fix: pattern matching for exclusions/encryption

- Fix PowerShell wildcard detection using .Contains('*') instead of broken backtick escaping
- Fix stderr redirection for git commands (2>&1 instead of 2>$null)
- Add missing encryption patterns (.credentials.json, client_secret_*.json)
- Add missing exclusion patterns (debug/, file-history/, ide/, plugins/, etc.)
- Bump version to 0.1.1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: FelixIsaac

README.md

@@ -120,6 +120,8 @@ claude-code-sync pull
 - `settings.json` - May contain API keys in `env`
 - `settings.local.json` - User overrides
 - `~/.claude.json` - OAuth tokens, MCP server configs (separate file at home dir, not inside ~/.claude/)
+- `.credentials.json` - OAuth credentials
+- `client_secret_*.json` - OAuth client secrets
 - `skills/*/resources/*` - May contain credentials
 
 ### Excluded (not synced)
@@ -129,6 +131,13 @@ claude-code-sync pull
 - `statsig/` - Analytics/telemetry data
 - `history.jsonl` - Conversation history index
 - `todos/` - Session-specific todo files
+- `debug/` - Debug logs
+- `file-history/` - File history cache
+- `ide/` - IDE integration cache
+- `plugins/` - Plugin cache
+- `shell-snapshots/` - Shell state snapshots
+- `telemetry/` - Telemetry data
+- `stats-cache.json` - Statistics cache
 - `*.log`, `*.tmp`, `*.cache`
 
 ## Security

claude-code-sync

@@ -3,7 +3,7 @@
 # https://github.com/felixisaac/claude-code-sync
 set -euo pipefail
 
-VERSION="0.1.0"
+VERSION="0.1.1"
 
 # Directories
 CLAUDE_DIR="$HOME/.claude"
@@ -27,23 +27,34 @@ ENCRYPT_PATTERNS=(
     "settings.json"
     "settings.local.json"
     "claude.json"
+    ".credentials.json"
+    "client_secret_*.json"
     "skills/*/resources/*"
 )
 
 # Files/dirs to exclude from sync
 EXCLUDE_PATTERNS=(
+    # Directories
     "plans"
-    "*.log"
-    "*.tmp"
-    ".git"
-    "*.local-backup-*"
-    "sessionStorage"
-    "*.cache"
     "projects"
     "local"
     "statsig"
-    "history.jsonl"
     "todos"
+    "debug"
+    "file-history"
+    "ide"
+    "plugins"
+    "shell-snapshots"
+    "telemetry"
+    "sessionStorage"
+    # Files
+    "history.jsonl"
+    "stats-cache.json"
+    "*.log"
+    "*.tmp"
+    "*.cache"
+    "*.local-backup-*"
+    ".git"
 )
 
 #--- Utility Functions ---#
@@ -89,16 +100,26 @@ get_public_key() {
 should_encrypt() {
     local file="$1"
     local relpath="${file#$CLAUDE_DIR/}"
+    local filename
+    filename=$(basename "$relpath")
 
     # Check against encrypt patterns
     for pattern in "${ENCRYPT_PATTERNS[@]}"; do
         # shellcheck disable=SC2053
-        if [[ "$relpath" == $pattern ]] || [[ "$(basename "$relpath")" == "$pattern" ]]; then
-            return 0
+        if [[ "$pattern" == *"*"* ]]; then
+            # Wildcard pattern - match against filename or full path
+            if [[ "$filename" == $pattern ]] || [[ "$relpath" == $pattern ]]; then
+                return 0
+            fi
+        else
+            # Exact match against filename
+            if [[ "$filename" == "$pattern" ]]; then
+                return 0
+            fi
         fi
     done
 
-    # Also encrypt claude.json (separate file)
+    # Also encrypt claude.json (separate file at ~/)
     if [[ "$file" == "$CLAUDE_JSON" ]]; then
         return 0
     fi
@@ -109,11 +130,25 @@ should_encrypt() {
 should_exclude() {
     local file="$1"
     local relpath="${file#$CLAUDE_DIR/}"
+    local filename
+    filename=$(basename "$relpath")
 
     for pattern in "${EXCLUDE_PATTERNS[@]}"; do
         # shellcheck disable=SC2053
-        if [[ "$relpath" == $pattern* ]] || [[ "$(basename "$relpath")" == $pattern ]]; then
-            return 0
+        if [[ "$pattern" == *"*"* ]]; then
+            # Wildcard pattern - match against filename
+            if [[ "$filename" == $pattern ]]; then
+                return 0
+            fi
+        else
+            # Directory/file name - match if relpath starts with pattern/ or equals pattern
+            if [[ "$relpath" == "$pattern" ]] || [[ "$relpath" == "$pattern/"* ]]; then
+                return 0
+            fi
+            # Also check exact filename match
+            if [[ "$filename" == "$pattern" ]]; then
+                return 0
+            fi
         fi
     done
     return 1

claude-code-sync.ps1

@@ -18,7 +18,7 @@ param(
 )
 
 $ErrorActionPreference = "Stop"
-$VERSION = "0.1.0"
+$VERSION = "0.1.1"
 
 # Directories
 $CLAUDE_DIR = Join-Path $env:USERPROFILE ".claude"
@@ -30,26 +30,38 @@ $REPO_DIR = Join-Path $SYNC_DIR "repo"
 $BACKUP_DIR = Join-Path $SYNC_DIR "backups"
 $LOCK_FILE = Join-Path $SYNC_DIR ".lock"
 
-# Patterns
+# Patterns - files to encrypt (contain secrets)
 $ENCRYPT_PATTERNS = @(
     "settings.json",
     "settings.local.json",
-    "claude.json"
+    "claude.json",
+    ".credentials.json",
+    "client_secret_*.json"
 )
 
+# Patterns - files/folders to exclude (not synced)
 $EXCLUDE_PATTERNS = @(
+    # Directories
     "plans",
-    "*.log",
-    "*.tmp",
-    ".git",
-    "*.local-backup-*",
-    "sessionStorage",
-    "*.cache",
     "projects",
     "local",
     "statsig",
+    "todos",
+    "debug",
+    "file-history",
+    "ide",
+    "plugins",
+    "shell-snapshots",
+    "telemetry",
+    "sessionStorage",
+    # Files
     "history.jsonl",
-    "todos"
+    "stats-cache.json",
+    "*.log",
+    "*.tmp",
+    "*.cache",
+    "*.local-backup-*",
+    ".git"
 )
 
 #--- Utility Functions ---#
@@ -95,17 +107,20 @@ function Test-ShouldEncrypt {
     $relPath = $FilePath.Replace("$CLAUDE_DIR\", "").Replace("$CLAUDE_DIR/", "")
 
     foreach ($pattern in $ENCRYPT_PATTERNS) {
-        if ($fileName -eq $pattern -or $relPath -like $pattern) {
-            return $true
+        # Use wildcard matching for patterns with *, exact match otherwise
+        if ($pattern.Contains('*')) {
+            if ($fileName -like $pattern) { return $true }
+        } else {
+            if ($fileName -eq $pattern) { return $true }
         }
     }
 
-    # Also encrypt claude.json
+    # Also encrypt claude.json (separate file at ~/)
     if ($FilePath -eq $CLAUDE_JSON) {
         return $true
     }
 
-    # Encrypt resources in skills
+    # Encrypt resources in skills (may contain credentials)
     if ($relPath -like "skills\*\resources\*" -or $relPath -like "skills/*/resources/*") {
         return $true
     }
@@ -118,10 +133,25 @@ function Test-ShouldExclude {
 
     $fileName = Split-Path $FilePath -Leaf
     $relPath = $FilePath.Replace("$CLAUDE_DIR\", "").Replace("$CLAUDE_DIR/", "")
+    # Normalize to forward slashes for consistent matching (case-insensitive)
+    $relPathNorm = $relPath.Replace("\", "/").ToLower()
 
     foreach ($pattern in $EXCLUDE_PATTERNS) {
-        if ($relPath -like "$pattern*" -or $fileName -like $pattern) {
-            return $true
+        $patternLower = $pattern.ToLower()
+        if ($pattern.Contains('*')) {
+            # Wildcard pattern - match against filename
+            if ($fileName -like $pattern) {
+                return $true
+            }
+        } else {
+            # Directory/file name - match if relPath starts with pattern/ or equals pattern
+            if ($relPathNorm -eq $patternLower -or $relPathNorm.StartsWith("$patternLower/")) {
+                return $true
+            }
+            # Also check exact filename match for file patterns like "history.jsonl"
+            if ($fileName.ToLower() -eq $patternLower) {
+                return $true
+            }
         }
     }
     return $false
@@ -359,7 +389,7 @@ function Invoke-Pull {
             # Backup existing file if different
             if (Test-Path $dest) {
                 $existingContent = Get-Content $dest -Raw -ErrorAction SilentlyContinue
-                $newContent = & age -d -i $KEY_FILE $file 2>$null
+                $newContent = & age -d -i $KEY_FILE $file 2>&1
                 if ($existingContent -ne $newContent) {
                     $backupName = "$dest.local-backup-$(Get-Timestamp)"
                     Write-Warn "Conflict: backing up $actualRelPath to $backupName"
@@ -408,9 +438,9 @@ function Invoke-Status {
     # Check remote status
     $remotes = & git -C $REPO_DIR remote
     if ($remotes -contains "origin") {
-        & git -C $REPO_DIR fetch origin 2>$null
-        $localCommit = & git -C $REPO_DIR rev-parse HEAD 2>$null
-        $remoteCommit = & git -C $REPO_DIR rev-parse origin/HEAD 2>$null
+        $null = & git -C $REPO_DIR fetch origin 2>&1
+        $localCommit = & git -C $REPO_DIR rev-parse HEAD 2>&1 | Select-Object -First 1
+        $remoteCommit = & git -C $REPO_DIR rev-parse origin/HEAD 2>&1 | Select-Object -First 1
 
         if ($localCommit -eq $remoteCommit) {
             Write-Host "Remote: " -NoNewline; Write-Host "Up to date" -ForegroundColor Green
@@ -604,7 +634,7 @@ function Invoke-Unlink {
         return
     }
 
-    $remotes = & git -C $REPO_DIR remote 2>$null
+    $remotes = & git -C $REPO_DIR remote 2>&1
     if ($remotes -contains "origin") {
         & git -C $REPO_DIR remote remove origin
         if (Test-Path $CONFIG_FILE) { Remove-Item -Force $CONFIG_FILE }