomad is now at v${version}`
+  );
+  console.log(`Release notes: ${RELEASE_NOTES_TAG_URL}/v${version}`);
 }
 
 // src/nomad.ts
 init_config();
 
-// src/crash-report.write.ts
+// src/core/crash-report.write.ts
 init_config();
 import { randomBytes as randomBytes5 } from "node:crypto";
 import { mkdirSync as mkdirSync16, readdirSync as readdirSync21, statSync as statSync14, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join70 } from "node:path";
+import { join as join73 } from "node:path";
 
-// src/crash-report.ts
+// src/core/crash-report.ts
 var CRASH_MAX_STACK_LINES = 50;
 var CRASH_MAX_ARGV = 32;
 var CRASH_MAX_ARGV_TOKEN_LENGTH = 200;
@@ -10245,18 +10484,18 @@ function buildCrashReport(input) {
   return truncateToBytes(scrubbed, CRASH_MAX_REPORT_BYTES);
 }
 
-// src/crash-report.redact.ts
+// src/core/crash-report.redact.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync21, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join69 } from "node:path";
-init_push_gitleaks_scan();
+import { join as join72 } from "node:path";
+init_gitleaks_scan();
 var CRASH_SCAN_TIMEOUT_MS = 3e3;
 var SCAN_UNAVAILABLE_ADVISORY = "\n\n[gitleaks value-based scan unavailable; only structural redaction applied. Review before sharing this file publicly.]\n";
 function redactWithGitleaks(text, scan = scanFile) {
   let dir;
   try {
-    dir = mkdtempSync3(join69(tmpdir2(), "nomad-crash-scan-"));
-    const tmp = join69(dir, "crash.txt");
+    dir = mkdtempSync3(join72(tmpdir2(), "nomad-crash-scan-"));
+    const tmp = join72(dir, "crash.txt");
     writeFileSync10(tmp, text, { mode: 384 });
     const findings = scan(tmp, false, CRASH_SCAN_TIMEOUT_MS);
     if (findings === null) return text + SCAN_UNAVAILABLE_ADVISORY;
@@ -10273,7 +10512,7 @@ function redactWithGitleaks(text, scan = scanFile) {
   }
 }
 
-// src/crash-report.write.ts
+// src/core/crash-report.write.ts
 init_utils_fs();
 init_utils();
 var CRASH_RETENTION_KEEP = 20;
@@ -10281,7 +10520,7 @@ function listCrashFiles(dir = crashDir()) {
   try {
     return readdirSync21(dir).flatMap((name) => {
       try {
-        return [{ name, mtimeMs: statSync14(join70(dir, name)).mtimeMs }];
+        return [{ name, mtimeMs: statSync14(join73(dir, name)).mtimeMs }];
       } catch {
         return [];
       }
@@ -10295,7 +10534,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
   const targets = prunableByCount(files, keep);
   for (const name of targets) {
     try {
-      unlinkSync2(join70(dir, name));
+      unlinkSync2(join73(dir, name));
     } catch {
     }
   }
@@ -10303,7 +10542,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
 function writeCrashReport(text, dir = crashDir()) {
   mkdirSync16(dir, { recursive: true, mode: 448 });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes5(4).toString("hex")}`;
-  const path = join70(dir, `crash-${stamp}.txt`);
+  const path = join73(dir, `crash-${stamp}.txt`);
   writeFileSync11(path, text, { mode: 384 });
   pruneCrashDir(dir);
   return path;
@@ -10333,20 +10572,20 @@ function handleCrash(err, argv, opts) {
   }
 }
 
-// src/diff.ts
+// src/commands/diff.ts
 init_config();
-import { existsSync as existsSync52 } from "node:fs";
-import { join as join71 } from "node:path";
+import { existsSync as existsSync53 } from "node:fs";
+import { join as join74 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync52(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync53(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join71(repo, "path-map.json");
-    const map = existsSync52(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join74(repo, "path-map.json");
+    const map = existsSync53(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     computePreview(ts, map, "diff");
   } catch (err) {
@@ -10359,12 +10598,12 @@ function cmdDiff() {
   }
 }
 
-// src/init.ts
+// src/commands/init/init.ts
 init_config();
-import { existsSync as existsSync54, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join73 } from "node:path";
+import { existsSync as existsSync55, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join76 } from "node:path";
 
-// src/init.gh-onboard.ts
+// src/commands/init/gh-onboard.ts
 init_config();
 import { execFileSync as execFileSync25 } from "node:child_process";
 init_utils();
@@ -10439,44 +10678,44 @@ function ensureOriginRepo(repoName, run = execFileSync25) {
   log(`created private repo ${owner}/${repoName} and wired origin`);
 }
 
-// src/init.snapshot.ts
+// src/commands/init/snapshot.ts
 init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync9, existsSync as existsSync53, rmSync as rmSync22, statSync as statSync15 } from "node:fs";
-import { join as join72 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync9, existsSync as existsSync54, rmSync as rmSync22, statSync as statSync15 } from "node:fs";
+import { join as join75 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join72(claude, name);
-    if (!existsSync53(src)) continue;
-    const dst = join72(repo, "shared", name);
+    const src = join75(claude, name);
+    if (!existsSync54(src)) continue;
+    const dst = join75(repo, "shared", name);
     if (statSync15(src).isDirectory()) {
-      const gk = join72(dst, ".gitkeep");
-      if (existsSync53(gk)) rmSync22(gk);
+      const gk = join75(dst, ".gitkeep");
+      if (existsSync54(gk)) rmSync22(gk);
       cpSync9(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join72(claude, "settings.json");
-  if (existsSync53(userSettings)) {
+  const userSettings = join75(claude, "settings.json");
+  if (existsSync54(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join72(repo, "hosts", `${HOST}.json`);
+    const hostFile = join75(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
 }
 
-// src/init.ts
+// src/commands/init/init.ts
 init_utils();
 init_utils_fs();
 var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.claude/CLAUDE.md by nomad pull -->\n";
@@ -10484,14 +10723,14 @@ var GITATTRIBUTES = "# nomad: sync content is byte-managed, disable all line-end
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join73(repoHome2, "shared", "settings.base.json"),
-    join73(repoHome2, "shared", "CLAUDE.md"),
-    join73(repoHome2, "path-map.json"),
-    join73(repoHome2, "hosts"),
-    join73(repoHome2, "shared")
+    join76(repoHome2, "shared", "settings.base.json"),
+    join76(repoHome2, "shared", "CLAUDE.md"),
+    join76(repoHome2, "path-map.json"),
+    join76(repoHome2, "hosts"),
+    join76(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync54(c)) return c;
+    if (existsSync55(c)) return c;
   }
   return null;
 }
@@ -10509,27 +10748,27 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync17(join73(repo, "shared"), { recursive: true });
-  mkdirSync17(join73(repo, "hosts"), { recursive: true });
+  mkdirSync17(join76(repo, "shared"), { recursive: true });
+  mkdirSync17(join76(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync17(join73(repo, "shared", name), { recursive: true });
+    mkdirSync17(join76(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join73(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync54(userClaudeMd)) {
-    writeFileSync12(join73(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join76(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync55(userClaudeMd)) {
+    writeFileSync12(join76(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync12(join73(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync12(join76(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync12(join73(repo, "hosts", ".gitkeep"), "");
+  writeFileSync12(join76(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join73(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join76(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join73(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join76(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
-  writeFileSync12(join73(repo, ".gitattributes"), GITATTRIBUTES);
+  writeFileSync12(join76(repo, ".gitattributes"), GITATTRIBUTES);
   item("created .gitattributes");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -10592,14 +10831,14 @@ function maybeDisableRepoActions(repoHome2, run) {
   }
 }
 
-// src/init.prompt.ts
+// src/commands/init/prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync55, readdirSync as readdirSync22, statSync as statSync16 } from "node:fs";
-import { join as join74 } from "node:path";
+import { existsSync as existsSync56, readdirSync as readdirSync22, statSync as statSync16 } from "node:fs";
+import { join as join77 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync55(path)) return false;
+  if (!existsSync56(path)) return false;
   try {
     if (statSync16(path).isDirectory()) return readdirSync22(path).length > 0;
     return true;
@@ -10608,8 +10847,8 @@ function nonEmptyExists(path) {
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync55(join74(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join74(claudeHome2, name)));
+  if (existsSync56(join77(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join77(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -10633,7 +10872,7 @@ async function resolveSnapshotChoice(flagSnapshot, claudeHome2, confirm = confir
   return confirm(claudeHome2);
 }
 
-// src/nomad.dispatch.helpers.ts
+// src/cli/dispatch.helpers.ts
 var REJECT = { ok: false, advance: 0 };
 function applyBool(seen, set) {
   if (seen) return REJECT;
@@ -10646,7 +10885,7 @@ function extractFlagValue(argv, i) {
   return val;
 }
 
-// src/nomad.dispatch.clean.ts
+// src/cli/dispatch.clean.ts
 function applyOlderThan(argv, i, st) {
   if (st.olderThan !== void 0) return REJECT;
   const val = extractFlagValue(argv, i);
@@ -10693,7 +10932,7 @@ function parseCleanArgs(argv) {
   return { dryRun: st.dryRun, olderThan: st.olderThan, keep: st.keep };
 }
 
-// src/nomad.dispatch.capture-settings.ts
+// src/cli/dispatch.capture-settings.ts
 function parseCaptureSettingsArgs(argv) {
   let host = false;
   let dryRun = false;
@@ -10718,7 +10957,7 @@ function parseCaptureSettingsArgs(argv) {
   return { host, dryRun, yes };
 }
 
-// src/nomad.dispatch.eject.ts
+// src/cli/dispatch.eject.ts
 function parseEjectArgs(argv) {
   let dryRun = false;
   let i = 3;
@@ -10735,7 +10974,7 @@ function parseEjectArgs(argv) {
   return { dryRun };
 }
 
-// src/nomad.dispatch.ts
+// src/cli/dispatch.ts
 function applyInitToken(argv, i, st) {
   const token = argv[i];
   if (token === "--snapshot") {
@@ -10808,7 +11047,7 @@ function parseRedactArgs(argv) {
   return { id, rule, dryRun };
 }
 
-// src/nomad.dispatch.allow.ts
+// src/cli/dispatch.allow.ts
 function parseAllowArgs(argv) {
   const positionals = argv.slice(3);
   if (positionals.length === 0) return null;
@@ -10818,7 +11057,7 @@ function parseAllowArgs(argv) {
   return positionals;
 }
 
-// src/nomad.dispatch.pull.ts
+// src/cli/dispatch.pull.ts
 function parsePullArgs(argv) {
   let dryRun = false;
   let forceRemote = false;
@@ -10840,7 +11079,7 @@ function parsePullArgs(argv) {
   return { dryRun, forceRemote };
 }
 
-// src/nomad.dispatch.push.ts
+// src/cli/dispatch.push.ts
 var RULE_ID_RE = /^\w[\w-]*$/;
 function applyAllow(argv, i, st) {
   if (st.allowRule !== void 0) return REJECT;
@@ -10893,7 +11132,7 @@ function parsePushArgs(argv) {
   };
 }
 
-// src/nomad.dispatch.sync.ts
+// src/cli/dispatch.sync.ts
 function parseSyncArgs(argv) {
   let dryRun = false;
   let verbose = false;
@@ -10916,7 +11155,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.67.3",
+  version: "0.69.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -10983,7 +11222,8 @@ var package_default = {
   overrides: {
     "@conventional-changelog/git-client": {
       "conventional-commits-parser": "^7.0.0"
-    }
+    },
+    "smol-toml": "^1.7.1"
   },
   devDependencies: {
     "@commitlint/cli": "^21.0.1",
@@ -10992,7 +11232,7 @@ var package_default = {
     "@stryker-mutator/core": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@vitest/coverage-v8": "^5.0.0",
     "conventional-changelog-conventionalcommits": "^10.2.1",
     diff: "^9.0.0",
     esbuild: "^0.28.0",
@@ -11008,11 +11248,11 @@ var package_default = {
     prettier: "^3.8.3",
     typescript: "^6.0.3",
     "typescript-eslint": "^8.59.4",
-    vitest: "^4.1.6"
+    vitest: "^5.0.0"
   }
 };
 
-// src/nomad.help.ts
+// src/cli/help.ts
 var DESC_COL = 26;
 var row = (label, desc) => label.padEnd(DESC_COL) + desc;
 var cont = (text) => " ".repeat(DESC_COL) + text;
@@ -11160,19 +11400,19 @@ var DEFAULT_HELP = [
   "every pull)."
 ].join("\n");
 
-// src/resume.ts
+// src/sync/resume.ts
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync56, readFileSync as readFileSync21, readdirSync as readdirSync23 } from "node:fs";
-import { join as join75 } from "node:path";
+import { existsSync as existsSync57, readFileSync as readFileSync21, readdirSync as readdirSync23 } from "node:fs";
+import { join as join78 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join75(claudeHome(), "projects");
-  if (!existsSync56(projectsRoot)) {
+  const projectsRoot = join78(claudeHome(), "projects");
+  if (!existsSync57(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -11186,8 +11426,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join75(repoHome(), "path-map.json");
-  if (!existsSync56(mapPath)) {
+  const mapPath = join78(repoHome(), "path-map.json");
+  if (!existsSync57(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -11210,8 +11450,8 @@ function resumeCmd(sessionId) {
 }
 function findTranscriptPath(projectsRoot, sessionId) {
   for (const dir of readdirSync23(projectsRoot)) {
-    const candidate = join75(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync56(candidate)) return candidate;
+    const candidate = join78(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync57(candidate)) return candidate;
   }
   return null;
 }
@@ -11244,7 +11484,7 @@ function shQuote(s) {
   return `'${escaped}'`;
 }
 
-// src/user-abort.ts
+// src/core/user-abort.ts
 var ABORT_NAMES = /* @__PURE__ */ new Set(["AbortError", "ExitPromptError"]);
 var ABORT_CODE = "ABORT_ERR";
 function isUserAbort(err) {