claude-nomad 0.68.0 → 0.69.0

package/dist/nomad.mjs

@@ -41,7 +41,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/config.never-sync.ts
+// src/core/config.never-sync.ts
 function stripTrailingDotsAndWhitespace(name) {
   let end = name.length;
   while (end > 0 && (name[end - 1] === "." || /\s/.test(name[end - 1]))) end -= 1;
@@ -97,7 +97,7 @@ function isNeverSync(path) {
 }
 var NEVER_SYNC, CLAUDE_EXTRA_NEVER_SYNC, ALWAYS_NEVER_SYNC, SECRET_FILE_PATTERNS, UNFILTERED_SHARED_REGIONS;
 var init_config_never_sync = __esm({
-  "src/config.never-sync.ts"() {
+  "src/core/config.never-sync.ts"() {
     "use strict";
     NEVER_SYNC = /* @__PURE__ */ new Set([
       ".claude.json",
@@ -222,10 +222,10 @@ var require_picocolors = __commonJS({
   }
 });
 
-// src/color.ts
+// src/render/color.ts
 var import_picocolors, enabled, red, yellow, green, cyan, blue, dim, bold, wslNarrowPad, okGlyph, failGlyph, warnGlyph, infoGlyph;
 var init_color = __esm({
-  "src/color.ts"() {
+  "src/render/color.ts"() {
     "use strict";
     import_picocolors = __toESM(require_picocolors(), 1);
     enabled = import_picocolors.default.isColorSupported;
@@ -244,10 +244,10 @@ var init_color = __esm({
   }
 });
 
-// src/exit-codes.ts
+// src/core/exit-codes.ts
 var EXIT;
 var init_exit_codes = __esm({
-  "src/exit-codes.ts"() {
+  "src/core/exit-codes.ts"() {
     "use strict";
     EXIT = {
       /** Completed successfully. Also returned when a held lock causes a no-op skip. */
@@ -269,7 +269,7 @@ var init_exit_codes = __esm({
   }
 });
 
-// src/utils.ts
+// src/core/utils.ts
 import { execFileSync } from "node:child_process";
 function isProcessExit(err) {
   if (typeof err !== "object" || err === null) return false;
@@ -304,7 +304,7 @@ function gitOrFatal(args, context, cwd) {
 }
 var log, ok, warn, fail, item, NomadFatal, PROCESS_EXIT_BRAND, ProcessExit, die, gitStatusPorcelainZ;
 var init_utils = __esm({
-  "src/utils.ts"() {
+  "src/core/utils.ts"() {
     "use strict";
     init_color();
     init_exit_codes();
@@ -349,7 +349,7 @@ var init_utils = __esm({
   }
 });
 
-// src/config.sharedDirs.guard.ts
+// src/core/config.sharedDirs.guard.ts
 function assertSafeLogical(logical) {
   if (!SAFE_LOGICAL.test(logical) || logical === "." || logical === "..") {
     throw new NomadFatal(
@@ -419,7 +419,7 @@ function isValidSharedDir(entry) {
 }
 var SAFE_LOGICAL, SAFE_SEGMENT, RESERVED_SHARED, RESERVED_SHARED_FOLDED, WIN32_DEVICE_NAMES, UNJOINABLE_REASONS;
 var init_config_sharedDirs_guard = __esm({
-  "src/config.sharedDirs.guard.ts"() {
+  "src/core/config.sharedDirs.guard.ts"() {
     "use strict";
     init_config_never_sync();
     init_utils();
@@ -455,10 +455,10 @@ var init_config_sharedDirs_guard = __esm({
   }
 });
 
-// src/settings-keys.ts
+// src/core/settings-keys.ts
 var SCHEMA_KEYS, APP_ONLY_KEYS, KNOWN_SETTINGS_KEYS;
 var init_settings_keys = __esm({
-  "src/settings-keys.ts"() {
+  "src/core/settings-keys.ts"() {
     "use strict";
     SCHEMA_KEYS = [
       "$schema",
@@ -635,7 +635,7 @@ var init_settings_keys = __esm({
   }
 });
 
-// src/config.ts
+// src/core/config.ts
 import { homedir, hostname } from "node:os";
 import { join, resolve } from "node:path";
 function home() {
@@ -686,7 +686,7 @@ function sharedDirEntries(map) {
 }
 var SETTINGS_SCHEMA_URL, NPM_REGISTRY_LATEST_URL, GITLEAKS_PINNED_VERSION, GITLEAKS_SCAN_TIMEOUT_MS, HOST, SHARED_LINKS, GSD_PREFIX, GSD_DROPPED_NAMES, SUPPORTED_EXTRAS, PUSH_ALLOWED_STATIC;
 var init_config = __esm({
-  "src/config.ts"() {
+  "src/core/config.ts"() {
     "use strict";
     init_config_sharedDirs_guard();
     init_utils();
@@ -721,7 +721,7 @@ var init_config = __esm({
   }
 });
 
-// src/error-text.ts
+// src/core/error-text.ts
 function errorText(err) {
   try {
     const message = err?.message;
@@ -731,12 +731,12 @@ function errorText(err) {
   }
 }
 var init_error_text = __esm({
-  "src/error-text.ts"() {
+  "src/core/error-text.ts"() {
     "use strict";
   }
 });
 
-// src/utils.json.ts
+// src/core/utils.json.ts
 import { readFileSync } from "node:fs";
 function readJson(path) {
   const data = JSON.parse(readFileSync(path, "utf8"));
@@ -774,10 +774,13 @@ function validatePathMapShape(raw) {
   }
   return null;
 }
+function isProtoPollutionKey(key) {
+  return key === "__proto__" || key === "constructor" || key === "prototype";
+}
 function deepMerge(target, source) {
   const out = { ...target };
   for (const [key, value] of Object.entries(source)) {
-    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+    if (isProtoPollutionKey(key)) continue;
     const existing = out[key];
     const bothObjects = value !== null && typeof value === "object" && !Array.isArray(value) && existing !== null && typeof existing === "object" && !Array.isArray(existing);
     out[key] = bothObjects ? deepMerge(existing, value) : value;
@@ -789,6 +792,7 @@ function sortKeysDeep(value) {
   if (value !== null && typeof value === "object") {
     const out = {};
     for (const key of Object.keys(value).sort((a, b) => a.localeCompare(b, "en"))) {
+      if (isProtoPollutionKey(key)) continue;
       out[key] = sortKeysDeep(value[key]);
     }
     return out;
@@ -797,7 +801,7 @@ function sortKeysDeep(value) {
 }
 var ENCODE_MAX, hashPath, encodePath;
 var init_utils_json = __esm({
-  "src/utils.json.ts"() {
+  "src/core/utils.json.ts"() {
     "use strict";
     init_config();
     init_utils();
@@ -815,7 +819,7 @@ var init_utils_json = __esm({
   }
 });
 
-// src/utils.fs.ts
+// src/core/utils.fs.ts
 import {
   closeSync,
   cpSync as cpSync3,
@@ -886,6 +890,12 @@ function freshBackupTs(backupRoot) {
   while (existsSync3(join5(backupRoot, `${base}-${n}`))) n++;
   return `${base}-${n}`;
 }
+function prunableByAge(dirs, olderThanMs, nowMs) {
+  return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
+}
+function prunableByCount(dirs, keep) {
+  return dirs.slice(keep).map((d) => d.name);
+}
 function discardEmptyBackupDir(backupRoot) {
   try {
     rmdirSync(backupRoot);
@@ -926,7 +936,7 @@ function backupExtrasWrite(absPath, ts, projectRoot) {
 }
 var RENAME_RETRY_MAX_ATTEMPTS, RENAME_RETRY_BACKOFF_MS;
 var init_utils_fs = __esm({
-  "src/utils.fs.ts"() {
+  "src/core/utils.fs.ts"() {
     "use strict";
     init_config();
     init_error_text();
@@ -937,7 +947,7 @@ var init_utils_fs = __esm({
   }
 });
 
-// src/commands.pull.wedge.ts
+// src/commands/pull/wedge.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync15 } from "node:fs";
 import { join as join21 } from "node:path";
@@ -1006,23 +1016,54 @@ function orphanedAutostashPresent(repo) {
   return raw.split("\n").some((line) => /:\s*autostash$/.test(line));
 }
 var INDEX_PROBE_TIMEOUT_MS;
-var init_commands_pull_wedge = __esm({
-  "src/commands.pull.wedge.ts"() {
+var init_wedge = __esm({
+  "src/commands/pull/wedge.ts"() {
     "use strict";
     INDEX_PROBE_TIMEOUT_MS = 3e4;
   }
 });
 
-// src/push-gitleaks.config.ts
-import { existsSync as existsSync16, mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join22 } from "node:path";
+// src/core/package-root.ts
+import { existsSync as existsSync16 } from "node:fs";
+import { basename as basename3, dirname as dirname4, join as join22 } from "node:path";
 import { fileURLToPath } from "node:url";
+function packageRoot(from = HERE) {
+  let dir = from;
+  for (; ; ) {
+    if (existsSync16(join22(dir, "package.json"))) return dir;
+    if (basename3(dir) === "node_modules") {
+      throw new Error(`no package.json above ${from} within its own package`);
+    }
+    const parent = dirname4(dir);
+    if (parent === dir) throw new Error(`no package.json above ${from}`);
+    dir = parent;
+  }
+}
+var HERE;
+var init_package_root = __esm({
+  "src/core/package-root.ts"() {
+    "use strict";
+    HERE = dirname4(fileURLToPath(import.meta.url));
+  }
+});
+
+// src/commands/push/gitleaks.config.ts
+import { existsSync as existsSync17, mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join23 } from "node:path";
 function resolveTomlPath(repo = repoHome()) {
-  const repoToml = join22(repo, ".gitleaks.toml");
-  if (existsSync16(repoToml)) return repoToml;
-  const bundled = fileURLToPath(new URL("../.gitleaks.toml", import.meta.url));
-  return existsSync16(bundled) ? bundled : null;
+  const repoToml = join23(repo, ".gitleaks.toml");
+  if (existsSync17(repoToml)) return repoToml;
+  let root;
+  try {
+    root = packageRoot();
+  } catch {
+    throw new NomadFatal(
+      "claude-nomad install looks incomplete (no package.json above the CLI); reinstall with `npm i -g claude-nomad`"
+    );
+  }
+  const bundled = join23(root, ".gitleaks.toml");
+  return existsSync17(bundled) ? bundled : null;
 }
 function assertOverlayAllowlistsScoped(overlayBody) {
   if (OVERLAY_INLINE_ALLOWLIST_RE.test(overlayBody)) {
@@ -1060,17 +1101,17 @@ function buildOverlayTempConfig(overlayBody, bundled) {
 path = ${JSON.stringify(bundled)}
 
 ${overlayBody}`;
-  const tempPath = mkdtempSync(join22(tmpdir(), "nomad-gitleaks-cfg-"));
-  const configPath = join22(tempPath, "config.toml");
+  const tempPath = mkdtempSync(join23(tmpdir(), "nomad-gitleaks-cfg-"));
+  const configPath = join23(tempPath, "config.toml");
   writeFileSync3(configPath, tempBody, { mode: 384, flag: "wx" });
   return { configPath, tempPath };
 }
 function resolveTomlConfig() {
   const repo = repoHome();
-  const overlayPath = join22(repo, ".gitleaks.overlay.toml");
-  const repoToml = join22(repo, ".gitleaks.toml");
+  const overlayPath = join23(repo, ".gitleaks.overlay.toml");
+  const repoToml = join23(repo, ".gitleaks.toml");
   const bundled = resolveTomlPath(repo);
-  if (!existsSync16(overlayPath)) {
+  if (!existsSync17(overlayPath)) {
     return { path: bundled, tempPath: null };
   }
   if (bundled === repoToml) {
@@ -1101,10 +1142,11 @@ function resolveTomlConfig() {
   }
 }
 var OVERLAY_EXTEND_RE, TABLE_HEADER_RE, OVERLAY_ALLOWLIST_HEADER_RE, OVERLAY_INLINE_ALLOWLIST_RE, PATHS_KEY_RE, CATCH_ALL_RE;
-var init_push_gitleaks_config = __esm({
-  "src/push-gitleaks.config.ts"() {
+var init_gitleaks_config = __esm({
+  "src/commands/push/gitleaks.config.ts"() {
     "use strict";
     init_config();
+    init_package_root();
     init_utils();
     OVERLAY_EXTEND_RE = /^[ \t]*(?:\[[ \t]*extend[ \t]*\]|extend[ \t]*[.=])/m;
     TABLE_HEADER_RE = /^\s*\[/;
@@ -1115,7 +1157,7 @@ var init_push_gitleaks_config = __esm({
   }
 });
 
-// src/autostash-guard.ts
+// src/commands/autostash-guard.ts
 function autostashConflictRunbookText(resumeCmd2, stashRetained) {
   const head = `${resumeCmd2} reported success, but the autostash pop it ran internally conflicted. The working tree now holds conflict markers and the index is unmerged. Nothing has been copied to ~/.claude/ yet, and there is no rebase or merge in progress to abort.`;
   if (stashRetained) {
@@ -1146,19 +1188,19 @@ function assertNoAutostashConflict(repo, resumeCmd2) {
   });
 }
 var init_autostash_guard = __esm({
-  "src/autostash-guard.ts"() {
+  "src/commands/autostash-guard.ts"() {
     "use strict";
-    init_commands_pull_wedge();
+    init_wedge();
     init_exit_codes();
     init_utils();
   }
 });
 
-// src/push-checks.ts
+// src/commands/push/checks.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { readdirSync as readdirSync8, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { delimiter, join as join23 } from "node:path";
+import { delimiter, join as join24 } from "node:path";
 function gitleaksInstallHint() {
   const head = "gitleaks not on PATH (required for nomad push). Install:";
   const plat = platform();
@@ -1206,7 +1248,7 @@ function findGitlinks(dir) {
       return;
     }
     for (const e of entries) {
-      const p = join23(current, e.name);
+      const p = join24(current, e.name);
       if (e.name === ".git") {
         hits.push(p);
         continue;
@@ -1255,22 +1297,22 @@ function rebaseBeforePush(repo) {
   }
   assertNoAutostashConflict(repo, "nomad push");
 }
-var init_push_checks = __esm({
-  "src/push-checks.ts"() {
+var init_checks = __esm({
+  "src/commands/push/checks.ts"() {
     "use strict";
-    init_push_gitleaks_config();
+    init_gitleaks_config();
     init_autostash_guard();
-    init_commands_pull_wedge();
+    init_wedge();
     init_exit_codes();
     init_utils();
   }
 });
 
-// src/push-gitleaks.scan.ts
+// src/commands/push/gitleaks.scan.ts
 import { execFileSync as execFileSync9 } from "node:child_process";
 import { mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 function toFinding(entry) {
   if (typeof entry !== "object" || entry === null) return null;
   const e = entry;
@@ -1318,9 +1360,9 @@ function resolveScanFailure(reportPath, e, forwardStreams) {
   return report;
 }
 function scanStagedTree(repoDir, forwardStreams = false) {
-  const cacheDir = join27(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join28(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
-  const reportPath = join27(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
+  const reportPath = join28(cacheDir, `gitleaks-${nowTimestamp()}-${process.pid}.json`);
   const { path: toml, tempPath } = resolveTomlConfig();
   const args = [
     "protect",
@@ -1348,14 +1390,14 @@ function scanStagedTree(repoDir, forwardStreams = false) {
   }
 }
 function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TIMEOUT_MS) {
-  const cacheDir = join27(homedir3(), ".cache", "claude-nomad");
+  const cacheDir = join28(homedir3(), ".cache", "claude-nomad");
   mkdirSync3(cacheDir, { recursive: true });
   const { path: toml, tempPath } = resolveTomlConfig();
   let reportDir;
   let reportPath;
   try {
-    reportDir = mkdtempSync2(join27(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}-`));
-    reportPath = join27(reportDir, "report.json");
+    reportDir = mkdtempSync2(join28(cacheDir, `gitleaks-file-${nowTimestamp()}-${process.pid}-`));
+    reportPath = join28(reportDir, "report.json");
     const args = [
       "detect",
       "--no-git",
@@ -1380,16 +1422,16 @@ function scanFile(filePath, forwardStreams = false, timeoutMs = GITLEAKS_SCAN_TI
     if (reportDir !== void 0) rmSync8(reportDir, { recursive: true, force: true });
   }
 }
-var init_push_gitleaks_scan = __esm({
-  "src/push-gitleaks.scan.ts"() {
+var init_gitleaks_scan = __esm({
+  "src/commands/push/gitleaks.scan.ts"() {
     "use strict";
     init_config();
-    init_push_gitleaks_config();
+    init_gitleaks_config();
     init_utils_fs();
   }
 });
 
-// src/push-gitleaks.ts
+// src/commands/push/gitleaks.ts
 function findingIdentityKey(f) {
   const fp = f.Fingerprint;
   return typeof fp === "string" && fp.length > 0 ? fp : `${f.File}:${f.RuleID}:${f.StartLine}:${f.StartColumn}`;
@@ -1477,13 +1519,13 @@ function buildSessionAwareFatal(bySession, other) {
   return lines.join("\n");
 }
 var SESSION_PATH, SUBAGENT_SESSION_PATH, LEGACY_FATAL;
-var init_push_gitleaks = __esm({
-  "src/push-gitleaks.ts"() {
+var init_gitleaks = __esm({
+  "src/commands/push/gitleaks.ts"() {
     "use strict";
     init_config();
     init_exit_codes();
-    init_push_checks();
-    init_push_gitleaks_scan();
+    init_checks();
+    init_gitleaks_scan();
     init_utils();
     SESSION_PATH = /^shared\/projects\/[^/]+\/([^/]+)\.jsonl$/;
     SUBAGENT_SESSION_PATH = /^shared\/projects\/[^/]+\/([^/]+)\/.*\.jsonl$/;
@@ -1491,9 +1533,9 @@ var init_push_gitleaks = __esm({
   }
 });
 
-// src/push-leak-verdict.ts
-var push_leak_verdict_exports = {};
-__export(push_leak_verdict_exports, {
+// src/commands/push/leak-verdict.ts
+var leak_verdict_exports = {};
+__export(leak_verdict_exports, {
   failRow: () => failRow,
   leakVerdictRow: () => leakVerdictRow,
   noLeaksRow: () => noLeaksRow,
@@ -1566,27 +1608,27 @@ function scanPushVerdict(repo) {
   return leakFound(findings);
 }
 var noLeaksRow, failRow;
-var init_push_leak_verdict = __esm({
-  "src/push-leak-verdict.ts"() {
+var init_leak_verdict = __esm({
+  "src/commands/push/leak-verdict.ts"() {
     "use strict";
     init_color();
     init_exit_codes();
-    init_push_checks();
-    init_push_gitleaks();
+    init_checks();
+    init_gitleaks();
     noLeaksRow = () => `${green(okGlyph)} no leaks`;
     failRow = (text) => `${red(failGlyph)} ${text}`;
   }
 });
 
-// src/commands.adopt.ts
+// src/commands/adopt.ts
 import { existsSync as existsSync5, lstatSync as lstatSync7 } from "node:fs";
 import { join as join9 } from "node:path";
 
-// src/commands.adopt.recover.ts
+// src/commands/adopt.recover.ts
 import { rmSync as rmSync4 } from "node:fs";
 import { dirname as dirname2, join as join7, resolve as resolve2 } from "node:path";
 
-// src/commands.adopt.scan.ts
+// src/commands/adopt.scan.ts
 init_config();
 init_error_text();
 init_exit_codes();
@@ -1665,17 +1707,17 @@ function refuseDeniedEntries(name, root) {
   });
 }
 
-// src/commands.adopt.recover.ts
+// src/commands/adopt.recover.ts
 init_config();
 init_error_text();
 init_exit_codes();
 
-// src/extras-sync.core.ts
+// src/sync/extras/core.ts
 init_config();
 import { cpSync as cpSync2, existsSync as existsSync2, lstatSync as lstatSync3, readdirSync as readdirSync3, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
 import { basename as basename2, join as join4, relative as relative2 } from "node:path";
 
-// src/extras-sync.collision.ts
+// src/sync/extras/collision.ts
 init_utils();
 import { cpSync, existsSync, lstatSync as lstatSync2, readdirSync as readdirSync2, rmSync } from "node:fs";
 import { basename, join as join3 } from "node:path";
@@ -1750,7 +1792,7 @@ function copyExtrasFilteredPreservingBy(src, dst, isPreserved, isRootPreserved)
   });
 }
 
-// src/extras-sync.guards.ts
+// src/sync/extras/guards.ts
 init_utils();
 init_config_sharedDirs_guard();
 import { isAbsolute, normalize, sep } from "node:path";
@@ -1768,7 +1810,7 @@ function assertSafeLocalRoot(localRoot, logical) {
   }
 }
 
-// src/extras-sync.core.ts
+// src/sync/extras/core.ts
 init_utils();
 init_utils_json();
 function loadValidatedExtras(opts) {
@@ -1797,12 +1839,12 @@ function* eachExtrasTarget(v, counts) {
       counts.unmapped++;
       continue;
     }
-    for (const dirname15 of dirnames) {
-      if (!whitelist.includes(dirname15)) {
+    for (const dirname16 of dirnames) {
+      if (!whitelist.includes(dirname16)) {
         counts.skipped++;
         continue;
       }
-      yield { logical, localRoot, dirname: dirname15 };
+      yield { logical, localRoot, dirname: dirname16 };
     }
   }
 }
@@ -1844,8 +1886,8 @@ function copyExtrasFileSkipDiverged(src, dst) {
   }
   copyExtras(src, dst);
 }
-function extrasDenySet(dirname15) {
-  return isClaudeExtraName(dirname15) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
+function extrasDenySet(dirname16) {
+  return isClaudeExtraName(dirname16) ? CLAUDE_EXTRA_NEVER_SYNC : ALWAYS_NEVER_SYNC;
 }
 function copyExtrasFiltered(src, dst, blockSet) {
   rmSync2(dst, { recursive: true, force: true });
@@ -1888,7 +1930,7 @@ function copyExtrasFilteredPreserving(src, dst, blockSet) {
   });
 }
 
-// src/fs-presence.ts
+// src/core/fs-presence.ts
 import { lstatSync as lstatSync4, statSync } from "node:fs";
 var ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR", "ENAMETOOLONG"]);
 function classifyPresence(p) {
@@ -1913,14 +1955,110 @@ function lexists(p) {
   return classifyPresence(p) !== "absent";
 }
 
-// src/links.ts
+// src/sync/links.ts
 init_config();
 import { existsSync as existsSync4, lstatSync as lstatSync6, rmSync as rmSync3 } from "node:fs";
 import { join as join6 } from "node:path";
 
-// src/hooks-filter.ts
+// src/commands/capture-settings/core.ts
+init_utils_json();
+
+// src/sync/hooks-filter.ts
 init_config();
-var KNOWN_LAUNCHER_BASENAMES = /* @__PURE__ */ new Set(["node", "bash", "sh"]);
+init_utils_json();
+
+// src/sync/hooks-filter.command-sub.ts
+var SUB_START = /^"?(?:\$\(|`)/;
+function opensSubstitution(token) {
+  return SUB_START.test(token);
+}
+function stepChar(token, i, scan) {
+  const c = token[i];
+  const top = scan.stack.at(-1);
+  if (top === "sq") {
+    if (c === "'") scan.stack.pop();
+    return i + 1;
+  }
+  if (scan.escaped) {
+    scan.escaped = false;
+    return i + 1;
+  }
+  if (c === "\\") {
+    scan.escaped = true;
+    return i + 1;
+  }
+  if (c === "$" && token[i + 1] === "(") {
+    scan.stack.push("cmd");
+    scan.depth++;
+    return i + 2;
+  }
+  if (c === "'" && top === "cmd") scan.stack.push("sq");
+  else if (c === "`") toggleBacktick(scan, top);
+  else if (c === '"') toggleDoubleQuote(scan, top);
+  else if (top === "cmd") stepParen(c, scan);
+  return i + 1;
+}
+function toggleBacktick(scan, top) {
+  if (top === "bt") scan.stack.pop();
+  else scan.stack.push("bt");
+}
+function toggleDoubleQuote(scan, top) {
+  if (top === "dq") scan.stack.pop();
+  else scan.stack.push("dq");
+}
+function stepParen(c, scan) {
+  if (c === "(") {
+    scan.stack.push("cmd");
+    scan.depth++;
+  } else if (c === ")") {
+    scan.stack.pop();
+    scan.depth--;
+  }
+}
+function skipDollarParen(tokens, start, from) {
+  const scan = { stack: ["cmd"], depth: 1, escaped: false };
+  let i = from;
+  for (let j = start; j < tokens.length; j++) {
+    const token = tokens[j];
+    while (i < token.length) {
+      i = stepChar(token, i, scan);
+      if (scan.depth === 0) return { next: j + 1, rest: token.slice(i) };
+    }
+    i = 0;
+    scan.escaped = false;
+  }
+  return unterminated(tokens, start);
+}
+function skipBacktick(tokens, start, from) {
+  let i = from;
+  for (let j = start; j < tokens.length; j++) {
+    const token = tokens[j];
+    while (i < token.length) {
+      if (token[i] === "\\") i += 2;
+      else if (token[i] === "`") return { next: j + 1, rest: token.slice(i + 1) };
+      else i++;
+    }
+    i = 0;
+  }
+  return unterminated(tokens, start);
+}
+function unterminated(tokens, start) {
+  return { next: start + 1, rest: tokens[start] };
+}
+function skipSubstitution(tokens, start) {
+  const token = tokens[start] ?? "";
+  const paren = token.indexOf("$(");
+  const tick = token.indexOf("`");
+  if (paren < 0 && tick < 0) return { next: start + 1, rest: token };
+  if (tick >= 0 && (paren < 0 || tick < paren)) return skipBacktick(tokens, start, tick + 1);
+  return skipDollarParen(tokens, start, paren + 2);
+}
+
+// src/sync/hooks-filter.ts
+var KNOWN_LAUNCHER_BASENAMES = /* @__PURE__ */ new Set(["env", "node", "bash", "sh"]);
+var SUBSTITUTION_ARTIFACT = /[`()'"]/;
+var ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/;
+var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", ";", "|", "&"]);
 function scriptBasename(token) {
   const lastSlash = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
   return lastSlash >= 0 ? token.slice(lastSlash + 1) : token;
@@ -1935,25 +2073,56 @@ function stripQuotes(token) {
   }
   return token;
 }
+var NO_CANDIDATE = { index: -1, word: "" };
+function nextScriptWord(tokens, from, inScriptSlot) {
+  let slot = inScriptSlot;
+  let i = from;
+  while (i < tokens.length) {
+    const token = tokens[i];
+    if (SHELL_OPERATORS.has(token)) {
+      slot = false;
+      i++;
+    } else if (token.startsWith("-")) {
+      i++;
+    } else if (!opensSubstitution(token)) {
+      return { index: i, word: token };
+    } else {
+      const end = skipSubstitution(tokens, i);
+      if (end.rest !== "") return { index: end.next - 1, word: end.rest };
+      if (slot && !SHELL_OPERATORS.has(tokens[end.next] ?? "")) return NO_CANDIDATE;
+      i = end.next;
+    }
+  }
+  return NO_CANDIDATE;
+}
+function resolveScriptWord(tokens, from, underEnv) {
+  let candidate = nextScriptWord(tokens, from, true);
+  while (underEnv && candidate.index >= 0) {
+    const word = stripQuotes(candidate.word);
+    const isBareInterpreter = !word.includes("/") && !word.includes("\\") && KNOWN_LAUNCHER_BASENAMES.has(word);
+    if (!isBareInterpreter && !ENV_ASSIGNMENT.test(word)) return candidate;
+    candidate = nextScriptWord(tokens, candidate.index + 1, true);
+  }
+  return candidate;
+}
 function isGsdHookEntry(command) {
   const tokens = command.trim().split(/\s+/);
-  if (tokens.length === 0 || tokens[0] === "") return false;
-  const envAssign = /^[A-Za-z_]\w*=/;
+  if (tokens[0] === "") return false;
   let i = 0;
-  while (i < tokens.length && envAssign.test(tokens[i])) {
+  while (i < tokens.length && ENV_ASSIGNMENT.test(tokens[i])) {
     i++;
   }
-  const first = stripQuotes(tokens[i] ?? "");
+  const launcher = nextScriptWord(tokens, i, false);
+  if (launcher.index < 0) return false;
+  const first = stripQuotes(launcher.word);
   const firstBase = scriptBasename(first);
   const firstHasPath = first.includes("/") || first.includes("\\");
-  if (firstHasPath && !KNOWN_LAUNCHER_BASENAMES.has(firstBase) || first.startsWith(GSD_PREFIX)) {
+  if (!KNOWN_LAUNCHER_BASENAMES.has(firstBase) && (firstHasPath || !SUBSTITUTION_ARTIFACT.test(first))) {
     return firstBase.startsWith(GSD_PREFIX);
   }
-  for (let j = i + 1; j < tokens.length; j++) {
-    if (tokens[j].startsWith("-")) continue;
-    return scriptBasename(stripQuotes(tokens[j])).startsWith(GSD_PREFIX);
-  }
-  return false;
+  const script = resolveScriptWord(tokens, launcher.index + 1, firstBase === "env");
+  if (script.index < 0) return false;
+  return scriptBasename(stripQuotes(script.word)).startsWith(GSD_PREFIX);
 }
 function filterMatcherEntry(entry) {
   if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return entry;
@@ -1981,24 +2150,26 @@ function filterEventMatchers(matchers) {
 function stripGsdHookEntries(settings) {
   const out = {};
   for (const [key, value] of Object.entries(settings)) {
-    if (key !== "hooks") {
-      out[key] = value;
-      continue;
-    }
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    if (isProtoPollutionKey(key)) continue;
+    const hooksObj = key === "hooks" ? asPlainObject(value) : null;
+    if (hooksObj === null) {
       out[key] = value;
       continue;
     }
-    const hooksObj = value;
-    const filteredHooks = {};
-    for (const [event, matchers] of Object.entries(hooksObj)) {
-      const filtered = filterEventMatchers(matchers);
-      if (filtered !== null) filteredHooks[event] = filtered;
-    }
-    if (Object.keys(filteredHooks).length > 0) out[key] = filteredHooks;
+    const filteredHooks = filterHooksBlock(hooksObj);
+    if (filteredHooks !== null) out[key] = filteredHooks;
   }
   return out;
 }
+function filterHooksBlock(hooksObj) {
+  const filteredHooks = {};
+  for (const [event, matchers] of Object.entries(hooksObj)) {
+    if (isProtoPollutionKey(event)) continue;
+    const filtered = filterEventMatchers(matchers);
+    if (filtered !== null) filteredHooks[event] = filtered;
+  }
+  return Object.keys(filteredHooks).length > 0 ? filteredHooks : null;
+}
 function keepMatcherEntry(entry) {
   if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
   const entryObj = entry;
@@ -2028,6 +2199,7 @@ function keepGsdHookEntries(settings) {
   const hooksObj = hooksVal;
   const keptHooks = {};
   for (const [event, matchers] of Object.entries(hooksObj)) {
+    if (isProtoPollutionKey(event)) continue;
     const kept = keepEventMatchers(matchers);
     if (kept !== null) keptHooks[event] = kept;
   }
@@ -2062,7 +2234,7 @@ function graftGsdHookEntries(base, gsdOnly) {
   const baseHooks = asPlainObject(base.hooks);
   const mergedHooks = baseHooks ? { ...baseHooks } : {};
   for (const [event, gsdMatchers] of Object.entries(gsdHooks)) {
-    if (!Array.isArray(gsdMatchers)) continue;
+    if (isProtoPollutionKey(event) || !Array.isArray(gsdMatchers)) continue;
     const baseMatchers = mergedHooks[event];
     mergedHooks[event] = Array.isArray(baseMatchers) ? unionMatcherArrays(baseMatchers, gsdMatchers) : gsdMatchers;
   }
@@ -2093,7 +2265,7 @@ function baseHasGsdHookEntries(settings) {
   return false;
 }
 
-// src/commands.capture-settings.core.ts
+// src/commands/capture-settings/core.ts
 function arraysEqual(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
@@ -2187,6 +2359,7 @@ function normalizeNodePathsDeep(value) {
   if (value !== null && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
+      if (isProtoPollutionKey(k)) continue;
       out[k] = normalizeNodePathsDeep(v);
     }
     return out;
@@ -2205,7 +2378,7 @@ function buildCaptureSubset(merged, settings, opts) {
   return out;
 }
 
-// src/links.ts
+// src/sync/links.ts
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -2391,7 +2564,7 @@ function regenerateSettings(ts, opts = {}) {
   return { label: overrideLabel };
 }
 
-// src/commands.adopt.recover.ts
+// src/commands/adopt.recover.ts
 init_utils();
 function isDirectChildOf(root, abs) {
   return dirname2(resolve2(abs)) === resolve2(root);
@@ -2503,14 +2676,14 @@ function reportSourceRemovalFailure(name, linkPath, message, stage) {
   );
 }
 
-// src/commands.adopt.ts
+// src/commands/adopt.ts
 init_config();
 init_config_sharedDirs_guard();
 init_exit_codes();
 init_utils();
 init_utils_fs();
 
-// src/utils.lockfile.ts
+// src/core/utils.lockfile.ts
 init_config();
 init_utils();
 import { closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
@@ -2623,7 +2796,7 @@ function retryOnce(verb, lp) {
   }
 }
 
-// src/commands.adopt.ts
+// src/commands/adopt.ts
 init_utils_json();
 var ADOPT_PUSH_HINT = "run `nomad push` to share with other hosts";
 function readMapIfPresent(repoHome2) {
@@ -2787,11 +2960,11 @@ function adoptPreflightAndMove(name, linkPath, sharedTarget, repo, backup, dryRu
   }
 }
 
-// src/commands.allow.ts
+// src/commands/allow.ts
 init_config();
 import { existsSync as existsSync6 } from "node:fs";
 
-// src/commands.redact.core.ts
+// src/commands/redact/core.ts
 import { appendFileSync, readFileSync as readFileSync4 } from "node:fs";
 import { join as join10 } from "node:path";
 function collectMatchIntervals(content, findings) {
@@ -2865,7 +3038,7 @@ function appendGitleaksIgnore(fingerprint, repo) {
   appendFileSync(ignPath, prefix + formatFingerprint(sanitized), "utf8");
 }
 
-// src/commands.allow.ts
+// src/commands/allow.ts
 init_exit_codes();
 init_utils();
 function cmdAllow(fingerprints) {
@@ -2885,7 +3058,7 @@ function cmdAllow(fingerprints) {
   log(`allowed ${fingerprints.length} fingerprint(s)`);
 }
 
-// src/commands.capture-settings.ts
+// src/commands/capture-settings/capture-settings.ts
 init_config();
 import { existsSync as existsSync7 } from "node:fs";
 import { join as join11 } from "node:path";
@@ -2967,10 +3140,11 @@ async function cmdCaptureSettings(opts) {
   }
 }
 
-// src/commands.clean.ts
+// src/commands/clean.ts
 init_config();
 init_exit_codes();
 init_utils();
+init_utils_fs();
 import { existsSync as existsSync8, lstatSync as lstatSync8, readdirSync as readdirSync4, rmSync as rmSync5, statSync as statSync3 } from "node:fs";
 import { join as join12 } from "node:path";
 var TS_SHAPE = /^\d{8}-\d{6}(-\d+)?$/;
@@ -3005,12 +3179,6 @@ function holdsNoContent(dir) {
   }
   return true;
 }
-function prunableByAge(dirs, olderThanMs, nowMs) {
-  return dirs.filter((d) => nowMs - d.mtimeMs > olderThanMs).map((d) => d.name);
-}
-function prunableByCount(dirs, keep) {
-  return dirs.slice(keep).map((d) => d.name);
-}
 function safeDelete(backupBase2, name) {
   if (!isTsDir(name)) return;
   const full = join12(backupBase2, name);
@@ -3070,7 +3238,7 @@ function pruneBackups(opts, backupBase2) {
   log(`removed ${targets.length} backup(s)`);
 }
 
-// src/commands.eject.ts
+// src/commands/eject.ts
 init_config();
 init_config_sharedDirs_guard();
 init_utils();
@@ -3270,20 +3438,20 @@ function cmdEject(opts = {}, roots = defaultEjectRoots()) {
   }
 }
 
-// src/commands.doctor.ts
-import { existsSync as existsSync35 } from "node:fs";
-import { join as join49 } from "node:path";
+// src/commands/doctor/doctor.ts
+import { existsSync as existsSync36 } from "node:fs";
+import { join as join52 } from "node:path";
 
-// src/commands.doctor.checks.repo.ts
+// src/commands/doctor/checks/repo.ts
 init_color();
 init_config();
 import { existsSync as existsSync11, lstatSync as lstatSync10, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
 import { join as join17 } from "node:path";
 
-// src/commands.doctor.format.ts
+// src/commands/doctor/format.ts
 init_color();
 
-// src/output-tree.ts
+// src/render/output-tree.ts
 init_color();
 var FAIL_GLYPH_BARE = "\u2717";
 function section(header, raw = false) {
@@ -3341,7 +3509,7 @@ function renderTree(sections) {
 }
 var renderDoctor = renderTree;
 
-// src/commands.doctor.format.ts
+// src/commands/doctor/format.ts
 init_utils_json();
 function readJsonSafe(path, label, section2) {
   try {
@@ -3353,12 +3521,12 @@ function readJsonSafe(path, label, section2) {
   }
 }
 
-// src/commands.doctor.checks.repo.win32.ts
+// src/commands/doctor/checks/repo.win32.ts
 init_color();
 init_config();
 import { join as join14, win32 as win32Path } from "node:path";
 
-// src/extras-sync.diff.ts
+// src/sync/extras/diff.ts
 init_utils();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { relative as relative4 } from "node:path";
@@ -3413,7 +3581,7 @@ function listDivergingModified(a, b) {
   return runNameStatusDiff(a, b, (stdout) => parseModifiedPaths(stdout, a));
 }
 
-// src/commands.doctor.checks.repo.win32.ts
+// src/commands/doctor/checks/repo.win32.ts
 function win32CopyOkRow(name, exempt = 0) {
   const note = exempt > 0 ? dim(` (${exempt} never-synced path(s) not compared)`) : "";
   return { line: `${green(okGlyph)} ${name}: real copy (win32 copy-sync)${note}`, fail: false };
@@ -3465,7 +3633,7 @@ function classifyWin32Copy(name, p) {
   };
 }
 
-// src/commands.doctor.checks.repo.source.ts
+// src/commands/doctor/checks/repo.source.ts
 init_color();
 init_config();
 import { join as join15 } from "node:path";
@@ -3516,7 +3684,7 @@ function repoSourceRow(name, present, absent) {
   return state === "resolves" ? present : absent;
 }
 
-// src/init.classify.ts
+// src/commands/init/classify.ts
 init_config();
 init_utils_json();
 import { existsSync as existsSync10 } from "node:fs";
@@ -3559,7 +3727,7 @@ function reasonForPartial(repoHome2, host) {
   return "- partial state (unknown gap)";
 }
 
-// src/commands.doctor.checks.repo.ts
+// src/commands/doctor/checks/repo.ts
 init_utils_json();
 function isOverrideActive() {
   return Boolean(process.env.NOMAD_REPO);
@@ -3718,7 +3886,7 @@ function reportDroppedNamesMigration(section2) {
   }
 }
 
-// src/commands.doctor.checks.settings.ts
+// src/commands/doctor/checks/settings.ts
 init_color();
 init_config();
 import { existsSync as existsSync12, readdirSync as readdirSync6 } from "node:fs";
@@ -3779,7 +3947,7 @@ function reportHostOverrides(section2, base, settings) {
   }
 }
 
-// src/commands.doctor.checks.pathmap.ts
+// src/commands/doctor/checks/pathmap.ts
 init_color();
 init_config();
 init_config_sharedDirs_guard();
@@ -3965,7 +4133,7 @@ function reportNeverSync(section2) {
   );
 }
 
-// src/commands.doctor.checks.skills.ts
+// src/commands/doctor/checks/skills.ts
 init_color();
 import { existsSync as existsSync14 } from "node:fs";
 import { join as join20 } from "node:path";
@@ -4013,15 +4181,15 @@ function reportSkillsDivergence(section2) {
   }
 }
 
-// src/commands.doctor.checks.git-state.ts
+// src/commands/doctor/checks/git-state.ts
 init_color();
 init_config();
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join24, relative as relative5 } from "node:path";
-init_commands_pull_wedge();
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join25, relative as relative5 } from "node:path";
+init_wedge();
 
-// src/git-probe.ts
+// src/core/git-probe.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 var PROBE_TIMEOUT_MS = 1e4;
 var PROBE_MAX_BUFFER = 64 * 1024 * 1024;
@@ -4038,8 +4206,8 @@ function gitProbe(args, repo) {
   }
 }
 
-// src/commands.doctor.checks.git-state.ts
-init_push_checks();
+// src/commands/doctor/checks/git-state.ts
+init_checks();
 init_utils();
 function reportGitleaksProbe(section2) {
   try {
@@ -4060,8 +4228,8 @@ function reportGitleaksProbe(section2) {
 }
 function reportGitlinks(section2) {
   const repo = repoHome();
-  const sharedDir = join24(repo, "shared");
-  if (existsSync17(sharedDir)) {
+  const sharedDir = join25(repo, "shared");
+  if (existsSync18(sharedDir)) {
     const gitlinks = findGitlinks(sharedDir);
     for (const p of gitlinks) {
       const rel = relative5(repo, p).replaceAll("\\", "/");
@@ -4196,10 +4364,10 @@ function reportTrackedDeniedShared(section2) {
   );
 }
 
-// src/commands.doctor.checks.backups.ts
+// src/commands/doctor/checks/backups.ts
 init_color();
-import { existsSync as existsSync18, lstatSync as lstatSync12, readdirSync as readdirSync9 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync19, lstatSync as lstatSync12, readdirSync as readdirSync9 } from "node:fs";
+import { join as join26 } from "node:path";
 init_config();
 var TS_SHAPE2 = /^\d{8}-\d{6}(-\d+)?$/;
 function safeReaddir(dir) {
@@ -4215,7 +4383,7 @@ var BYTES_PER_MB = 1024 * 1024;
 function dirSizeBytes(dir) {
   let bytes = 0;
   for (const entry of safeReaddir(dir)) {
-    const full = join25(dir, entry);
+    const full = join26(dir, entry);
     const st = lstatSync12(full, { throwIfNoEntry: false });
     if (!st) continue;
     if (st.isSymbolicLink()) continue;
@@ -4226,11 +4394,11 @@ function dirSizeBytes(dir) {
 }
 function totalSizeMb(backupBase2, dirs) {
   let bytes = 0;
-  for (const name of dirs) bytes += dirSizeBytes(join25(backupBase2, name));
+  for (const name of dirs) bytes += dirSizeBytes(join26(backupBase2, name));
   return bytes / BYTES_PER_MB;
 }
 function reportBackupsCheck(section2, backupBase2 = backupBase()) {
-  if (!existsSync18(backupBase2)) return;
+  if (!existsSync19(backupBase2)) return;
   const dirs = safeReaddir(backupBase2).filter((n) => TS_SHAPE2.test(n));
   const count = dirs.length;
   const sizeMb = totalSizeMb(backupBase2, dirs);
@@ -4242,7 +4410,7 @@ function reportBackupsCheck(section2, backupBase2 = backupBase()) {
   }
 }
 
-// src/commands.doctor.check-remote.ts
+// src/commands/doctor/checks/remote.ts
 init_color();
 import { execFileSync as execFileSync7 } from "node:child_process";
 init_config();
@@ -4309,13 +4477,13 @@ function reportCheckRemote(section2) {
   addItem(section2, `${green(okGlyph)} remote: origin/main has shared/ and a valid path-map.json`);
 }
 
-// src/commands.doctor.check-schema.ts
+// src/commands/doctor/checks/schema.ts
 init_color();
-import { existsSync as existsSync19 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { join as join27 } from "node:path";
 init_config();
 
-// src/http-fetch.ts
+// src/core/http-fetch.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 var FETCH_TIMEOUT_MS = 3e3;
 function fetchUrl(url, run = execFileSync8) {
@@ -4336,7 +4504,7 @@ function fetchUrl(url, run = execFileSync8) {
   }
 }
 
-// src/commands.doctor.check-schema.ts
+// src/commands/doctor/checks/schema.ts
 function fetchSchemaKeys() {
   try {
     const raw = fetchUrl(SETTINGS_SCHEMA_URL);
@@ -4349,8 +4517,8 @@ function fetchSchemaKeys() {
   }
 }
 function reportCheckSchema(section2) {
-  const settingsPath = join26(claudeHome(), "settings.json");
-  if (!existsSync19(settingsPath)) {
+  const settingsPath = join27(claudeHome(), "settings.json");
+  if (!existsSync20(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json to check`);
     return;
   }
@@ -4376,23 +4544,23 @@ function reportCheckSchema(section2) {
   }
 }
 
-// src/commands.doctor.check-shared.ts
+// src/commands/doctor/checks/shared.ts
 init_color();
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync12, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync8, readdirSync as readdirSync12, rmSync as rmSync12 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 
-// src/commands.doctor.check-shared.memory.ts
+// src/commands/doctor/checks/shared.memory.ts
 init_color();
 import { execFileSync as execFileSync10 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { mkdirSync as mkdirSync4, rmSync as rmSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, join as join28 } from "node:path";
+import { dirname as dirname5, join as join29 } from "node:path";
 init_config();
-init_push_gitleaks();
+init_gitleaks();
 init_utils_fs();
 var MEMORY_MD_PATH = /^shared\/projects\/([^/]+)\/memory\/[^/]+\.md$/;
 function buildMemoryScanTree(tmpRoot) {
@@ -4423,8 +4591,8 @@ function buildMemoryScanTree(tmpRoot) {
       incomplete = true;
       continue;
     }
-    const dest = join28(tmpRoot, rel);
-    mkdirSync4(dirname4(dest), { recursive: true });
+    const dest = join29(tmpRoot, rel);
+    mkdirSync4(dirname5(dest), { recursive: true });
     writeFileSync4(dest, blob);
     logicals.add(m[1]);
   }
@@ -4442,10 +4610,10 @@ function reportMemoryFindings(section2, findings) {
 function reportCommittedMemory(section2) {
   let tmpRoot;
   try {
-    const cacheDir = join28(homedir4(), ".cache", "claude-nomad");
+    const cacheDir = join29(homedir4(), ".cache", "claude-nomad");
     mkdirSync4(cacheDir, { recursive: true });
     const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes(4).toString("hex")}`;
-    tmpRoot = join28(cacheDir, `check-shared-memory-tree-${stamp}`);
+    tmpRoot = join29(cacheDir, `check-shared-memory-tree-${stamp}`);
     mkdirSync4(tmpRoot, { recursive: true, mode: 448 });
     const { staged, incomplete } = buildMemoryScanTree(tmpRoot);
     if (incomplete) {
@@ -4490,14 +4658,14 @@ function reportCommittedMemory(section2) {
   }
 }
 
-// src/commands.doctor.check-shared.scan.ts
+// src/commands/doctor/checks/shared.scan.ts
 init_color();
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 init_config();
-init_push_gitleaks();
+init_gitleaks();
 function scrubPath(logical, sid, logicalToEncoded) {
   const encoded = logicalToEncoded.get(logical) ?? logical;
-  return join29(claudeHome(), "projects", encoded, `${sid}.jsonl`);
+  return join30(claudeHome(), "projects", encoded, `${sid}.jsonl`);
 }
 function reportSessionFindings(section2, bySession) {
   for (const [sid, counts] of bySession) {
@@ -4580,15 +4748,15 @@ function scanAndReport(section2, tmpRoot, staged, logicalToEncoded) {
   emitDescriptionLegend(section2, findings);
 }
 
-// src/commands.doctor.check-shared.skills.ts
+// src/commands/doctor/checks/shared.skills.ts
 init_color();
 import { execFileSync as execFileSync11 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdirSync as mkdirSync5, rmSync as rmSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname5, join as join30 } from "node:path";
+import { dirname as dirname6, join as join31 } from "node:path";
 init_config();
-init_push_gitleaks();
+init_gitleaks();
 init_utils_fs();
 var SKILL_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
 function buildSkillScanTree(tmpRoot) {
@@ -4619,8 +4787,8 @@ function buildSkillScanTree(tmpRoot) {
       incomplete = true;
       continue;
     }
-    const dest = join30(tmpRoot, rel);
-    mkdirSync5(dirname5(dest), { recursive: true });
+    const dest = join31(tmpRoot, rel);
+    mkdirSync5(dirname6(dest), { recursive: true });
     writeFileSync5(dest, blob);
     names.add(m[1]);
   }
@@ -4642,10 +4810,10 @@ function reportSkillFindings(section2, findings) {
 function reportCommittedSkills(section2) {
   let tmpRoot;
   try {
-    const cacheDir = join30(homedir5(), ".cache", "claude-nomad");
+    const cacheDir = join31(homedir5(), ".cache", "claude-nomad");
     mkdirSync5(cacheDir, { recursive: true });
     const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes2(4).toString("hex")}`;
-    tmpRoot = join30(cacheDir, `check-shared-skills-tree-${stamp}`);
+    tmpRoot = join31(cacheDir, `check-shared-skills-tree-${stamp}`);
     mkdirSync5(tmpRoot, { recursive: true, mode: 448 });
     const { staged, incomplete } = buildSkillScanTree(tmpRoot);
     if (incomplete) {
@@ -4690,22 +4858,22 @@ function reportCommittedSkills(section2) {
   }
 }
 
-// src/commands.doctor.check-shared.ts
+// src/commands/doctor/checks/shared.ts
 init_config();
 
-// src/remap.ts
+// src/sync/remap.ts
 init_config_sharedDirs_guard();
-import { cpSync as cpSync5, existsSync as existsSync21, lstatSync as lstatSync13, mkdirSync as mkdirSync7, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync6 } from "node:fs";
-import { dirname as dirname7, join as join32, relative as relative6, sep as sep5 } from "node:path";
+import { cpSync as cpSync5, existsSync as existsSync22, lstatSync as lstatSync13, mkdirSync as mkdirSync7, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync6 } from "node:fs";
+import { dirname as dirname8, join as join33, relative as relative6, sep as sep5 } from "node:path";
 init_config();
 
-// src/push-manifest.ts
+// src/commands/push/manifest.ts
 init_config();
-init_push_gitleaks_config();
+init_gitleaks_config();
 init_utils_fs();
 import { createHash } from "node:crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync10, readFileSync as readFileSync7, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join31 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync10, readFileSync as readFileSync7, statSync as statSync5 } from "node:fs";
+import { dirname as dirname7, join as join32 } from "node:path";
 function isChanged(prev, cur, hash) {
   if (prev === void 0) return true;
   if (prev.size !== cur.size) return true;
@@ -4746,7 +4914,7 @@ function hashFile(absPath) {
 }
 function enumerateDir(dir, results) {
   for (const entry of readdirSync10(dir)) {
-    const fullPath = join31(dir, entry);
+    const fullPath = join32(dir, entry);
     const st = statSync5(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -4758,7 +4926,7 @@ function enumerateDir(dir, results) {
 function enumerateSourceFiles(projectDir) {
   const results = [];
   for (const entry of readdirSync10(projectDir)) {
-    const fullPath = join31(projectDir, entry);
+    const fullPath = join32(projectDir, entry);
     const st = statSync5(fullPath);
     if (st.isDirectory()) {
       enumerateDir(fullPath, results);
@@ -4770,15 +4938,15 @@ function enumerateSourceFiles(projectDir) {
 }
 function fileIdentity(p) {
   if (p === null) return "none::absent";
-  if (!existsSync20(p)) return `${p}::absent`;
+  if (!existsSync21(p)) return `${p}::absent`;
   return `${p}::${createHash("sha256").update(readFileSync7(p)).digest("hex")}`;
 }
 function computeConfigHash() {
   const repo = repoHome();
   const parts = [
     fileIdentity(resolveTomlPath(repo)),
-    fileIdentity(join31(repo, ".gitleaks.overlay.toml")),
-    fileIdentity(join31(repo, ".gitleaksignore"))
+    fileIdentity(join32(repo, ".gitleaks.overlay.toml")),
+    fileIdentity(join32(repo, ".gitleaksignore"))
   ];
   return createHash("sha256").update(parts.join("\n")).digest("hex");
 }
@@ -4798,14 +4966,14 @@ function readManifest(path) {
   }
 }
 function writeManifest(path, manifest) {
-  mkdirSync6(dirname6(path), { recursive: true });
+  mkdirSync6(dirname7(path), { recursive: true });
   writeJsonAtomic(path, manifest);
 }
 function buildManifest(files, scannerVersion, configHash) {
   return { schema: 1, scannerVersion, configHash, files };
 }
 
-// src/remap.ts
+// src/sync/remap.ts
 init_utils();
 init_utils_fs();
 init_utils_json();
@@ -4822,16 +4990,15 @@ function overlaySessionDir(src, dst) {
   cpSyncGuarded(src, dst, void 0, "overlaySessionDir");
 }
 function copyFileAtomic(src, dst) {
-  mkdirSync7(dirname7(dst), { recursive: true });
+  mkdirSync7(dirname8(dst), { recursive: true });
   const tmp = `${dst}.tmp.${process.pid}`;
   cpSync5(src, tmp, { force: true, preserveTimestamps: true });
   renameAtomicRetry(tmp, dst);
 }
 function hasDeltaForDir(sel, localDir) {
   const prefix = `${localDir}${sep5}`;
-  for (const p of sel.changed) if (p.startsWith(prefix)) return true;
-  for (const p of sel.deleted) if (p.startsWith(prefix)) return true;
-  return false;
+  const underDir = (p) => p.startsWith(prefix);
+  return [...sel.changed].some(underDir) || sel.deleted.some(underDir);
 }
 function skipForSelection(sel, localDir) {
   return sel !== void 0 && !hasDeltaForDir(sel, localDir);
@@ -4840,12 +5007,12 @@ function applySelective(sel, localDir, repoDst) {
   const prefix = `${localDir}${sep5}`;
   for (const src of sel.changed) {
     if (!src.startsWith(prefix)) continue;
-    copyFileAtomic(src, join32(repoDst, relative6(localDir, src)));
+    copyFileAtomic(src, join33(repoDst, relative6(localDir, src)));
   }
   for (const src of sel.deleted) {
     if (!src.startsWith(prefix)) continue;
-    const dst = join32(repoDst, relative6(localDir, src));
-    if (existsSync21(dst)) rmSync11(dst);
+    const dst = join33(repoDst, relative6(localDir, src));
+    if (existsSync22(dst)) rmSync11(dst);
   }
 }
 function copyDirJsonlOnly(src, dst) {
@@ -4874,15 +5041,15 @@ function remapPull(ts, opts = {}) {
   const wouldPull = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join32(repo, "path-map.json");
-  const repoProjects = join32(repo, "shared", "projects");
-  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) {
+  const mapPath = join33(repo, "path-map.json");
+  const repoProjects = join33(repo, "shared", "projects");
+  if (!existsSync22(mapPath) || !existsSync22(repoProjects)) {
     const text = "no path-map or repo projects dir; skipping session remap";
     emitPreview(opts.onPreview, { kind: "note", text }, text);
     return { unmapped: 0, pulled, wouldPull };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join32(claude, "projects");
+  const localProjects = join33(claude, "projects");
   if (!dryRun) mkdirSync7(localProjects, { recursive: true });
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
@@ -4892,9 +5059,9 @@ function remapPull(ts, opts = {}) {
       continue;
     }
     assertSafeLocalRoot(localPath, logical);
-    const src = join32(repoProjects, logical);
-    if (!existsSync21(src)) continue;
-    const dst = join32(localProjects, encodePath(localPath));
+    const src = join33(repoProjects, logical);
+    if (!existsSync22(src)) continue;
+    const dst = join33(localProjects, encodePath(localPath));
     if (dryRun) {
       wouldPull.push(logical);
       emitPreview(
@@ -4913,8 +5080,8 @@ function remapPull(ts, opts = {}) {
 function countLocalOnly(src, dst) {
   let count = 0;
   for (const name of readdirSync11(dst)) {
-    const dstPath = join32(dst, name);
-    const srcPath = join32(src, name);
+    const dstPath = join33(dst, name);
+    const srcPath = join33(src, name);
     if (lstatSync13(dstPath).isDirectory()) {
       count += countLocalOnly(srcPath, dstPath);
     } else if (lstatSync13(srcPath, { throwIfNoEntry: false }) === void 0) {
@@ -4926,20 +5093,20 @@ function countLocalOnly(src, dst) {
 function scanLocalOnly() {
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join32(repo, "path-map.json");
-  const repoProjects = join32(repo, "shared", "projects");
-  if (!existsSync21(mapPath) || !existsSync21(repoProjects)) return 0;
+  const mapPath = join33(repo, "path-map.json");
+  const repoProjects = join33(repo, "shared", "projects");
+  if (!existsSync22(mapPath) || !existsSync22(repoProjects)) return 0;
   const map = readPathMap(mapPath);
-  const localProjects = join32(claude, "projects");
+  const localProjects = join33(claude, "projects");
   let count = 0;
   for (const [logical, hosts] of Object.entries(map.projects)) {
     assertSafeLogical(logical);
     const localPath = hosts[HOST];
     if (!localPath || localPath === "TBD") continue;
     assertSafeLocalRoot(localPath, logical);
-    const dst = join32(localProjects, encodePath(localPath));
-    if (!existsSync21(dst)) continue;
-    count += countLocalOnly(join32(repoProjects, logical), dst);
+    const dst = join33(localProjects, encodePath(localPath));
+    if (!existsSync22(dst)) continue;
+    count += countLocalOnly(join33(repoProjects, logical), dst);
   }
   return count;
 }
@@ -4974,16 +5141,16 @@ function remapPush(ts, opts = {}) {
   const wouldPush = [];
   const repo = repoHome();
   const claude = claudeHome();
-  const mapPath = join32(repo, "path-map.json");
-  if (!existsSync21(mapPath)) {
+  const mapPath = join33(repo, "path-map.json");
+  if (!existsSync22(mapPath)) {
     log("no path-map.json; skipping session export");
     return { unmapped: 0, collisions: 0, pushed, wouldPush };
   }
   const map = readPathMap(mapPath);
-  const localProjects = join32(claude, "projects");
-  const repoProjects = join32(repo, "shared", "projects");
+  const localProjects = join33(claude, "projects");
+  const repoProjects = join33(repo, "shared", "projects");
   const reverse = buildReverseMap(map);
-  if (!existsSync21(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
+  if (!existsSync22(localProjects)) return { unmapped, collisions: 0, pushed, wouldPush };
   if (!dryRun) mkdirSync7(repoProjects, { recursive: true });
   for (const dir of readdirSync11(localProjects)) {
     if (dir.endsWith(TMP_SUFFIX)) continue;
@@ -4992,8 +5159,8 @@ function remapPush(ts, opts = {}) {
       unmapped++;
       continue;
     }
-    const localDir = join32(localProjects, dir);
-    const repoDst = join32(repoProjects, logical);
+    const localDir = join33(localProjects, dir);
+    const repoDst = join33(repoProjects, logical);
     if (skipForSelection(opts.selection, localDir)) continue;
     if (dryRun) {
       wouldPush.push(logical);
@@ -5010,15 +5177,15 @@ function remapPush(ts, opts = {}) {
   return { unmapped, collisions: 0, pushed, wouldPush };
 }
 
-// src/commands.doctor.check-shared.ts
+// src/commands/doctor/checks/shared.ts
 init_utils_fs();
 init_utils_json();
 function buildScanTree(tmpRoot) {
   const logicalToEncoded = /* @__PURE__ */ new Map();
   let staged = 0;
   const repo = repoHome();
-  const mapPath = join33(repo, "path-map.json");
-  if (!existsSync22(mapPath)) return { logicalToEncoded, staged, malformed: false };
+  const mapPath = join34(repo, "path-map.json");
+  if (!existsSync23(mapPath)) return { logicalToEncoded, staged, malformed: false };
   let map;
   try {
     map = readJson(mapPath);
@@ -5035,12 +5202,12 @@ function buildScanTree(tmpRoot) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join33(claudeHome(), "projects");
-  if (!existsSync22(localProjects)) return { logicalToEncoded, staged, malformed: false };
+  const localProjects = join34(claudeHome(), "projects");
+  if (!existsSync23(localProjects)) return { logicalToEncoded, staged, malformed: false };
   for (const dir of readdirSync12(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    copyDirJsonlOnly(join33(localProjects, dir), join33(tmpRoot, "shared", "projects", logical));
+    copyDirJsonlOnly(join34(localProjects, dir), join34(tmpRoot, "shared", "projects", logical));
     logicalToEncoded.set(logical, dir);
     staged++;
   }
@@ -5070,11 +5237,11 @@ function ensureGitleaksReady(section2, gitleaksReady) {
   return true;
 }
 function runLocalPreviewScan(section2) {
-  const cacheDir = join33(homedir6(), ".cache", "claude-nomad");
+  const cacheDir = join34(homedir6(), ".cache", "claude-nomad");
   mkdirSync8(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes3(4).toString("hex")}`;
-  const reportPath = join33(cacheDir, `check-shared-${stamp}.json`);
-  const tmpRoot = join33(cacheDir, `check-shared-tree-${stamp}`);
+  const reportPath = join34(cacheDir, `check-shared-${stamp}.json`);
+  const tmpRoot = join34(cacheDir, `check-shared-tree-${stamp}`);
   try {
     const { logicalToEncoded, staged, malformed } = buildScanTree(tmpRoot);
     if (malformed) {
@@ -5105,10 +5272,10 @@ function reportCheckShared(section2, gitleaksReady) {
   }
 }
 
-// src/commands.doctor.checks.hooks.scope.ts
+// src/commands/doctor/checks/hooks.scope.ts
 init_color();
-import { existsSync as existsSync23, readFileSync as readFileSync8, readdirSync as readdirSync13, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname8, extname, join as join34 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync8, readdirSync as readdirSync13, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname9, extname, join as join35 } from "node:path";
 init_config();
 function typeFromPackageJson(pkgPath) {
   try {
@@ -5128,11 +5295,11 @@ function effectiveType(hookPath) {
   } catch {
     return null;
   }
-  let dir = dirname8(real);
+  let dir = dirname9(real);
   for (; ; ) {
-    const pkg = join34(dir, "package.json");
-    if (existsSync23(pkg)) return typeFromPackageJson(pkg);
-    const parent = dirname8(dir);
+    const pkg = join35(dir, "package.json");
+    if (existsSync24(pkg)) return typeFromPackageJson(pkg);
+    const parent = dirname9(dir);
     if (parent === dir) return "cjs";
     dir = parent;
   }
@@ -5173,15 +5340,15 @@ function safeRead(path) {
   }
 }
 function reportHookScopeCheck(section2) {
-  const hooksDir = join34(claudeHome(), "hooks");
-  if (!existsSync23(hooksDir)) {
+  const hooksDir = join35(claudeHome(), "hooks");
+  if (!existsSync24(hooksDir)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/hooks; skipping module-scope check`);
     return;
   }
   let anyWarn = false;
   for (const name of safeReaddir2(hooksDir)) {
     if (extname(name) !== ".js") continue;
-    const abs = join34(hooksDir, name);
+    const abs = join35(hooksDir, name);
     const eff = effectiveType(abs);
     if (eff === null) continue;
     const src = safeRead(abs);
@@ -5199,10 +5366,10 @@ function reportHookScopeCheck(section2) {
   }
 }
 
-// src/commands.doctor.checks.hooks.ts
+// src/commands/doctor/checks/hooks.ts
 init_color();
-import { existsSync as existsSync24 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync25 } from "node:fs";
+import { join as join36 } from "node:path";
 init_config();
 function expandHome(token) {
   const h2 = home();
@@ -5245,7 +5412,7 @@ function checkEventGroups(section2, event, groups) {
   for (const group of groups) {
     for (const cmd of commandsFromGroup(group)) {
       for (const resolved of claudePathsIn(cmd)) {
-        if (existsSync24(resolved)) continue;
+        if (existsSync25(resolved)) continue;
         addItem(
           section2,
           `${red(failGlyph)} hooks/${event}: command target missing: ${resolved} (run nomad pull)`
@@ -5258,8 +5425,8 @@ function checkEventGroups(section2, event, groups) {
   return anyFail;
 }
 function reportHooksTargetCheck(section2) {
-  const settingsPath = join35(claudeHome(), "settings.json");
-  if (!existsSync24(settingsPath)) {
+  const settingsPath = join36(claudeHome(), "settings.json");
+  if (!existsSync25(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping hook target check`);
     return;
   }
@@ -5280,17 +5447,17 @@ function reportHooksTargetCheck(section2) {
   }
 }
 
-// src/commands.doctor.checks.hooks.preserve-symlinks.ts
+// src/commands/doctor/checks/hooks.preserve-symlinks.ts
 init_color();
-import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync9 } from "node:fs";
+import { join as join38 } from "node:path";
 
-// src/commands.doctor.checks.hooks.preserve-symlinks.probe.ts
-import { closeSync as closeSync3, existsSync as existsSync25, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
-import { dirname as dirname9, join as join36, resolve as resolve3 } from "node:path";
+// src/commands/doctor/checks/hooks.preserve-symlinks.probe.ts
+import { closeSync as closeSync3, existsSync as existsSync26, openSync as openSync3, readSync, realpathSync as realpathSync4 } from "node:fs";
+import { dirname as dirname10, join as join37, resolve as resolve3 } from "node:path";
 function suppressedRanges(src) {
   const ranges = [];
-  const re = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|'[^']*'|"[^"]*"|`[^`]*`/g;
+  const re = /\/\*[^]*?\*\/|\/\/[^\n]*|(['"`])(?:\\[^]|[^\\])*?\1/g;
   let m;
   while ((m = re.exec(src)) !== null) {
     ranges.push([m.index, m.index + m[0].length]);
@@ -5303,7 +5470,7 @@ function inSuppressedRange(pos, ranges) {
   }
   return false;
 }
-function topRelativeSpecifiers(src) {
+function relativeSpecifiers(src) {
   const ranges = suppressedRanges(src);
   const specifiers = [];
   const reqRe = /\brequire\s*\(\s*(['"])(\.\.?\/[^'"]*)\1\s*\)/g;
@@ -5319,12 +5486,12 @@ function topRelativeSpecifiers(src) {
 }
 function specifierIsMissing(specifier, baseDir) {
   const base = resolve3(baseDir, specifier);
-  if (existsSync25(base)) return false;
+  if (existsSync26(base)) return false;
   for (const ext of [".js", ".cjs", ".mjs"]) {
-    if (existsSync25(base + ext)) return false;
+    if (existsSync26(base + ext)) return false;
   }
   for (const idx of ["index.js", "index.cjs", "index.mjs"]) {
-    if (existsSync25(join36(base, idx))) return false;
+    if (existsSync26(join37(base, idx))) return false;
   }
   return true;
 }
@@ -5348,16 +5515,16 @@ function relativeRequireTargetsBroken(scriptPath) {
   } catch {
     return false;
   }
-  const specifiers = topRelativeSpecifiers(raw);
+  const specifiers = relativeSpecifiers(raw);
   if (specifiers.length === 0) return false;
-  const baseDir = dirname9(realPath);
+  const baseDir = dirname10(realPath);
   for (const spec of specifiers) {
     if (specifierIsMissing(spec, baseDir)) return true;
   }
   return false;
 }
 
-// src/commands.doctor.checks.hooks.preserve-symlinks.ts
+// src/commands/doctor/checks/hooks.preserve-symlinks.ts
 init_config();
 function expandHome2(token) {
   const h2 = home();
@@ -5379,8 +5546,8 @@ function commandTokens(command) {
   return tokens;
 }
 function readPathMapSafe() {
-  const mapPath = join37(repoHome(), "path-map.json");
-  if (!existsSync26(mapPath)) return { projects: {} };
+  const mapPath = join38(repoHome(), "path-map.json");
+  if (!existsSync27(mapPath)) return { projects: {} };
   try {
     return JSON.parse(readFileSync9(mapPath, "utf8"));
   } catch {
@@ -5454,8 +5621,8 @@ function checkEventForPreserveSymlinks(section2, event, groups, sharedLinkNames)
   return anyWarn;
 }
 function reportPreserveSymlinksCheck(section2) {
-  const settingsPath = join37(claudeHome(), "settings.json");
-  if (!existsSync26(settingsPath)) {
+  const settingsPath = join38(claudeHome(), "settings.json");
+  if (!existsSync27(settingsPath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} no ~/.claude/settings.json; skipping preserve-symlinks-main check`
@@ -5486,10 +5653,10 @@ function reportPreserveSymlinksCheck(section2) {
   }
 }
 
-// src/commands.doctor.checks.settings-drift.ts
+// src/commands/doctor/checks/settings-drift.ts
 init_color();
-import { existsSync as existsSync27, readFileSync as readFileSync10 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync10 } from "node:fs";
+import { join as join39 } from "node:path";
 init_config();
 init_utils_json();
 function diffMergedSettings(merged, settings) {
@@ -5507,7 +5674,7 @@ function tryReadJson(filePath) {
   }
 }
 function reportHooksBaseSelfCleanNote(section2) {
-  const basePath = join38(repoHome(), "shared", "settings.base.json");
+  const basePath = join39(repoHome(), "shared", "settings.base.json");
   const base = tryReadJson(basePath);
   if (base === null) return;
   if (!baseHasGsdHookEntries(base)) return;
@@ -5520,14 +5687,14 @@ function reportSettingsDriftCheck(section2) {
   const claude = claudeHome();
   const repo = repoHome();
   const host = HOST;
-  const settingsPath = join38(claude, "settings.json");
-  const basePath = join38(repo, "shared", "settings.base.json");
-  const hostPath = join38(repo, "hosts", `${host}.json`);
-  if (!existsSync27(settingsPath)) {
+  const settingsPath = join39(claude, "settings.json");
+  const basePath = join39(repo, "shared", "settings.base.json");
+  const hostPath = join39(repo, "hosts", `${host}.json`);
+  if (!existsSync28(settingsPath)) {
     addItem(section2, `${dim(infoGlyph)} no ~/.claude/settings.json; skipping merge-drift check`);
     return;
   }
-  if (!existsSync27(basePath)) {
+  if (!existsSync28(basePath)) {
     addItem(
       section2,
       `${dim(infoGlyph)} shared/settings.base.json missing; skipping merge-drift check`
@@ -5546,7 +5713,7 @@ function reportSettingsDriftCheck(section2) {
   if (settings === null) {
     return;
   }
-  const hostExists = existsSync27(hostPath);
+  const hostExists = existsSync28(hostPath);
   const hostObj = hostExists ? tryReadJson(hostPath) : null;
   if (hostExists && hostObj === null) {
     addItem(
@@ -5590,19 +5757,20 @@ function emitDriftRows(section2, missing, changed, promotable, excluded, hostFil
   }
 }
 
-// src/commands.doctor.ts
+// src/commands/doctor/doctor.ts
 init_config();
 
-// src/commands.doctor.engine.ts
+// src/commands/doctor/engine.ts
 init_color();
 import { readFileSync as readFileSync12 } from "node:fs";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { join as join41 } from "node:path";
 
-// src/commands.doctor.version.ts
+// src/commands/doctor/version.ts
 init_color();
 import { readFileSync as readFileSync11 } from "node:fs";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { join as join40 } from "node:path";
 init_config();
+init_package_root();
 var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;
 var STRICT_SEMVER_PREFIX = /^(\d+\.\d+\.\d+)(?:[-+]|$)/;
 function compareSemver(a, b) {
@@ -5616,7 +5784,7 @@ function compareSemver(a, b) {
 }
 function readLocalVersion() {
   try {
-    const pkgPath = fileURLToPath2(new URL("../package.json", import.meta.url));
+    const pkgPath = join40(packageRoot(), "package.json");
     const parsed = JSON.parse(readFileSync11(pkgPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -5667,7 +5835,8 @@ function reportVersionCheck(section2) {
   }
 }
 
-// src/commands.doctor.engine.ts
+// src/commands/doctor/engine.ts
+init_package_root();
 var ENGINES_GTE = /^>=\s*(\d+\.\d+\.\d+)$/;
 function parseMinVersion(spec) {
   const m = ENGINES_GTE.exec(spec);
@@ -5675,7 +5844,7 @@ function parseMinVersion(spec) {
 }
 function readEnginesNode() {
   try {
-    const pkgPath = fileURLToPath3(new URL("../package.json", import.meta.url));
+    const pkgPath = join41(packageRoot(), "package.json");
     const parsed = JSON.parse(readFileSync12(pkgPath, "utf8"));
     const node = parsed.engines?.node;
     if (typeof node === "string" && node.length > 0) return node;
@@ -5702,7 +5871,7 @@ function reportNodeEngineCheck(section2) {
   addItem(section2, `${green(okGlyph)} node: ${process.version}`);
 }
 
-// src/commands.doctor.checks.longpaths.ts
+// src/commands/doctor/checks/longpaths.ts
 init_color();
 import { execFileSync as execFileSync13 } from "node:child_process";
 init_config();
@@ -5760,18 +5929,18 @@ function reportSyncModality(section2) {
   addItem(section2, `${dim(infoGlyph)} sync modality: ${modality}`);
 }
 
-// src/commands.doctor.checks.crlf.ts
+// src/commands/doctor/checks/crlf.ts
 init_color();
 import { execFileSync as execFileSync14 } from "node:child_process";
-import { existsSync as existsSync28, readFileSync as readFileSync13 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync13 } from "node:fs";
+import { join as join42 } from "node:path";
 init_config();
 var PROBE_TIMEOUT_MS3 = 3e3;
 var GUARD_LINE = /^\*\s+-text\b/;
 function hasGitattributesGuard(repo) {
   try {
-    const path = join39(repo, ".gitattributes");
-    if (!existsSync28(path)) return false;
+    const path = join42(repo, ".gitattributes");
+    if (!existsSync29(path)) return false;
     const content = readFileSync13(path, "utf8");
     return content.split("\n").map((line) => line.trim()).some((line) => line !== "" && !line.startsWith("#") && GUARD_LINE.test(line));
   } catch {
@@ -5810,24 +5979,24 @@ function reportCrlfGuardCheck(section2, run = execFileSync14) {
   addExposedRow(section2, repo, probeAutocrlf(repo, run));
 }
 
-// src/spinner.ts
+// src/render/spinner.ts
 init_color();
-import { existsSync as existsSync33 } from "node:fs";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { existsSync as existsSync34 } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { Worker } from "node:worker_threads";
 
-// src/commands.push.recovery.ts
+// src/commands/push/recovery/recovery.ts
 init_config();
 import { readFileSync as readFileSync18, rmSync as rmSync15, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join47 } from "node:path";
+import { join as join50 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
-// src/commands.push.recovery.actions.ts
+// src/commands/push/recovery/actions.ts
 init_config();
 import { readFileSync as readFileSync17 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve4, sep as sep9 } from "node:path";
 
-// src/commands.push.recovery.memory.ts
+// src/commands/push/recovery/memory.ts
 init_config();
 init_config_sharedDirs_guard();
 import {
@@ -5839,17 +6008,17 @@ import {
   statSync as statSync7,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname10, join as join40, sep as sep6 } from "node:path";
-init_push_gitleaks_scan();
+import { dirname as dirname11, join as join43, sep as sep6 } from "node:path";
+init_gitleaks_scan();
 
-// src/rel-path-guard.ts
+// src/core/rel-path-guard.ts
 function isSafeRelPath(relPath) {
   if (relPath.length === 0 || relPath.startsWith("/") || relPath.includes("\\")) return false;
   const segments = relPath.split("/");
   return segments.every((s) => s.length > 0 && s !== "." && s !== "..");
 }
 
-// src/commands.push.recovery.memory.ts
+// src/commands/push/recovery/memory.ts
 init_utils_fs();
 init_utils_json();
 init_utils();
@@ -5868,8 +6037,8 @@ function resolveMemoryLocalPath(logical, relPath, map) {
   if (!isSafeRelPath(relPath)) return null;
   const abs = map.projects[logical]?.[HOST];
   if (abs === void 0) return null;
-  const memoryRoot = join40(claudeHome(), "projects", encodePath(abs), "memory");
-  const localPath = join40(memoryRoot, ...relPath.split("/"));
+  const memoryRoot = join43(claudeHome(), "projects", encodePath(abs), "memory");
+  const localPath = join43(memoryRoot, ...relPath.split("/"));
   if (localPath !== memoryRoot && !localPath.startsWith(memoryRoot + sep6)) return null;
   try {
     if (lstatSync14(localPath).isSymbolicLink()) return null;
@@ -5923,13 +6092,13 @@ function applyMemoryRedact(f, ts, map, scan = scanFile) {
     );
   }
   writeFileSync6(localPath, after, "utf8");
-  const dest = join40(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
-  mkdirSync9(dirname10(dest), { recursive: true });
+  const dest = join43(repoHome(), "shared", "projects", logical, "memory", ...relPath.split("/"));
+  mkdirSync9(dirname11(dest), { recursive: true });
   cpSync6(localPath, dest, { force: true });
   return true;
 }
 
-// src/commands.push.recovery.skills.ts
+// src/commands/push/recovery/skills.ts
 init_config();
 import {
   cpSync as cpSync7,
@@ -5940,27 +6109,27 @@ import {
   statSync as statSync8,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname11, join as join42, sep as sep7 } from "node:path";
+import { dirname as dirname12, join as join45, sep as sep7 } from "node:path";
 
-// src/skills-sync.ts
+// src/sync/skills-sync.ts
 init_config();
-import { existsSync as existsSync29, lstatSync as lstatSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync14, rmSync as rmSync13 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync30, lstatSync as lstatSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync14, rmSync as rmSync13 } from "node:fs";
+import { join as join44 } from "node:path";
 
-// src/skills-sync.tracked.ts
+// src/sync/skills-sync.tracked.ts
 init_utils();
-import { basename as basename3 } from "node:path";
+import { basename as basename4 } from "node:path";
 function trackedRootSkillsAt(ref, repo) {
   try {
     const raw = gitCaptureRaw(["ls-tree", "--name-only", "-z", ref, "--", "shared/skills/"], repo);
     const entries = raw.split("\0").filter((entry) => entry !== "");
-    return new Set(entries.map((entry) => basename3(entry)));
+    return new Set(entries.map((entry) => basename4(entry)));
   } catch {
     return /* @__PURE__ */ new Set();
   }
 }
 
-// src/skills-sync.ts
+// src/sync/skills-sync.ts
 init_utils_fs();
 function isGsdOwned(name) {
   return name.startsWith(GSD_PREFIX);
@@ -5980,9 +6149,9 @@ function copySkillsPull(src, dst, isRootPreserved) {
   copyExtrasFilteredPreservingBy(src, dst, isSkillExcluded, isRootPreserved);
 }
 function syncSkillsPull(ts, prePostHeads) {
-  const sharedSkills = join41(repoHome(), "shared", "skills");
-  if (!existsSync29(sharedSkills)) return;
-  const localSkills = join41(claudeHome(), "skills");
+  const sharedSkills = join44(repoHome(), "shared", "skills");
+  if (!existsSync30(sharedSkills)) return;
+  const localSkills = join44(claudeHome(), "skills");
   backupBeforeWrite(localSkills, ts);
   const dstStat = lstatSync15(localSkills, { throwIfNoEntry: false });
   if (dstStat?.isSymbolicLink() === true) {
@@ -5993,16 +6162,16 @@ function syncSkillsPull(ts, prePostHeads) {
   copySkillsPull(sharedSkills, localSkills, (name) => !tracked.has(name));
 }
 function syncSkillsPush() {
-  const localSkills = join41(claudeHome(), "skills");
+  const localSkills = join44(claudeHome(), "skills");
   const stat = lstatSync15(localSkills, { throwIfNoEntry: false });
   if (stat === void 0) return;
   if (stat.isSymbolicLink()) return;
-  const sharedSkills = join41(repoHome(), "shared", "skills");
+  const sharedSkills = join44(repoHome(), "shared", "skills");
   copySkillsPush(localSkills, sharedSkills);
 }
 
-// src/commands.push.recovery.skills.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/skills.ts
+init_gitleaks_scan();
 init_utils_fs();
 init_utils();
 var SKILL_FINDING_PATH = /^shared\/skills\/([^/]+)\/(.+)$/;
@@ -6020,9 +6189,9 @@ function resolveSkillLocalPath(name, relPath) {
   if (!SAFE_SKILL_NAME.test(name) || name === "." || name === "..") return null;
   if (isGsdOwned(name)) return null;
   if (!isSafeRelPath(relPath)) return null;
-  const skillsRoot = join42(claudeHome(), "skills");
-  const skillRoot = join42(skillsRoot, name);
-  const localPath = join42(skillRoot, ...relPath.split("/"));
+  const skillsRoot = join45(claudeHome(), "skills");
+  const skillRoot = join45(skillsRoot, name);
+  const localPath = join45(skillRoot, ...relPath.split("/"));
   if (localPath !== skillRoot && !localPath.startsWith(skillRoot + sep7)) return null;
   try {
     if (lstatSync16(localPath).isSymbolicLink()) return null;
@@ -6074,17 +6243,17 @@ function applySkillRedact(f, ts, scan = scanFile) {
     );
   }
   writeFileSync7(localPath, after, "utf8");
-  const dest = join42(repoHome(), "shared", "skills", name, ...relPath.split("/"));
-  mkdirSync11(dirname11(dest), { recursive: true });
+  const dest = join45(repoHome(), "shared", "skills", name, ...relPath.split("/"));
+  mkdirSync11(dirname12(dest), { recursive: true });
   cpSync7(localPath, dest, { force: true });
   return true;
 }
 
-// src/commands.push.recovery.allow-gate.ts
+// src/commands/push/recovery/allow-gate.ts
 init_utils();
 
-// src/commands.push.recovery.seams.ts
-init_push_gitleaks();
+// src/commands/push/recovery/seams.ts
+init_gitleaks();
 function findingKey(f) {
   return `${f.File}:${f.StartLine}:${f.StartColumn}:${f.RuleID}`;
 }
@@ -6105,7 +6274,7 @@ function parseAction(raw) {
   return "skip";
 }
 
-// src/commands.push.recovery.allow-gate.ts
+// src/commands/push/recovery/allow-gate.ts
 function isCleared(f, state) {
   const action = state.actions.get(findingKey(f)) ?? "skip";
   if (action === "allow") return true;
@@ -6149,28 +6318,28 @@ function applyDeferredAllows(findings, state, repo) {
   }
 }
 
-// src/commands.push.recovery.redact.ts
+// src/commands/push/recovery/redact.ts
 init_config();
 init_config_sharedDirs_guard();
-import { cpSync as cpSync8, existsSync as existsSync32, mkdirSync as mkdirSync12 } from "node:fs";
-import { dirname as dirname13, join as join45, sep as sep8 } from "node:path";
+import { cpSync as cpSync8, existsSync as existsSync33, mkdirSync as mkdirSync12 } from "node:fs";
+import { dirname as dirname14, join as join48, sep as sep8 } from "node:path";
 
-// src/commands.redact.ts
+// src/commands/redact/redact.ts
 init_config();
-import { existsSync as existsSync31 } from "node:fs";
-import { dirname as dirname12, join as join44 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { dirname as dirname13, join as join47 } from "node:path";
 
-// src/commands.redact.subtree.ts
-import { existsSync as existsSync30, lstatSync as lstatSync17, readFileSync as readFileSync16, readdirSync as readdirSync15, statSync as statSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join43 } from "node:path";
+// src/commands/redact/subtree.ts
+import { existsSync as existsSync31, lstatSync as lstatSync17, readFileSync as readFileSync16, readdirSync as readdirSync15, statSync as statSync9, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join46 } from "node:path";
 init_utils_fs();
 init_utils();
 function collectFiles(dir, out) {
-  if (!existsSync30(dir)) return;
+  if (!existsSync31(dir)) return;
   const st = lstatSync17(dir);
   if (!st.isDirectory()) return;
   for (const entry of readdirSync15(dir)) {
-    const abs = join43(dir, entry);
+    const abs = join46(dir, entry);
     const lst = lstatSync17(abs);
     if (lst.isSymbolicLink()) continue;
     if (lst.isDirectory()) {
@@ -6224,7 +6393,7 @@ function applySubtreeRedactions(mainPath, mainFindings, subtreeFiles, rule, ts,
   return { total, dirty };
 }
 
-// src/commands.pushed-history.ts
+// src/commands/pushed-history.ts
 init_utils();
 import { execFileSync as execFileSync15 } from "node:child_process";
 function pushedRef(repo) {
@@ -6272,23 +6441,23 @@ function warnIfSessionPushed(id, repo) {
   );
 }
 
-// src/commands.redact.ts
-init_push_gitleaks_scan();
+// src/commands/redact/redact.ts
+init_gitleaks_scan();
 init_exit_codes();
 init_utils_fs();
 init_utils_json();
 init_utils();
 function resolveLiveTranscript(id) {
   try {
-    const mapPath = join44(repoHome(), "path-map.json");
-    if (!existsSync31(mapPath)) return null;
+    const mapPath = join47(repoHome(), "path-map.json");
+    if (!existsSync32(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const hostMap of Object.values(projects)) {
       const abs = hostMap[HOST];
       if (abs === void 0) continue;
-      const live = join44(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync31(live)) return live;
+      const live = join47(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync32(live)) return live;
     }
     return null;
   } catch {
@@ -6308,17 +6477,17 @@ function cmdRedact(opts, nowMs = Date.now, scan = scanFile) {
   }
   const repo = repoHome();
   const backup = backupBase();
-  if (!existsSync31(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync32(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("redact");
   if (handle === null) process.exit(0);
   try {
     const localPath = resolveLiveTranscript(id);
-    if (localPath === null || !existsSync31(localPath)) {
+    if (localPath === null || !existsSync32(localPath)) {
       fail(`could not resolve local transcript for session ${id} on this host`);
       process.exitCode = 1;
       return;
     }
-    const sessionDir = join44(dirname12(localPath), id);
+    const sessionDir = join47(dirname13(localPath), id);
     const subtreeFiles = listSubtreeFiles(sessionDir);
     if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
       log(
@@ -6370,8 +6539,8 @@ ${lines}`);
   }
 }
 
-// src/commands.push.recovery.redact.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/redact.ts
+init_gitleaks_scan();
 init_utils_json();
 init_utils();
 function resolveStagedDir(localPath, map, claude, repo) {
@@ -6379,8 +6548,8 @@ function resolveStagedDir(localPath, map, claude, repo) {
     assertSafeLogical(logical);
     const abs = hostMap[HOST];
     if (abs === void 0) continue;
-    if (localPath.startsWith(join45(claude, "projects", encodePath(abs)) + sep8)) {
-      return join45(repo, "shared", "projects", logical);
+    if (localPath.startsWith(join48(claude, "projects", encodePath(abs)) + sep8)) {
+      return join48(repo, "shared", "projects", logical);
     }
   }
   return null;
@@ -6390,7 +6559,7 @@ function preflightRedactable(f, map, nowMs) {
   if (sid === null) return "a finding has no resolvable session id (not a session transcript)";
   const localPath = resolveLiveTranscript(sid);
   if (localPath === null) return `session ${sid}: local transcript not found`;
-  const sessionDir = join45(dirname13(localPath), sid);
+  const sessionDir = join48(dirname14(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return `session ${sid}: looks active (modified within the last 5 minutes)`;
@@ -6419,7 +6588,7 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
       `could not locate the local transcript for session ${sid}; choose Skip or Drop session.`
     );
   }
-  const sessionDir = join45(dirname13(localPath), sid);
+  const sessionDir = join48(dirname14(localPath), sid);
   const subtreeFiles = listSubtreeFiles(sessionDir);
   if (isSubtreeActive(localPath, subtreeFiles, nowMs())) {
     return refuse(
@@ -6452,35 +6621,35 @@ function applyRedact(f, ts, map, nowMs, scan = scanFile) {
     );
   }
   mkdirSync12(stagedProjectDir, { recursive: true });
-  cpSync8(localPath, join45(stagedProjectDir, `${sid}.jsonl`), { force: true });
-  if (existsSync32(sessionDir)) {
-    cpSync8(sessionDir, join45(stagedProjectDir, sid), { force: true, recursive: true });
+  cpSync8(localPath, join48(stagedProjectDir, `${sid}.jsonl`), { force: true });
+  if (existsSync33(sessionDir)) {
+    cpSync8(sessionDir, join48(stagedProjectDir, sid), { force: true, recursive: true });
   }
   return true;
 }
 
-// src/commands.push.recovery.drop.ts
+// src/commands/push/recovery/drop.ts
 init_config();
 import { rmSync as rmSync14 } from "node:fs";
-import { join as join46 } from "node:path";
+import { join as join49 } from "node:path";
 function dropSessionFromStaged(sid, map) {
   const logicals = Object.keys(map.projects);
   if (logicals.length === 0) return false;
   const repo = repoHome();
   for (const logical of logicals) {
-    const jsonl = join46(repo, "shared", "projects", logical, `${sid}.jsonl`);
-    const dir = join46(repo, "shared", "projects", logical, sid);
+    const jsonl = join49(repo, "shared", "projects", logical, `${sid}.jsonl`);
+    const dir = join49(repo, "shared", "projects", logical, sid);
     rmSync14(jsonl, { force: true });
     rmSync14(dir, { recursive: true, force: true });
   }
   return true;
 }
 
-// src/commands.push.recovery.actions.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/actions.ts
+init_gitleaks_scan();
 init_utils();
 
-// src/commands.push.recovery.span-align.ts
+// src/commands/push/recovery/span-align.ts
 var REDACTED_TOKEN = "REDACTED";
 var SHIFT_WINDOW = [0, -1, 1, -2, 2];
 var ENTROPY_TOLERANCE = 1e-4;
@@ -6567,7 +6736,7 @@ function alignFindingSpan(finding, buf) {
   return breakTie(hits, finding);
 }
 
-// src/commands.push.recovery.secret-shape.ts
+// src/commands/push/recovery/secret-shape.ts
 var VALUE_HEAD = 4;
 var VALUE_TAIL = 4;
 var MIN_ELIDE_LEN = 16;
@@ -6663,15 +6832,15 @@ function elideTokenRuns(text) {
   });
 }
 
-// src/commands.push.recovery.display.ts
+// src/commands/push/recovery/display.ts
 var RULE_PAD = 24;
 var GROUP_SEP = "\0";
 function sessionSuffix(finding) {
   const sid = sessionIdFromFinding(finding);
   if (sid === null) return "";
   const rawBasename = finding.File.replace(/^.*\//, "");
-  const basename4 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
-  return basename4 === sid ? "" : ` (session: ${sid})`;
+  const basename5 = rawBasename.endsWith(".jsonl") ? rawBasename.slice(0, -".jsonl".length) : rawBasename;
+  return basename5 === sid ? "" : ` (session: ${sid})`;
 }
 function renderFindingBlock(finding, readLine, siblings = []) {
   const lines = [`  file:  ${finding.File}:${finding.StartLine}${sessionSuffix(finding)}`];
@@ -6721,7 +6890,7 @@ function buildPromptHeader(group, index, total, readLine, peers = 0, siblings =
   return ["", headerLine, ...body, menu, ""].join("\n");
 }
 
-// src/commands.push.recovery.actions.ts
+// src/commands/push/recovery/actions.ts
 function allowAllFindings(findings, repo) {
   for (const f of findings) {
     appendGitleaksIgnore(f.Fingerprint, repo);
@@ -6854,8 +7023,8 @@ function dispatchActions(findings, actions, opts) {
   applyDeferredAllows(findings, ctx, repo);
 }
 
-// src/commands.push.recovery.redact-all.ts
-init_push_gitleaks_scan();
+// src/commands/push/recovery/redact-all.ts
+init_gitleaks_scan();
 init_utils();
 function redactAllDedupeKey(f) {
   const sid = sessionIdFromFinding(f);
@@ -6920,10 +7089,10 @@ function redactAllFindings(findings, ts, map, nowMs, scan = scanFile) {
   }
 }
 
-// src/commands.push.recovery.ts
+// src/commands/push/recovery/recovery.ts
 init_exit_codes();
-init_push_gitleaks_scan();
-init_push_gitleaks();
+init_gitleaks_scan();
+init_gitleaks();
 init_utils();
 function isTTY(stdin = process.stdin, stdout = process.stdout) {
   return stdin.isTTY === true && stdout.isTTY === true;
@@ -6954,7 +7123,7 @@ function applyThenRescan(scanVerdict, repoHome2) {
   return next;
 }
 function allowThenRescan(append, scanVerdict, repoHome2) {
-  const ignPath = join47(repoHome2, ".gitleaksignore");
+  const ignPath = join50(repoHome2, ".gitleaksignore");
   let before;
   try {
     before = readFileSync18(ignPath, "utf8");
@@ -6998,7 +7167,7 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
     scan = scanFile,
     printLegend = printRecoveryLegend
   } = deps;
-  const scanVerdict = deps.scanVerdict ?? (await Promise.resolve().then(() => (init_push_leak_verdict(), push_leak_verdict_exports))).scanPushVerdict;
+  const scanVerdict = deps.scanVerdict ?? (await Promise.resolve().then(() => (init_leak_verdict(), leak_verdict_exports))).scanPushVerdict;
   const repo = repoHome();
   let current = verdict;
   if (redactAll) {
@@ -7041,7 +7210,7 @@ async function resolveLeakFindings(verdict, ts, map, deps = {}) {
   return current;
 }
 
-// src/spinner.ts
+// src/render/spinner.ts
 function formatElapsed(ms) {
   return `${(ms / 1e3).toFixed(1)}s`;
 }
@@ -7060,11 +7229,11 @@ function writeAnimatedDone(out, label, ms, useTTY) {
 `);
 }
 function resolveWorkerPath(deps = {}) {
-  const check = deps.existsSyncFn ?? existsSync33;
+  const check = deps.existsSyncFn ?? existsSync34;
   const base = deps.baseUrl ?? import.meta.url;
-  const mjs = fileURLToPath4(new URL("./nomad.worker.mjs", base));
+  const mjs = fileURLToPath2(new URL("./nomad.worker.mjs", base));
   if (check(mjs)) return mjs;
-  return fileURLToPath4(new URL("./spinner.worker.ts", base));
+  return fileURLToPath2(new URL("./spinner.worker.ts", base));
 }
 function makeRealWorker() {
   return new Worker(resolveWorkerPath());
@@ -7124,11 +7293,11 @@ function withSpinner(label, fn, deps) {
   }
 }
 
-// src/commands.doctor.gitleaks-version.ts
+// src/commands/doctor/gitleaks-version.ts
 init_color();
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync34 } from "node:fs";
-import { join as join48 } from "node:path";
+import { existsSync as existsSync35 } from "node:fs";
+import { join as join51 } from "node:path";
 init_config();
 var SEMVER_MAJOR_MINOR = /^(\d+)\.(\d+)\.\d+$/;
 var GITLEAKS_TIMEOUT_MS = 5e3;
@@ -7137,7 +7306,7 @@ function majorMinorOf(value) {
   return m === null ? null : [m[1], m[2]];
 }
 function readGitleaksVersion(run, tomlExists) {
-  const tomlPath = join48(repoHome(), ".gitleaks.toml");
+  const tomlPath = join51(repoHome(), ".gitleaks.toml");
   const args = ["version"];
   if (tomlExists(tomlPath)) args.push("--config", tomlPath);
   try {
@@ -7149,7 +7318,7 @@ function readGitleaksVersion(run, tomlExists) {
     return null;
   }
 }
-function reportGitleaksVersionCheck(section2, run = execFileSync16, tomlExists = existsSync34) {
+function reportGitleaksVersionCheck(section2, run = execFileSync16, tomlExists = existsSync35) {
   const raw = readGitleaksVersion(run, tomlExists);
   if (raw === null) return;
   const local = majorMinorOf(raw);
@@ -7167,7 +7336,7 @@ function reportGitleaksVersionCheck(section2, run = execFileSync16, tomlExists =
   );
 }
 
-// src/commands.doctor.checks.deps.ts
+// src/commands/doctor/checks/deps.ts
 init_color();
 import { execFileSync as execFileSync17 } from "node:child_process";
 var VERSION_TOKEN = /(\d{1,9}\.\d{1,9}\.\d{1,9})/;
@@ -7219,12 +7388,12 @@ function reportOptionalDeps(section2, run = execFileSync17) {
   reportFetcherRow(section2, run);
 }
 
-// src/commands.doctor.actions-drift.ts
+// src/commands/doctor/actions-drift.ts
 init_color();
 import { execFileSync as execFileSync19 } from "node:child_process";
 init_config();
 
-// src/gh-actions.ts
+// src/commands/init/gh-actions.ts
 import { execFileSync as execFileSync18 } from "node:child_process";
 var GH_TIMEOUT_MS = 5e3;
 function parseGitHubRemote(remoteUrl) {
@@ -7284,7 +7453,7 @@ function readOriginRemote(cwd, run = execFileSync18) {
   }).toString().trim();
 }
 
-// src/commands.doctor.actions-drift.ts
+// src/commands/doctor/actions-drift.ts
 function reportActionsDrift(section2, run = execFileSync19) {
   let remote;
   try {
@@ -7316,7 +7485,7 @@ function reportActionsDrift(section2, run = execFileSync19) {
   );
 }
 
-// src/commands.doctor.verdict.ts
+// src/commands/doctor/verdict.ts
 init_color();
 function isFailLine(item2) {
   return item2.includes(failGlyph);
@@ -7340,7 +7509,7 @@ function buildVerdictSection(sections) {
   return summary;
 }
 
-// src/commands.doctor.banner.ts
+// src/commands/doctor/banner.ts
 var NOMAD_BANNER = [
   "                                        __",
   "   ____   ____   ____ ___   ____ _ ____/ /",
@@ -7354,7 +7523,7 @@ function printBanner(log2, stdout) {
   log2("");
 }
 
-// src/commands.doctor.compact.ts
+// src/commands/doctor/compact.ts
 init_color();
 var ALWAYS_FULL = /* @__PURE__ */ new Set([
   "Nomad Version",
@@ -7396,7 +7565,7 @@ function compactSections(sections) {
   });
 }
 
-// src/commands.doctor.ts
+// src/commands/doctor/doctor.ts
 function gatherDoctorSections(opts) {
   const host = section("Environment");
   reportHostAndPaths(host);
@@ -7406,8 +7575,8 @@ function gatherDoctorSections(opts) {
   reportLongPathsCheck(host);
   reportCrlfGuardCheck(host);
   const links = section("Shared links");
-  const mapPath = join49(repoHome(), "path-map.json");
-  const rawMap = existsSync35(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
+  const mapPath = join52(repoHome(), "path-map.json");
+  const rawMap = existsSync36(mapPath) ? readJsonSafe(mapPath, mapPath, links) : null;
   const map = rawMap ?? { projects: {} };
   reportSharedLinks(links, map);
   reportDroppedNamesMigration(links);
@@ -7482,7 +7651,7 @@ function cmdDoctor(opts = {}) {
   renderDoctor(opts.verbose === true ? report : compactSections(report));
 }
 
-// src/nomad.dispatch.doctor.ts
+// src/cli/dispatch.doctor.ts
 function parseDoctorArgs(args) {
   if (args[0] === "--resume-cmd") {
     const id = args[1];
@@ -7503,13 +7672,13 @@ function parseDoctorArgs(args) {
   return { kind: "run", checkShared, checkSchema, checkRemote, verbose };
 }
 
-// src/commands.drop-session.ts
+// src/commands/drop-session/drop-session.ts
 init_config();
 import { execFileSync as execFileSync21 } from "node:child_process";
-import { existsSync as existsSync37, readdirSync as readdirSync16, statSync as statSync10 } from "node:fs";
-import { join as join51, relative as relative7 } from "node:path";
+import { existsSync as existsSync38, readdirSync as readdirSync16, statSync as statSync10 } from "node:fs";
+import { join as join54, relative as relative7 } from "node:path";
 
-// src/commands.drop-session.git.ts
+// src/commands/drop-session/git.ts
 import { execFileSync as execFileSync20 } from "node:child_process";
 function expandStagedDir(dirRel, repo) {
   try {
@@ -7546,12 +7715,12 @@ function isInIndex(rel, repo) {
   }
 }
 
-// src/commands.drop-session.scrub-hint.ts
+// src/commands/drop-session/scrub-hint.ts
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync36 } from "node:fs";
-import { join as join50 } from "node:path";
+import { existsSync as existsSync37 } from "node:fs";
+import { join as join53 } from "node:path";
 var SHARED_PROJECT_LOGICAL = /^shared\/projects\/([^/]+)\//;
 function reportScrubHint(id, matches) {
   const live = resolveLiveTranscript2(id, matches);
@@ -7567,8 +7736,8 @@ function reportScrubHint(id, matches) {
 }
 function resolveLiveTranscript2(id, matches) {
   try {
-    const mapPath = join50(repoHome(), "path-map.json");
-    if (!existsSync36(mapPath)) return null;
+    const mapPath = join53(repoHome(), "path-map.json");
+    if (!existsSync37(mapPath)) return null;
     const projects = readJson(mapPath).projects;
     const claude = claudeHome();
     for (const rel of matches) {
@@ -7576,8 +7745,8 @@ function resolveLiveTranscript2(id, matches) {
       if (logical === void 0) continue;
       const abs = projects[logical]?.[HOST];
       if (abs === void 0) continue;
-      const live = join50(claude, "projects", encodePath(abs), `${id}.jsonl`);
-      if (existsSync36(live)) return live;
+      const live = join53(claude, "projects", encodePath(abs), `${id}.jsonl`);
+      if (existsSync37(live)) return live;
     }
     return null;
   } catch {
@@ -7585,7 +7754,7 @@ function resolveLiveTranscript2(id, matches) {
   }
 }
 
-// src/commands.drop-session.ts
+// src/commands/drop-session/drop-session.ts
 init_utils();
 function cmdDropSession(id) {
   if (id.length === 0 || id.length > 128 || !/^[A-Za-z0-9_-]+$/.test(id)) {
@@ -7593,12 +7762,12 @@ function cmdDropSession(id) {
     process.exit(1);
   }
   const repo = repoHome();
-  if (!existsSync37(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync38(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("drop-session");
   if (handle === null) process.exit(0);
   try {
-    const repoProjects = join51(repo, "shared", "projects");
-    if (!existsSync37(repoProjects)) {
+    const repoProjects = join54(repo, "shared", "projects");
+    if (!existsSync38(repoProjects)) {
       throw new NomadFatal(`no staged session matches ${id}`);
     }
     const matches = collectMatches(repoProjects, id, repo);
@@ -7621,12 +7790,12 @@ function cmdDropSession(id) {
 function collectMatches(repoProjects, id, repo) {
   const matches = [];
   for (const logical of readdirSync16(repoProjects)) {
-    const candidate = join51(repoProjects, logical, `${id}.jsonl`);
-    if (existsSync37(candidate)) {
+    const candidate = join54(repoProjects, logical, `${id}.jsonl`);
+    if (existsSync38(candidate)) {
       matches.push(relative7(repo, candidate));
     }
-    const dir = join51(repoProjects, logical, id);
-    if (existsSync37(dir) && statSync10(dir).isDirectory()) {
+    const dir = join54(repoProjects, logical, id);
+    if (existsSync38(dir) && statSync10(dir).isDirectory()) {
       const dirRel = relative7(repo, dir);
       const staged = expandStagedDir(dirRel, repo);
       if (staged.length > 0) matches.push(...staged);
@@ -7660,15 +7829,15 @@ function unstageOne(rel, repo) {
   item(`dropped ${rel}`);
 }
 
-// src/commands.pull.ts
+// src/commands/pull/pull.ts
 init_autostash_guard();
-import { existsSync as existsSync46, mkdirSync as mkdirSync14 } from "node:fs";
-import { join as join62 } from "node:path";
+import { existsSync as existsSync47, mkdirSync as mkdirSync14 } from "node:fs";
+import { join as join65 } from "node:path";
 
-// src/commands.push.sections.ts
+// src/commands/push/sections.ts
 init_color();
 
-// src/summary.ts
+// src/render/summary.ts
 init_utils();
 function summaryText(verb, unmapped, collisions = 0, extrasSkipped = 0, localOnly = 0) {
   const extras = extrasSkipped > 0 ? `, ${extrasSkipped} extras skipped` : "";
@@ -7693,7 +7862,7 @@ function summaryRow(verb, unmapped, collisions = 0, extrasSkipped = 0, localOnly
   return text.replace(/^summary: /, "");
 }
 
-// src/commands.push.sections.ts
+// src/commands/push/sections.ts
 function collapsedSkipRow(n, noun) {
   if (n <= 0) return null;
   return `${dim(infoGlyph)} ${n} ${noun}`;
@@ -7766,23 +7935,23 @@ function renderNoScanTree(st, opts = {}) {
   renderTree(buildNoScanSections(st, opts));
 }
 
-// src/commands.pull.ts
+// src/commands/pull/pull.ts
 init_config();
 
-// src/extras-sync.ts
+// src/sync/extras/extras.ts
 init_config();
-import { existsSync as existsSync39, statSync as statSync11 } from "node:fs";
-import { join as join54 } from "node:path";
+import { existsSync as existsSync40, statSync as statSync11 } from "node:fs";
+import { join as join57 } from "node:path";
 init_utils();
 init_utils_json();
 
-// src/extras-sync.remap.ts
+// src/sync/extras/remap.ts
 init_config();
-import { existsSync as existsSync38, mkdirSync as mkdirSync13, readdirSync as readdirSync17, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
-import { dirname as dirname14, join as join53, sep as sep11 } from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync13, readdirSync as readdirSync17, readFileSync as readFileSync19, realpathSync as realpathSync7, rmSync as rmSync16 } from "node:fs";
+import { dirname as dirname15, join as join56, sep as sep11 } from "node:path";
 
-// src/extras-sync.planning-diff.ts
-import { join as join52, normalize as normalize2, sep as sep10 } from "node:path";
+// src/sync/extras/planning-diff.ts
+import { join as join55, normalize as normalize2, sep as sep10 } from "node:path";
 init_utils();
 function processRecord(fields, i, changed, deleted) {
   const status = fields[i];
@@ -7834,7 +8003,7 @@ function planningDeleteTargets(opts) {
   const { deleted } = parsePlanningDiff(raw);
   const logicalPrefix = "shared/extras/" + logical + "/";
   const prefix = logicalPrefix + ".planning/";
-  const planningRoot = join52(localRoot, ".planning");
+  const planningRoot = join55(localRoot, ".planning");
   const planningRootBoundary = planningRoot + sep10;
   const targets = [];
   for (const repoPath of deleted) {
@@ -7842,7 +8011,7 @@ function planningDeleteTargets(opts) {
       continue;
     }
     const remainder = repoPath.slice(logicalPrefix.length);
-    const candidate = join52(localRoot, remainder);
+    const candidate = join55(localRoot, remainder);
     const resolved = normalize2(candidate);
     if (!resolved.startsWith(planningRootBoundary)) {
       throw new NomadFatal(
@@ -7854,7 +8023,7 @@ function planningDeleteTargets(opts) {
   return targets;
 }
 
-// src/extras-sync.remap.ts
+// src/sync/extras/remap.ts
 init_utils_fs();
 init_utils();
 function runExtrasOp(v, dryRun, paths, backup, copy) {
@@ -7863,7 +8032,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   const would = [];
   for (const t of eachExtrasTarget(v, counts)) {
     const { src, dst } = paths(t);
-    if (!existsSync38(src)) continue;
+    if (!existsSync39(src)) continue;
     const item2 = `${t.logical}/${t.dirname}`;
     if (dryRun) {
       would.push(item2);
@@ -7876,7 +8045,7 @@ function runExtrasOp(v, dryRun, paths, backup, copy) {
   return { ...counts, done, would };
 }
 function pruneEmptyAncestors(target, planningRoot) {
-  let dir = dirname14(target);
+  let dir = dirname15(target);
   while (dir !== planningRoot && dir.startsWith(planningRoot + sep11)) {
     try {
       if (readdirSync17(dir).length > 0) break;
@@ -7884,7 +8053,7 @@ function pruneEmptyAncestors(target, planningRoot) {
     } catch {
       break;
     }
-    dir = dirname14(dir);
+    dir = dirname15(dir);
   }
 }
 function tryRealpath(dir) {
@@ -7898,8 +8067,8 @@ function isInsidePlanningRoot(parentReal, rootReal) {
   return parentReal === rootReal || parentReal.startsWith(rootReal + sep11);
 }
 function deletePlanningTarget(target, planningRoot, repoCounterpart) {
-  if (existsSync38(repoCounterpart)) return;
-  const parentReal = tryRealpath(dirname14(target));
+  if (existsSync39(repoCounterpart)) return;
+  const parentReal = tryRealpath(dirname15(target));
   if (parentReal === void 0) return;
   const rootReal = tryRealpath(planningRoot);
   if (rootReal === void 0) return;
@@ -7908,7 +8077,7 @@ function deletePlanningTarget(target, planningRoot, repoCounterpart) {
   pruneEmptyAncestors(target, planningRoot);
 }
 function localDivergesFromPreDelete(target, pre, repoRel, repo) {
-  if (!existsSync38(target)) return false;
+  if (!existsSync39(target)) return false;
   try {
     const preBlob = gitCaptureBuffer(["show", `${pre}:${repoRel}`], repo);
     return !readFileSync19(target).equals(preBlob);
@@ -7953,7 +8122,7 @@ function keptDeletePreview(v, prePostHeads, repo) {
   return kept;
 }
 function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
-  const repoExtras = join53(repo, "shared", "extras");
+  const repoExtras = join56(repo, "shared", "extras");
   for (const t of eachExtrasTarget(v, { unmapped: 0, skipped: 0 })) {
     if (t.dirname !== ".planning") continue;
     let raw;
@@ -7968,14 +8137,14 @@ function propagatePlanningDeletes(v, ts, prePostHeads, repo) {
     }
     const pairs = deletePairsFor(t, raw);
     if (pairs.length === 0) continue;
-    backupExtrasWrite(join53(t.localRoot, t.dirname), ts, t.localRoot);
-    const planningRoot = join53(t.localRoot, ".planning");
+    backupExtrasWrite(join56(t.localRoot, t.dirname), ts, t.localRoot);
+    const planningRoot = join56(t.localRoot, ".planning");
     for (const { target, relToLocal, repoRel } of pairs) {
       if (localDivergesFromPreDelete(target, prePostHeads.pre, repoRel, repo)) {
         warn(keptDeleteWarnLine(t.logical, relToLocal));
         continue;
       }
-      deletePlanningTarget(target, planningRoot, join53(repoExtras, t.logical, relToLocal));
+      deletePlanningTarget(target, planningRoot, join56(repoExtras, t.logical, relToLocal));
     }
   }
 }
@@ -7984,14 +8153,14 @@ function remapExtrasPush(ts, opts = {}) {
   const v = loadValidatedExtras({ missingMsg: "no path-map.json; skipping extras push" });
   if (v === null) return { unmapped: 0, skipped: 0, pushed: [], wouldPush: [] };
   const repo = repoHome();
-  const repoExtras = join53(repo, "shared", "extras");
+  const repoExtras = join56(repo, "shared", "extras");
   if (!dryRun) mkdirSync13(repoExtras, { recursive: true });
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname15 }) => ({
-      src: join53(localRoot, dirname15),
-      dst: join53(repoExtras, logical, dirname15)
+    ({ localRoot, logical, dirname: dirname16 }) => ({
+      src: join56(localRoot, dirname16),
+      dst: join56(repoExtras, logical, dirname16)
     }),
     (dst) => backupRepoWrite(dst, ts, repo),
     // Push copy routing per extra type:
@@ -8000,11 +8169,11 @@ function remapExtrasPush(ts, opts = {}) {
     //     The filter prevents ALWAYS_NEVER_SYNC files from landing in the repo
     //     working tree before the allow-list gate fires, eliminating the
     //     "residue wedges repeat push" regression. The allow-list gate
-    //     (enforceAllowList in commands.push.allowlist.ts, blockSetFor in
+    //     (enforceAllowList in commands/push/allowlist.ts, blockSetFor in
     //     config.never-sync.ts)
     //     remains the hard security boundary.
     //   All others: copyExtrasFiltered with per-extra denylist.
-    (src, dst, dirname15) => dirname15 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname15)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname15))
+    (src, dst, dirname16) => dirname16 === ".planning" ? copyExtrasOverlayFiltered(src, dst, extrasDenySet(dirname16)) : copyExtrasFiltered(src, dst, extrasDenySet(dirname16))
   );
   return { unmapped, skipped, pushed: done, wouldPush: would };
 }
@@ -8020,9 +8189,9 @@ function remapExtrasPull(ts, opts = {}) {
   const { unmapped, skipped, done, would } = runExtrasOp(
     v,
     dryRun,
-    ({ localRoot, logical, dirname: dirname15 }) => ({
-      src: join53(repo, "shared", "extras", logical, dirname15),
-      dst: join53(localRoot, dirname15)
+    ({ localRoot, logical, dirname: dirname16 }) => ({
+      src: join56(repo, "shared", "extras", logical, dirname16),
+      dst: join56(localRoot, dirname16)
     }),
     // Snapshot the host-side dst BEFORE the copy step touches it. Anchor on
     // localRoot so the backup tree mirrors the project layout.
@@ -8040,12 +8209,12 @@ function remapExtrasPull(ts, opts = {}) {
     //     copyExtrasFileSkipDiverged keeps a locally-edited file rather than
     //     clobbering it, so the divergence WARN's keep-local promise holds for
     //     every extra, not just `.planning`.
-    (src, dst, dirname15) => {
-      if (dirname15 === ".claude")
-        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname15));
-      if (dirname15 === ".planning") {
+    (src, dst, dirname16) => {
+      if (dirname16 === ".claude")
+        return copyExtrasFilteredPreserving(src, dst, extrasDenySet(dirname16));
+      if (dirname16 === ".planning") {
         const divergedSet = new Set(listDivergingModified(dst, src));
-        return copyExtrasOverlaySkipDiverged(src, dst, extrasDenySet(dirname15), divergedSet);
+        return copyExtrasOverlaySkipDiverged(src, dst, extrasDenySet(dirname16), divergedSet);
       }
       return copyExtrasFileSkipDiverged(src, dst);
     }
@@ -8056,7 +8225,7 @@ function remapExtrasPull(ts, opts = {}) {
   return { unmapped, skipped, pulled: done, wouldPull: would };
 }
 
-// src/extras-sync.ts
+// src/sync/extras/extras.ts
 function divergenceWarnLine(o) {
   const kind = o.isDir ? "folder" : "file";
   const name = o.isDir ? `${o.dirname}/` : o.dirname;
@@ -8069,20 +8238,20 @@ function divergenceCheckExtras(ts, prePostHeads) {
   const v = loadValidatedExtras({});
   if (v === null) return 0;
   const counts = { unmapped: 0, skipped: 0 };
-  const backupRoot = join54(backupBase(), ts, "extras");
+  const backupRoot = join57(backupBase(), ts, "extras");
   const repo = repoHome();
   let divergedCount = 0;
-  for (const { logical, localRoot, dirname: dirname15 } of eachExtrasTarget(v, counts)) {
-    const local = join54(localRoot, dirname15);
-    const repoEntry = join54(repo, "shared", "extras", logical, dirname15);
-    if (!existsSync39(local) || !existsSync39(repoEntry)) continue;
+  for (const { logical, localRoot, dirname: dirname16 } of eachExtrasTarget(v, counts)) {
+    const local = join57(localRoot, dirname16);
+    const repoEntry = join57(repo, "shared", "extras", logical, dirname16);
+    if (!existsSync40(local) || !existsSync40(repoEntry)) continue;
     const modified = listDivergingModified(local, repoEntry);
     if (modified.length === 0) continue;
     divergedCount += modified.length;
-    const projectBackupRoot = join54(backupRoot, encodePath(localRoot));
+    const projectBackupRoot = join57(backupRoot, encodePath(localRoot));
     warn(
       divergenceWarnLine({
-        dirname: dirname15,
+        dirname: dirname16,
         logical,
         isDir: statSync11(local).isDirectory(),
         count: modified.length,
@@ -8099,10 +8268,10 @@ function divergenceCheckExtras(ts, prePostHeads) {
   return divergedCount;
 }
 
-// src/links.baseline.ts
+// src/sync/links.baseline.ts
 init_config();
 import { lstatSync as lstatSync18, readdirSync as readdirSync18 } from "node:fs";
-import { join as join55, relative as relative8, sep as sep12 } from "node:path";
+import { join as join58, relative as relative8, sep as sep12 } from "node:path";
 init_utils();
 var SHARED_BASELINE_KIND = "shared-links-baseline/1";
 var SHARED_BASELINE_CONFIG_HASH = "not-applicable";
@@ -8144,7 +8313,7 @@ function collectSharedFiles(dir, claude, scan) {
     return;
   }
   for (const entry of entries) {
-    const abs = join55(dir, entry);
+    const abs = join58(dir, entry);
     if (isDeniedName(ALWAYS_NEVER_SYNC, entry)) {
       scan.declined.push(baselineKey(claude, abs));
       continue;
@@ -8160,7 +8329,7 @@ function enumerateLocalSharedScan(map, opts = {}) {
       scan.declined.push(name);
       continue;
     }
-    addLocalPath(join55(claude, name), claude, scan);
+    addLocalPath(join58(claude, name), claude, scan);
   }
   return scan;
 }
@@ -8172,7 +8341,7 @@ function buildSharedBaseline(map, opts = {}) {
   const files = {};
   for (const [key, st] of Object.entries(enumerateLocalSharedFiles(map, opts))) {
     try {
-      files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join55(claude, key)) };
+      files[key] = { size: st.size, mtime: st.mtime, hash: hashFile(join58(claude, key)) };
     } catch {
     }
   }
@@ -8187,12 +8356,12 @@ function writeSharedBaseline(map, opts = {}) {
   }
 }
 
-// src/commands.pull.win32.ts
+// src/commands/pull/win32.ts
 init_color();
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join60 } from "node:path";
+import { existsSync as existsSync45 } from "node:fs";
+import { join as join63 } from "node:path";
 
-// src/commands.pull.recovery.git.ts
+// src/commands/pull/recovery.git.ts
 init_utils();
 import { execFileSync as execFileSync22 } from "node:child_process";
 function gitCapture(args, cwd) {
@@ -8231,13 +8400,13 @@ function parseDirtyPaths(repo, opts = {}) {
   return parsePorcelainZ(gitStatusPorcelainZ(repo, opts));
 }
 
-// src/commands.pull.win32.ts
+// src/commands/pull/win32.ts
 init_config();
 
-// src/links.deletions.ts
+// src/sync/links.deletions.ts
 init_config();
-import { existsSync as existsSync40, lstatSync as lstatSync19, rmSync as rmSync17 } from "node:fs";
-import { join as join56, relative as relative9, resolve as resolve5, sep as sep13 } from "node:path";
+import { existsSync as existsSync41, lstatSync as lstatSync19, rmSync as rmSync17 } from "node:fs";
+import { join as join59, relative as relative9, resolve as resolve5, sep as sep13 } from "node:path";
 init_utils();
 init_utils_fs();
 function isUnknown(declined, key) {
@@ -8247,15 +8416,15 @@ function deletionFor(key, names, claude, sharedRoot) {
   const segments = key.split("/");
   const name = segments[0];
   if (!names.has(name)) return null;
-  if (!existsSync40(join56(claude, name))) return null;
+  if (!existsSync41(join59(claude, name))) return null;
   if (segments.some((segment) => isDeniedName(ALWAYS_NEVER_SYNC, segment))) return null;
   const repoPath = resolve5(sharedRoot, key);
-  const rel = relative9(join56(sharedRoot, name), repoPath);
+  const rel = relative9(join59(sharedRoot, name), repoPath);
   if (rel === "" || rel === ".." || rel.startsWith(`..${sep13}`)) return null;
   if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
     return null;
-  if (!existsSync40(repoPath)) return null;
-  return { kind: "deletion", name, localPath: join56(claude, key), repoPath };
+  if (!existsSync41(repoPath)) return null;
+  return { kind: "deletion", name, localPath: join59(claude, key), repoPath };
 }
 function planSharedLinkDeletions(map, opts = {}) {
   if (process.platform !== "win32") return [];
@@ -8263,7 +8432,7 @@ function planSharedLinkDeletions(map, opts = {}) {
   const baseline = readSharedBaseline();
   if (baseline === null) return [];
   const claude = claudeHome();
-  const sharedRoot = join56(repoHome(), "shared");
+  const sharedRoot = join59(repoHome(), "shared");
   const linkNames = opts.linkNames ?? allSharedLinks(map);
   const scan = enumerateLocalSharedScan(map, { linkNames });
   const present = new Set(Object.keys(scan.files).map((key) => key.toLowerCase()));
@@ -8295,11 +8464,11 @@ function applySharedLinkDeletions(map, ts, opts = {}) {
   return removed;
 }
 
-// src/links.mirror.ts
+// src/sync/links.mirror.ts
 init_config();
 init_error_text();
-import { existsSync as existsSync41, lstatSync as lstatSync20, rmSync as rmSync18, statSync as statSync12 } from "node:fs";
-import { join as join57 } from "node:path";
+import { existsSync as existsSync42, lstatSync as lstatSync20, rmSync as rmSync18, statSync as statSync12 } from "node:fs";
+import { join as join60 } from "node:path";
 init_utils();
 init_utils_fs();
 function emitMirror(onPreview, name, localPath, repoPath) {
@@ -8313,7 +8482,7 @@ function emitMirrorWet(onPreview, name, localPath, repoPath) {
   if (onPreview) onPreview({ kind: "mirror", name, localPath, repoPath });
 }
 function notShared(target) {
-  return !existsSync41(target);
+  return !existsSync42(target);
 }
 function warnUnusableSharedTarget(name, dryRun, state) {
   const reason = state === "dangling" ? `shared/${name} does not resolve to anything usable in the sync repo. Remove it, or restore what it points at` : `shared/${name} could not be read in the sync repo, so whether it is usable could not be determined. Check its permissions there`;
@@ -8341,8 +8510,8 @@ function warnUnreadableLocalName(name, target, err, dryRun) {
   );
 }
 function mirrorOneSharedName(name, claude, repo, policy, opts) {
-  const localPath = join57(claude, name);
-  const target = join57(repo, "shared", name);
+  const localPath = join60(claude, name);
+  const target = join60(repo, "shared", name);
   let stat;
   try {
     stat = lstatSync20(localPath, { throwIfNoEntry: false });
@@ -8402,7 +8571,7 @@ function mirrorSharedNames(map, policy, opts = {}) {
   if (map === null) return;
   const claude = claudeHome();
   const repo = repoHome();
-  const sharedPath = join57(repo, "shared");
+  const sharedPath = join60(repo, "shared");
   const sharedState = classifyPresence(sharedPath);
   if (isUnusableTarget(sharedState)) {
     warnUnusableSharedDir(opts.dryRun === true, sharedState);
@@ -8431,7 +8600,7 @@ function presentAt(abs) {
   }
 }
 function removeUntrackedDenied(repo, path, segment, ts) {
-  const abs = join57(repo, path);
+  const abs = join60(repo, path);
   const denied = `the path segment "${segment}" is on the never-sync list`;
   if (!presentAt(abs)) {
     warn(
@@ -8439,7 +8608,7 @@ function removeUntrackedDenied(repo, path, segment, ts) {
     );
     return;
   }
-  const snapshotted = existsSync41(abs);
+  const snapshotted = existsSync42(abs);
   try {
     backupRepoWrite(abs, ts, repo);
   } catch (err) {
@@ -8475,7 +8644,7 @@ function reportTrackedDenied(repo, path, segment) {
     );
     return;
   }
-  if (!existsSync41(join57(repo, path))) return;
+  if (!existsSync42(join60(repo, path))) return;
   warn(
     `${path} is tracked and has changes against HEAD: ${denied}. Nothing was changed. Run git checkout HEAD -- "${path}" to put the committed content back, or move the file outside shared/ if you want to keep it. Neither of those takes the committed copy out of the repo: git rm -- "${path}" and a commit does that going forward, and if it holds a real secret, rotate it and rewrite history, because nomad only changes your local worktree and index and cannot scrub what a previous push already sent to the remote`
   );
@@ -8491,10 +8660,10 @@ function revertDeniedMirrorPaths(repo, status, ts) {
   }
 }
 
-// src/preview.ts
+// src/render/preview.ts
 init_config();
-import { existsSync as existsSync43 } from "node:fs";
-import { join as join59 } from "node:path";
+import { existsSync as existsSync44 } from "node:fs";
+import { join as join62 } from "node:path";
 
 // node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -8746,7 +8915,7 @@ function tokenize(value, options) {
   return retLines;
 }
 
-// src/diff-lines.ts
+// src/render/diff-lines.ts
 init_color();
 function diffLinesToUnified(oldStr, newStr) {
   const parts = diffLines(oldStr, newStr);
@@ -8767,18 +8936,18 @@ function diffLinesToUnified(oldStr, newStr) {
   return lines;
 }
 
-// src/preview.skills.ts
+// src/render/preview.skills.ts
 init_config();
-import { existsSync as existsSync42, readdirSync as readdirSync19 } from "node:fs";
-import { join as join58 } from "node:path";
+import { existsSync as existsSync43, readdirSync as readdirSync19 } from "node:fs";
+import { join as join61 } from "node:path";
 function buildSkillsPreviewSection() {
   const s = section("Skills");
-  const sharedSkills = join58(repoHome(), "shared", "skills");
-  if (!existsSync42(sharedSkills)) return s;
+  const sharedSkills = join61(repoHome(), "shared", "skills");
+  if (!existsSync43(sharedSkills)) return s;
   const sharedNames = readdirSync19(sharedSkills, { encoding: "utf8" }).filter((name) => !isSkillExcluded(name)).sort((a, b) => a.localeCompare(b, "en"));
   for (const name of sharedNames) addItem(s, name);
-  const localSkills = join58(claudeHome(), "skills");
-  const localOnly = existsSync42(localSkills) ? readdirSync19(localSkills, { encoding: "utf8" }).filter(
+  const localSkills = join61(claudeHome(), "skills");
+  const localOnly = existsSync43(localSkills) ? readdirSync19(localSkills, { encoding: "utf8" }).filter(
     (name) => !isSkillExcluded(name) && !sharedNames.includes(name)
   ).length : 0;
   if (localOnly > 0) {
@@ -8787,7 +8956,7 @@ function buildSkillsPreviewSection() {
   return s;
 }
 
-// src/preview.ts
+// src/render/preview.ts
 init_utils_json();
 var CANONICAL_ORDER_NOTE = "settings.json will be rewritten in canonical key order; no value changes";
 function diffJsonStrings(currentJsonText, newJsonText) {
@@ -8800,7 +8969,7 @@ function diffJsonStrings(currentJsonText, newJsonText) {
   return lines.join("\n");
 }
 function readJsonOrNull(path) {
-  if (!existsSync43(path)) return null;
+  if (!existsSync44(path)) return null;
   try {
     return readJson(path);
   } catch {
@@ -8814,12 +8983,12 @@ function previewSettings(basePath, hostPath, settingsPath) {
   }
   const notes = [];
   const hostOverrides = readJsonOrNull(hostPath);
-  if (hostOverrides === null && existsSync43(hostPath)) {
+  if (hostOverrides === null && existsSync44(hostPath)) {
     notes.push(`malformed hosts/${HOST}.json; ignoring overrides`);
   }
   const merged = stripGsdHookEntries(deepMerge(base, hostOverrides ?? {}));
   const current = readJsonOrNull(settingsPath);
-  if (current === null && existsSync43(settingsPath)) {
+  if (current === null && existsSync44(settingsPath)) {
     return { diff: "", notes: [...notes, "malformed; skipping diff"] };
   }
   const strippedCurrent = stripGsdHookEntries(current ?? {});
@@ -8886,9 +9055,9 @@ function computePreview(ts, map, verb = "pull", plans) {
     onPreview: (e) => addItem(links, formatLinkRow(e))
   });
   const settingsResult = previewSettings(
-    join59(repo, "shared", "settings.base.json"),
-    join59(repo, "hosts", `${HOST}.json`),
-    join59(claude, "settings.json")
+    join62(repo, "shared", "settings.base.json"),
+    join62(repo, "hosts", `${HOST}.json`),
+    join62(claude, "settings.json")
   );
   const settingsSection = buildSettingsSectionForPreview(settingsResult);
   const sessions = section("Sessions");
@@ -8904,7 +9073,7 @@ function computePreview(ts, map, verb = "pull", plans) {
   const extras = section("Extras");
   let extrasSkipped = 0;
   let extrasUnmapped = 0;
-  if (existsSync43(join59(repo, "path-map.json")) && existsSync43(join59(repo, "shared", "extras"))) {
+  if (existsSync44(join62(repo, "path-map.json")) && existsSync44(join62(repo, "shared", "extras"))) {
     const extrasResult = remapExtrasPull(ts, { dryRun: true });
     for (const entry of extrasResult.wouldPull) {
       addItem(extras, entry);
@@ -8921,11 +9090,11 @@ function computePreview(ts, map, verb = "pull", plans) {
   return { unmapped: remapResult.unmapped, collisions: 0, localOnly };
 }
 
-// src/commands.pull.win32.ts
+// src/commands/pull/win32.ts
 init_utils();
 init_utils_json();
 function readMapForMirror(mapPath) {
-  if (!existsSync44(mapPath)) return { projects: {} };
+  if (!existsSync45(mapPath)) return { projects: {} };
   try {
     return readPathMap(mapPath);
   } catch {
@@ -8989,7 +9158,7 @@ function reconcileSharedLinksBeforePull(repo, ts) {
   let namesDerived = false;
   let derivedSharedDirs;
   try {
-    const map = readMapForMirror(join60(repo, "path-map.json"));
+    const map = readMapForMirror(join63(repo, "path-map.json"));
     if (map !== null) {
       linkNames = allSharedLinks(map);
       namesDerived = true;
@@ -9028,7 +9197,7 @@ function buildMirrorSection(events, discard) {
 function describeSkippedMirrorDiscard(repo, ts) {
   if (process.platform !== "win32") return null;
   try {
-    const map = readMapForMirror(join60(repo, "path-map.json"));
+    const map = readMapForMirror(join63(repo, "path-map.json"));
     const linkNames = map !== null ? allSharedLinks(map, { quiet: true }) : void 0;
     const captures = [];
     stageLocalSharedEdits(map, ts, {
@@ -9037,13 +9206,13 @@ function describeSkippedMirrorDiscard(repo, ts) {
       linkNames
     });
     if (captures.length === 0) return null;
-    return { count: captures.length, backupPath: join60(backupBase(), ts) };
+    return { count: captures.length, backupPath: join63(backupBase(), ts) };
   } catch {
     return null;
   }
 }
 function planSharedReconcileBeforePull(repo, ts) {
-  const map = readMapForMirror(join60(repo, "path-map.json"));
+  const map = readMapForMirror(join63(repo, "path-map.json"));
   const captures = [];
   const linkNames = process.platform === "win32" && map !== null ? allSharedLinks(map) : void 0;
   stageLocalSharedEdits(map, ts, { dryRun: true, onPreview: (e) => captures.push(e), linkNames });
@@ -9055,11 +9224,11 @@ function planSharedReconcileBeforePull(repo, ts) {
   };
 }
 
-// src/commands.pull.collision.ts
+// src/commands/pull/collision.ts
 init_config();
 init_exit_codes();
-import { existsSync as existsSync45, lstatSync as lstatSync21, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
-import { join as join61 } from "node:path";
+import { existsSync as existsSync46, lstatSync as lstatSync21, readFileSync as readFileSync20, rmSync as rmSync19 } from "node:fs";
+import { join as join64 } from "node:path";
 init_utils();
 var SHARED_PREFIX = /^shared\//;
 var EXTENSION = /(\.[^.]+)?$/;
@@ -9115,15 +9284,15 @@ function isContainedMirrorPath(rel) {
 }
 function matchesLocalOriginal(repo, rel) {
   try {
-    const local = join61(claudeHome(), rel.replace(SHARED_PREFIX, ""));
-    return readFileSync20(join61(repo, rel)).equals(readFileSync20(local));
+    const local = join64(claudeHome(), rel.replace(SHARED_PREFIX, ""));
+    return readFileSync20(join64(repo, rel)).equals(readFileSync20(local));
   } catch {
     return false;
   }
 }
 function removeMirroredCopies(repo, repoRelPaths) {
   for (const rel of repoRelPaths.filter(isContainedMirrorPath)) {
-    const abs = join61(repo, rel);
+    const abs = join64(repo, rel);
     try {
       if (lstatSync21(abs, { throwIfNoEntry: false })?.isFile() !== true) continue;
       if (!matchesLocalOriginal(repo, rel)) continue;
@@ -9132,7 +9301,7 @@ function removeMirroredCopies(repo, repoRelPaths) {
       warn(`could not remove nomad's copy at ${abs}: ${err.message}`);
     }
   }
-  return repoRelPaths.every((rel) => !existsSync45(join61(repo, rel)));
+  return repoRelPaths.every((rel) => !existsSync46(join64(repo, rel)));
 }
 function pullWithCollisionRunbook(repo, mirrored) {
   try {
@@ -9147,10 +9316,10 @@ function pullWithCollisionRunbook(repo, mirrored) {
   }
 }
 
-// src/commands.pull.ts
-init_commands_pull_wedge();
+// src/commands/pull/pull.ts
+init_wedge();
 
-// src/commands.pull.recovery.ts
+// src/commands/pull/recovery.ts
 init_config();
 init_utils();
 init_utils_fs();
@@ -9244,9 +9413,9 @@ an ordinary pull.
   log(buildRecoverySummary(branchName, strandedLog, untracked));
 }
 
-// src/commands.pull.recovery.unmerged.ts
+// src/commands/pull/recovery.unmerged.ts
 init_exit_codes();
-init_commands_pull_wedge();
+init_wedge();
 init_utils();
 function recoverUnmergedIndex(repo) {
   const conflicted = new Set(
@@ -9269,7 +9438,7 @@ function recoverUnmergedIndex(repo) {
   }
 }
 
-// src/commands.pull.ts
+// src/commands/pull/pull.ts
 init_exit_codes();
 init_utils();
 init_utils_fs();
@@ -9339,7 +9508,7 @@ function runPullCore(opts = {}) {
   try {
     return runPullWithBackupTs(ts, opts);
   } finally {
-    discardEmptyBackupDir(join62(backup, ts));
+    discardEmptyBackupDir(join65(backup, ts));
   }
 }
 function runPullWithBackupTs(ts, opts) {
@@ -9350,7 +9519,7 @@ function runPullWithBackupTs(ts, opts) {
   const backup = backupBase();
   const recovered = handleWedge(repo, forceRemote);
   if (!dryRun) {
-    const backupRoot = join62(backup, ts);
+    const backupRoot = join65(backup, ts);
     try {
       mkdirSync14(backupRoot, { recursive: true });
     } catch (err) {
@@ -9373,8 +9542,8 @@ function runPullWithBackupTs(ts, opts) {
     pullWithCollisionRunbook(repo, mirrored);
   });
   assertNoAutostashConflict(repo, "nomad pull");
-  const mapPath = join62(repo, "path-map.json");
-  const map = existsSync46(mapPath) ? readPathMap(mapPath) : { projects: {} };
+  const mapPath = join65(repo, "path-map.json");
+  const map = existsSync47(mapPath) ? readPathMap(mapPath) : { projects: {} };
   const divergedKeptLocal = divergenceCheckExtras(ts, dryRun ? prePostHeads : void 0);
   if (dryRun) {
     computePreview(ts, map, "pull", plansAgainst(sharedPlans, map));
@@ -9401,8 +9570,8 @@ function runPullWithBackupTs(ts, opts) {
 }
 function cmdPull(opts = {}) {
   const repo = repoHome();
-  if (!existsSync46(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync46(join62(repo, "shared", "settings.base.json"))) {
+  if (!existsSync47(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync47(join65(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("pull");
@@ -9423,15 +9592,15 @@ function cmdPull(opts = {}) {
   }
 }
 
-// src/commands.push.ts
+// src/commands/push/push.ts
 init_config();
-import { existsSync as existsSync50 } from "node:fs";
-import { join as join67 } from "node:path";
+import { existsSync as existsSync51 } from "node:fs";
+import { join as join70 } from "node:path";
 
-// src/commands.push.selection.ts
+// src/commands/push/selection.ts
 init_config();
-import { existsSync as existsSync47, statSync as statSync13 } from "node:fs";
-import { join as join63 } from "node:path";
+import { existsSync as existsSync48, statSync as statSync13 } from "node:fs";
+import { join as join66 } from "node:path";
 init_utils_json();
 function buildCurrentMap(map) {
   const current = {};
@@ -9440,8 +9609,8 @@ function buildCurrentMap(map) {
   for (const [, hostMap] of Object.entries(map.projects)) {
     const localPath = hostMap[HOST];
     if (!localPath) continue;
-    const localDir = join63(claude, "projects", encodePath(localPath));
-    if (!existsSync47(localDir)) continue;
+    const localDir = join66(claude, "projects", encodePath(localPath));
+    if (!existsSync48(localDir)) continue;
     for (const f of enumerateSourceFiles(localDir)) {
       const st = statSync13(f);
       current[f] = { size: st.size, mtime: st.mtimeMs };
@@ -9472,7 +9641,7 @@ function computePushSelection(map, old, scannerVersion, configHash, fullScan) {
   };
 }
 function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan) {
-  const map = existsSync47(mapPath) ? readPathMap(mapPath) : null;
+  const map = existsSync48(mapPath) ? readPathMap(mapPath) : null;
   const { selection, newManifest } = computePushSelection(
     map,
     old,
@@ -9483,7 +9652,7 @@ function loadSelectionForPush(mapPath, old, scannerVersion, configHash, fullScan
   return { map, selection, newManifest };
 }
 
-// src/commands.push.allowlist.ts
+// src/commands/push/allowlist.ts
 init_config();
 init_config_sharedDirs_guard();
 init_utils();
@@ -9558,21 +9727,21 @@ function enforceAllowList(statusPorcelain, map) {
     fail(`${p} is in NEVER_SYNC and must never be pushed`);
   }
   for (const p of violations) {
-    fail(`to sync ${p}, add to PUSH_ALLOWED in src/config.ts`);
+    fail(`to sync ${p}, add to PUSH_ALLOWED in src/core/config.ts`);
   }
   throw new NomadFatal("push allow-list violations");
 }
 
-// src/commands.push.settings.ts
+// src/commands/push/settings.ts
 init_config();
-import { existsSync as existsSync48 } from "node:fs";
-import { join as join64 } from "node:path";
+import { existsSync as existsSync49 } from "node:fs";
+import { join as join67 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function stripGsdHooksFromBase(repo, backup) {
-  const basePath = join64(repo, "shared", "settings.base.json");
-  if (!existsSync48(basePath)) return;
+  const basePath = join67(repo, "shared", "settings.base.json");
+  if (!existsSync49(basePath)) return;
   let base;
   try {
     base = readJson(basePath);
@@ -9586,14 +9755,14 @@ function stripGsdHooksFromBase(repo, backup) {
   writeJsonAtomic(basePath, stripped);
 }
 function reportSettingsAheadDrift(repo) {
-  const basePath = join64(repo, "shared", "settings.base.json");
-  if (!existsSync48(basePath)) return;
-  const settingsPath = join64(claudeHome(), "settings.json");
-  if (!existsSync48(settingsPath)) return;
+  const basePath = join67(repo, "shared", "settings.base.json");
+  if (!existsSync49(basePath)) return;
+  const settingsPath = join67(claudeHome(), "settings.json");
+  if (!existsSync49(settingsPath)) return;
   try {
     const base = readJson(basePath);
-    const hostPath = join64(repo, "hosts", `${HOST}.json`);
-    const overrides = existsSync48(hostPath) ? readJson(hostPath) : {};
+    const hostPath = join67(repo, "hosts", `${HOST}.json`);
+    const overrides = existsSync49(hostPath) ? readJson(hostPath) : {};
     const merged = deepMerge(base, overrides);
     const settings = readJson(settingsPath);
     const { ahead } = classifySettingsDrift(merged, settings);
@@ -9607,12 +9776,12 @@ function reportSettingsAheadDrift(repo) {
   }
 }
 
-// src/commands.push.guards.ts
-init_push_checks();
+// src/commands/push/guards.ts
+init_checks();
 init_utils();
-import { join as join65, relative as relative10 } from "node:path";
+import { join as join68, relative as relative10 } from "node:path";
 function guardGitlinks(repo) {
-  const gitlinks = findGitlinks(join65(repo, "shared"));
+  const gitlinks = findGitlinks(join68(repo, "shared"));
   if (gitlinks.length === 0) return;
   for (const p of gitlinks) {
     const rel = relative10(repo, p).replaceAll("\\", "/");
@@ -9639,10 +9808,10 @@ function guardResolutionModeConflicts(dryRun, redactAll, allowAll, allowRule) {
   }
 }
 
-// src/commands.push.steps.ts
+// src/commands/push/steps.ts
 init_config();
 
-// src/push-global-config.ts
+// src/commands/push/global-config.ts
 init_config();
 import { execFileSync as execFileSync23 } from "node:child_process";
 var STATUS_LABELS = {
@@ -9714,19 +9883,19 @@ function collectGlobalConfigChanges(repoHome2, hostname2, opts) {
   return changes;
 }
 
-// src/commands.push.steps.ts
-init_push_leak_verdict();
+// src/commands/push/steps.ts
+init_leak_verdict();
 
-// src/push-preview.ts
+// src/commands/push/preview.ts
 init_color();
 init_config();
 init_config_sharedDirs_guard();
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync49, lstatSync as lstatSync22, mkdirSync as mkdirSync15, readdirSync as readdirSync20, rmSync as rmSync20 } from "node:fs";
+import { copyFileSync, existsSync as existsSync50, lstatSync as lstatSync22, mkdirSync as mkdirSync15, readdirSync as readdirSync20, rmSync as rmSync20 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join66, relative as relative11, sep as sep14 } from "node:path";
-init_push_leak_verdict();
-init_push_gitleaks();
+import { join as join69, relative as relative11, sep as sep14 } from "node:path";
+init_leak_verdict();
+init_gitleaks();
 init_utils_fs();
 init_utils_json();
 var NOTHING_TO_SCAN_ROW = `${dim(infoGlyph)} nothing to scan, no leaks`;
@@ -9736,7 +9905,7 @@ function stageSessionDir(localDir, dstDir, changed) {
     const matching = [...changed].filter((p) => p.startsWith(prefix));
     if (matching.length === 0) return false;
     for (const src of matching) {
-      copyFileAtomic(src, join66(dstDir, relative11(localDir, src)));
+      copyFileAtomic(src, join69(dstDir, relative11(localDir, src)));
     }
     return true;
   }
@@ -9752,14 +9921,14 @@ function stageSessions(tmpRoot, map, changed) {
     if (!p || p === "TBD") continue;
     reverse.set(encodePath(p), logical);
   }
-  const localProjects = join66(claudeHome(), "projects");
-  if (!existsSync49(localProjects)) return 0;
+  const localProjects = join69(claudeHome(), "projects");
+  if (!existsSync50(localProjects)) return 0;
   let staged = 0;
   for (const dir of readdirSync20(localProjects)) {
     const logical = reverse.get(dir);
     if (!logical) continue;
-    const localDir = join66(localProjects, dir);
-    const dstDir = join66(tmpRoot, "shared", "projects", logical);
+    const localDir = join69(localProjects, dir);
+    const dstDir = join69(tmpRoot, "shared", "projects", logical);
     if (stageSessionDir(localDir, dstDir, changed)) staged++;
   }
   return staged;
@@ -9773,11 +9942,11 @@ function stageExtras(tmpRoot, map) {
     assertSafeLogical(logical);
     const localRoot = map.projects[logical]?.[HOST];
     if (!localRoot || localRoot === "TBD") continue;
-    for (const dirname15 of dirnames) {
-      if (!whitelist.includes(dirname15)) continue;
-      const src = join66(localRoot, dirname15);
-      if (!existsSync49(src)) continue;
-      const dst = join66(tmpRoot, "shared", "extras", logical, dirname15);
+    for (const dirname16 of dirnames) {
+      if (!whitelist.includes(dirname16)) continue;
+      const src = join69(localRoot, dirname16);
+      if (!existsSync50(src)) continue;
+      const dst = join69(tmpRoot, "shared", "extras", logical, dirname16);
       copyExtras(src, dst);
       staged++;
     }
@@ -9785,19 +9954,19 @@ function stageExtras(tmpRoot, map) {
   return staged;
 }
 function stageSkills(tmpRoot) {
-  const localSkills = join66(claudeHome(), "skills");
+  const localSkills = join69(claudeHome(), "skills");
   const stat = lstatSync22(localSkills, { throwIfNoEntry: false });
   if (stat === void 0 || stat.isSymbolicLink()) return 0;
   const names = readdirSync20(localSkills, { encoding: "utf8" }).filter((n) => !isSkillExcluded(n));
   if (names.length === 0) return 0;
-  copySkillsPush(localSkills, join66(tmpRoot, "shared", "skills"));
+  copySkillsPush(localSkills, join69(tmpRoot, "shared", "skills"));
   return names.length;
 }
 function previewPushLeaks(map, opts = {}) {
-  const cacheDir = join66(homedir7(), ".cache", "claude-nomad");
+  const cacheDir = join69(homedir7(), ".cache", "claude-nomad");
   mkdirSync15(cacheDir, { recursive: true });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes4(4).toString("hex")}`;
-  const tmpRoot = join66(cacheDir, `push-preview-tree-${stamp}`);
+  const tmpRoot = join69(cacheDir, `push-preview-tree-${stamp}`);
   try {
     const sessionCount = stageSessions(tmpRoot, map, opts.selection?.changed);
     const extrasCount = stageExtras(tmpRoot, map);
@@ -9805,9 +9974,9 @@ function previewPushLeaks(map, opts = {}) {
     if (sessionCount + extrasCount + skillCount === 0) {
       return { leak: false, verdictRow: NOTHING_TO_SCAN_ROW, recovery: null, findings: [] };
     }
-    const ignoreFile = join66(repoHome(), ".gitleaksignore");
-    if (existsSync49(ignoreFile)) {
-      copyFileSync(ignoreFile, join66(tmpRoot, ".gitleaksignore"));
+    const ignoreFile = join69(repoHome(), ".gitleaksignore");
+    if (existsSync50(ignoreFile)) {
+      copyFileSync(ignoreFile, join69(tmpRoot, ".gitleaksignore"));
     }
     let findings;
     try {
@@ -9824,7 +9993,7 @@ function previewPushLeaks(map, opts = {}) {
   }
 }
 
-// src/commands.push.steps.ts
+// src/commands/push/steps.ts
 init_utils();
 async function commitAndPush(st, ts, map, resolution, repo, newManifest, render) {
   gitOrFatal(["add", "-A"], "git add", repo);
@@ -9876,8 +10045,8 @@ function runDryRunPreview(st, map, repo, selection) {
   if (verdict.recovery !== null) fail(verdict.recovery);
 }
 
-// src/commands.push.ts
-init_push_checks();
+// src/commands/push/push.ts
+init_checks();
 init_utils();
 init_utils_fs();
 function aheadOfUpstream(repo) {
@@ -9935,7 +10104,7 @@ async function runPushCore(opts = {}) {
   const scannerVersion = probeGitleaks();
   const configHash = computeConfigHash();
   const old = readManifest(manifestPath());
-  const mapPath = join67(repo, "path-map.json");
+  const mapPath = join70(repo, "path-map.json");
   const { map, selection, newManifest } = loadSelectionForPush(
     mapPath,
     old,
@@ -9988,7 +10157,7 @@ async function cmdPush(opts = {}) {
     opts.allowRule
   );
   const repo = repoHome();
-  if (!existsSync50(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync51(repo)) die(`repo not cloned at ${repo}`);
   const handle = acquireLock("push");
   if (handle === null) process.exit(0);
   try {
@@ -10005,9 +10174,9 @@ async function cmdPush(opts = {}) {
   }
 }
 
-// src/commands.sync.ts
-import { existsSync as existsSync51 } from "node:fs";
-import { join as join68 } from "node:path";
+// src/commands/sync.ts
+import { existsSync as existsSync52 } from "node:fs";
+import { join as join71 } from "node:path";
 init_config();
 init_color();
 init_utils();
@@ -10148,8 +10317,8 @@ async function cmdSync(opts = {}) {
   const dryRun = opts.dryRun === true;
   const verbose = opts.verbose === true;
   const repo = repoHome();
-  if (!existsSync51(repo)) die(`repo not cloned at ${repo}`);
-  if (!existsSync51(join68(repo, "shared", "settings.base.json"))) {
+  if (!existsSync52(repo)) die(`repo not cloned at ${repo}`);
+  if (!existsSync52(join71(repo, "shared", "settings.base.json"))) {
     die("repo not initialized; run 'nomad init' to scaffold");
   }
   const handle = acquireLock("sync");
@@ -10172,9 +10341,11 @@ async function cmdSync(opts = {}) {
   }
 }
 
-// src/commands.update.ts
-import { execFileSync as execFileSync24 } from "node:child_process";
+// src/commands/update.ts
 init_utils();
+import { execFileSync as execFileSync24 } from "node:child_process";
+var RELEASE_NOTES_TAG_URL = "https://github.com/funkadelic/claude-nomad/releases/tag";
+var SEMVER = /^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/;
 function readInstalledVersion(run = execFileSync24) {
   const isWin = process.platform === "win32";
   try {
@@ -10186,6 +10357,10 @@ function readInstalledVersion(run = execFileSync24) {
     return null;
   }
 }
+function readOwnVersion(run) {
+  const version = readInstalledVersion(run);
+  return version !== null && SEMVER.test(version) ? version : null;
+}
 function cmdUpdate(currentVersion, run = execFileSync24) {
   console.log(`Updating claude-nomad v${currentVersion}...`);
   const isWin = process.platform === "win32";
@@ -10209,26 +10384,27 @@ function cmdUpdate(currentVersion, run = execFileSync24) {
 ${detail}` : "";
     throw new NomadFatal(`npm update -g claude-nomad failed: ${e.message}${suffix}`);
   }
-  const version = readInstalledVersion(run);
+  const version = readOwnVersion(run);
   if (!version) {
     console.log('Update complete. Run "nomad --version" to confirm the new version.');
-  } else if (version === currentVersion) {
-    console.log(`claude-nomad is already at the latest version (v${version}).`);
-  } else {
-    console.log(`claude-nomad is now at v${version}`);
+    return;
   }
+  console.log(
+    version === currentVersion ? `claude-nomad is already at the latest version (v${version}).` : `claude-nomad is now at v${version}`
+  );
+  console.log(`Release notes: ${RELEASE_NOTES_TAG_URL}/v${version}`);
 }
 
 // src/nomad.ts
 init_config();
 
-// src/crash-report.write.ts
+// src/core/crash-report.write.ts
 init_config();
 import { randomBytes as randomBytes5 } from "node:crypto";
 import { mkdirSync as mkdirSync16, readdirSync as readdirSync21, statSync as statSync14, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join70 } from "node:path";
+import { join as join73 } from "node:path";
 
-// src/crash-report.ts
+// src/core/crash-report.ts
 var CRASH_MAX_STACK_LINES = 50;
 var CRASH_MAX_ARGV = 32;
 var CRASH_MAX_ARGV_TOKEN_LENGTH = 200;
@@ -10308,18 +10484,18 @@ function buildCrashReport(input) {
   return truncateToBytes(scrubbed, CRASH_MAX_REPORT_BYTES);
 }
 
-// src/crash-report.redact.ts
+// src/core/crash-report.redact.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync21, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join69 } from "node:path";
-init_push_gitleaks_scan();
+import { join as join72 } from "node:path";
+init_gitleaks_scan();
 var CRASH_SCAN_TIMEOUT_MS = 3e3;
 var SCAN_UNAVAILABLE_ADVISORY = "\n\n[gitleaks value-based scan unavailable; only structural redaction applied. Review before sharing this file publicly.]\n";
 function redactWithGitleaks(text, scan = scanFile) {
   let dir;
   try {
-    dir = mkdtempSync3(join69(tmpdir2(), "nomad-crash-scan-"));
-    const tmp = join69(dir, "crash.txt");
+    dir = mkdtempSync3(join72(tmpdir2(), "nomad-crash-scan-"));
+    const tmp = join72(dir, "crash.txt");
     writeFileSync10(tmp, text, { mode: 384 });
     const findings = scan(tmp, false, CRASH_SCAN_TIMEOUT_MS);
     if (findings === null) return text + SCAN_UNAVAILABLE_ADVISORY;
@@ -10336,7 +10512,7 @@ function redactWithGitleaks(text, scan = scanFile) {
   }
 }
 
-// src/crash-report.write.ts
+// src/core/crash-report.write.ts
 init_utils_fs();
 init_utils();
 var CRASH_RETENTION_KEEP = 20;
@@ -10344,7 +10520,7 @@ function listCrashFiles(dir = crashDir()) {
   try {
     return readdirSync21(dir).flatMap((name) => {
       try {
-        return [{ name, mtimeMs: statSync14(join70(dir, name)).mtimeMs }];
+        return [{ name, mtimeMs: statSync14(join73(dir, name)).mtimeMs }];
       } catch {
         return [];
       }
@@ -10358,7 +10534,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
   const targets = prunableByCount(files, keep);
   for (const name of targets) {
     try {
-      unlinkSync2(join70(dir, name));
+      unlinkSync2(join73(dir, name));
     } catch {
     }
   }
@@ -10366,7 +10542,7 @@ function pruneCrashDir(dir, keep = CRASH_RETENTION_KEEP) {
 function writeCrashReport(text, dir = crashDir()) {
   mkdirSync16(dir, { recursive: true, mode: 448 });
   const stamp = `${nowTimestamp()}-${process.pid}-${randomBytes5(4).toString("hex")}`;
-  const path = join70(dir, `crash-${stamp}.txt`);
+  const path = join73(dir, `crash-${stamp}.txt`);
   writeFileSync11(path, text, { mode: 384 });
   pruneCrashDir(dir);
   return path;
@@ -10396,20 +10572,20 @@ function handleCrash(err, argv, opts) {
   }
 }
 
-// src/diff.ts
+// src/commands/diff.ts
 init_config();
-import { existsSync as existsSync52 } from "node:fs";
-import { join as join71 } from "node:path";
+import { existsSync as existsSync53 } from "node:fs";
+import { join as join74 } from "node:path";
 init_utils();
 init_utils_fs();
 init_utils_json();
 function cmdDiff() {
   try {
     const repo = repoHome();
-    if (!existsSync52(repo)) die(`repo not cloned at ${repo}`);
+    if (!existsSync53(repo)) die(`repo not cloned at ${repo}`);
     const ts = freshBackupTs(backupBase());
-    const mapPath = join71(repo, "path-map.json");
-    const map = existsSync52(mapPath) ? readPathMap(mapPath) : { projects: {} };
+    const mapPath = join74(repo, "path-map.json");
+    const map = existsSync53(mapPath) ? readPathMap(mapPath) : { projects: {} };
     divergenceCheckExtras(ts);
     computePreview(ts, map, "diff");
   } catch (err) {
@@ -10422,12 +10598,12 @@ function cmdDiff() {
   }
 }
 
-// src/init.ts
+// src/commands/init/init.ts
 init_config();
-import { existsSync as existsSync54, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join73 } from "node:path";
+import { existsSync as existsSync55, mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join76 } from "node:path";
 
-// src/init.gh-onboard.ts
+// src/commands/init/gh-onboard.ts
 init_config();
 import { execFileSync as execFileSync25 } from "node:child_process";
 init_utils();
@@ -10502,44 +10678,44 @@ function ensureOriginRepo(repoName, run = execFileSync25) {
   log(`created private repo ${owner}/${repoName} and wired origin`);
 }
 
-// src/init.snapshot.ts
+// src/commands/init/snapshot.ts
 init_config();
 init_utils();
 init_utils_fs();
 init_utils_json();
-import { copyFileSync as copyFileSync2, cpSync as cpSync9, existsSync as existsSync53, rmSync as rmSync22, statSync as statSync15 } from "node:fs";
-import { join as join72 } from "node:path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync9, existsSync as existsSync54, rmSync as rmSync22, statSync as statSync15 } from "node:fs";
+import { join as join75 } from "node:path";
 function snapshotIntoShared(map) {
   const repo = repoHome();
   const claude = claudeHome();
   for (const name of allSharedLinks(map)) {
-    const src = join72(claude, name);
-    if (!existsSync53(src)) continue;
-    const dst = join72(repo, "shared", name);
+    const src = join75(claude, name);
+    if (!existsSync54(src)) continue;
+    const dst = join75(repo, "shared", name);
     if (statSync15(src).isDirectory()) {
-      const gk = join72(dst, ".gitkeep");
-      if (existsSync53(gk)) rmSync22(gk);
+      const gk = join75(dst, ".gitkeep");
+      if (existsSync54(gk)) rmSync22(gk);
       cpSync9(src, dst, { recursive: true, force: false, errorOnExist: true });
     } else {
       copyFileSync2(src, dst);
     }
     log(`snapshotted shared/${name} from ${src}`);
   }
-  const userSettings = join72(claude, "settings.json");
-  if (existsSync53(userSettings)) {
+  const userSettings = join75(claude, "settings.json");
+  if (existsSync54(userSettings)) {
     let parsed;
     try {
       parsed = readJson(userSettings);
     } catch (err) {
       return die(`malformed ${userSettings}: ${err.message}`);
     }
-    const hostFile = join72(repo, "hosts", `${HOST}.json`);
+    const hostFile = join75(repo, "hosts", `${HOST}.json`);
     writeJsonAtomic(hostFile, parsed);
     log(`snapshotted hosts/${HOST}.json from ${userSettings}`);
   }
 }
 
-// src/init.ts
+// src/commands/init/init.ts
 init_utils();
 init_utils_fs();
 var SHARED_CLAUDE_MD = "<!-- claude-nomad shared CLAUDE.md; symlinked into ~/.claude/CLAUDE.md by nomad pull -->\n";
@@ -10547,14 +10723,14 @@ var GITATTRIBUTES = "# nomad: sync content is byte-managed, disable all line-end
 var SHARED_KEEP_DIRS = ["agents", "skills", "commands", "rules", "hooks"];
 function preflightConflict(repoHome2) {
   const candidates = [
-    join73(repoHome2, "shared", "settings.base.json"),
-    join73(repoHome2, "shared", "CLAUDE.md"),
-    join73(repoHome2, "path-map.json"),
-    join73(repoHome2, "hosts"),
-    join73(repoHome2, "shared")
+    join76(repoHome2, "shared", "settings.base.json"),
+    join76(repoHome2, "shared", "CLAUDE.md"),
+    join76(repoHome2, "path-map.json"),
+    join76(repoHome2, "hosts"),
+    join76(repoHome2, "shared")
   ];
   for (const c of candidates) {
-    if (existsSync54(c)) return c;
+    if (existsSync55(c)) return c;
   }
   return null;
 }
@@ -10572,27 +10748,27 @@ function cmdInit(opts = {}) {
     die(`already initialized; refusing to clobber ${conflict}`);
   }
   ensureOriginRepo(opts.repoName ?? DEFAULT_REPO_NAME, opts.run);
-  mkdirSync17(join73(repo, "shared"), { recursive: true });
-  mkdirSync17(join73(repo, "hosts"), { recursive: true });
+  mkdirSync17(join76(repo, "shared"), { recursive: true });
+  mkdirSync17(join76(repo, "hosts"), { recursive: true });
   for (const name of SHARED_KEEP_DIRS) {
-    mkdirSync17(join73(repo, "shared", name), { recursive: true });
+    mkdirSync17(join76(repo, "shared", name), { recursive: true });
   }
-  const userClaudeMd = join73(claude, "CLAUDE.md");
-  if (!snapshot || !existsSync54(userClaudeMd)) {
-    writeFileSync12(join73(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
+  const userClaudeMd = join76(claude, "CLAUDE.md");
+  if (!snapshot || !existsSync55(userClaudeMd)) {
+    writeFileSync12(join76(repo, "shared", "CLAUDE.md"), SHARED_CLAUDE_MD);
     item("created shared/CLAUDE.md");
   }
   for (const name of SHARED_KEEP_DIRS) {
-    writeFileSync12(join73(repo, "shared", name, ".gitkeep"), "");
+    writeFileSync12(join76(repo, "shared", name, ".gitkeep"), "");
     item(`created shared/${name}/.gitkeep`);
   }
-  writeFileSync12(join73(repo, "hosts", ".gitkeep"), "");
+  writeFileSync12(join76(repo, "hosts", ".gitkeep"), "");
   item("created hosts/.gitkeep");
-  writeJsonAtomic(join73(repo, "shared", "settings.base.json"), {});
+  writeJsonAtomic(join76(repo, "shared", "settings.base.json"), {});
   item("created shared/settings.base.json");
-  writeJsonAtomic(join73(repo, "path-map.json"), { projects: {} });
+  writeJsonAtomic(join76(repo, "path-map.json"), { projects: {} });
   item("created path-map.json");
-  writeFileSync12(join73(repo, ".gitattributes"), GITATTRIBUTES);
+  writeFileSync12(join76(repo, ".gitattributes"), GITATTRIBUTES);
   item("created .gitattributes");
   if (snapshot) {
     snapshotIntoShared({ projects: {} });
@@ -10655,14 +10831,14 @@ function maybeDisableRepoActions(repoHome2, run) {
   }
 }
 
-// src/init.prompt.ts
+// src/commands/init/prompt.ts
 init_config();
 init_utils();
-import { existsSync as existsSync55, readdirSync as readdirSync22, statSync as statSync16 } from "node:fs";
-import { join as join74 } from "node:path";
+import { existsSync as existsSync56, readdirSync as readdirSync22, statSync as statSync16 } from "node:fs";
+import { join as join77 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 function nonEmptyExists(path) {
-  if (!existsSync55(path)) return false;
+  if (!existsSync56(path)) return false;
   try {
     if (statSync16(path).isDirectory()) return readdirSync22(path).length > 0;
     return true;
@@ -10671,8 +10847,8 @@ function nonEmptyExists(path) {
   }
 }
 function hasExistingClaudeConfig(claudeHome2) {
-  if (existsSync55(join74(claudeHome2, "settings.json"))) return true;
-  return SHARED_LINKS.some((name) => nonEmptyExists(join74(claudeHome2, name)));
+  if (existsSync56(join77(claudeHome2, "settings.json"))) return true;
+  return SHARED_LINKS.some((name) => nonEmptyExists(join77(claudeHome2, name)));
 }
 async function confirmSnapshotDefault(claudeHome2) {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
@@ -10696,7 +10872,7 @@ async function resolveSnapshotChoice(flagSnapshot, claudeHome2, confirm = confir
   return confirm(claudeHome2);
 }
 
-// src/nomad.dispatch.helpers.ts
+// src/cli/dispatch.helpers.ts
 var REJECT = { ok: false, advance: 0 };
 function applyBool(seen, set) {
   if (seen) return REJECT;
@@ -10709,7 +10885,7 @@ function extractFlagValue(argv, i) {
   return val;
 }
 
-// src/nomad.dispatch.clean.ts
+// src/cli/dispatch.clean.ts
 function applyOlderThan(argv, i, st) {
   if (st.olderThan !== void 0) return REJECT;
   const val = extractFlagValue(argv, i);
@@ -10756,7 +10932,7 @@ function parseCleanArgs(argv) {
   return { dryRun: st.dryRun, olderThan: st.olderThan, keep: st.keep };
 }
 
-// src/nomad.dispatch.capture-settings.ts
+// src/cli/dispatch.capture-settings.ts
 function parseCaptureSettingsArgs(argv) {
   let host = false;
   let dryRun = false;
@@ -10781,7 +10957,7 @@ function parseCaptureSettingsArgs(argv) {
   return { host, dryRun, yes };
 }
 
-// src/nomad.dispatch.eject.ts
+// src/cli/dispatch.eject.ts
 function parseEjectArgs(argv) {
   let dryRun = false;
   let i = 3;
@@ -10798,7 +10974,7 @@ function parseEjectArgs(argv) {
   return { dryRun };
 }
 
-// src/nomad.dispatch.ts
+// src/cli/dispatch.ts
 function applyInitToken(argv, i, st) {
   const token = argv[i];
   if (token === "--snapshot") {
@@ -10871,7 +11047,7 @@ function parseRedactArgs(argv) {
   return { id, rule, dryRun };
 }
 
-// src/nomad.dispatch.allow.ts
+// src/cli/dispatch.allow.ts
 function parseAllowArgs(argv) {
   const positionals = argv.slice(3);
   if (positionals.length === 0) return null;
@@ -10881,7 +11057,7 @@ function parseAllowArgs(argv) {
   return positionals;
 }
 
-// src/nomad.dispatch.pull.ts
+// src/cli/dispatch.pull.ts
 function parsePullArgs(argv) {
   let dryRun = false;
   let forceRemote = false;
@@ -10903,7 +11079,7 @@ function parsePullArgs(argv) {
   return { dryRun, forceRemote };
 }
 
-// src/nomad.dispatch.push.ts
+// src/cli/dispatch.push.ts
 var RULE_ID_RE = /^\w[\w-]*$/;
 function applyAllow(argv, i, st) {
   if (st.allowRule !== void 0) return REJECT;
@@ -10956,7 +11132,7 @@ function parsePushArgs(argv) {
   };
 }
 
-// src/nomad.dispatch.sync.ts
+// src/cli/dispatch.sync.ts
 function parseSyncArgs(argv) {
   let dryRun = false;
   let verbose = false;
@@ -10979,7 +11155,7 @@ function parseSyncArgs(argv) {
 // package.json
 var package_default = {
   name: "claude-nomad",
-  version: "0.68.0",
+  version: "0.69.0",
   type: "module",
   description: "Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.",
   keywords: [
@@ -11046,7 +11222,8 @@ var package_default = {
   overrides: {
     "@conventional-changelog/git-client": {
       "conventional-commits-parser": "^7.0.0"
-    }
+    },
+    "smol-toml": "^1.7.1"
   },
   devDependencies: {
     "@commitlint/cli": "^21.0.1",
@@ -11055,7 +11232,7 @@ var package_default = {
     "@stryker-mutator/core": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@vitest/coverage-v8": "^5.0.0",
     "conventional-changelog-conventionalcommits": "^10.2.1",
     diff: "^9.0.0",
     esbuild: "^0.28.0",
@@ -11071,11 +11248,11 @@ var package_default = {
     prettier: "^3.8.3",
     typescript: "^6.0.3",
     "typescript-eslint": "^8.59.4",
-    vitest: "^4.1.6"
+    vitest: "^5.0.0"
   }
 };
 
-// src/nomad.help.ts
+// src/cli/help.ts
 var DESC_COL = 26;
 var row = (label, desc) => label.padEnd(DESC_COL) + desc;
 var cont = (text) => " ".repeat(DESC_COL) + text;
@@ -11223,19 +11400,19 @@ var DEFAULT_HELP = [
   "every pull)."
 ].join("\n");
 
-// src/resume.ts
+// src/sync/resume.ts
 init_config();
 init_utils();
 init_utils_json();
-import { existsSync as existsSync56, readFileSync as readFileSync21, readdirSync as readdirSync23 } from "node:fs";
-import { join as join75 } from "node:path";
+import { existsSync as existsSync57, readFileSync as readFileSync21, readdirSync as readdirSync23 } from "node:fs";
+import { join as join78 } from "node:path";
 function resumeCmd(sessionId) {
   if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || sessionId.length > 128) {
     fail(`invalid session id: ${sessionId}`);
     process.exit(1);
   }
-  const projectsRoot = join75(claudeHome(), "projects");
-  if (!existsSync56(projectsRoot)) {
+  const projectsRoot = join78(claudeHome(), "projects");
+  if (!existsSync57(projectsRoot)) {
     fail(`${projectsRoot} does not exist`);
     process.exit(1);
   }
@@ -11249,8 +11426,8 @@ function resumeCmd(sessionId) {
     fail(`no cwd field found in ${jsonlPath}`);
     process.exit(1);
   }
-  const mapPath = join75(repoHome(), "path-map.json");
-  if (!existsSync56(mapPath)) {
+  const mapPath = join78(repoHome(), "path-map.json");
+  if (!existsSync57(mapPath)) {
     fail("path-map.json missing");
     process.exit(1);
   }
@@ -11273,8 +11450,8 @@ function resumeCmd(sessionId) {
 }
 function findTranscriptPath(projectsRoot, sessionId) {
   for (const dir of readdirSync23(projectsRoot)) {
-    const candidate = join75(projectsRoot, dir, `${sessionId}.jsonl`);
-    if (existsSync56(candidate)) return candidate;
+    const candidate = join78(projectsRoot, dir, `${sessionId}.jsonl`);
+    if (existsSync57(candidate)) return candidate;
   }
   return null;
 }
@@ -11307,7 +11484,7 @@ function shQuote(s) {
   return `'${escaped}'`;
 }
 
-// src/user-abort.ts
+// src/core/user-abort.ts
 var ABORT_NAMES = /* @__PURE__ */ new Set(["AbortError", "ExitPromptError"]);
 var ABORT_CODE = "ABORT_ERR";
 function isUserAbort(err) {