@rmyndharis/aimhooman 0.1.1 → 0.1.3

package/bin/aimhooman.mjs

@@ -3,6 +3,7 @@ import { execFileSync } from 'node:child_process';
 import { chmodSync, lstatSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { GIT_TIMEOUT_MS } from '../src/git-environment.mjs';
 import { newEngineWithDiagnostics } from '../src/scan.mjs';
 import { exitCode, human, jsonReport, visible } from '../src/report.mjs';
 import {
@@ -19,7 +20,7 @@ import {
 } from '../src/gitx.mjs';
 import { loadConfig, loadOverrides, loadProjectPolicy, normalizeOverrideTarget, saveConfig, saveOverrides } from '../src/state.mjs';
 import { applyExclude, inspectExclude, patternsForRules, removeExclude } from '../src/exclude.mjs';
-import { hookDiagnostics, installHooks, installGlobalHooks, uninstallGlobalHooks, globalHooksDir, installedHooks, uninstallHooks, unrestoredChainedBackups } from '../src/githooks.mjs';
+import { hookDiagnostics, installHooks, installGlobalHooks, uninstallGlobalHooks, globalHooksDir, installedHooks, remainingDispatchers, uninstallHooks, unrestoredChainedBackups } from '../src/githooks.mjs';
 import { ArgumentError, parseArguments } from '../src/args.mjs';
 import { engineForPolicy, scanGitTarget, scanMessage } from '../src/scan-target.mjs';
 import { resolvePolicy } from '../src/policy-resolver.mjs';
@@ -37,8 +38,7 @@ const LIFECYCLE_LOCK_OPTIONS = { retries: 1000 };
 function tryRepo() {
     try {
         return openRepo();
-    } catch (error) {
-        if (error?.name === 'StateMigrationError') throw error;
+    } catch {
         return null;
     }
 }
@@ -48,6 +48,7 @@ function currentRepositoryIsBare() {
         return execFileSync('git', ['rev-parse', '--is-bare-repository'], {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: GIT_TIMEOUT_MS,
         }).trim() === 'true';
     } catch {
         return false;
@@ -58,6 +59,42 @@ function tone() {
     return process.env.AIMHOOMAN_TONE === 'professional' || process.env.CI ? 'professional' : 'playful';
 }
 
+// The per-scan budget sizes the `cat-file --batch` read buffer, so a value that
+// travelled with a clone would let a hostile repository drive the verifier out
+// of memory instead of being rejected by it. These stay in the environment for
+// that reason, never in .aimhooman.json, and a raise is capped for the same one.
+// Lowering needs no ceiling: a smaller budget only skips more, and a skip is
+// already an incomplete scan, which fails closed at 31.
+const MAX_SCAN_LIMIT_BYTES = 1 << 30;
+
+// Crossing a scan budget marks the scan incomplete on every profile, and an
+// incomplete scan is a ref update the reference-transaction hook refuses — the
+// one boundary --no-verify does not skip. A repository tracking a lockfile, an
+// image or a vendored bundle over the default therefore could not commit at all,
+// and "reduce the target or limits and retry" named something no flag, schema
+// field or config key could do. This is that knob.
+function scanLimits() {
+    const limits = {};
+    for (const [key, name] of [
+        ['maxFileBytes', 'AIMHOOMAN_MAX_FILE_BYTES'],
+        ['maxTotalBytes', 'AIMHOOMAN_MAX_TOTAL_BYTES'],
+    ]) {
+        const raw = process.env[name];
+        if (raw === undefined || raw === '') continue;
+        if (!/^\d+$/.test(raw)) {
+            throw new ArgumentError(`${name} must be a whole number of bytes; got "${visible(raw)}"`);
+        }
+        const value = Number(raw);
+        if (value < 1 || value > MAX_SCAN_LIMIT_BYTES) {
+            throw new ArgumentError(
+                `${name} must be between 1 and ${MAX_SCAN_LIMIT_BYTES} bytes; got ${raw}`
+            );
+        }
+        limits[key] = value;
+    }
+    return limits;
+}
+
 function configuredEngine(profile, repo) {
     const { engine, errors } = newEngineWithDiagnostics(profile, repo?.stateDir);
     if (errors.length && profile === 'strict') {
@@ -159,10 +196,23 @@ function emitDiagnostics(diagnostics = []) {
 }
 
 function incompleteMessage(scan) {
-    const skipped = Object.entries(scan.stats?.skipped || {})
+    const reasons = scan.stats?.skipped || {};
+    const skipped = Object.entries(reasons)
         .map(([reason, count]) => `${reason}=${count}`)
         .join(', ');
-    return `aimhooman: scan incomplete${skipped ? ` (${skipped})` : ''}; reduce the target or limits and retry\n`;
+    // Every other reason is a size or budget the caller can shrink. A pack that
+    // will not compile is not, and the warning above already names the file and
+    // the error, so point at that instead of misdirecting to the limits. When a
+    // byte budget is what stopped the scan, name the budget: the caller whose own
+    // tree outgrew it needs to raise one, and "reduce the limits" sends them the
+    // wrong way down a road they cannot leave.
+    const budgeted = reasons['size-limit'] || reasons['total-byte-limit'];
+    const hint = reasons['local-pack-error']
+        ? 'fix the reported rule pack and retry'
+        : budgeted
+            ? 'reduce the target, or raise AIMHOOMAN_MAX_FILE_BYTES / AIMHOOMAN_MAX_TOTAL_BYTES, and retry'
+            : 'reduce the target or limits and retry';
+    return `aimhooman: scan incomplete${skipped ? ` (${skipped})` : ''}; ${hint}\n`;
 }
 
 function snapshotFile(path) {
@@ -193,6 +243,7 @@ function gitConfigAtScope(root, scope, key) {
             cwd: root,
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: GIT_TIMEOUT_MS,
         }).trim();
     } catch {
         return '';
@@ -200,7 +251,7 @@ function gitConfigAtScope(root, scope, key) {
 }
 
 function gitVersion() {
-    try { return execFileSync('git', ['--version'], { encoding: 'utf8' }).trim(); }
+    try { return execFileSync('git', ['--version'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim(); }
     catch { return 'Git unavailable'; }
 }
 
@@ -247,9 +298,10 @@ function cmdPrecommit(args) {
     parseNoArguments(args);
     const repo = tryRepo();
     if (!repo) { console.error('aimhooman: not a git repository'); return 30; }
+    const limits = scanLimits();
     let scan;
     try {
-        scan = scanGitTarget(repo, { kind: 'staged' });
+        scan = scanGitTarget(repo, { kind: 'staged', limits });
     } catch (e) {
         console.error(`aimhooman: cannot scan staged content: ${e.message}`);
         return expectedErrorCode(e);
@@ -275,6 +327,7 @@ function cmdPrecommit(args) {
         return 10;
     }
     const paths = [...new Set(blocks.map((f) => f.path).filter(Boolean))];
+    let emptied = false;
     try {
         const unstageTargets = new Set(paths);
         for (const finding of blocks) {
@@ -283,15 +336,15 @@ function cmdPrecommit(args) {
             }
         }
         for (const source of stagedRenameSources(repo, paths)) unstageTargets.add(source);
-        // The empty-commit hint is derived from the staged paths captured before
-        // repair, not from a second git read after `git restore --staged`. That
-        // post-repair read followed an index write and could transiently report
-        // the wrong state under heavy CI load, flaking the repair tests.
-        // unstagePaths is atomic (it throws on failure), so when every staged
-        // path is a repair target the index matches HEAD afterward. The capture
-        // is best-effort and runs before the repair: if this read fails the
-        // unstage still runs and the hint is omitted (empty stays false) rather
-        // than skipping the repair or blocking the commit.
+        // Whether the repair empties the index is derived from the staged paths
+        // captured before repair, not from a second git read after
+        // `git restore --staged`. That post-repair read followed an index write
+        // and could transiently report the wrong state under heavy CI load,
+        // flaking the repair tests. unstagePaths is atomic (it throws on
+        // failure), so when every staged path is a repair target the index
+        // matches HEAD afterward. The capture is best-effort and runs before the
+        // repair: if this read fails the unstage still runs and the commit is
+        // left to proceed rather than blocked on a state we could not read.
         let stagedBefore;
         try {
             stagedBefore = stagedPaths(repo);
@@ -316,10 +369,10 @@ function cmdPrecommit(args) {
             if (!pending.length) break;
             unstagePaths(repo, pending);
         }
-        const empty = stagedBefore !== null
+        emptied = stagedBefore !== null
             && stagedBefore.every((path) => unstageTargets.has(path));
         process.stderr.write(
-            `aimhooman: unstaged ${paths.length} AI artifact(s) from this commit: ${paths.map(visible).join(', ')}${empty ? ' (nothing else staged — the commit will be empty)' : ''}\n`
+            `aimhooman: unstaged ${paths.length} file(s) from this commit: ${paths.map(visible).join(', ')}${emptied ? ' — nothing else was staged, so the commit is stopped rather than left empty' : ''}\n`
         );
     } catch (e) {
         process.stderr.write(
@@ -328,8 +381,20 @@ function cmdPrecommit(args) {
         );
         return 10;
     }
-    if (reviews.length) process.stderr.write(human(reviews, tone()));
+    // Seven of the rules that can reach the summary above are secret rules, so it
+    // cannot name a cause without guessing wrong for a private key or an AWS
+    // credential — and it used to be the only thing printed for a block. Let the
+    // findings speak instead: human() already carries the rule id, the path, the
+    // reason and the remediation, and already redacts secret text. It labels each
+    // one BLOCK, which is the decision that unstaged the path, not a stopped
+    // commit; the summary above says what actually happened to them.
+    process.stderr.write(human([...blocks, ...reviews], tone()));
     if (!scan.complete) process.stderr.write(incompleteMessage(scan));
+    // Git refuses a commit with nothing staged; repair runs after git has already
+    // decided otherwise, so carrying on here mints the empty commit git would
+    // not. The request was to commit the artifact, not to stamp the history with
+    // its message and no content.
+    if (emptied) return 10;
     return scan.complete ? 0 : 31;
 }
 
@@ -371,12 +436,13 @@ function cmdCommitmsg(args) {
     }
     const text = messageBytes.toString('utf8');
     const validUtf8 = Buffer.from(text, 'utf8').equals(messageBytes);
+    const limits = scanLimits();
     let scan;
     let treeScan = null;
     try {
         const checked = againstWouldBeTree(() => ({
             message: scanMessage(repo, text, { target: 'staged' }),
-            tree: options.tree ? scanGitTarget(repo, { kind: 'staged' }) : null,
+            tree: options.tree ? scanGitTarget(repo, { kind: 'staged', limits }) : null,
         }));
         scan = checked.message;
         treeScan = checked.tree;
@@ -452,18 +518,12 @@ function cmdRefcheck(args) {
     if (phase === 'committed' || phase === 'aborted') return 0;
 
     const repo = tryRepo();
-    if (!repo) {
-        // Global hooks also run in bare repositories. Bare repositories have no
-        // worktree/index policy boundary and are intentionally unsupported, so
-        // a global dispatcher must remain transparent there instead of making
-        // every receive-pack or update-ref fail merely because --show-toplevel
-        // is unavailable.
-        if (currentRepositoryIsBare()) return 0;
-        console.error('aimhooman: not a git repository');
-        return 30;
-    }
     if (phase === 'preparing') {
-        return dispatchHooksChanged(repo, 'clean') ? 20 : 0;
+        // This phase never scans, and without a repository there is no
+        // dispatcher directory to inspect either. Git fires it while `git init`
+        // is still building the repository, so refusing here would only stop
+        // repository creation on behalf of a phase with nothing to say.
+        return repo && dispatchHooksChanged(repo, 'clean') ? 20 : 0;
     }
     let input;
     try { input = readFileSync(0, 'utf8'); }
@@ -487,7 +547,32 @@ function cmdRefcheck(args) {
             return 30;
         }
         if (/^0+$/.test(newObjectId)) continue;
-        updates.push({ oldObjectId, newObjectId });
+        updates.push({ oldObjectId, newObjectId, ref });
+    }
+
+    if (!repo) {
+        // Git writes the initial HEAD inside a reference transaction and fires
+        // this hook while the repository is still being built: GIT_DIR is
+        // exported but nothing can be queried yet, so every rev-parse fails,
+        // --is-bare-repository included. The bare carve-out below therefore
+        // cannot speak for `git init` or `git init --bare`, and reading the
+        // silence as "not a git repository" aborted the transaction and left a
+        // half-built .git behind that a second `git init` could not repair.
+        // That payload is `0000..0000 ref:refs/heads/<name> HEAD`, which the
+        // symref filter above already dropped, so no policy-relevant update
+        // survives and there is nothing to scan. The scope is "the payload
+        // carries nothing", never "git failed to answer": a transaction holding
+        // a real object still demands a repository, so no one can disable the
+        // last veto by arranging for openRepo to fail.
+        if (!updates.length) return 0;
+        // Global hooks also run in bare repositories. Bare repositories have no
+        // worktree/index policy boundary and are intentionally unsupported, so
+        // a global dispatcher must remain transparent there instead of making
+        // every receive-pack or update-ref fail merely because --show-toplevel
+        // is unavailable.
+        if (currentRepositoryIsBare()) return 0;
+        console.error('aimhooman: not a git repository');
+        return 30;
     }
 
     let commits;
@@ -524,6 +609,7 @@ function cmdRefcheck(args) {
         console.error(`aimhooman: cannot resolve proposed commits: ${error.message}`);
         return 30;
     }
+    const limits = scanLimits();
     for (const [revision, reviewContexts] of commits) {
         let scan;
         try {
@@ -532,6 +618,7 @@ function cmdRefcheck(args) {
                 revision,
                 reviewContexts,
                 policyMigrationContexts: reviewContexts,
+                limits,
             });
         }
         catch (error) {
@@ -584,6 +671,7 @@ function cmdCheck(args) {
             return 30;
         }
     }
+    const limits = scanLimits();
     let scan;
     try {
         if (o.message && !o.staged && !o.tracked) {
@@ -597,6 +685,7 @@ function cmdCheck(args) {
                 revision: o.commit,
                 range: o.range,
                 explicitProfile: o.profile,
+                limits,
                 ...(o.message ? { messageText } : {}),
             });
         }
@@ -650,7 +739,7 @@ function cmdInit(args) {
         const aimDir = globalHooksDir();
         let existing = '';
         try {
-            existing = execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8' }).trim();
+            existing = execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim();
         } catch { /* unset */ }
         if (existing && existing !== aimDir) {
             console.error(
@@ -663,7 +752,7 @@ function cmdInit(args) {
         // could silently disable a system-wide hook manager, so refuse here too.
         let systemHooksPath = '';
         try {
-            systemHooksPath = execFileSync('git', ['config', '--system', '--get', 'core.hooksPath'], { encoding: 'utf8' }).trim();
+            systemHooksPath = execFileSync('git', ['config', '--system', '--get', 'core.hooksPath'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim();
         } catch { /* unset or no system config */ }
         if (systemHooksPath) {
             console.error(
@@ -687,7 +776,7 @@ function cmdInit(args) {
                 console.error('aimhooman: global hook installation aborted; core.hooksPath was not changed');
                 return 20;
             }
-            execFileSync('git', ['config', '--global', 'core.hooksPath', rep.dir]);
+            execFileSync('git', ['config', '--global', 'core.hooksPath', rep.dir], { timeout: GIT_TIMEOUT_MS });
         } catch (error) {
             const rollbackFailures = [];
             for (const snapshot of hookSnapshots.reverse()) {
@@ -697,8 +786,8 @@ function cmdInit(args) {
                 }
             }
             try {
-                if (existing) execFileSync('git', ['config', '--global', 'core.hooksPath', existing]);
-                else execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: 'ignore' });
+                if (existing) execFileSync('git', ['config', '--global', 'core.hooksPath', existing], { timeout: GIT_TIMEOUT_MS });
+                else execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: 'ignore', timeout: GIT_TIMEOUT_MS });
             } catch (rollbackError) {
                 rollbackFailures.push(`global core.hooksPath: ${rollbackError.message}`);
             }
@@ -759,7 +848,13 @@ function cmdInit(args) {
         rep = installHooks(repo, CLI_PATH);
         const activeHooks = installedHooks(repo);
         if (!REQUIRED_GIT_HOOKS.every((name) => activeHooks.includes(name))) {
-            throw new Error('hook installation incomplete; repository guard is not active');
+            // installHooks declines rather than throws when the hooks directory is
+            // not ours, and its warnings are the only record of why. They are
+            // printed on the success path only, so carry them into the failure or
+            // the user is told nothing but "incomplete". The prefix is load-bearing:
+            // the exit-code branch below matches on it.
+            const cause = rep.shared && rep.warnings.length ? `${rep.warnings.join('; ')}; ` : '';
+            throw new Error(`hook installation incomplete; ${cause}repository guard is not active`);
         }
         saveConfig(repo.stateDir, { profile });
         applyExclude(repo.excludeFile, patternsForRules(eng.rules));
@@ -847,7 +942,6 @@ function cmdStatus(args) {
     console.log(`overrides: ${overrides.allow.length} allow, ${overrides.deny.length} deny`);
     console.log(`excludes: ${excludeError ? `unknown (malformed markers: ${excludeError}; run: aimhooman init)` : excludes.current ? 'current' : excludes.installed ? 'out of date (run: aimhooman init)' : 'not installed (run: aimhooman init)'}`);
     for (const error of errors) console.log(`warning:  ${error.message}`);
-    for (const diagnostic of repo.stateDiagnostics || []) console.log(`${diagnostic.level || 'info'}: ${diagnostic.message}`);
     const localHooks = gitConfigAtScope(repo.root, '--local', 'core.hooksPath');
     const globalHooks = gitConfigAtScope(repo.root, '--global', 'core.hooksPath');
     console.log(`hooks path: local=${localHooks || 'unset'}, global=${globalHooks || 'unset'}`);
@@ -1414,10 +1508,6 @@ function cmdDoctor(args) {
     } else {
         console.log(`ok host adapters present (${adapters.present}/${adapters.total})`);
     }
-    for (const diagnostic of repo.stateDiagnostics || []) {
-        console.log(`${diagnostic.level === 'error' ? 'x' : '!'} state: ${diagnostic.message}`);
-        if (diagnostic.level === 'error') ok = false;
-    }
     const gitRuntime = supportedGitVersion();
     if (gitRuntime.supported) {
         console.log(`ok runtime Node ${process.versions.node}; ${gitRuntime.display}`);
@@ -1485,7 +1575,7 @@ function cmdUninstall(args) {
         const aimDir = globalHooksDir();
         const readGlobalHooksPath = () => {
             try {
-                return execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8' }).trim();
+                return execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], { encoding: 'utf8', timeout: GIT_TIMEOUT_MS }).trim();
             } catch { return ''; }
         };
         const current = readGlobalHooksPath();
@@ -1493,7 +1583,7 @@ function cmdUninstall(args) {
         if (current === aimDir) {
             unsetAttempted = true;
             try {
-                execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: ['ignore', 'ignore', 'ignore'] });
+                execFileSync('git', ['config', '--global', '--unset', 'core.hooksPath'], { stdio: ['ignore', 'ignore', 'ignore'], timeout: GIT_TIMEOUT_MS });
             } catch { /* may have failed; re-verify below */ }
             // A read-only or locked ~/.gitconfig can make --unset fail silently.
             // Do not remove the dispatchers while core.hooksPath still resolves to
@@ -1527,12 +1617,33 @@ function cmdUninstall(args) {
     }
     return withLock(join(repo.commonDir, 'aimhooman-lifecycle.lock'), () => {
     const rep = uninstallHooks(repo);
-    removeExclude(repo.excludeFile);
-    console.log('aimhooman: uninstalled');
+    // The irreversible work is already done above, and the report is still
+    // below. A throw from here unwound past all of it, so a damaged marker was
+    // the only thing the user heard while four dispatchers kept guarding every
+    // commit. Report the failure beside the removal report instead of in place
+    // of it. Nothing is swallowed: this is also where the symlink and permission
+    // guards surface, and their messages still reach the user and still exit 30.
+    let excludeFailure = '';
+    try {
+        removeExclude(repo.excludeFile);
+    } catch (error) {
+        excludeFailure = `exclude block left in ${repo.excludeFile}: ${error.message}`;
+    }
+    // Trust the directory, not the report. Every refusal below leaves a working
+    // dispatcher behind, and one printed under "uninstalled" reads as done.
+    const remaining = remainingDispatchers(repo);
+    if (remaining.length) {
+        console.error('aimhooman: NOT uninstalled; leaving dispatchers in place:');
+        for (const path of remaining) console.error(`  ${path}`);
+        console.error('  These still guard every commit. Remove them by hand to finish uninstalling.');
+    } else {
+        console.log('aimhooman: uninstalled');
+    }
     if (rep.removed.length) console.log(`  hooks removed:  ${rep.removed.join(', ')}`);
     if (rep.restored.length) console.log(`  hooks restored: ${rep.restored.join(', ')}`);
     for (const w of rep.warnings || []) console.log(`  warning: ${w}`);
-    for (const f of rep.failures || []) console.log(`  warning: ${f}`);
+    for (const f of rep.failures || []) console.error(`  failure: ${f}`);
+    if (excludeFailure) console.error(`  failure: ${excludeFailure}`);
     const unrestored = purge ? unrestoredChainedBackups(repo) : [];
     if (purge) {
         // Never wipe stateDir while a predecessor hook backup is still on disk:
@@ -1560,6 +1671,7 @@ function cmdUninstall(args) {
     try {
         globalHooksPath = execFileSync('git', ['config', '--global', '--get', 'core.hooksPath'], {
             encoding: 'utf8',
+            timeout: GIT_TIMEOUT_MS,
         }).trim();
     } catch { /* unset */ }
     if (globalHooksPath === aimDir) {
@@ -1567,7 +1679,9 @@ function cmdUninstall(args) {
         console.log('  eligible non-bare repositories that inherit core.hooksPath are still guarded.');
         console.log('  run `aimhooman uninstall --global` to remove it.');
     }
-    return rep.failures?.length || unrestored.length ? 30 : 0;
+    // The managed block is still in the exclude file and still ignoring paths, so
+    // the uninstall is genuinely incomplete and 30 is the honest answer.
+    return remaining.length || rep.failures?.length || unrestored.length || excludeFailure ? 30 : 0;
     }, LIFECYCLE_LOCK_OPTIONS);
 }
 

package/docs/design/frictionless-enforcement.md

@@ -65,6 +65,30 @@ Git 2.54 also emits an earlier `preparing` reference-transaction callback. The
 hook checks dispatcher integrity there without scanning unresolved references,
 then keeps the full-scan veto at `prepared`, after Git has locked them.
 
+### Frictionless agent guard (the everyday commands run)
+
+The layer-2 PreToolUse guard reports paths and refuses unprovable protected Git
+mutations. It does not stand between a developer and the commands they run to read a
+repository. A read-only Git subcommand piped to a filter is a source: `git log | head`,
+`git status | grep modified`, `git diff | cat`, and the `cd repo && git log | head`
+prefix produce stdout for the downstream filter and cannot hide or feed a commit, so
+they run with no refusal. Build and test toolchains (`npm`, `cargo`, `make`, `jest`,
+`eslint`, `tsc`, `pytest`, ...) are allowed as a source for the same reason. The listing
+forms of branch/tag/remote/stash/notes move no ref and run; their mutating forms
+(`git branch -D`, `git tag v1`) still reach the reference-transaction guard. A commit
+made of already-safe halves runs as a whole: `build && git add . && git commit` is
+allowed, because an unmodelled prefix is not a bypass and pre-commit still scans the real
+index at commit time.
+
+What stays refused is what can actually get past the scan. Git as a pipe sink
+(`cat patch | git apply`) reads stdin, which can drive `apply`/`am`/`hash-object`.
+Pipe-to-shell, subshells, `eval`, command substitution, and readers that execute their
+own input stay opaque. `git commit --no-verify`, an explicit `core.hooksPath` override,
+and `git push` refuse on the tiers that own them. The boundary that decides whether a
+commit is scanned is the pre-commit and reference-transaction hook, never a denial of the
+shell line that reads the repo. Refusing the read taught agents to drop the `&&` gate
+rather than run the command on its own, which is the friction this tier exists to avoid.
+
 ### Components
 
 1. **Rule catalog** — `rules/paths.json`, `rules/attribution.json`,
@@ -118,6 +142,10 @@ means local rules only add restrictions and can never override a core block.
   transparent in unsupported bare repositories.
 - **HEAD-safe unstage.** `git restore --staged` needs HEAD; on a repository's
   initial commit it falls back to `git rm --cached --ignore-unmatch`.
+- **Repair never mints an empty commit.** When the pre-commit repair unstages the last
+  staged path (stage only a `.env`, then `git commit`), it exits 10 so Git stops, the
+  same outcome as committing with nothing staged. Carrying on would create a commit Git
+  itself would have refused and leave the developer a junk commit to `git reset --hard`.
 - **Anchored attribution rules.** The AI-noreply rule is anchored to trailer
   lines (`*-by:`) so it never strips a prose line that merely mentions the email.
 - **`compliance` keeps disclosure.** AI-attribution rules resolve to `allow`

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rmyndharis/aimhooman",
-    "version": "0.1.1",
+    "version": "0.1.3",
     "description": "AI works. Hoomans ship. Keep AI session files, secrets, and attribution out of your commits.",
     "homepage": "https://github.com/rmyndharis/aimhooman#readme",
     "repository": {

package/rules/attribution.json

@@ -1,14 +1,14 @@
 [
     {
         "id": "attribution.claude-coauthor",
-        "version": 1,
+        "version": 2,
         "provider": "claude-code",
         "category": "ai-attribution",
         "confidence": "high",
         "kind": "message",
         "match": {
             "content": [
-                "(?i)^\\s*co-authored-by:\\s*(?:claude|claude code)\\s*<noreply@anthropic\\.com>\\s*$"
+                "(?i)^\\s*co-authored-by:[^<>]+<noreply@anthropic\\.com>\\s*$"
             ]
         },
         "actions": {
@@ -49,14 +49,14 @@
     },
     {
         "id": "attribution.codex-coauthor",
-        "version": 1,
+        "version": 2,
         "provider": "codex",
         "category": "ai-attribution",
         "confidence": "high",
         "kind": "message",
         "match": {
             "content": [
-                "(?i)^\\s*co-authored-by:\\s*(?:openai\\s+)?codex\\s*<noreply@openai\\.com>\\s*$"
+                "(?i)^\\s*co-authored-by:[^<>]+<noreply@openai\\.com>\\s*$"
             ]
         },
         "actions": {
@@ -95,15 +95,15 @@
     },
     {
         "id": "attribution.generated-with",
-        "version": 1,
+        "version": 3,
         "provider": "generic",
         "category": "ai-attribution",
         "confidence": "high",
         "kind": "message",
         "match": {
             "content": [
-                "(?i)^\\s*generated\\s+(?:with|by)\\s+(?:claude(?:\\s+code)?|(?:github\\s+)?copilot|chatgpt|gpt(?:-[0-9]+(?:\\.[0-9]+)?)?|(?:openai\\s+)?codex|cursor)[.!]?\\s*$",
-                "(?i)^\\s*(?:🤖\\s*)?generated\\s+with\\s+\\[claude code\\]\\(https://claude\\.ai/code\\)\\s*$"
+                "(?i)^\\s*(?:🤖\\s*)?generated\\s+(?:with|by)\\s+(?:claude|(?:github\\s+)?copilot|chatgpt|gpt(?:-[0-9]+(?:\\.[0-9]+)?)?|(?:openai\\s+)?codex|cursor)(?:\\s+[A-Za-z0-9.]+){0,3}[.!]?\\s*(?:🤖\\s*)?$",
+                "(?i)^\\s*(?:🤖\\s*)?generated\\s+with\\s+\\[(?:claude|(?:github\\s+)?copilot|chatgpt|gpt(?:-[0-9]+(?:\\.[0-9]+)?)?|(?:openai\\s+)?codex|cursor)(?:\\s+[A-Za-z0-9.]+){0,3}\\]\\([^)]*\\)\\s*(?:🤖\\s*)?$"
             ]
         },
         "actions": {
@@ -126,7 +126,7 @@
         "kind": "message",
         "match": {
             "content": [
-                "(?i)^\\s*[a-z-]+-by:\\s*[^<>]+\\s*<noreply@(anthropic|openai)\\.com>\\s*$"
+                "(?i)^\\s*[a-z-]+-by:[^<>]+<noreply@(anthropic|openai)\\.com>\\s*$"
             ]
         },
         "actions": {

package/rules/markers.json

@@ -1,7 +1,7 @@
 [
     {
         "id": "marker.corner-cut",
-        "version": 2,
+        "version": 3,
         "provider": "generic",
         "category": "ai-marker",
         "confidence": "medium",
@@ -14,19 +14,32 @@
                 "**/docs/**",
                 "**/test/**",
                 "**/tests/**",
+                "**/__tests__/**",
+                "**/testdata/**",
                 "**/fixtures/**",
                 "**/__fixtures__/**",
                 "**/vendor/**",
+                "**/vendored/**",
                 "**/third_party/**",
                 "**/node_modules/**",
                 "**/dist/**",
                 "**/build/**",
+                "out/**",
+                "target/**",
+                "**/.next/**",
                 "**/coverage/**",
                 "**/generated/**",
                 "**/*.generated.*",
                 "**/*.min.js",
                 "**/*.map",
-                "**/*.md"
+                "**/*.md",
+                "**/*.mdx",
+                "**/*.markdown",
+                "**/*.rst",
+                "**/*.test.*",
+                "**/*.spec.*",
+                "**/*_test.*",
+                "**/*_spec.*"
             ],
             "content": [
                 "(?i)\\b(ponytail|caveman|yagni-oneliner):"
@@ -44,7 +57,7 @@
     },
     {
         "id": "marker.ai-authored",
-        "version": 1,
+        "version": 2,
         "provider": "generic",
         "category": "ai-marker",
         "confidence": "low",
@@ -57,22 +70,35 @@
                 "**/docs/**",
                 "**/test/**",
                 "**/tests/**",
+                "**/__tests__/**",
+                "**/testdata/**",
                 "**/fixtures/**",
                 "**/__fixtures__/**",
                 "**/vendor/**",
+                "**/vendored/**",
                 "**/third_party/**",
                 "**/node_modules/**",
                 "**/dist/**",
                 "**/build/**",
+                "out/**",
+                "target/**",
+                "**/.next/**",
                 "**/coverage/**",
                 "**/generated/**",
                 "**/*.generated.*",
                 "**/*.min.js",
                 "**/*.map",
-                "**/*.md"
+                "**/*.md",
+                "**/*.mdx",
+                "**/*.markdown",
+                "**/*.rst",
+                "**/*.test.*",
+                "**/*.spec.*",
+                "**/*_test.*",
+                "**/*_spec.*"
             ],
             "content": [
-                "(?i)\\b(ai[- ]?generated|generated by (ai|copilot|claude|chatgpt|codex))\\b"
+                "(?i)\\b(generated by (ai|copilot|claude|chatgpt|codex))\\b"
             ]
         },
         "actions": {