@rmyndharis/aimhooman 0.1.0 → 0.1.1

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
             "name": "aimhooman",
             "source": "./",
             "description": "Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
-            "version": "0.1.0",
+            "version": "0.1.1",
             "license": "MIT",
             "keywords": [
                 "git",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman maintainers",

package/CHANGELOG.md

@@ -7,6 +7,57 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-07-16
+
+### Fixed
+
+- Git hooks no longer trap the repository when the aimhooman CLI or Node is
+  missing (for example after the package was removed without `aimhooman
+  uninstall`). The dispatcher used to exit 127 and abort every commit; it now
+  warns once and allows the operation without protection, so a half-removed
+  install degrades gracefully instead of breaking Git.
+- The `PreToolUse` guard no longer denies ordinary read-only pipelines. Any pipe
+  made the parsed command uncertain, and the clean and compliance profiles read
+  that uncertainty as a possibly hidden commit, so everyday lines such as
+  `gh issue view 1 | tail -5` were blocked. A pipeline now passes when every
+  segment is a known read-only command and the line carries no opaque shell
+  syntax; everything else stays denied, including pipe-to-shell, subshells,
+  `eval`, and readers that execute their own input. `strict` is unchanged.
+- A bare `allow <path>` for a path that matches a secret rule (for example
+  `.env.minimal`) no longer reports success while leaving the block in place.
+  It now fails closed and directs to `--scope secret-path`, the only scope that
+  can silence a secret, so a local override cannot hide a possible leaked key.
+- Detect secrets renamed to a neutral path. A path-only secret such as `.env`
+  was missed when moved to a name the destination scan does not match, because its
+  content carries no PEM, AWS, or token shape; the rename-source review now retains
+  secret-category findings and reports them on the destination path where the bytes
+  live, so clean-profile repair unstages the blob that carries the secret. Deleting
+  a secret path remains a non-finding.
+- Retry the atomic rename that commits a state write when Windows reports a
+  transient `EPERM`, `EACCES`, or `EBUSY`. An antivirus or indexer holding a
+  handle on the file aimhooman had just written could kill a lock contender at
+  its ticket publication, which surfaced as unrelated failures (a lifecycle-queue
+  timeout, or a repair that appeared not to run). A persistent failure, any other
+  error code, and every non-Windows platform still fail immediately, and the
+  original file is never left partially written.
+- The clean-profile repair now verifies it cleared every target and re-runs the
+  unstage when a transient git operation under heavy load left a path staged, so
+  the repair no longer reports success while an artifact rides through.
+- Derive the post-repair empty-commit hint from the staged paths captured
+  before repair instead of a second git read after `git restore --staged`. That
+  read followed an index write and could transiently report the wrong state
+  under heavy load; the derivation is deterministic.
+
+### Changed
+
+- The release workflow runs `npm run verify` before publish instead of `npm test`,
+  so the tarball-manifest check and the installed-hook smoke test gate the published
+  tag, matching the push workflow.
+- Non-hook commands no longer load the PreToolUse shell parser at startup; it is
+  imported only for the `hook` subcommand, which speeds up `init`, `uninstall`,
+  `check`, `status`, and the rest and gives the lifecycle-lock queue more headroom
+  on slow runners.
+
 ## [0.1.0] - 2026-07-15
 
 First public release. aimhooman keeps AI coding-agent residue out of Git history
@@ -30,10 +81,9 @@ commit messages, and AI markers left in code.
 - Scan every index stage during unresolved conflicts so a secret on either side
   cannot be missed.
 - Authorize protected-path CI only when the exact workflow-run attempt's actor and
-  triggering actor, including their IDs, match the current personal-repository
-  owner returned by GitHub. Bind that authorization to exact commits, paths,
-  blobs, modes, deletion tombstones, and policy migrations; non-owner changes fail
-  closed with no reviewer fallback.
+  triggering actor, including their IDs, match the repository owner returned by
+  GitHub. Bind that authorization to exact commits, paths, blobs, modes, deletion
+  tombstones, and policy migrations; changes not attributed to the owner fail closed.
 - Keep the published local rule-pack schema compatible with strict JSON Schema
   validators.
 - Prove npm version absence and forward dist-tag movement with bounded retries

package/CONTRIBUTING.md

@@ -107,38 +107,18 @@ Commits must read as if a human wrote them:
 
 By participating, you agree to abide by the [Code of Conduct](CODE_OF_CONDUCT.md).
 
-This is a personal, owner-only repository. GitHub branch rules require the `tests`
-workflow but no pull-request approval, code-owner review, last-push approval, or
-other reviewer. The repository has no `CODEOWNERS` fallback.
-
-Changes to agent instructions or `.aimhooman.json` are protected-path changes. CI
-verifies the pinned repository and owner login plus numeric IDs through the GitHub
-API, then fetches the exact workflow-run attempt. GitHub must attribute the
-attempt's `actor` and `triggering_actor` to that owner's login and numeric ID. CI
-binds that authorization to the exact
-head, transition commit, path, resulting blob and regular-file mode, or deletion
-tombstone. Policy migrations additionally bind the old and new policy objects.
-Another commit, attempt, path result, mode, or migration needs fresh authorization.
-A protected-path change by any non-owner fails closed.
-
-The owner account and its credentials are the repository trust root. These checks
-verify GitHub's actor attribution and bind the resulting objects; they do not prove
-an interactive human action, provide independent review, or protect against a
-compromised owner credential.
+## Releases
 
 Releases publish to npm automatically when a `v*` tag is pushed. The workflow
-installs dependencies, runs the test suite, and publishes with npm build provenance,
-authenticated by the `NPM_TOKEN` secret. To cut a release: bump the version (keep
-`package.json`, `.claude-plugin/plugin.json`, `.codex-plugin/plugin.json`, and
-`.claude-plugin/marketplace.json` in sync), add the `## [version]` CHANGELOG entry
-and the matching README version badge, then tag and push:
+installs dependencies, runs the test suite, and publishes with npm build provenance.
+To cut a release, bump the version (keep `package.json`, `.claude-plugin/plugin.json`,
+`.codex-plugin/plugin.json`, and `.claude-plugin/marketplace.json` in sync), add the
+`## [version]` CHANGELOG entry and the matching README version badge, then:
 
 ```sh
 git tag -a v0.1.0 -m v0.1.0
 git push origin v0.1.0
 ```
 
-Protect `v*` tags so only the owner can create them and tag update or deletion is
-blocked. Use a granular, publish-only, package-scoped npm token with 2FA enabled
-and rotate it regularly. Do not run `npm publish` or move dist-tags manually while
-a release job is pending or running.
+Use a granular, publish-only npm token with 2FA enabled, and avoid publishing or
+moving dist-tags manually while a release job is running.

package/README.md

@@ -9,7 +9,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/github/actions/workflow/status/rmyndharis/aimhooman/test.yml?branch=main&label=CI" alt="CI">
-  <img src="https://img.shields.io/badge/version-v0.1.0-blue" alt="v0.1.0">
+  <img src="https://img.shields.io/badge/version-v0.1.1-blue" alt="v0.1.1">
   <img src="https://img.shields.io/badge/node-%E2%89%A522.8-339933?logo=node.js&logoColor=white" alt="Node 22.8+">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero dependencies">
   <img src="https://img.shields.io/badge/license-MIT-111111" alt="MIT">
@@ -286,17 +286,15 @@ Under `strict`, policy files and agent instructions produce review-required find
 The product's `review` and `policy-review` commands record local, object-bound decisions;
 an ordinary path allow cannot satisfy either finding.
 
-This personal repository does not use GitHub approvals, required reviewers, or
-`CODEOWNERS`. For a protected-path change, CI verifies the pinned repository and owner
-login plus numeric IDs through the GitHub API, then inspects the exact workflow-run
-attempt. GitHub must attribute both `actor` and `triggering_actor`, including their
-numeric IDs, to that owner. CI then binds the
-authorization to the exact head, transition commit, path, resulting blob and regular-file
-mode, or deletion tombstone. A strict-policy migration also binds its old and new policy
-objects. A different attempt, commit, path result, mode, or policy transition needs fresh
-authorization. A non-owner change fails closed; there is no reviewer or `CODEOWNERS`
-fallback. The owner account and its credentials are the trust root, so this is owner
-authorization, not independent review.
+For a protected-path change, CI verifies the pinned repository and owner login plus
+numeric IDs through the GitHub API, then inspects the exact workflow-run attempt.
+GitHub must attribute both `actor` and `triggering_actor`, including their numeric IDs,
+to that owner. CI then binds the authorization to the exact head, transition commit,
+path, resulting blob and regular-file mode, or deletion tombstone. A strict-policy
+migration also binds its old and new policy objects. A different attempt, commit, path
+result, mode, or policy transition needs fresh authorization. A change not attributed to
+the owner fails closed. This is owner authorization verified through GitHub attribution,
+not independent review.
 
 ## Overrides
 

package/SECURITY.md

@@ -54,16 +54,14 @@ only the latest minor release will receive security fixes.
 - A committed `.aimhooman.json` provides the versioned team profile. Invalid
   project policy fails closed; per-clone allow/deny entries remain local and
   should be governed by team process where compliance requires it.
-- This is a personal, owner-only repository with no GitHub approval, required
-  reviewer, or `CODEOWNERS` gate. For protected-path changes, CI resolves the
-  pinned repository and owner through the GitHub API and fetches the exact
-  workflow-run attempt. GitHub must attribute both the actor and triggering actor
-  to the owner's login and numeric ID. The resulting decision is bound to the exact head,
-  transition commit, path, blob and regular-file mode, or deletion tombstone; a
-  policy migration also binds its old and new objects. Non-owner changes fail
-  closed with no reviewer fallback. The owner is the trust root, not an independent
-  reviewer. These checks verify GitHub attribution, not an interactive human action,
-  and cannot defend against malicious or compromised owner credentials.
+- For protected-path changes (agent instruction files, `.aimhooman.json`), CI resolves
+  the repository and owner through the GitHub API and fetches the exact workflow-run
+  attempt. GitHub must attribute both the actor and triggering actor to the owner's
+  login and numeric ID. The resulting decision is bound to the exact head, transition
+  commit, path, blob, and regular-file mode (or deletion tombstone); a policy migration
+  also binds its old and new objects. Changes not attributed to the owner fail closed.
+  These checks verify GitHub actor attribution, not an interactive human action, and
+  cannot defend against a compromised owner credential.
 - The release pipeline pins actions to immutable commit SHAs and publishes with npm
   build provenance. Pushing a `v*` tag runs the workflow: it installs dependencies,
   runs the test suite, then publishes to npm authenticated by the `NPM_TOKEN` secret

package/bin/aimhooman.mjs

@@ -8,11 +8,11 @@ import { exitCode, human, jsonReport, visible } from '../src/report.mjs';
 import {
     GitRevisionError,
     gitConfig,
-    hasStagedChanges,
     introducedCommits,
     openRepo,
     readCommitPath,
     readStagedPath,
+    stagedPaths,
     stagedRenameSources,
     unstagePaths,
     withIndexFromTree,
@@ -20,7 +20,6 @@ import {
 import { loadConfig, loadOverrides, loadProjectPolicy, normalizeOverrideTarget, saveConfig, saveOverrides } from '../src/state.mjs';
 import { applyExclude, inspectExclude, patternsForRules, removeExclude } from '../src/exclude.mjs';
 import { hookDiagnostics, installHooks, installGlobalHooks, uninstallGlobalHooks, globalHooksDir, installedHooks, uninstallHooks, unrestoredChainedBackups } from '../src/githooks.mjs';
-import { runHook } from '../src/hook.mjs';
 import { ArgumentError, parseArguments } from '../src/args.mjs';
 import { engineForPolicy, scanGitTarget, scanMessage } from '../src/scan-target.mjs';
 import { resolvePolicy } from '../src/policy-resolver.mjs';
@@ -284,9 +283,41 @@ function cmdPrecommit(args) {
             }
         }
         for (const source of stagedRenameSources(repo, paths)) unstageTargets.add(source);
+        // The empty-commit hint is derived from the staged paths captured before
+        // repair, not from a second git read after `git restore --staged`. That
+        // post-repair read followed an index write and could transiently report
+        // the wrong state under heavy CI load, flaking the repair tests.
+        // unstagePaths is atomic (it throws on failure), so when every staged
+        // path is a repair target the index matches HEAD afterward. The capture
+        // is best-effort and runs before the repair: if this read fails the
+        // unstage still runs and the hint is omitted (empty stays false) rather
+        // than skipping the repair or blocking the commit.
+        let stagedBefore;
+        try {
+            stagedBefore = stagedPaths(repo);
+        } catch {
+            stagedBefore = null;
+        }
         unstagePaths(repo, [...unstageTargets]);
-        let empty = false;
-        try { empty = !hasStagedChanges(repo); } catch { /* could not re-read */ }
+        // Under heavy CI load a `git restore --staged` or the rename-source
+        // detection above can transiently leave a target staged, which flakes
+        // the repair tests and would let an artifact ride through. Re-detect
+        // rename sources and re-unstage any still-staged target until every
+        // target is gone or the budget is reached.
+        for (let attempt = 0; attempt < 4; attempt += 1) {
+            let stillStaged;
+            try {
+                for (const source of stagedRenameSources(repo, paths)) unstageTargets.add(source);
+                stillStaged = new Set(stagedPaths(repo));
+            } catch {
+                break;
+            }
+            const pending = [...unstageTargets].filter((path) => stillStaged.has(path));
+            if (!pending.length) break;
+            unstagePaths(repo, pending);
+        }
+        const empty = stagedBefore !== null
+            && stagedBefore.every((path) => unstageTargets.has(path));
         process.stderr.write(
             `aimhooman: unstaged ${paths.length} AI artifact(s) from this commit: ${paths.map(visible).join(', ')}${empty ? ' (nothing else staged — the commit will be empty)' : ''}\n`
         );
@@ -885,6 +916,19 @@ function cmdOverride(args, allow) {
             `secret rules cannot be allowed at --scope rule (that would suppress every matching secret path under every profile); use --scope secret-path <path> to allow a specific secret path`,
         );
     }
+    // A path that matches a secret rule cannot be silenced by a path (or rule)
+    // allow: only --scope secret-path suppresses secret findings, deliberately,
+    // so a local override cannot hide a possible leaked key. Without this check
+    // a bare `allow .env.minimal` would report success but leave the block in
+    // place, which reads as a broken allow.
+    if (allow && scope !== 'secret-path'
+        && engine.checkPaths([target]).some((finding) => finding.category === 'secret')) {
+        throw new ArgumentError(
+            `"${target}" matches a secret rule, so a ${scope} allow cannot silence it `
+            + '(a local override must not hide a possible leaked key); '
+            + 'use --scope secret-path to explicitly allow this specific path',
+        );
+    }
     if (scope === 'secret-path' && !allow) {
         throw new ArgumentError('--scope secret-path is only valid with allow');
     }
@@ -1563,7 +1607,14 @@ if (argv[0] === 'hook') {
         console.error('aimhooman: hook requires exactly one supported event');
         process.exit(20);
     }
-    runHook(hookArgs)
+    // hook.mjs (the PreToolUse shell parser) is by far the largest module and is
+    // only needed for the `hook` subcommand. Loading it lazily cuts the heaviest
+    // parse cost from every other command's startup, so the lifecycle-lock
+    // candidate is published earlier. This widens the margin under the queue-wait
+    // budget rather than guaranteeing it: openRepo's git spawns still set the
+    // floor on slow runners.
+    import('../src/hook.mjs')
+        .then(({ runHook }) => runHook(hookArgs))
         .then((code) => {
             // Drain the permission decision before exiting: on a piped stdout,
             // process.exit() can cut off the emit() write and drop a deny. The

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rmyndharis/aimhooman",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "description": "AI works. Hoomans ship. Keep AI session files, secrets, and attribution out of your commits.",
     "homepage": "https://github.com/rmyndharis/aimhooman#readme",
     "repository": {

package/src/atomic-write.mjs

@@ -39,7 +39,7 @@ export function atomicWrite(file, data, options = {}) {
         operations.sync(descriptor);
         operations.close(descriptor);
         descriptor = undefined;
-        operations.rename(temporary, file);
+        renameWithRetry(operations, temporary, file, options.renameRetries);
         try {
             syncDirectory(directory, operations);
         } catch (error) {
@@ -57,6 +57,30 @@ export function atomicWrite(file, data, options = {}) {
     }
 }
 
+// Windows fails a rename with EPERM/EACCES/EBUSY while another handle is open on
+// either path — an antivirus or indexer scanning the file aimhooman just wrote is
+// enough, and it clears within milliseconds. Observed on CI as a lock contender
+// dying at its ticket publication, which then read as a lifecycle-queue timeout.
+// The rename is the atomic commit point, so a retry either lands the complete
+// file or leaves the original untouched; it can never publish a partial write.
+// A non-transient error (and every code on other platforms) still throws at once.
+const TRANSIENT_RENAME_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+
+function renameWithRetry(operations, temporary, file, retries = 20) {
+    for (let attempt = 0; ; attempt += 1) {
+        try {
+            operations.rename(temporary, file);
+            return;
+        } catch (error) {
+            const retryable = process.platform === 'win32'
+                && TRANSIENT_RENAME_CODES.has(error?.code)
+                && attempt + 1 < retries;
+            if (!retryable) throw error;
+            waitForLock(5);
+        }
+    }
+}
+
 function existingMode(file) {
     try {
         return statSync(file).mode & 0o777;

package/src/githooks.mjs

@@ -581,8 +581,8 @@ AIMHOOMAN_NODE=${shq(nodePath)}
 AIMHOOMAN_PATH=${shq(shellPathValue)}
 ${captureTree}${captureTransaction}run_aimhooman() {
   if [ ! -f "$AIMHOOMAN_CLI" ] || [ ! -f "$AIMHOOMAN_NODE" ]; then
-    echo "aimhooman: guard unavailable; install it or run 'aimhooman init' again" >&2
-    return 127
+    echo "aimhooman: guard unavailable (aimhooman CLI or Node is missing); allowing this operation without protection. Reinstall aimhooman or remove the managed hooks." >&2
+    return 0
   fi
   (
     unset NODE_OPTIONS NODE_PATH NODE_REPL_EXTERNAL_MODULE NODE_EXTRA_CA_CERTS

package/src/gitx.mjs

@@ -612,18 +612,6 @@ export function trackedEntries(repo) {
     return enrichEntries(repo, entries);
 }
 
-// hasStagedChanges checks the complete index delta, including deletions that
-// are intentionally excluded from content scanning.
-export function hasStagedChanges(repo) {
-    try {
-        gitBuf(['diff', '--cached', '--quiet', '--'], repo.root);
-        return false;
-    } catch (error) {
-        if (error?.status === 1) return true;
-        throw error;
-    }
-}
-
 // withIndexFromTree exposes an immutable tree through Git's staged-index APIs.
 // It is used by commit-msg after the dispatcher snapshots the would-be commit
 // tree, so a chained hook cannot switch the policy by mutating the live index.

package/src/hook.mjs

@@ -101,7 +101,12 @@ function hookPreToolUse(input) {
     const executorCommand = command(input, executor);
     if (executorCommand === null) return unknownExecutorShape(input, executor.name);
     const rawParsed = parseGit(executorCommand);
-    if (nonPosixExecutor(executor.name)) rawParsed.uncertainShell = true;
+    if (nonPosixExecutor(executor.name)) {
+        rawParsed.uncertainShell = true;
+        // The benign-pipeline classifier is POSIX-only; never exempt a non-POSIX
+        // shell line (pwsh/fish/cmd/nu) from opaque-commit-hiding treatment.
+        rawParsed.opaqueCommitHiding = true;
+    }
     if (executorTargetSyntaxUncertain(executor.name, executorCommand, rawParsed)
         && (rawParsed.addPaths.length > 0 || rawParsed.commands.some(isProtectedMutation))) {
         return emitDecision(
@@ -364,7 +369,7 @@ function hookPreToolUse(input) {
     const prefixBypass = parsed.commands.some((candidate) => (
         (candidate.verb === 'commit' || candidate.verb === 'unknown')
         && candidate.prefixRisk
-    )) || (parsed.uncertainShell && parsed.commands.length === 0 && parsed.prefixRisk);
+    )) || (parsed.opaqueCommitHiding && parsed.commands.length === 0 && parsed.prefixRisk);
     const aliasBypass = parsed.commands.some((candidate) => (
         (candidate.verb === 'commit' || candidate.verb === 'unknown')
         && candidate.inlineAliasRisk
@@ -379,7 +384,13 @@ function hookPreToolUse(input) {
     const unmodelledPrefixReason =
         'aimhooman cannot verify the final staged snapshot or Git hooks after an earlier unmodelled command; run that command separately, then retry the commit.';
     const blocks = [];
-    const potentialCommit = commit || parsed.uncertainShell;
+    // potentialCommit treats a command as leading to a commit. uncertainShell
+    // was too broad: it flagged any pipe, so a benign read-only pipeline
+    // (gh ... | tail) was scanned and denied as if it staged a secret.
+    // opaqueCommitHiding keeps every commit-hiding shape (subshells,
+    // substitution, script-feeds, code-executing/unlisted pipe segments) while
+    // excluding pipelines of known read-only commands.
+    const potentialCommit = commit || parsed.opaqueCommitHiding;
     if (potentialCommit && repo) {
         try {
             const entries = stagedEntries(repo);
@@ -1055,11 +1066,17 @@ export function parseGit(cmd, initialCwd = process.cwd()) {
                 : commands.some((candidate) => candidate.verb === 'commit' && candidate.futureIndex)
                     ? 'future-index'
                     : 'direct';
+    // opaqueCommitHiding narrows uncertainShell to uncertainty that can hide or
+    // feed a commit (subshells, substitution, script-feeds, code-executing or
+    // unlisted pipe segments). A bare pipeline of known read-only commands
+    // (gh ... | tail) cannot, so it is not treated as a potential commit.
+    const opaqueCommitHiding = uncertainShell && !benignReadOnlyPipeline(cmd);
     return {
         commit,
         noVerify,
         bypassHooks,
         uncertainShell,
+        opaqueCommitHiding,
         classification,
         environmentRisk: unique(commands.flatMap((candidate) => candidate.environmentRisk || [])),
         prefixRisk,
@@ -1737,6 +1754,103 @@ function shellUnits(s) {
     return out;
 }
 
+// SAFE_PIPE_EXECUTABLES are commands permitted in a "benign read-only pipeline":
+// they take only data arguments, never run a sub-command, never execute code,
+// never write files, and cannot bypass Git hooks. Anything not listed is treated
+// as potentially able to hide or feed a commit (fail-closed). Deliberately
+// excluded: shells and interpreters, awk/sed/ed/vim, sqlite3/psql/dc/bc/octave
+// and other stdin-as-program readers, git, tee (writes files), env/xargs/find
+// (run sub-commands), and curl/wget (fetch arbitrary content to a pipe).
+const SAFE_PIPE_EXECUTABLES = new Set([
+    'cat', 'tac', 'head', 'tail', 'tr', 'cut', 'paste', 'fold', 'fmt', 'expand',
+    'unexpand', 'rev', 'nl', 'pr', 'column', 'sort', 'uniq', 'comm', 'tsort',
+    'shuf', 'wc', 'grep', 'egrep', 'fgrep', 'rg', 'ag', 'ack', 'xxd', 'od',
+    'hexdump', 'base64', 'base32', 'md5sum', 'sha1sum', 'sha224sum', 'sha256sum',
+    'sha384sum', 'sha512sum', 'cksum', 'b2sum', 'sum', 'file', 'ls', 'exa', 'eza',
+    'lsd', 'tree', 'du', 'df', 'stat', 'date', 'whoami', 'id', 'uname',
+    'hostname', 'uptime', 'printenv', 'pwd', 'basename', 'dirname', 'realpath',
+    'seq', 'yes', 'echo', 'printf', 'test', 'true', 'false', 'jq', 'yq', 'bat',
+    'gh', '[',
+]);
+
+// containsOpaquePipeLexeme is a quote-aware scan for shell constructs that can
+// hide or feed a commit or subcommand: command substitution, subshells, brace
+// expansion/groups, script-feed redirects, and command separators. Output
+// redirects (>, >>) and fd-dups such as 2>&1 are intentionally NOT opaque: they
+// cannot feed code into a pipe sink. A bare & (background) is opaque unless it
+// is part of an fd-dup (>& / <&) or &&.
+function containsOpaquePipeLexeme(command) {
+    let quote = '';
+    let escaped = false;
+    for (let i = 0; i < command.length; i += 1) {
+        const char = command[i];
+        const prev = command[i - 1];
+        const next = command[i + 1];
+        if (escaped) { escaped = false; continue; }
+        if (char === '\\' && quote !== "'") { escaped = true; continue; }
+        if (quote) {
+            if (quote === '"' && (char === '`' || (char === '$' && next === '('))) return true;
+            if (char === quote) quote = '';
+            continue;
+        }
+        if (char === "'" || char === '"') { quote = char; continue; }
+        if (char === '`' || char === '(' || char === ')' || char === '{' || char === '}') return true;
+        if (char === '$' && (next === '(' || next === '{')) return true;
+        if (char === '<' || char === ';') return true;
+        if (char === '&' && next !== '&' && prev !== '&' && prev !== '>' && prev !== '<') return true;
+    }
+    return false;
+}
+
+// splitPipeSegments splits a command on an unquoted pipe (|) that is not part
+// of ||. Unlike shellUnits it does not break on &, so 2>&1 stays within a
+// segment.
+function splitPipeSegments(command) {
+    const segments = [];
+    let segment = '';
+    let quote = '';
+    let escaped = false;
+    for (let i = 0; i < command.length; i += 1) {
+        const char = command[i];
+        if (escaped) { segment += char; escaped = false; continue; }
+        if (char === '\\' && quote !== "'") { segment += char; escaped = true; continue; }
+        if (quote) { segment += char; if (char === quote) quote = ''; continue; }
+        if (char === "'" || char === '"') { segment += char; quote = char; continue; }
+        if (char === '|' && command[i + 1] !== '|') { segments.push(segment); segment = ''; continue; }
+        segment += char;
+    }
+    segments.push(segment);
+    return segments;
+}
+
+// pipelineSegmentExecutable returns the shellExecutable basename of the first
+// non-environment-assignment token in a pipe segment, or null when the segment
+// has no command. A leading redirect token (e.g. 2>&1 before the command) is
+// treated as unlisted -> null -> not benign (fail-closed), which is safe.
+function pipelineSegmentExecutable(segment) {
+    for (const word of shellWords(segment.trim())) {
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) continue;
+        return shellExecutable(word);
+    }
+    return null;
+}
+
+// benignReadOnlyPipeline reports whether a command is a bare pipeline whose
+// every segment is a known non-code-executing, non-mutating command with no
+// opaque shell syntax. Such a pipe cannot hide or feed a commit, so it is not a
+// "potential commit" for the unmodelled-prefix guard. Fail-closed: any opaque
+// lexeme, unlisted executable, missing executable, or non-pipe returns false.
+function benignReadOnlyPipeline(command) {
+    if (!command.includes('|')) return false;
+    if (containsOpaquePipeLexeme(command)) return false;
+    const segments = splitPipeSegments(command);
+    if (segments.length < 2) return false;
+    return segments.every((segment) => {
+        const executable = pipelineSegmentExecutable(segment);
+        return executable !== null && SAFE_PIPE_EXECUTABLES.has(executable);
+    });
+}
+
 function pipedShellCommitInvocations(source, initialCwd) {
     const units = shellUnits(source);
     const commits = [];

package/src/scan-target.mjs

@@ -363,27 +363,38 @@ function scanEntryGroup(repo, engine, entries, policy, accumulator, options = {}
 
 function scanReviewPathChanges(engine, entries, policy, accumulator, options = {}) {
     for (const entry of entries) {
-        const paths = [];
-        if (entry.status === 'D' || entry.type === 'deleted') paths.push(entry.path);
-        if (entry.status === 'R' && entry.sourcePath && entry.sourcePath !== entry.path) {
-            paths.push(entry.sourcePath);
-        }
-        for (const path of paths) {
-            const context = {
-                objectId: null,
-                mode: null,
-                transition: options.transition ?? entry.commit,
-                ...(options.allowMissingPolicy && path === '.aimhooman.json'
-                    ? { transientAllowRules: new Set(['generic.project-policy']) }
-                    : {}),
-            };
-            const findings = engine.checkPaths([path], context).filter((finding) => (
-                finding.matchedRuleIds?.some((ruleId) => (
-                    ruleId === 'generic.agent-instructions' || ruleId === 'generic.project-policy'
-                ))
-            ));
-            accumulator.add(findings.map((finding) => decorate(finding, entry, policy)));
-        }
+        // A deleted path is gone, so only structural policy rules (agent
+        // instructions, project policy) can still matter: deleting a secret or a
+        // session file is hygiene, not a violation. A renamed-away path is
+        // different — its content survives under a new name, so a path-only
+        // secret (e.g. .env) must still fire or a `git mv` to a neutral name
+        // would slip past the destination scan, which only catches content-shaped
+        // secrets. That finding is reported on the destination path (where the
+        // bytes now live) so clean-profile repair unstages the blob that carries
+        // the secret rather than the old name.
+        const deleted = entry.status === 'D' || entry.type === 'deleted';
+        const renamed = entry.status === 'R' && entry.sourcePath && entry.sourcePath !== entry.path;
+        if (!deleted && !renamed) continue;
+        const sourcePath = deleted ? entry.path : entry.sourcePath;
+        const context = {
+            objectId: null,
+            mode: null,
+            transition: options.transition ?? entry.commit,
+            ...(options.allowMissingPolicy && sourcePath === '.aimhooman.json'
+                ? { transientAllowRules: new Set(['generic.project-policy']) }
+                : {}),
+        };
+        const findings = engine.checkPaths([sourcePath], context).filter((finding) => {
+            if (finding.matchedRuleIds?.some((ruleId) => (
+                ruleId === 'generic.agent-instructions' || ruleId === 'generic.project-policy'
+            ))) return true;
+            return renamed && finding.category === 'secret';
+        });
+        accumulator.add(findings.map((finding) => decorate(
+            renamed && finding.category === 'secret' ? { ...finding, path: entry.path } : finding,
+            entry,
+            policy,
+        )));
     }
 }