claude-nomad 0.69.0 → 0.69.2

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # Changelog
 
+## [0.69.2](https://github.com/funkadelic/claude-nomad/compare/v0.69.1...v0.69.2) (2026-09-19)
+
+
+### What's new
+
+**On native Windows (PowerShell, cmd, or Git Bash).** WSL2 behaves like Linux, so these do not apply to it.
+
+* `nomad allow`, and choosing Allow when `nomad push` finds a possible secret, no longer add a duplicate line to a `.gitleaksignore` saved with Windows line endings.
+* The cleanup commands `nomad eject` prints now use forward slashes, so you can paste them into Git Bash as they are.
+
+**On every platform**
+
+* `nomad pull` no longer overwrites a setting you changed on this machine but haven't saved to your sync repo. It stops, names each one, and tells you to save it with `nomad capture-settings` or delete it. `nomad sync` and `nomad pull --dry-run` flag the same settings.
+* When a setting is removed from your sync repo, whether you removed it or another machine did, a pull removes it here too, but only if you haven't edited it on this machine. The pull names each setting it removes, `nomad doctor` warns about them beforehand, and the settings file from before the pull is kept in `~/.cache/claude-nomad/backup/`.
+* Settings that can hold a secret, such as `env` or `apiKeyHelper`, are never printed, so a pull can't list them. When it replaces some that your sync repo doesn't track, it now tells you how many. Keep values like these in `~/.claude/settings.local.json`, which nomad never touches.
+* `nomad eject` now also deletes the records nomad keeps about this machine, so setting nomad up here again starts fresh.
+
+
+### Fixed
+
+* **eject:** forget this machine's sync records ([#615](https://github.com/funkadelic/claude-nomad/issues/615)) ([899abd8](https://github.com/funkadelic/claude-nomad/commit/899abd82b2ffd1acd3f6faf36d8e1d26402eb6c7))
+* **pull:** keep a setting you changed when the repo drops it ([#614](https://github.com/funkadelic/claude-nomad/issues/614)) ([f60cc98](https://github.com/funkadelic/claude-nomad/commit/f60cc98989296938f560db58cd05950280f335c7))
+* **pull:** name the settings a pull removes ([#613](https://github.com/funkadelic/claude-nomad/issues/613)) ([8266fc9](https://github.com/funkadelic/claude-nomad/commit/8266fc90a19e3119782354751c8e1ee9c225e6b2))
+* **pull:** stop overwriting settings you have not saved to the repo ([#606](https://github.com/funkadelic/claude-nomad/issues/606)) ([160abba](https://github.com/funkadelic/claude-nomad/commit/160abbaa10766786b58f3a73906fd2feb6c6e097))
+* **pull:** stop refusing a setting you removed from the repo ([#612](https://github.com/funkadelic/claude-nomad/issues/612)) ([d7d620c](https://github.com/funkadelic/claude-nomad/commit/d7d620cf25534aa0d4d65afe0fcbd834d35b7c50))
+* **pull:** warn before replacing a credential setting not in the repo ([#610](https://github.com/funkadelic/claude-nomad/issues/610)) ([db739f5](https://github.com/funkadelic/claude-nomad/commit/db739f510ac7a8fde6c7139f0ea00a22cf3c4aec))
+* **redact:** stop adding duplicate lines to a Windows-style .gitleaksignore ([#609](https://github.com/funkadelic/claude-nomad/issues/609)) ([07152de](https://github.com/funkadelic/claude-nomad/commit/07152de8c26b31ee2ce93a45b1c5ef948e83b558))
+* **redact:** stop re-appending a fingerprint to a CRLF .gitleaksignore ([07152de](https://github.com/funkadelic/claude-nomad/commit/07152de8c26b31ee2ce93a45b1c5ef948e83b558))
+
+
+### Changed
+
+* split four oversized source files ([#608](https://github.com/funkadelic/claude-nomad/issues/608)) ([8a08ba7](https://github.com/funkadelic/claude-nomad/commit/8a08ba7d27cfb0dab9a7d9c89b69872c13d200c9))
+
+
+### Dependencies
+
+* bump devalue from 5.8.1 to 5.9.2 in /docs-site ([#611](https://github.com/funkadelic/claude-nomad/issues/611)) ([ad47cbc](https://github.com/funkadelic/claude-nomad/commit/ad47cbcf98ee7cf85628e741b834487ce806cf37))
+
+## [0.69.1](https://github.com/funkadelic/claude-nomad/compare/v0.69.0...v0.69.1) (2026-09-15)
+
+
+### What's new
+
+* `nomad push` refuses to sync files it does not recognize. That message used to name a source
+  file inside the tool, which is no help if you installed from npm. It now tells you to add the
+  folder to `sharedDirs` in your `path-map.json`.
+* The summary `nomad push` prints was leaving things out. Changes to your `path-map.json`, and to
+  any folder you added through `sharedDirs`, were going up without being listed. Both now appear
+  alongside the rest of your global config.
+
+
+### Fixed
+
+* **push:** list path-map.json and sharedDirs changes in the push summary ([#605](https://github.com/funkadelic/claude-nomad/issues/605)) ([b5ea573](https://github.com/funkadelic/claude-nomad/commit/b5ea573863ae10d895f2fbb24236de227251b282))
+* **push:** suggest sharedDirs when push refuses an unsynced file ([#604](https://github.com/funkadelic/claude-nomad/issues/604)) ([ff5e263](https://github.com/funkadelic/claude-nomad/commit/ff5e26321cb8cae7e61c52a12dd4228e27cc78b0))
+
+
+### Changed
+
+* add a prose check and tighten the docs ([#599](https://github.com/funkadelic/claude-nomad/issues/599)) ([2753d11](https://github.com/funkadelic/claude-nomad/commit/2753d1156a9a7a8a59235bfcab7e623489185258))
+
+
+### Dependencies
+
+* bump astro from 7.3.1 to 7.3.2 in /docs-site in the astro group ([#603](https://github.com/funkadelic/claude-nomad/issues/603)) ([8f413ea](https://github.com/funkadelic/claude-nomad/commit/8f413eac62554a7310e0271dce987a0f0376f50d))
+* bump the codeql-action group across 1 directory with 2 updates ([#602](https://github.com/funkadelic/claude-nomad/issues/602)) ([22f51e6](https://github.com/funkadelic/claude-nomad/commit/22f51e63db6a77b66fa455986e797498dae29870))
+* bump the dev-dependencies group across 1 directory with 3 updates ([#601](https://github.com/funkadelic/claude-nomad/issues/601)) ([9a0bdf6](https://github.com/funkadelic/claude-nomad/commit/9a0bdf61c295e7c7bd19874f27b323338a34e2d9))
+
 ## [0.69.0](https://github.com/funkadelic/claude-nomad/compare/v0.68.0...v0.69.0) (2026-09-11)
 
 

package/README.md

@@ -66,9 +66,10 @@ session history survives different file paths and your secrets never ride along.
   warning, not a failure), and settings drift in both directions: keys present in the repo merge but
   absent from your live `settings.json` (behind; the next `nomad pull` will restore them, fix:
   `nomad pull`) and keys present locally but not yet in the repo (ahead; local-only additions, fix:
-  `nomad capture-settings`). Each issue includes a fix hint. By default the report is compact: it
-  shows only checks that need action plus a one-line verdict. Add `--verbose` (or `--all` / `-v`) to
-  see the full per-check tree, including everything that passed.
+  `nomad capture-settings`), plus a warning for a local setting the next pull will remove because
+  the repo dropped it. Each issue includes a fix hint. By default the report is compact: it shows
+  only checks that need action plus a one-line verdict. Add `--verbose` (or `--all` / `-v`) to see
+  the full per-check tree, including everything that passed.
 - **Self-healing sync.** Every overwrite is backed up first, and `nomad pull --force-remote`
   recovers two kinds of stuck sync repo: a repo stuck mid-rebase or mid-merge (aborts the operation,
   parks stranded work on a branch, refuses if shared config is at risk), and a repo where the rebase
@@ -138,13 +139,13 @@ still available as lower-level commands for cases `sync` does not cover: recover
 with `nomad pull --force-remote`, or resolving a detected secret without the interactive menu via
 `nomad push --redact-all` / `--allow` / `--allow-all` (see [Changing settings](#changing-settings)
 and [Recovery flows](https://funkadelic.github.io/claude-nomad/recovery/)). The
-[FAQ](https://funkadelic.github.io/claude-nomad/faq/) covers what `sync` does under the hood and the
-push/pull order it enforces.
+[FAQ](https://funkadelic.github.io/claude-nomad/faq/) covers what `sync` does and the push/pull
+order it enforces.
 
 ### Windows
 
 claude-nomad runs natively on Windows (PowerShell or cmd), and WSL2 works too. The everyday loop is
-the same either way; the difference is under the hood.
+the same either way.
 
 Native Windows cannot use symlinks, so claude-nomad keeps a real copy of your shared config in
 `~/.claude/` instead of a symlink. `nomad pull` and `nomad sync` both mirror your local copies into
@@ -217,6 +218,34 @@ it:
   before the next `nomad pull` overwrites them. Add `--host` to land machine-specific values (such
   as absolute paths) in `hosts/<HOST>.json` instead of the shared base.
 
+If `nomad pull` finds settings on this machine that your sync repo does not track, it leaves
+`~/.claude/settings.json` as it is, so those settings are not lost. It lists the settings by name
+and suggests two fixes: run `nomad capture-settings` to save them to the repo (add `--host` for
+values that belong to this machine only), or delete them from `~/.claude/settings.json` if you no
+longer want them. Your shared files, skills, sessions, and project extras still update, and the
+command exits with a non-zero status so a scripted or cron-driven pull does not report success. Once
+you have saved or deleted the settings, the next pull proceeds normally.
+
+Credential settings are the one exception. Keys that can hold a secret (`env`, `apiKeyHelper`,
+`awsAuthRefresh`, `awsCredentialExport`, `otelHeadersHelper`) are never printed, so pull cannot list
+them and will not stop for them. When it finds some your repo does not track, it writes
+`settings.json` as usual and tells you how many it replaced. Keep values like these in
+`~/.claude/settings.local.json`, which nomad never touches.
+
+A setting that another machine removed from the repo is removed here too. Each time nomad writes
+your settings, on a pull or a `nomad capture-settings`, it records which settings it wrote on this
+machine, with a fingerprint of each value. A setting in that record that the repo no longer carries,
+and that still has the value nomad wrote, is one nomad put there, so the next pull removes it. The
+pull names each setting it removes (so does `nomad pull --dry-run`), and the file from before the
+pull stays in `~/.cache/claude-nomad/backup/`. A setting missing from the record is one you added,
+and one you changed since is yours now, so either is kept and listed as above. A removal is handled
+the same whether it arrives with this pull or reached your repo earlier through an edit you made, a
+`nomad push`, or a `nomad pull --dry-run`.
+
+A machine that has not finished a pull yet, or whose cache folder was cleared, has nothing recorded.
+There a removal that reached the repo earlier is still listed as a setting you added. Save it or
+delete it as above and pull again.
+
 During `nomad push` and `nomad pull`, long-running steps (rebase, secret scan, git push, session
 sync) show an animated progress indicator on an interactive terminal so the CLI does not look hung.
 In CI and when output is piped, only plain text lines are printed, with no ANSI control codes, so
@@ -292,7 +321,7 @@ the copy-sync trade-off.
 
 **Optional:** [curl](https://curl.se/) or [wget](https://www.gnu.org/software/wget/) for the
 version-staleness check and `nomad doctor --check-schema`. The CLI works without them. The opt-in
-`nomad doctor --check-remote` flag reads the locally-cached `origin/main` remote-tracking ref (no
+`nomad doctor --check-remote` flag reads the locally cached `origin/main` remote-tracking ref (no
 curl or wget needed) and verifies that `shared/` and a valid `path-map.json` are present there; it
 skips with a `⚠︎` when the ref is unavailable, and is non-fatal in all cases.
 
@@ -301,14 +330,15 @@ skips with a `⚠︎` when the ref is unavailable, and is non-fatal in all cases
 Every `nomad` subcommand exits with one of a small set of codes, so a script or cron wrapper can
 branch on `$?` without parsing stderr text.
 
-| Code | Name            | Meaning                                                                              |
-| ---- | --------------- | ------------------------------------------------------------------------------------ |
-| 0    | Success         | Completed successfully.                                                              |
-| 1    | Generic failure | Unclassified failure; the default for any error not covered below.                   |
-| 2    | Usage           | Bad argv: an unknown subcommand, an unknown flag, or a malformed flag value.         |
-| 4    | Conflict        | The sync repo is wedged (e.g. an unresolved rebase) and needs manual git resolution. |
-| 5    | Leak blocked    | gitleaks confirmed a secret in the staged tree and the push was aborted.             |
-| 130  | Interrupted     | You pressed Ctrl+C at an interactive prompt, so nomad stopped without finishing.     |
+| Code | Name             | Meaning                                                                                                                                       |
+| ---- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| 0    | Success          | Completed successfully.                                                                                                                       |
+| 1    | Generic failure  | Unclassified failure; the default for any error not covered below.                                                                            |
+| 2    | Usage            | Bad argv: an unknown subcommand, an unknown flag, or a malformed flag value.                                                                  |
+| 4    | Conflict         | The sync repo is wedged (e.g. an unresolved rebase) and needs manual git resolution.                                                          |
+| 5    | Leak blocked     | gitleaks confirmed a secret in the staged tree and the push was aborted.                                                                      |
+| 6    | Settings blocked | Pull (or the pull half of `nomad sync`) found settings on this machine that are not in the sync repo, so it did not write your settings file. |
+| 130  | Interrupted      | You pressed Ctrl+C at an interactive prompt, so nomad stopped without finishing.                                                              |
 
 A run skipped because another nomad process already holds the lock also exits 0: this is an
 intentional no-op skip, not a failure, so a backgrounded shell-rc or cron invocation never raises a
@@ -333,7 +363,7 @@ What this means for you:
   best-effort secret scan runs the same gitleaks-based redaction nomad already uses for session
   transcripts. The secret scan works on a temporary, owner-only (`0o600`) copy that already has the
   structural scrub applied; that scratch file is deleted immediately after the scan, and only the
-  fully-redacted report is kept.
+  fully redacted report is kept.
 - **It degrades safely without gitleaks.** If gitleaks is not installed, the structural scrub and
   the credential-shape backstop still run and the report is still written, with a one-line note that
   the deeper secret scan did not run. The backstop catches common token shapes but not everything,