@rmyndharis/aimhooman 0.1.1 → 0.1.2

package/src/hook.mjs

@@ -3,6 +3,7 @@ import { execFileSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { GIT_TIMEOUT_MS } from './git-environment.mjs';
 import { newEngineWithDiagnostics } from './scan.mjs';
 import { openRepo, stagedEntries } from './gitx.mjs';
 import { applyExclude, patternsForRules } from './exclude.mjs';
@@ -330,7 +331,11 @@ function hookPreToolUse(input) {
         }
     }
     let eng;
+    // diagnosticWarning is about the rule pack and drives the messages below;
+    // hygieneWarning is housekeeping that never touches the decision. Kept apart
+    // so the "invalid local pack skipped" wording stays true.
     let diagnosticWarning = '';
+    let hygieneWarning = '';
     try {
         const loaded = repo
             ? engineForPolicy(repo, policy, policy.head)
@@ -343,7 +348,6 @@ function hookPreToolUse(input) {
                 return emitDecision('deny', `aimhooman strict policy could not load local rules: ${diagnosticWarning}`);
             }
         }
-        if (repo) applyExclude(repo.excludeFile, patternsForRules(eng.rules));
     } catch (e) {
         const reason = e?.name === 'LocalOverridesError'
             ? `aimhooman cannot load local overrides: ${e.message}`
@@ -352,6 +356,17 @@ function hookPreToolUse(input) {
         if (profile === 'strict') return emitDecision('deny', reason);
         return emitDecision('allow', `${reason}; continuing because profile=${profile}`);
     }
+    // Refreshing the excludes is gitignore hygiene, not part of the verdict:
+    // pre-commit never writes them and still answers. Kept out of the block
+    // above so a read-only .git/info (CI checkout, read-only volume, a
+    // repository owned by another user) cannot decide what is allowed.
+    if (repo) {
+        try {
+            applyExclude(repo.excludeFile, patternsForRules(eng.rules));
+        } catch (e) {
+            hygieneWarning = `could not refresh ${repo.excludeFile}: ${e.message}`;
+        }
+    }
     // A strict policy cannot make a meaningful guarantee if Git's own guards
     // are explicitly bypassed. Deny before the shell can stage-and-commit in a
     // single command, when inspecting the future index would be impossible.
@@ -468,6 +483,9 @@ function hookPreToolUse(input) {
         if (diagnosticWarning) {
             return emitDecision('allow', `aimhooman warning: ${diagnosticWarning}; invalid local pack skipped`);
         }
+        if (hygieneWarning) {
+            return emitDecision('allow', `aimhooman warning: ${hygieneWarning}`);
+        }
         return 0;
     }
 
@@ -495,10 +513,8 @@ function hookPreToolUse(input) {
     }
     const guarded = repo && !bypassed && installedHooks(repo).includes('pre-commit');
     const advisory = advisoryReason(blocks, guarded, bypassed ? bypassContext : '');
-    return emitDecision(
-        'allow',
-        diagnosticWarning ? `${advisory} Warning: ${diagnosticWarning}.` : advisory
-    );
+    const notes = [diagnosticWarning, hygieneWarning].filter(Boolean).join('; ');
+    return emitDecision('allow', notes ? `${advisory} Warning: ${notes}.` : advisory);
 }
 
 function toolName(i) {
@@ -1213,7 +1229,12 @@ function configuredPushReceiver(repo) {
         return execFileSync(
             'git',
             ['config', '--get-regexp', '^remote\\..*\\.receivepack$'],
-            { cwd: repo.root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },
+            {
+                cwd: repo.root,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                timeout: GIT_TIMEOUT_MS,
+            },
         ).trim().length > 0;
     } catch (error) {
         if (error?.status === 1) return false;
@@ -1448,6 +1469,7 @@ function readGitAlias(cwd, name) {
             cwd,
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: GIT_TIMEOUT_MS,
         }).trim();
     } catch {
         return null;

package/src/scan-session.mjs

@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process';
-import { gitEnvironment } from './git-environment.mjs';
+import { gitEnvironment, GIT_TIMEOUT_MS } from './git-environment.mjs';
 
 export const DEFAULT_SCAN_LIMITS = Object.freeze({
     maxFileBytes: 2 << 20,
@@ -112,6 +112,7 @@ function readObjects(repo, objectIds, expectedBytes = 0) {
         input: Buffer.from(unique.join('\n') + '\n'),
         encoding: 'buffer',
         maxBuffer: Math.max(2 * 1024 * 1024, expectedBytes + unique.length * 256 + 1024),
+        timeout: GIT_TIMEOUT_MS,
     });
     const objects = new Map();
     const failures = [];

package/src/scan-target.mjs

@@ -49,6 +49,7 @@ export function scanMessage(repo, text, options = {}) {
     const { policy, head } = resolved;
     const loaded = engineForPolicy(repo, policy, options.overrideHead || head);
     const accumulator = createAccumulator(options.limits);
+    accumulator.addSkipped(loaded.skipped);
     accumulator.add(loaded.engine.checkMessage(text).map((finding) => decorate(finding, null, policy)));
     accumulator.addSkipped(loaded.engine.takeSkipped());
     return {
@@ -68,6 +69,7 @@ function scanIndex(repo, options) {
     const { rawPolicy, floor, policy, head, acknowledged } = resolveStagedPolicy(repo, options.explicitProfile);
     const loaded = engineForPolicy(repo, policy, options.overrideHead || head);
     const accumulator = createAccumulator(options.limits);
+    accumulator.addSkipped(loaded.skipped);
     let entries = kind === 'tracked' ? trackedEntries(repo) : stagedEntries(repo);
     const conflicts = unmergedPaths(repo);
     const diagnostics = [...loaded.diagnostics];
@@ -189,6 +191,7 @@ function scanCommit(repo, options) {
         reviewContexts,
     );
     const accumulator = createAccumulator(options.limits);
+    accumulator.addSkipped(loaded.skipped);
     const diagnostics = [...loaded.diagnostics];
 
     if (snapshot.shallowBoundary) {
@@ -261,6 +264,9 @@ function scanRange(repo, options) {
     // only constructs an Engine and applies overrides (see engineForPolicy).
     const preloaded = loadRulesWithDiagnostics(repo.stateDir);
     const preloadedOverrides = loadOverrides(repo.stateDir);
+    // Counted once for the range, not once per commit: the same packs back every
+    // commit's engine, so the per-commit loaded.skipped would inflate the tally.
+    accumulator.addSkipped(packSkipped(preloaded.errors));
 
     for (const commit of history.commits) {
         const changes = commitChanges(repo, commit.commit, commit.commit, commit.parents);
@@ -452,7 +458,14 @@ export function engineForPolicy(
         [...reviewedInstructions, ...reviewedPolicies],
     );
     const diagnostics = loaded.errors.map((error) => ({ level: 'warning', message: `${error.message}; pack skipped` }));
-    return { engine: loaded.engine, diagnostics };
+    return { engine: loaded.engine, diagnostics, skipped: packSkipped(loaded.errors) };
+}
+
+// packSkipped turns rule-pack load failures into a counted skip reason. A pack
+// that never loaded is a hole in coverage, not an empty result: strict throws
+// above, and clean/compliance proceed but must not report a complete scan.
+function packSkipped(errors) {
+    return errors.length ? { 'local-pack-error': errors.length } : {};
 }
 
 function reviewedEngineEntry(entry, ruleId, transition) {
@@ -589,6 +602,10 @@ function rangeReportPolicy(basePolicy, policies, usedStrictFloor, explicitProfil
     };
 }
 
+// Skip reasons that mean a rule never ran, as opposed to a rule running and
+// matching nothing. Either way the scan cannot claim to have covered its input.
+const INCOMPLETE_SKIP_REASONS = new Set(['local-input-limit', 'local-pack-error']);
+
 function createAccumulator(limits = {}) {
     const effectiveLimits = { ...DEFAULT_SCAN_LIMITS, ...limits };
     const findings = [];
@@ -644,7 +661,7 @@ function createAccumulator(limits = {}) {
         addSkipped(skipped = {}) {
             for (const [reason, count] of Object.entries(skipped)) {
                 stats.skipped[reason] = (stats.skipped[reason] || 0) + count;
-                if (reason === 'local-input-limit') complete = false;
+                if (INCOMPLETE_SKIP_REASONS.has(reason)) complete = false;
             }
         },
         markIncomplete() {