@rmyndharis/aimhooman 0.1.1 → 0.1.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
             "name": "aimhooman",
             "source": "./",
             "description": "Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
-            "version": "0.1.1",
+            "version": "0.1.2",
             "license": "MIT",
             "keywords": [
                 "git",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.1",
+    "version": "0.1.2",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.1",
+    "version": "0.1.2",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman maintainers",

package/CHANGELOG.md

@@ -5,7 +5,153 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.1.2] - 2026-07-17
+
+### Removed
+
+- The legacy per-clone state migration is gone, and with it the failure paths it
+  created. `openRepo` used to look for state under `.git/worktrees/<name>/aimhooman`
+  and migrate it into `<commonDir>/aimhooman`, fingerprinting both and refusing to
+  continue when two copies disagreed. No released version ever wrote to that
+  location — v0.1.0 already resolved state to `<commonDir>/aimhooman` on the line
+  above the migration — so the predecessor it protected never existed. What it did
+  produce was real: any error other than ENOENT while listing `.git/worktrees` was
+  re-raised through every command, including `uninstall`, so a directory Git itself
+  reads without trouble could freeze a repository with no supported way out.
+  `.git/worktrees` belongs to Git and can be owned by another uid after a
+  `sudo git worktree add`. Repository state resolves to `<commonDir>/aimhooman`, as
+  it always has.
+
+### Fixed
+
+- Unstaging residue no longer stages the deletion of tracked files. The HEAD probe
+  reused the options object carrying the pathspec on stdin, and `git rev-parse`
+  never reads stdin, so once the pathspec passed the 64 KiB pipe buffer the write
+  failed with `EPIPE`. The catch read that as "this repository has no HEAD" and ran
+  `git rm --cached` where `git restore --staged` was meant, staging the deletion of
+  every tracked path it had been asked to restore, printing "unstaged N AI
+  artifact(s)", and exiting 0 so the commit carried the deletions into history. It
+  takes roughly 470 paths to cross that buffer, which a tracked `.claude/projects/`
+  tree passes without trying, and the repair loop could not see it: the staged
+  deletions read as still-staged, so it retried, made no progress, and reported
+  success anyway. The probe no longer receives the pathspec, and only git's own exit
+  status may pick the branch — a timeout or a missing git stops the commit instead
+  of guessing that HEAD is absent. Present since 0.1.0.
+- A stuck `git` no longer holds a repository open indefinitely. `execFileSync` has
+  no default timeout, so a child that never exited blocked its caller for as long as
+  it lived, with nothing printed and nothing logged; one held a CI runner for six
+  hours and died to the platform's ceiling rather than to anything here. Every child
+  process now carries a bound: 120 seconds for git, far above any real call, and 5
+  seconds for the `ps` identity probe, which runs inside the lock retry loop and only
+  on macOS and BSD (Linux reads `/proc`, Windows returns early). Both throw into the
+  handling that was already there, so a bounded failure degrades the way a missing
+  git already did instead of hanging. A test walks `src/` and `bin/` and fails on any
+  child process without a bound.
+- Renaming or moving a repository no longer freezes it. The dispatcher bakes
+  absolute paths, so a move changes the `CHAINED` value it carries, and ownership
+  was decided by comparing that string — overruling the SHA-256 fingerprint on the
+  line above, which had already proved the file was ours. Every commit, every
+  `--no-verify`, and every branch creation then failed; `status` reported the guard
+  as belonging to another repository; `aimhooman init`, the remedy each message
+  named, refused too. Ownership inside the repository's own `.git` is now settled
+  by the fingerprint alone, because no second repository can own a file there. The
+  baked path keeps its vote only where a hooks directory can genuinely be shared —
+  two repositories pointing `core.hooksPath` at one place — which is the case it
+  was written for.
+- `uninstall` no longer reports success while leaving its own dispatchers behind.
+  Refusals were recorded as warnings, the exit code only consulted failures, and
+  the "uninstalled" headline printed before either was known, so a moved
+  repository was told it was free while four dispatchers still blocked every
+  commit. uninstall now checks the hooks directory instead of trusting its own
+  report: anything of ours still on disk is named with its full path, the headline
+  is withheld, and the exit code is 30. A chained backup that is a symlink is
+  still never read or copied through, but the dispatcher above it is now removed
+  rather than held as collateral, and the report says the original hook was not
+  restored.
+- A `HOME` behind a symlink no longer makes every global dispatcher look foreign.
+  `hookDiagnostics` compared the effective hooks directory to the global one with
+  `resolve`, which does not follow symlinks, while Git reports the realpath — so
+  on a distribution that ships `/home` as a link, or an NFS or autofs home, the
+  two spellings differed and every global hook was diagnosed as managed for
+  another repository.
+- A failed excludes refresh no longer disables the `PreToolUse` guard. Writing
+  `.git/info/exclude` sat inside the same `try` as the engine load, and the shared
+  `catch` allowed the command on every non-strict profile, so an unwritable
+  `.git/info` — a CI checkout, a read-only volume, a repository owned by another
+  user — turned a staged AWS key plus `git commit --no-verify` from `deny` into
+  `allow`. Nothing about the policy was wrong: the rules had loaded, and the
+  reported cause ("could not load policy rules") named the wrong thing. Refreshing
+  the excludes is gitignore hygiene, which `pre-commit` never does and still
+  answers correctly, so it now runs outside the verdict and reports as a warning.
+
+- A local rule pack that cannot load no longer produces a report claiming a
+  complete scan. `strict` already failed closed, but `clean` and `compliance`
+  turned the load error into a stderr warning and left the accumulator untouched,
+  so `--json` returned `complete: true`, `findings: []`, `skipped: {}` and exit 0
+  while the team's own rules had never run. The pack most teams write is a
+  detector for their internal token format; one typo took it out of the scan, and
+  the report actively certified that nothing was missed. A failed pack is now the
+  counted skip reason `local-pack-error` and marks the scan incomplete, which is
+  the treatment `local-input-limit` already had in every profile: a rule that
+  never ran is a coverage gap, not an empty result. `clean` and `compliance`
+  therefore stop at exit 31 where they previously continued. The hint now points
+  at the pack instead of suggesting the caller reduce the target or limits, which
+  was never the remedy for a pattern that will not compile.
+- Creating a branch no longer rescans the entire repository. A new branch arrives
+  with an all-zero old tip, so `rev-list` ran with no negative boundary and every
+  ancestor was re-read, tree and blob sizes included: 24.7s at 200 commits, growing
+  linearly, on an operation `--no-verify` cannot skip. Reachability from
+  `refs/heads/*` is now trusted, because those commits passed this same guard when
+  their branch was written, which puts `git checkout -b` back at ordinary commit
+  cost (0.95s in the same repository). Only `refs/heads/*` counts: tags and remote
+  refs are not gated here and still cannot pre-poison reachability, the refs under
+  review are never their own proof, and a commit no local branch reaches is still
+  scanned in full. Commits that predate `aimhooman init` are outside the guard's
+  scope; audit them with `check --range`.
+- `init` no longer writes dispatchers into a hooks directory that Git tracks.
+  Ownership was tested by location alone, so any `core.hooksPath` inside the
+  worktree counted as the repository's own — including the committed `.husky` and
+  `.githooks` directories that husky and the vanilla pattern rely on. init edited
+  those tracked files in place, and the dispatcher it wrote carries this machine's
+  absolute CLI, Node, and PATH: once committed, the hook is dead for every
+  teammate, and the PATH alone discloses the author's home directory and installed
+  tooling. Ownership now also requires that Git is not tracking the directory, and
+  a directory Git cannot be asked about counts as tracked. A refusal now names the
+  cause instead of reporting a bare incomplete installation; as before, integrate
+  aimhooman into the existing hook manager or remove the override.
+- A moved Node interpreter no longer disables the guard silently. 0.1.1 made the
+  dispatcher degrade gracefully when the CLI or Node was missing, which is right
+  for a half-removed install but wrong for a relocated interpreter: `brew upgrade
+  node`, `nvm`, `fnm`, and `volta` all move the `process.execPath` that `init`
+  pins, and every hook then warned once and allowed the commit unprotected. The
+  conditions now separate by what the user can still do about them. A missing CLI
+  still allows the operation, because the package is gone and no guard is wanted.
+  A missing pinned interpreter stops the operation and names the path and the
+  remedy — but only while a Node exists to run that remedy with, since `init` and
+  `uninstall` are both Node programs and the CLI file is inert without one.
+  Where no Node is present at all, the dispatcher degrades and says so, because
+  refusing there would leave the repository unusable with no supported way to
+  remove the hooks. Stopping matches what the CLI already believed —
+  `installedHooks` treats an unreachable Node as an inactive dispatcher, so the
+  shell was short-circuiting the CLI's own fail-closed path — but only where
+  stopping is recoverable. Re-run `aimhooman init` after upgrading Node to re-pin it.
+- Attribution rules no longer miss current AI footers. `attribution.generated-with`
+  pinned the literal vendor link `https://claude.ai/code`, and the co-author rules
+  pinned the display names `Claude`, `Claude Code`, and `Codex`. Once the link was
+  rebranded and the display name grew a model suffix, the default footer passed
+  through untouched with exit 0 while the older form was still repaired perfectly.
+  The rules now anchor on what identifies the machine rather than what marketing
+  changes: a co-author trailer is matched by its `noreply@` service address alone,
+  and the generated-with link is matched by its shape. A new contract test rejects
+  any attribution pattern that pins a vendor URL, so the pack cannot rot back into
+  this state without failing CI.
+- `attribution.ai-noreply` no longer backtracks catastrophically. `\s*[^<>]+\s*`
+  placed three ambiguous quantifiers before a literal `<`, which cost 49s on a
+  6400-character trailer that never closes; built-in patterns are exempt from the
+  local input cap, so a commit message reached it directly. The redundant
+  whitespace quantifiers are gone (`[^<>]+` already spans them), leaving the
+  matched language unchanged, and a bounded-cost test now covers the built-in
+  message patterns.
 
 ## [0.1.1] - 2026-07-16
 

package/CONTRIBUTING.md

@@ -88,7 +88,39 @@ Personal, per-clone detection belongs in `<git-common-dir>/aimhooman/rules/*.jso
 (local, never committed). Linked worktrees share it. Contribute general-purpose
 rules to `rules/` instead.
 
-## Commit policy (important)
+## Commits
+
+Subject lines follow [Conventional Commits](https://www.conventionalcommits.org/):
+`type(scope): summary`.
+
+| Type | Use for |
+| --- | --- |
+| `feat` | a new rule, host adapter, or CLI capability |
+| `fix` | a bug fix |
+| `docs` | documentation only |
+| `test` | tests and fixtures only |
+| `refactor` | restructuring that leaves behavior identical |
+| `perf` | a speedup you can measure |
+| `ci` | workflows and release automation |
+| `chore` | dependency bumps, version stamping, housekeeping |
+
+Scopes track the project layout: `rules`, `hook`, `githooks`, `cli`, `state`,
+`adapter`, `deps`, `release`. Drop the scope when a change spans several.
+
+The `type(scope):` prefix is the only part that is a format. Everything after the
+colon stays a plain imperative sentence that names what actually changed:
+
+```
+fix(state): retry the rename when Windows reports a transient lock
+fix(hook): allow Git operations when the aimhooman CLI or Node is missing
+ci: run the test matrix once per change instead of twice
+chore(release): 0.1.1
+```
+
+PRs land as squash merges, so the PR title is the commit message that lands on
+`main`. Title the PR the same way.
+
+### Policy (important)
 
 This project keeps AI tooling residue out of history — **including its own**.
 Commits must read as if a human wrote them:
@@ -100,10 +132,11 @@ Commits must read as if a human wrote them:
 
 ## Pull requests
 
-1. Open a PR against `main`.
+1. Open a PR against `main`. Title it `type(scope): summary` — it becomes the
+   commit message on `main`.
 2. Include tests for any new behavior and run `npm run verify`.
 3. Update `CHANGELOG.md` and `docs/` where relevant.
-4. Make sure the PR follows the commit policy above.
+4. Make sure the PR follows the commit conventions above.
 
 By participating, you agree to abide by the [Code of Conduct](CODE_OF_CONDUCT.md).
 

package/README.md

@@ -9,7 +9,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/github/actions/workflow/status/rmyndharis/aimhooman/test.yml?branch=main&label=CI" alt="CI">
-  <img src="https://img.shields.io/badge/version-v0.1.1-blue" alt="v0.1.1">
+  <img src="https://img.shields.io/badge/version-v0.1.2-blue" alt="v0.1.2">
   <img src="https://img.shields.io/badge/node-%E2%89%A522.8-339933?logo=node.js&logoColor=white" alt="Node 22.8+">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero dependencies">
   <img src="https://img.shields.io/badge/license-MIT-111111" alt="MIT">
@@ -151,8 +151,10 @@ Prefer repository `init` unless the global ordering is understood.
 
 When `core.hooksPath` is set, Git reads hooks only from that effective directory and
 ignores `.git/hooks`. Repository `init` installs and chains predecessors only when
-that directory is absent or is proven to be owned by the repository. It refuses to
-modify a global, shared, or external hook directory. In that case, integrate
+that directory is absent or is proven to be owned by the repository: inside it and
+not tracked by Git. It refuses to modify a global, shared, external, or tracked
+hook directory, because a dispatcher committed from one machine names paths that
+exist only on that machine. In that case, integrate
 aimhooman into the existing hook manager or remove the override before retrying.
 
 Repository `init` installs `pre-commit`, `pre-merge-commit`, `commit-msg`, and

package/bin/aimhooman.mjs

@@ -3,6 +3,7 @@ import { execFileSync } from 'node:child_process';
 import { chmodSync, lstatSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { GIT_TIMEOUT_MS } from '../src/git-environment.mjs';
 import { newEngineWithDiagnostics } from '../src/scan.mjs';
 import { exitCode, human, jsonReport, visible } from '../src/report.mjs';
 import {
@@ -19,7 +20,7 @@ import {
 } from '../src/gitx.mjs';
 import { loadConfig, loadOverrides, loadProjectPolicy, normalizeOverrideTarget, saveConfig, saveOverrides } from '../src/state.mjs';
 import { applyExclude, inspectExclude, patternsForRules, removeExclude } from '../src/exclude.mjs';
-import { hookDiagnostics, installHooks, installGlobalHooks, uninstallGlobalHooks, globalHooksDir, installedHooks, uninstallHooks, unrestoredChainedBackups } from '../src/githooks.mjs';
+import { hookDiagnostics, installHooks, installGlobalHooks, uninstallGlobalHooks, globalHooksDir, installedHooks, remainingDispatchers, uninstallHooks, unrestoredChainedBackups } from '../src/githooks.mjs';
 import { ArgumentError, parseArguments } from '../src/args.mjs';
 import { engineForPolicy, scanGitTarget, scanMessage } from '../src/scan-target.mjs';
 import { resolvePolicy } from '../src/policy-resolver.mjs';
@@ -37,8 +38,7 @@ const LIFECYCLE_LOCK_OPTIONS = { retries: 1000 };
 function tryRepo() {
     try {
         return openRepo();
-    } catch (error) {
-        if (error?.name === 'StateMigrationError') throw error;
+    } catch {
         return null;
     }
 }
@@ -48,6 +48,7 @@ function currentRepositoryIsBare() {
         return execFileSync('git', ['rev-parse', '--is-bare-repository'], {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: GIT_TIMEOUT_MS,
         }).trim() === 'true';
     } catch {
         return false;
@@ -159,10 +160,17 @@ function emitDiagnostics(diagnostics = []) {
 }
 
 function incompleteMessage(scan) {
-    const skipped = Object.entries(scan.stats?.skipped || {})
+    const reasons = scan.stats?.skipped || {};
+    const skipped = Object.entries(reasons)
         .map(([reason, count]) => `${reason}=${count}`)
         .join(', ');
-    return `aimhooman: scan incomplete${skipped ? ` (${skipped})` : ''}; reduce the target or limits and retry\n`;
+    // Every other reason is a size or budget the caller can shrink. A pack that
+    // will not compile is not, and the warning above already names the file and
+    // the error, so point at that instead of misdirecting to the limits.
+    const hint = reasons['local-pack-error']
+        ? 'fix the reported rule pack and retry'
+        : 'reduce the target or limits and retry';
+    return `aimhooman: scan incomplete${skipped ? ` (${skipped})` : ''}; ${hint}\n`;
 }
 
 function snapshotFile(path) {
@@ -193,6 +201,7 @@ function gitConfigAtScope(root, scope, key) {
             cwd: root,
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: GIT_TIMEOUT_MS,
         }).trim();
     } catch {
         return '';
@@ -200,7 +209,7 @@ function gitConfigAtScope(root, scope, key) {
 }
 
 function gitVersion() {
-    try { return execFileSync('git', ['--version'], { encoding: 'utf8' }).trim(); }
+    try { return execFileSync('git', ['--version'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim(); }
     catch { return 'Git unavailable'; }
 }
 
@@ -487,7 +496,7 @@ function cmdRefcheck(args) {
             return 30;
         }
         if (/^0+$/.test(newObjectId)) continue;
-        updates.push({ oldObjectId, newObjectId });
+        updates.push({ oldObjectId, newObjectId, ref });
     }
 
     let commits;
@@ -650,7 +659,7 @@ function cmdInit(args) {
         const aimDir = globalHooksDir();
         let existing = '';
         try {
-            existing = execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8' }).trim();
+            existing = execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim();
         } catch { /* unset */ }
         if (existing && existing !== aimDir) {
             console.error(
@@ -663,7 +672,7 @@ function cmdInit(args) {
         // could silently disable a system-wide hook manager, so refuse here too.
         let systemHooksPath = '';
         try {
-            systemHooksPath = execFileSync('git', ['config', '--system', '--get', 'core.hooksPath'], { encoding: 'utf8' }).trim();
+            systemHooksPath = execFileSync('git', ['config', '--system', '--get', 'core.hooksPath'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim();
         } catch { /* unset or no system config */ }
         if (systemHooksPath) {
             console.error(
@@ -687,7 +696,7 @@ function cmdInit(args) {
                 console.error('aimhooman: global hook installation aborted; core.hooksPath was not changed');
                 return 20;
             }
-            execFileSync('git', ['config', '--global', 'core.hooksPath', rep.dir]);
+            execFileSync('git', ['config', '--global', 'core.hooksPath', rep.dir], { timeout: GIT_TIMEOUT_MS });
         } catch (error) {
             const rollbackFailures = [];
             for (const snapshot of hookSnapshots.reverse()) {
@@ -697,8 +706,8 @@ function cmdInit(args) {
                 }
             }
             try {
-                if (existing) execFileSync('git', ['config', '--global', 'core.hooksPath', existing]);
-                else execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: 'ignore' });
+                if (existing) execFileSync('git', ['config', '--global', 'core.hooksPath', existing], { timeout: GIT_TIMEOUT_MS });
+                else execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: 'ignore', timeout: GIT_TIMEOUT_MS });
             } catch (rollbackError) {
                 rollbackFailures.push(`global core.hooksPath: ${rollbackError.message}`);
             }
@@ -759,7 +768,13 @@ function cmdInit(args) {
         rep = installHooks(repo, CLI_PATH);
         const activeHooks = installedHooks(repo);
         if (!REQUIRED_GIT_HOOKS.every((name) => activeHooks.includes(name))) {
-            throw new Error('hook installation incomplete; repository guard is not active');
+            // installHooks declines rather than throws when the hooks directory is
+            // not ours, and its warnings are the only record of why. They are
+            // printed on the success path only, so carry them into the failure or
+            // the user is told nothing but "incomplete". The prefix is load-bearing:
+            // the exit-code branch below matches on it.
+            const cause = rep.shared && rep.warnings.length ? `${rep.warnings.join('; ')}; ` : '';
+            throw new Error(`hook installation incomplete; ${cause}repository guard is not active`);
         }
         saveConfig(repo.stateDir, { profile });
         applyExclude(repo.excludeFile, patternsForRules(eng.rules));
@@ -847,7 +862,6 @@ function cmdStatus(args) {
     console.log(`overrides: ${overrides.allow.length} allow, ${overrides.deny.length} deny`);
     console.log(`excludes: ${excludeError ? `unknown (malformed markers: ${excludeError}; run: aimhooman init)` : excludes.current ? 'current' : excludes.installed ? 'out of date (run: aimhooman init)' : 'not installed (run: aimhooman init)'}`);
     for (const error of errors) console.log(`warning:  ${error.message}`);
-    for (const diagnostic of repo.stateDiagnostics || []) console.log(`${diagnostic.level || 'info'}: ${diagnostic.message}`);
     const localHooks = gitConfigAtScope(repo.root, '--local', 'core.hooksPath');
     const globalHooks = gitConfigAtScope(repo.root, '--global', 'core.hooksPath');
     console.log(`hooks path: local=${localHooks || 'unset'}, global=${globalHooks || 'unset'}`);
@@ -1414,10 +1428,6 @@ function cmdDoctor(args) {
     } else {
         console.log(`ok host adapters present (${adapters.present}/${adapters.total})`);
     }
-    for (const diagnostic of repo.stateDiagnostics || []) {
-        console.log(`${diagnostic.level === 'error' ? 'x' : '!'} state: ${diagnostic.message}`);
-        if (diagnostic.level === 'error') ok = false;
-    }
     const gitRuntime = supportedGitVersion();
     if (gitRuntime.supported) {
         console.log(`ok runtime Node ${process.versions.node}; ${gitRuntime.display}`);
@@ -1485,7 +1495,7 @@ function cmdUninstall(args) {
         const aimDir = globalHooksDir();
         const readGlobalHooksPath = () => {
             try {
-                return execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8' }).trim();
+                return execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim();
             } catch { return ''; }
         };
         const current = readGlobalHooksPath();
@@ -1493,7 +1503,7 @@ function cmdUninstall(args) {
         if (current === aimDir) {
             unsetAttempted = true;
             try {
-                execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: ['ignore', 'ignore', 'ignore'] });
+                execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: ['ignore', 'ignore', 'ignore'], timeout: GIT_TIMEOUT_MS });
             } catch { /* may have failed; re-verify below */ }
             // A read-only or locked ~/.gitconfig can make --unset fail silently.
             // Do not remove the dispatchers while core.hooksPath still resolves to
@@ -1528,11 +1538,20 @@ function cmdUninstall(args) {
     return withLock(join(repo.commonDir, 'aimhooman-lifecycle.lock'), () => {
     const rep = uninstallHooks(repo);
     removeExclude(repo.excludeFile);
-    console.log('aimhooman: uninstalled');
+    // Trust the directory, not the report. Every refusal below leaves a working
+    // dispatcher behind, and one printed under "uninstalled" reads as done.
+    const remaining = remainingDispatchers(repo);
+    if (remaining.length) {
+        console.error('aimhooman: NOT uninstalled; leaving dispatchers in place:');
+        for (const path of remaining) console.error(`  ${path}`);
+        console.error('  These still guard every commit. Remove them by hand to finish uninstalling.');
+    } else {
+        console.log('aimhooman: uninstalled');
+    }
     if (rep.removed.length) console.log(`  hooks removed:  ${rep.removed.join(', ')}`);
     if (rep.restored.length) console.log(`  hooks restored: ${rep.restored.join(', ')}`);
     for (const w of rep.warnings || []) console.log(`  warning: ${w}`);
-    for (const f of rep.failures || []) console.log(`  warning: ${f}`);
+    for (const f of rep.failures || []) console.error(`  failure: ${f}`);
     const unrestored = purge ? unrestoredChainedBackups(repo) : [];
     if (purge) {
         // Never wipe stateDir while a predecessor hook backup is still on disk:
@@ -1560,6 +1579,7 @@ function cmdUninstall(args) {
     try {
         globalHooksPath = execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], {
             encoding: 'utf8',
+            timeout: GIT_TIMEOUT_MS,
         }).trim();
     } catch { /* unset */ }
     if (globalHooksPath === aimDir) {
@@ -1567,7 +1587,7 @@ function cmdUninstall(args) {
         console.log('  eligible non-bare repositories that inherit core.hooksPath are still guarded.');
         console.log('  run `aimhooman uninstall --global` to remove it.');
     }
-    return rep.failures?.length || unrestored.length ? 30 : 0;
+    return remaining.length || rep.failures?.length || unrestored.length ? 30 : 0;
     }, LIFECYCLE_LOCK_OPTIONS);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rmyndharis/aimhooman",
-    "version": "0.1.1",
+    "version": "0.1.2",
     "description": "AI works. Hoomans ship. Keep AI session files, secrets, and attribution out of your commits.",
     "homepage": "https://github.com/rmyndharis/aimhooman#readme",
     "repository": {

package/rules/attribution.json

@@ -1,14 +1,14 @@
 [
     {
         "id": "attribution.claude-coauthor",
-        "version": 1,
+        "version": 2,
         "provider": "claude-code",
         "category": "ai-attribution",
         "confidence": "high",
         "kind": "message",
         "match": {
             "content": [
-                "(?i)^\\s*co-authored-by:\\s*(?:claude|claude code)\\s*<noreply@anthropic\\.com>\\s*$"
+                "(?i)^\\s*co-authored-by:[^<>]+<noreply@anthropic\\.com>\\s*$"
             ]
         },
         "actions": {
@@ -49,14 +49,14 @@
     },
     {
         "id": "attribution.codex-coauthor",
-        "version": 1,
+        "version": 2,
         "provider": "codex",
         "category": "ai-attribution",
         "confidence": "high",
         "kind": "message",
         "match": {
             "content": [
-                "(?i)^\\s*co-authored-by:\\s*(?:openai\\s+)?codex\\s*<noreply@openai\\.com>\\s*$"
+                "(?i)^\\s*co-authored-by:[^<>]+<noreply@openai\\.com>\\s*$"
             ]
         },
         "actions": {
@@ -95,7 +95,7 @@
     },
     {
         "id": "attribution.generated-with",
-        "version": 1,
+        "version": 2,
         "provider": "generic",
         "category": "ai-attribution",
         "confidence": "high",
@@ -103,7 +103,7 @@
         "match": {
             "content": [
                 "(?i)^\\s*generated\\s+(?:with|by)\\s+(?:claude(?:\\s+code)?|(?:github\\s+)?copilot|chatgpt|gpt(?:-[0-9]+(?:\\.[0-9]+)?)?|(?:openai\\s+)?codex|cursor)[.!]?\\s*$",
-                "(?i)^\\s*(?:🤖\\s*)?generated\\s+with\\s+\\[claude code\\]\\(https://claude\\.ai/code\\)\\s*$"
+                "(?i)^\\s*(?:🤖\\s*)?generated\\s+with\\s+\\[(?:claude(?:\\s+code)?|(?:github\\s+)?copilot|chatgpt|gpt(?:-[0-9]+(?:\\.[0-9]+)?)?|(?:openai\\s+)?codex|cursor)\\]\\([^)]*\\)\\s*$"
             ]
         },
         "actions": {
@@ -126,7 +126,7 @@
         "kind": "message",
         "match": {
             "content": [
-                "(?i)^\\s*[a-z-]+-by:\\s*[^<>]+\\s*<noreply@(anthropic|openai)\\.com>\\s*$"
+                "(?i)^\\s*[a-z-]+-by:[^<>]+<noreply@(anthropic|openai)\\.com>\\s*$"
             ]
         },
         "actions": {

package/src/atomic-write.mjs

@@ -111,6 +111,7 @@ function syncDirectory(directory, operations) {
 }
 
 const LOCK_WAIT_BUFFER = new Int32Array(new SharedArrayBuffer(4));
+const IDENTITY_PROBE_TIMEOUT_MS = 5_000;
 
 function waitForLock(milliseconds) {
     if (milliseconds > 0) Atomics.wait(LOCK_WAIT_BUFFER, 0, 0, milliseconds);
@@ -136,6 +137,12 @@ function processIdentity(pid) {
             const started = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
                 encoding: 'utf8',
                 stdio: ['ignore', 'pipe', 'ignore'],
+                // This is the only spawn on the lock path, and it runs on macOS
+                // and BSD alone: Linux reads /proc and Windows returns early.
+                // The retry loop below budgets milliseconds per attempt, so a
+                // probe that stalls must lose rather than stretch the loop. A
+                // timeout throws into the catch below, which fails safe.
+                timeout: IDENTITY_PROBE_TIMEOUT_MS,
             }).trim();
             return started ? `ps:${started}` : null;
         }

package/src/git-environment.mjs

@@ -3,3 +3,13 @@
 export function gitEnvironment(environment = process.env) {
     return { ...environment, GIT_NO_REPLACE_OBJECTS: '1' };
 }
+
+// execFileSync has no default timeout, so a git child that never exits blocks
+// the caller forever. One did: it held a CI runner until the platform's 6-hour
+// ceiling killed the job, with no error to read afterwards.
+//
+// Real calls here finish in milliseconds. This bound exists to end a stuck one,
+// not to pace a slow one, so it sits far above any legitimate call: a huge
+// repository on a slow disk stays well inside it, and a hang now raises an
+// error naming the command instead of going quiet.
+export const GIT_TIMEOUT_MS = 120_000;