@rmyndharis/aimhooman 0.1.0 → 0.1.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
             "name": "aimhooman",
             "source": "./",
             "description": "Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
-            "version": "0.1.0",
+            "version": "0.1.2",
             "license": "MIT",
             "keywords": [
                 "git",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.0",
+    "version": "0.1.2",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.0",
+    "version": "0.1.2",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman maintainers",

package/CHANGELOG.md

@@ -5,7 +5,204 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.1.2] - 2026-07-17
+
+### Removed
+
+- The legacy per-clone state migration is gone, and with it the failure paths it
+  created. `openRepo` used to look for state under `.git/worktrees/<name>/aimhooman`
+  and migrate it into `<commonDir>/aimhooman`, fingerprinting both and refusing to
+  continue when two copies disagreed. No released version ever wrote to that
+  location — v0.1.0 already resolved state to `<commonDir>/aimhooman` on the line
+  above the migration — so the predecessor it protected never existed. What it did
+  produce was real: any error other than ENOENT while listing `.git/worktrees` was
+  re-raised through every command, including `uninstall`, so a directory Git itself
+  reads without trouble could freeze a repository with no supported way out.
+  `.git/worktrees` belongs to Git and can be owned by another uid after a
+  `sudo git worktree add`. Repository state resolves to `<commonDir>/aimhooman`, as
+  it always has.
+
+### Fixed
+
+- Unstaging residue no longer stages the deletion of tracked files. The HEAD probe
+  reused the options object carrying the pathspec on stdin, and `git rev-parse`
+  never reads stdin, so once the pathspec passed the 64 KiB pipe buffer the write
+  failed with `EPIPE`. The catch read that as "this repository has no HEAD" and ran
+  `git rm --cached` where `git restore --staged` was meant, staging the deletion of
+  every tracked path it had been asked to restore, printing "unstaged N AI
+  artifact(s)", and exiting 0 so the commit carried the deletions into history. It
+  takes roughly 470 paths to cross that buffer, which a tracked `.claude/projects/`
+  tree passes without trying, and the repair loop could not see it: the staged
+  deletions read as still-staged, so it retried, made no progress, and reported
+  success anyway. The probe no longer receives the pathspec, and only git's own exit
+  status may pick the branch — a timeout or a missing git stops the commit instead
+  of guessing that HEAD is absent. Present since 0.1.0.
+- A stuck `git` no longer holds a repository open indefinitely. `execFileSync` has
+  no default timeout, so a child that never exited blocked its caller for as long as
+  it lived, with nothing printed and nothing logged; one held a CI runner for six
+  hours and died to the platform's ceiling rather than to anything here. Every child
+  process now carries a bound: 120 seconds for git, far above any real call, and 5
+  seconds for the `ps` identity probe, which runs inside the lock retry loop and only
+  on macOS and BSD (Linux reads `/proc`, Windows returns early). Both throw into the
+  handling that was already there, so a bounded failure degrades the way a missing
+  git already did instead of hanging. A test walks `src/` and `bin/` and fails on any
+  child process without a bound.
+- Renaming or moving a repository no longer freezes it. The dispatcher bakes
+  absolute paths, so a move changes the `CHAINED` value it carries, and ownership
+  was decided by comparing that string — overruling the SHA-256 fingerprint on the
+  line above, which had already proved the file was ours. Every commit, every
+  `--no-verify`, and every branch creation then failed; `status` reported the guard
+  as belonging to another repository; `aimhooman init`, the remedy each message
+  named, refused too. Ownership inside the repository's own `.git` is now settled
+  by the fingerprint alone, because no second repository can own a file there. The
+  baked path keeps its vote only where a hooks directory can genuinely be shared —
+  two repositories pointing `core.hooksPath` at one place — which is the case it
+  was written for.
+- `uninstall` no longer reports success while leaving its own dispatchers behind.
+  Refusals were recorded as warnings, the exit code only consulted failures, and
+  the "uninstalled" headline printed before either was known, so a moved
+  repository was told it was free while four dispatchers still blocked every
+  commit. uninstall now checks the hooks directory instead of trusting its own
+  report: anything of ours still on disk is named with its full path, the headline
+  is withheld, and the exit code is 30. A chained backup that is a symlink is
+  still never read or copied through, but the dispatcher above it is now removed
+  rather than held as collateral, and the report says the original hook was not
+  restored.
+- A `HOME` behind a symlink no longer makes every global dispatcher look foreign.
+  `hookDiagnostics` compared the effective hooks directory to the global one with
+  `resolve`, which does not follow symlinks, while Git reports the realpath — so
+  on a distribution that ships `/home` as a link, or an NFS or autofs home, the
+  two spellings differed and every global hook was diagnosed as managed for
+  another repository.
+- A failed excludes refresh no longer disables the `PreToolUse` guard. Writing
+  `.git/info/exclude` sat inside the same `try` as the engine load, and the shared
+  `catch` allowed the command on every non-strict profile, so an unwritable
+  `.git/info` — a CI checkout, a read-only volume, a repository owned by another
+  user — turned a staged AWS key plus `git commit --no-verify` from `deny` into
+  `allow`. Nothing about the policy was wrong: the rules had loaded, and the
+  reported cause ("could not load policy rules") named the wrong thing. Refreshing
+  the excludes is gitignore hygiene, which `pre-commit` never does and still
+  answers correctly, so it now runs outside the verdict and reports as a warning.
+
+- A local rule pack that cannot load no longer produces a report claiming a
+  complete scan. `strict` already failed closed, but `clean` and `compliance`
+  turned the load error into a stderr warning and left the accumulator untouched,
+  so `--json` returned `complete: true`, `findings: []`, `skipped: {}` and exit 0
+  while the team's own rules had never run. The pack most teams write is a
+  detector for their internal token format; one typo took it out of the scan, and
+  the report actively certified that nothing was missed. A failed pack is now the
+  counted skip reason `local-pack-error` and marks the scan incomplete, which is
+  the treatment `local-input-limit` already had in every profile: a rule that
+  never ran is a coverage gap, not an empty result. `clean` and `compliance`
+  therefore stop at exit 31 where they previously continued. The hint now points
+  at the pack instead of suggesting the caller reduce the target or limits, which
+  was never the remedy for a pattern that will not compile.
+- Creating a branch no longer rescans the entire repository. A new branch arrives
+  with an all-zero old tip, so `rev-list` ran with no negative boundary and every
+  ancestor was re-read, tree and blob sizes included: 24.7s at 200 commits, growing
+  linearly, on an operation `--no-verify` cannot skip. Reachability from
+  `refs/heads/*` is now trusted, because those commits passed this same guard when
+  their branch was written, which puts `git checkout -b` back at ordinary commit
+  cost (0.95s in the same repository). Only `refs/heads/*` counts: tags and remote
+  refs are not gated here and still cannot pre-poison reachability, the refs under
+  review are never their own proof, and a commit no local branch reaches is still
+  scanned in full. Commits that predate `aimhooman init` are outside the guard's
+  scope; audit them with `check --range`.
+- `init` no longer writes dispatchers into a hooks directory that Git tracks.
+  Ownership was tested by location alone, so any `core.hooksPath` inside the
+  worktree counted as the repository's own — including the committed `.husky` and
+  `.githooks` directories that husky and the vanilla pattern rely on. init edited
+  those tracked files in place, and the dispatcher it wrote carries this machine's
+  absolute CLI, Node, and PATH: once committed, the hook is dead for every
+  teammate, and the PATH alone discloses the author's home directory and installed
+  tooling. Ownership now also requires that Git is not tracking the directory, and
+  a directory Git cannot be asked about counts as tracked. A refusal now names the
+  cause instead of reporting a bare incomplete installation; as before, integrate
+  aimhooman into the existing hook manager or remove the override.
+- A moved Node interpreter no longer disables the guard silently. 0.1.1 made the
+  dispatcher degrade gracefully when the CLI or Node was missing, which is right
+  for a half-removed install but wrong for a relocated interpreter: `brew upgrade
+  node`, `nvm`, `fnm`, and `volta` all move the `process.execPath` that `init`
+  pins, and every hook then warned once and allowed the commit unprotected. The
+  conditions now separate by what the user can still do about them. A missing CLI
+  still allows the operation, because the package is gone and no guard is wanted.
+  A missing pinned interpreter stops the operation and names the path and the
+  remedy — but only while a Node exists to run that remedy with, since `init` and
+  `uninstall` are both Node programs and the CLI file is inert without one.
+  Where no Node is present at all, the dispatcher degrades and says so, because
+  refusing there would leave the repository unusable with no supported way to
+  remove the hooks. Stopping matches what the CLI already believed —
+  `installedHooks` treats an unreachable Node as an inactive dispatcher, so the
+  shell was short-circuiting the CLI's own fail-closed path — but only where
+  stopping is recoverable. Re-run `aimhooman init` after upgrading Node to re-pin it.
+- Attribution rules no longer miss current AI footers. `attribution.generated-with`
+  pinned the literal vendor link `https://claude.ai/code`, and the co-author rules
+  pinned the display names `Claude`, `Claude Code`, and `Codex`. Once the link was
+  rebranded and the display name grew a model suffix, the default footer passed
+  through untouched with exit 0 while the older form was still repaired perfectly.
+  The rules now anchor on what identifies the machine rather than what marketing
+  changes: a co-author trailer is matched by its `noreply@` service address alone,
+  and the generated-with link is matched by its shape. A new contract test rejects
+  any attribution pattern that pins a vendor URL, so the pack cannot rot back into
+  this state without failing CI.
+- `attribution.ai-noreply` no longer backtracks catastrophically. `\s*[^<>]+\s*`
+  placed three ambiguous quantifiers before a literal `<`, which cost 49s on a
+  6400-character trailer that never closes; built-in patterns are exempt from the
+  local input cap, so a commit message reached it directly. The redundant
+  whitespace quantifiers are gone (`[^<>]+` already spans them), leaving the
+  matched language unchanged, and a bounded-cost test now covers the built-in
+  message patterns.
+
+## [0.1.1] - 2026-07-16
+
+### Fixed
+
+- Git hooks no longer trap the repository when the aimhooman CLI or Node is
+  missing (for example after the package was removed without `aimhooman
+  uninstall`). The dispatcher used to exit 127 and abort every commit; it now
+  warns once and allows the operation without protection, so a half-removed
+  install degrades gracefully instead of breaking Git.
+- The `PreToolUse` guard no longer denies ordinary read-only pipelines. Any pipe
+  made the parsed command uncertain, and the clean and compliance profiles read
+  that uncertainty as a possibly hidden commit, so everyday lines such as
+  `gh issue view 1 | tail -5` were blocked. A pipeline now passes when every
+  segment is a known read-only command and the line carries no opaque shell
+  syntax; everything else stays denied, including pipe-to-shell, subshells,
+  `eval`, and readers that execute their own input. `strict` is unchanged.
+- A bare `allow <path>` for a path that matches a secret rule (for example
+  `.env.minimal`) no longer reports success while leaving the block in place.
+  It now fails closed and directs to `--scope secret-path`, the only scope that
+  can silence a secret, so a local override cannot hide a possible leaked key.
+- Detect secrets renamed to a neutral path. A path-only secret such as `.env`
+  was missed when moved to a name the destination scan does not match, because its
+  content carries no PEM, AWS, or token shape; the rename-source review now retains
+  secret-category findings and reports them on the destination path where the bytes
+  live, so clean-profile repair unstages the blob that carries the secret. Deleting
+  a secret path remains a non-finding.
+- Retry the atomic rename that commits a state write when Windows reports a
+  transient `EPERM`, `EACCES`, or `EBUSY`. An antivirus or indexer holding a
+  handle on the file aimhooman had just written could kill a lock contender at
+  its ticket publication, which surfaced as unrelated failures (a lifecycle-queue
+  timeout, or a repair that appeared not to run). A persistent failure, any other
+  error code, and every non-Windows platform still fail immediately, and the
+  original file is never left partially written.
+- The clean-profile repair now verifies it cleared every target and re-runs the
+  unstage when a transient git operation under heavy load left a path staged, so
+  the repair no longer reports success while an artifact rides through.
+- Derive the post-repair empty-commit hint from the staged paths captured
+  before repair instead of a second git read after `git restore --staged`. That
+  read followed an index write and could transiently report the wrong state
+  under heavy load; the derivation is deterministic.
+
+### Changed
+
+- The release workflow runs `npm run verify` before publish instead of `npm test`,
+  so the tarball-manifest check and the installed-hook smoke test gate the published
+  tag, matching the push workflow.
+- Non-hook commands no longer load the PreToolUse shell parser at startup; it is
+  imported only for the `hook` subcommand, which speeds up `init`, `uninstall`,
+  `check`, `status`, and the rest and gives the lifecycle-lock queue more headroom
+  on slow runners.
 
 ## [0.1.0] - 2026-07-15
 
@@ -30,10 +227,9 @@ commit messages, and AI markers left in code.
 - Scan every index stage during unresolved conflicts so a secret on either side
   cannot be missed.
 - Authorize protected-path CI only when the exact workflow-run attempt's actor and
-  triggering actor, including their IDs, match the current personal-repository
-  owner returned by GitHub. Bind that authorization to exact commits, paths,
-  blobs, modes, deletion tombstones, and policy migrations; non-owner changes fail
-  closed with no reviewer fallback.
+  triggering actor, including their IDs, match the repository owner returned by
+  GitHub. Bind that authorization to exact commits, paths, blobs, modes, deletion
+  tombstones, and policy migrations; changes not attributed to the owner fail closed.
 - Keep the published local rule-pack schema compatible with strict JSON Schema
   validators.
 - Prove npm version absence and forward dist-tag movement with bounded retries

package/CONTRIBUTING.md

@@ -88,7 +88,39 @@ Personal, per-clone detection belongs in `<git-common-dir>/aimhooman/rules/*.jso
 (local, never committed). Linked worktrees share it. Contribute general-purpose
 rules to `rules/` instead.
 
-## Commit policy (important)
+## Commits
+
+Subject lines follow [Conventional Commits](https://www.conventionalcommits.org/):
+`type(scope): summary`.
+
+| Type | Use for |
+| --- | --- |
+| `feat` | a new rule, host adapter, or CLI capability |
+| `fix` | a bug fix |
+| `docs` | documentation only |
+| `test` | tests and fixtures only |
+| `refactor` | restructuring that leaves behavior identical |
+| `perf` | a speedup you can measure |
+| `ci` | workflows and release automation |
+| `chore` | dependency bumps, version stamping, housekeeping |
+
+Scopes track the project layout: `rules`, `hook`, `githooks`, `cli`, `state`,
+`adapter`, `deps`, `release`. Drop the scope when a change spans several.
+
+The `type(scope):` prefix is the only part that is a format. Everything after the
+colon stays a plain imperative sentence that names what actually changed:
+
+```
+fix(state): retry the rename when Windows reports a transient lock
+fix(hook): allow Git operations when the aimhooman CLI or Node is missing
+ci: run the test matrix once per change instead of twice
+chore(release): 0.1.1
+```
+
+PRs land as squash merges, so the PR title is the commit message that lands on
+`main`. Title the PR the same way.
+
+### Policy (important)
 
 This project keeps AI tooling residue out of history — **including its own**.
 Commits must read as if a human wrote them:
@@ -100,45 +132,26 @@ Commits must read as if a human wrote them:
 
 ## Pull requests
 
-1. Open a PR against `main`.
+1. Open a PR against `main`. Title it `type(scope): summary` — it becomes the
+   commit message on `main`.
 2. Include tests for any new behavior and run `npm run verify`.
 3. Update `CHANGELOG.md` and `docs/` where relevant.
-4. Make sure the PR follows the commit policy above.
+4. Make sure the PR follows the commit conventions above.
 
 By participating, you agree to abide by the [Code of Conduct](CODE_OF_CONDUCT.md).
 
-This is a personal, owner-only repository. GitHub branch rules require the `tests`
-workflow but no pull-request approval, code-owner review, last-push approval, or
-other reviewer. The repository has no `CODEOWNERS` fallback.
-
-Changes to agent instructions or `.aimhooman.json` are protected-path changes. CI
-verifies the pinned repository and owner login plus numeric IDs through the GitHub
-API, then fetches the exact workflow-run attempt. GitHub must attribute the
-attempt's `actor` and `triggering_actor` to that owner's login and numeric ID. CI
-binds that authorization to the exact
-head, transition commit, path, resulting blob and regular-file mode, or deletion
-tombstone. Policy migrations additionally bind the old and new policy objects.
-Another commit, attempt, path result, mode, or migration needs fresh authorization.
-A protected-path change by any non-owner fails closed.
-
-The owner account and its credentials are the repository trust root. These checks
-verify GitHub's actor attribution and bind the resulting objects; they do not prove
-an interactive human action, provide independent review, or protect against a
-compromised owner credential.
+## Releases
 
 Releases publish to npm automatically when a `v*` tag is pushed. The workflow
-installs dependencies, runs the test suite, and publishes with npm build provenance,
-authenticated by the `NPM_TOKEN` secret. To cut a release: bump the version (keep
-`package.json`, `.claude-plugin/plugin.json`, `.codex-plugin/plugin.json`, and
-`.claude-plugin/marketplace.json` in sync), add the `## [version]` CHANGELOG entry
-and the matching README version badge, then tag and push:
+installs dependencies, runs the test suite, and publishes with npm build provenance.
+To cut a release, bump the version (keep `package.json`, `.claude-plugin/plugin.json`,
+`.codex-plugin/plugin.json`, and `.claude-plugin/marketplace.json` in sync), add the
+`## [version]` CHANGELOG entry and the matching README version badge, then:
 
 ```sh
 git tag -a v0.1.0 -m v0.1.0
 git push origin v0.1.0
 ```
 
-Protect `v*` tags so only the owner can create them and tag update or deletion is
-blocked. Use a granular, publish-only, package-scoped npm token with 2FA enabled
-and rotate it regularly. Do not run `npm publish` or move dist-tags manually while
-a release job is pending or running.
+Use a granular, publish-only npm token with 2FA enabled, and avoid publishing or
+moving dist-tags manually while a release job is running.

package/README.md

@@ -9,7 +9,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/github/actions/workflow/status/rmyndharis/aimhooman/test.yml?branch=main&label=CI" alt="CI">
-  <img src="https://img.shields.io/badge/version-v0.1.0-blue" alt="v0.1.0">
+  <img src="https://img.shields.io/badge/version-v0.1.2-blue" alt="v0.1.2">
   <img src="https://img.shields.io/badge/node-%E2%89%A522.8-339933?logo=node.js&logoColor=white" alt="Node 22.8+">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero dependencies">
   <img src="https://img.shields.io/badge/license-MIT-111111" alt="MIT">
@@ -151,8 +151,10 @@ Prefer repository `init` unless the global ordering is understood.
 
 When `core.hooksPath` is set, Git reads hooks only from that effective directory and
 ignores `.git/hooks`. Repository `init` installs and chains predecessors only when
-that directory is absent or is proven to be owned by the repository. It refuses to
-modify a global, shared, or external hook directory. In that case, integrate
+that directory is absent or is proven to be owned by the repository: inside it and
+not tracked by Git. It refuses to modify a global, shared, external, or tracked
+hook directory, because a dispatcher committed from one machine names paths that
+exist only on that machine. In that case, integrate
 aimhooman into the existing hook manager or remove the override before retrying.
 
 Repository `init` installs `pre-commit`, `pre-merge-commit`, `commit-msg`, and
@@ -286,17 +288,15 @@ Under `strict`, policy files and agent instructions produce review-required find
 The product's `review` and `policy-review` commands record local, object-bound decisions;
 an ordinary path allow cannot satisfy either finding.
 
-This personal repository does not use GitHub approvals, required reviewers, or
-`CODEOWNERS`. For a protected-path change, CI verifies the pinned repository and owner
-login plus numeric IDs through the GitHub API, then inspects the exact workflow-run
-attempt. GitHub must attribute both `actor` and `triggering_actor`, including their
-numeric IDs, to that owner. CI then binds the
-authorization to the exact head, transition commit, path, resulting blob and regular-file
-mode, or deletion tombstone. A strict-policy migration also binds its old and new policy
-objects. A different attempt, commit, path result, mode, or policy transition needs fresh
-authorization. A non-owner change fails closed; there is no reviewer or `CODEOWNERS`
-fallback. The owner account and its credentials are the trust root, so this is owner
-authorization, not independent review.
+For a protected-path change, CI verifies the pinned repository and owner login plus
+numeric IDs through the GitHub API, then inspects the exact workflow-run attempt.
+GitHub must attribute both `actor` and `triggering_actor`, including their numeric IDs,
+to that owner. CI then binds the authorization to the exact head, transition commit,
+path, resulting blob and regular-file mode, or deletion tombstone. A strict-policy
+migration also binds its old and new policy objects. A different attempt, commit, path
+result, mode, or policy transition needs fresh authorization. A change not attributed to
+the owner fails closed. This is owner authorization verified through GitHub attribution,
+not independent review.
 
 ## Overrides
 

package/SECURITY.md

@@ -54,16 +54,14 @@ only the latest minor release will receive security fixes.
 - A committed `.aimhooman.json` provides the versioned team profile. Invalid
   project policy fails closed; per-clone allow/deny entries remain local and
   should be governed by team process where compliance requires it.
-- This is a personal, owner-only repository with no GitHub approval, required
-  reviewer, or `CODEOWNERS` gate. For protected-path changes, CI resolves the
-  pinned repository and owner through the GitHub API and fetches the exact
-  workflow-run attempt. GitHub must attribute both the actor and triggering actor
-  to the owner's login and numeric ID. The resulting decision is bound to the exact head,
-  transition commit, path, blob and regular-file mode, or deletion tombstone; a
-  policy migration also binds its old and new objects. Non-owner changes fail
-  closed with no reviewer fallback. The owner is the trust root, not an independent
-  reviewer. These checks verify GitHub attribution, not an interactive human action,
-  and cannot defend against malicious or compromised owner credentials.
+- For protected-path changes (agent instruction files, `.aimhooman.json`), CI resolves
+  the repository and owner through the GitHub API and fetches the exact workflow-run
+  attempt. GitHub must attribute both the actor and triggering actor to the owner's
+  login and numeric ID. The resulting decision is bound to the exact head, transition
+  commit, path, blob, and regular-file mode (or deletion tombstone); a policy migration
+  also binds its old and new objects. Changes not attributed to the owner fail closed.
+  These checks verify GitHub actor attribution, not an interactive human action, and
+  cannot defend against a compromised owner credential.
 - The release pipeline pins actions to immutable commit SHAs and publishes with npm
   build provenance. Pushing a `v*` tag runs the workflow: it installs dependencies,
   runs the test suite, then publishes to npm authenticated by the `NPM_TOKEN` secret