@rmyndharis/aimhooman 0.1.1 → 0.1.3

package/.agents/rules/aimhooman.md

@@ -5,7 +5,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -15,8 +15,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
             "name": "aimhooman",
             "source": "./",
             "description": "Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
-            "version": "0.1.1",
+            "version": "0.1.3",
             "license": "MIT",
             "keywords": [
                 "git",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.1",
+    "version": "0.1.3",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman"

package/.clinerules/aimhooman.md

@@ -5,7 +5,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -15,8 +15,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.1",
+    "version": "0.1.3",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman maintainers",

package/.cursor/rules/aimhooman.mdc

@@ -11,7 +11,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -21,8 +21,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/.github/copilot-instructions.md

@@ -5,7 +5,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -15,8 +15,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/.kiro/steering/aimhooman.md

@@ -5,7 +5,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -15,8 +15,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/.windsurf/rules/aimhooman.md

@@ -9,7 +9,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -19,8 +19,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/AGENTS.md

@@ -5,7 +5,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -15,8 +15,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/CHANGELOG.md

@@ -5,7 +5,183 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.1.3] - 2026-07-18
+
+### Fixed
+
+- Repair that empties the index no longer mints an empty commit. Stage only a `.env`,
+  run `git commit -m "add config"`, and the pre-commit repair unstages it and prints
+  "the commit will be empty" — then Git made that empty commit anyway. Git refuses a
+  commit with nothing staged, but repair runs after Git has already decided to proceed,
+  so carrying on created a commit Git would never have made and left a junk commit to
+  `git reset --hard`. Pre-commit now exits 10 when the repair empties the index, so Git
+  stops. Nothing else staged means nothing to commit.
+- `build && git add . && git commit` is no longer denied. Each half already passed on its
+  own; only the pair was refused. The commit-time-staging deny asked the wide bypass
+  predicate — the one that decides whether the staged-content backstop reads the blobs —
+  instead of the narrow question of whether anything will scan the commit. An unmodelled
+  prefix is not a bypass, and pre-commit still scans the real index at commit time. The
+  deny now asks that narrow question. A prefix that reaches the hooks, `--no-verify`, and
+  a real `core.hooksPath` override all keep the deny, where the staged files really would
+  go unscanned. The refusal message no longer names "--no-verify or shell indirection"
+  when neither is present.
+- The `PreToolUse` guard stops refusing more everyday read-only pipelines. Building on the
+  0.1.1 filter allowance, a read-only Git subcommand is now an allowed pipe source, so
+  `git log | head`, `git status | grep modified`, `git diff | cat`, and
+  `cd repo && git log | head` run. Build and test toolchains (`npm`, `cargo`, `make`,
+  `jest`, `eslint`, `tsc`, `pytest`) are allowed as a source. The listing forms of
+  branch/tag/remote/stash/notes run (`git branch | grep`, `git remote -v | grep origin`),
+  while their mutating forms (`git branch -D`, `git tag v1`) stay denied. Git as a pipe
+  sink, `git commit --no-verify`, and `git push` still deny; the reference-transaction and
+  pre-commit hooks remain the boundary.
+
+## [0.1.2] - 2026-07-17
+
+### Removed
+
+- The legacy per-clone state migration is gone, and with it the failure paths it
+  created. `openRepo` used to look for state under `.git/worktrees/<name>/aimhooman`
+  and migrate it into `<commonDir>/aimhooman`, fingerprinting both and refusing to
+  continue when two copies disagreed. No released version ever wrote to that
+  location — v0.1.0 already resolved state to `<commonDir>/aimhooman` on the line
+  above the migration — so the predecessor it protected never existed. What it did
+  produce was real: any error other than ENOENT while listing `.git/worktrees` was
+  re-raised through every command, including `uninstall`, so a directory Git itself
+  reads without trouble could freeze a repository with no supported way out.
+  `.git/worktrees` belongs to Git and can be owned by another uid after a
+  `sudo git worktree add`. Repository state resolves to `<commonDir>/aimhooman`, as
+  it always has.
+
+### Fixed
+
+- Unstaging residue no longer stages the deletion of tracked files. The HEAD probe
+  reused the options object carrying the pathspec on stdin, and `git rev-parse`
+  never reads stdin, so once the pathspec passed the 64 KiB pipe buffer the write
+  failed with `EPIPE`. The catch read that as "this repository has no HEAD" and ran
+  `git rm --cached` where `git restore --staged` was meant, staging the deletion of
+  every tracked path it had been asked to restore, printing "unstaged N AI
+  artifact(s)", and exiting 0 so the commit carried the deletions into history. It
+  takes roughly 470 paths to cross that buffer, which a tracked `.claude/projects/`
+  tree passes without trying, and the repair loop could not see it: the staged
+  deletions read as still-staged, so it retried, made no progress, and reported
+  success anyway. The probe no longer receives the pathspec, and only git's own exit
+  status may pick the branch — a timeout or a missing git stops the commit instead
+  of guessing that HEAD is absent. Present since 0.1.0.
+- A stuck `git` no longer holds a repository open indefinitely. `execFileSync` has
+  no default timeout, so a child that never exited blocked its caller for as long as
+  it lived, with nothing printed and nothing logged; one held a CI runner for six
+  hours and died to the platform's ceiling rather than to anything here. Every child
+  process now carries a bound: 120 seconds for git, far above any real call, and 5
+  seconds for the `ps` identity probe, which runs inside the lock retry loop and only
+  on macOS and BSD (Linux reads `/proc`, Windows returns early). Both throw into the
+  handling that was already there, so a bounded failure degrades the way a missing
+  git already did instead of hanging. A test walks `src/` and `bin/` and fails on any
+  child process without a bound.
+- Renaming or moving a repository no longer freezes it. The dispatcher bakes
+  absolute paths, so a move changes the `CHAINED` value it carries, and ownership
+  was decided by comparing that string — overruling the SHA-256 fingerprint on the
+  line above, which had already proved the file was ours. Every commit, every
+  `--no-verify`, and every branch creation then failed; `status` reported the guard
+  as belonging to another repository; `aimhooman init`, the remedy each message
+  named, refused too. Ownership inside the repository's own `.git` is now settled
+  by the fingerprint alone, because no second repository can own a file there. The
+  baked path keeps its vote only where a hooks directory can genuinely be shared —
+  two repositories pointing `core.hooksPath` at one place — which is the case it
+  was written for.
+- `uninstall` no longer reports success while leaving its own dispatchers behind.
+  Refusals were recorded as warnings, the exit code only consulted failures, and
+  the "uninstalled" headline printed before either was known, so a moved
+  repository was told it was free while four dispatchers still blocked every
+  commit. uninstall now checks the hooks directory instead of trusting its own
+  report: anything of ours still on disk is named with its full path, the headline
+  is withheld, and the exit code is 30. A chained backup that is a symlink is
+  still never read or copied through, but the dispatcher above it is now removed
+  rather than held as collateral, and the report says the original hook was not
+  restored.
+- A `HOME` behind a symlink no longer makes every global dispatcher look foreign.
+  `hookDiagnostics` compared the effective hooks directory to the global one with
+  `resolve`, which does not follow symlinks, while Git reports the realpath — so
+  on a distribution that ships `/home` as a link, or an NFS or autofs home, the
+  two spellings differed and every global hook was diagnosed as managed for
+  another repository.
+- A failed excludes refresh no longer disables the `PreToolUse` guard. Writing
+  `.git/info/exclude` sat inside the same `try` as the engine load, and the shared
+  `catch` allowed the command on every non-strict profile, so an unwritable
+  `.git/info` — a CI checkout, a read-only volume, a repository owned by another
+  user — turned a staged AWS key plus `git commit --no-verify` from `deny` into
+  `allow`. Nothing about the policy was wrong: the rules had loaded, and the
+  reported cause ("could not load policy rules") named the wrong thing. Refreshing
+  the excludes is gitignore hygiene, which `pre-commit` never does and still
+  answers correctly, so it now runs outside the verdict and reports as a warning.
+
+- A local rule pack that cannot load no longer produces a report claiming a
+  complete scan. `strict` already failed closed, but `clean` and `compliance`
+  turned the load error into a stderr warning and left the accumulator untouched,
+  so `--json` returned `complete: true`, `findings: []`, `skipped: {}` and exit 0
+  while the team's own rules had never run. The pack most teams write is a
+  detector for their internal token format; one typo took it out of the scan, and
+  the report actively certified that nothing was missed. A failed pack is now the
+  counted skip reason `local-pack-error` and marks the scan incomplete, which is
+  the treatment `local-input-limit` already had in every profile: a rule that
+  never ran is a coverage gap, not an empty result. `clean` and `compliance`
+  therefore stop at exit 31 where they previously continued. The hint now points
+  at the pack instead of suggesting the caller reduce the target or limits, which
+  was never the remedy for a pattern that will not compile.
+- Creating a branch no longer rescans the entire repository. A new branch arrives
+  with an all-zero old tip, so `rev-list` ran with no negative boundary and every
+  ancestor was re-read, tree and blob sizes included: 24.7s at 200 commits, growing
+  linearly, on an operation `--no-verify` cannot skip. Reachability from
+  `refs/heads/*` is now trusted, because those commits passed this same guard when
+  their branch was written, which puts `git checkout -b` back at ordinary commit
+  cost (0.95s in the same repository). Only `refs/heads/*` counts: tags and remote
+  refs are not gated here and still cannot pre-poison reachability, the refs under
+  review are never their own proof, and a commit no local branch reaches is still
+  scanned in full. Commits that predate `aimhooman init` are outside the guard's
+  scope; audit them with `check --range`.
+- `init` no longer writes dispatchers into a hooks directory that Git tracks.
+  Ownership was tested by location alone, so any `core.hooksPath` inside the
+  worktree counted as the repository's own — including the committed `.husky` and
+  `.githooks` directories that husky and the vanilla pattern rely on. init edited
+  those tracked files in place, and the dispatcher it wrote carries this machine's
+  absolute CLI, Node, and PATH: once committed, the hook is dead for every
+  teammate, and the PATH alone discloses the author's home directory and installed
+  tooling. Ownership now also requires that Git is not tracking the directory, and
+  a directory Git cannot be asked about counts as tracked. A refusal now names the
+  cause instead of reporting a bare incomplete installation; as before, integrate
+  aimhooman into the existing hook manager or remove the override.
+- A moved Node interpreter no longer disables the guard silently. 0.1.1 made the
+  dispatcher degrade gracefully when the CLI or Node was missing, which is right
+  for a half-removed install but wrong for a relocated interpreter: `brew upgrade
+  node`, `nvm`, `fnm`, and `volta` all move the `process.execPath` that `init`
+  pins, and every hook then warned once and allowed the commit unprotected. The
+  conditions now separate by what the user can still do about them. A missing CLI
+  still allows the operation, because the package is gone and no guard is wanted.
+  A missing pinned interpreter stops the operation and names the path and the
+  remedy — but only while a Node exists to run that remedy with, since `init` and
+  `uninstall` are both Node programs and the CLI file is inert without one.
+  Where no Node is present at all, the dispatcher degrades and says so, because
+  refusing there would leave the repository unusable with no supported way to
+  remove the hooks. Stopping matches what the CLI already believed —
+  `installedHooks` treats an unreachable Node as an inactive dispatcher, so the
+  shell was short-circuiting the CLI's own fail-closed path — but only where
+  stopping is recoverable. Re-run `aimhooman init` after upgrading Node to re-pin it.
+- Attribution rules no longer miss current AI footers. `attribution.generated-with`
+  pinned the literal vendor link `https://claude.ai/code`, and the co-author rules
+  pinned the display names `Claude`, `Claude Code`, and `Codex`. Once the link was
+  rebranded and the display name grew a model suffix, the default footer passed
+  through untouched with exit 0 while the older form was still repaired perfectly.
+  The rules now anchor on what identifies the machine rather than what marketing
+  changes: a co-author trailer is matched by its `noreply@` service address alone,
+  and the generated-with link is matched by its shape. A new contract test rejects
+  any attribution pattern that pins a vendor URL, so the pack cannot rot back into
+  this state without failing CI.
+- `attribution.ai-noreply` no longer backtracks catastrophically. `\s*[^<>]+\s*`
+  placed three ambiguous quantifiers before a literal `<`, which cost 49s on a
+  6400-character trailer that never closes; built-in patterns are exempt from the
+  local input cap, so a commit message reached it directly. The redundant
+  whitespace quantifiers are gone (`[^<>]+` already spans them), leaving the
+  matched language unchanged, and a bounded-cost test now covers the built-in
+  message patterns.
 
 ## [0.1.1] - 2026-07-16
 

package/CONTRIBUTING.md

@@ -88,7 +88,39 @@ Personal, per-clone detection belongs in `<git-common-dir>/aimhooman/rules/*.jso
 (local, never committed). Linked worktrees share it. Contribute general-purpose
 rules to `rules/` instead.
 
-## Commit policy (important)
+## Commits
+
+Subject lines follow [Conventional Commits](https://www.conventionalcommits.org/):
+`type(scope): summary`.
+
+| Type | Use for |
+| --- | --- |
+| `feat` | a new rule, host adapter, or CLI capability |
+| `fix` | a bug fix |
+| `docs` | documentation only |
+| `test` | tests and fixtures only |
+| `refactor` | restructuring that leaves behavior identical |
+| `perf` | a speedup you can measure |
+| `ci` | workflows and release automation |
+| `chore` | dependency bumps, version stamping, housekeeping |
+
+Scopes track the project layout: `rules`, `hook`, `githooks`, `cli`, `state`,
+`adapter`, `deps`, `release`. Drop the scope when a change spans several.
+
+The `type(scope):` prefix is the only part that is a format. Everything after the
+colon stays a plain imperative sentence that names what actually changed:
+
+```
+fix(state): retry the rename when Windows reports a transient lock
+fix(hook): allow Git operations when the aimhooman CLI or Node is missing
+ci: run the test matrix once per change instead of twice
+chore(release): 0.1.1
+```
+
+PRs land as squash merges, so the PR title is the commit message that lands on
+`main`. Title the PR the same way.
+
+### Policy (important)
 
 This project keeps AI tooling residue out of history — **including its own**.
 Commits must read as if a human wrote them:
@@ -100,10 +132,11 @@ Commits must read as if a human wrote them:
 
 ## Pull requests
 
-1. Open a PR against `main`.
+1. Open a PR against `main`. Title it `type(scope): summary` — it becomes the
+   commit message on `main`.
 2. Include tests for any new behavior and run `npm run verify`.
 3. Update `CHANGELOG.md` and `docs/` where relevant.
-4. Make sure the PR follows the commit policy above.
+4. Make sure the PR follows the commit conventions above.
 
 By participating, you agree to abide by the [Code of Conduct](CODE_OF_CONDUCT.md).
 

package/GEMINI.md

@@ -5,7 +5,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -15,8 +15,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/README.md

@@ -9,7 +9,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/github/actions/workflow/status/rmyndharis/aimhooman/test.yml?branch=main&label=CI" alt="CI">
-  <img src="https://img.shields.io/badge/version-v0.1.1-blue" alt="v0.1.1">
+  <img src="https://img.shields.io/badge/version-v0.1.3-blue" alt="v0.1.3">
   <img src="https://img.shields.io/badge/node-%E2%89%A522.8-339933?logo=node.js&logoColor=white" alt="Node 22.8+">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero dependencies">
   <img src="https://img.shields.io/badge/license-MIT-111111" alt="MIT">
@@ -151,9 +151,14 @@ Prefer repository `init` unless the global ordering is understood.
 
 When `core.hooksPath` is set, Git reads hooks only from that effective directory and
 ignores `.git/hooks`. Repository `init` installs and chains predecessors only when
-that directory is absent or is proven to be owned by the repository. It refuses to
-modify a global, shared, or external hook directory. In that case, integrate
-aimhooman into the existing hook manager or remove the override before retrying.
+that directory is absent or is proven to be owned by the repository: inside it and
+not tracked by Git. It refuses to modify a global, shared, external, or tracked
+hook directory, because a dispatcher committed from one machine names paths that
+exist only on that machine. Those repositories are not guarded, and there is no
+way to guard them today. Calling `aimhooman precommit` from an existing hook
+manager runs the check but registers no managed guard, so the agent hook still
+refuses the commit. Remove the override before retrying, or accept that the
+repository is unguarded and do not run `init` there.
 
 Repository `init` installs `pre-commit`, `pre-merge-commit`, `commit-msg`, and
 `reference-transaction`, and preserves an existing hook as a predecessor. For
@@ -236,7 +241,8 @@ files automatically.
   `.agent/`. [`rules/paths.json`](rules/paths.json) is the complete catalog.
 - **Secrets**: a real `.env` (not `.env.example`), private-key content,
   `.aws/credentials`, service-account private keys, recognized AWS secret/session
-  assignments, and provider token prefixes for GitHub, GitLab, npm, and Slack.
+  assignments, and provider token prefixes for GitHub, GitLab, npm, Slack,
+  Anthropic, OpenAI, Google, Stripe, Hugging Face, and SendGrid.
   Public certificates are allowed.
 - **AI attribution** in commit messages: known AI `Co-authored-by:` identities,
   exact "Generated with/by ..." lines, and AI-service noreply attribution trailers.
@@ -408,9 +414,13 @@ that would open an editor, and commits with an active foreign `prepare-commit-ms
 It still cannot prove that every program already selected by local Git config is safe.
 Commands assembled from files, encoded data, or network input may also be invisible to
 its non-executing shell parser (POSIX shells — bash, sh, zsh, dash, ksh — and
-`git.exe`; command nesting, pipelines, background jobs, and non-POSIX executors
-such as PowerShell or fish are classified uncertain and, on `strict`, denied
-with a retry instruction). Repository selection written in non-POSIX shell syntax
+`git.exe`). Everyday read-only pipelines run, because a read-only source cannot hide or
+feed a commit: `git log | head`, `git status | grep modified`, `git diff | cat`,
+`git branch | grep`, `npm test | tail`, `cargo build 2>&1 | grep error`, and
+`cd repo && git log | head` all pass. What stays uncertain and, on `strict`, is denied
+with a retry instruction: a git command as a pipe *sink* (`cat patch | git apply`),
+pipe-to-shell (`curl x | bash`), command nesting, background jobs, and non-POSIX
+executors such as PowerShell or fish. Repository selection written in non-POSIX shell syntax
 is denied before policy lookup on every profile. Guarded Git changes, including
 `add`, commit, and ref updates, also reject shell-expanded targets, any leading-tilde
 target, POSIX targets beginning with exactly `//`, and an explicit split