@rmyndharis/aimhooman 0.1.1 → 0.1.3

package/rules/paths.json

@@ -1,12 +1,13 @@
 [
     {
         "id": "claude.local-settings",
-        "version": 1,
+        "version": 2,
         "provider": "claude-code",
         "category": "local-settings",
         "confidence": "high",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".claude/settings.local.json",
                 "**/.claude/settings.local.json"
@@ -24,17 +25,16 @@
     },
     {
         "id": "claude.session-state",
-        "version": 1,
+        "version": 2,
         "provider": "claude-code",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".claude.json",
                 "**/.claude.json",
-                ".claude/.credentials.json",
-                "**/.claude/.credentials.json",
                 ".claude/session*.json",
                 "**/.claude/session*.json",
                 ".claude/history*",
@@ -64,12 +64,13 @@
     },
     {
         "id": "codex.session-state",
-        "version": 1,
+        "version": 2,
         "provider": "codex",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".codex/sessions/**",
                 "**/.codex/sessions/**",
@@ -93,12 +94,13 @@
     },
     {
         "id": "copilot.session-state",
-        "version": 2,
+        "version": 3,
         "provider": "copilot",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".copilot/**",
                 "**/.copilot/**"
@@ -116,12 +118,13 @@
     },
     {
         "id": "cursor.session-state",
-        "version": 1,
+        "version": 2,
         "provider": "cursor",
         "category": "ephemeral-state",
         "confidence": "medium",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".cursor/session*",
                 "**/.cursor/session*",
@@ -143,12 +146,13 @@
     },
     {
         "id": "aider.history",
-        "version": 2,
+        "version": 3,
         "provider": "aider",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".aider.*",
                 "**/.aider.*"
@@ -166,12 +170,13 @@
     },
     {
         "id": "specstory.history",
-        "version": 1,
+        "version": 2,
         "provider": "specstory",
         "category": "ephemeral-state",
         "confidence": "medium",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".specstory/**",
                 "**/.specstory/**"
@@ -189,12 +194,13 @@
     },
     {
         "id": "continue.sessions",
-        "version": 1,
+        "version": 2,
         "provider": "continue",
         "category": "ephemeral-state",
         "confidence": "medium",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".continue/sessions/**",
                 "**/.continue/sessions/**"
@@ -212,7 +218,7 @@
     },
     {
         "id": "secret.dotenv",
-        "version": 2,
+        "version": 3,
         "provider": "generic",
         "category": "secret",
         "confidence": "high",
@@ -226,16 +232,11 @@
                 "**/.env.*"
             ],
             "except": [
-                ".env.example",
-                "**/.env.example",
-                ".env.sample",
-                "**/.env.sample",
-                ".env.template",
-                "**/.env.template",
-                ".env.dist",
-                "**/.env.dist",
-                ".env.defaults",
-                "**/.env.defaults"
+                "**/*.example",
+                "**/*.sample",
+                "**/*.template",
+                "**/*.dist",
+                "**/*.defaults"
             ]
         },
         "actions": {
@@ -303,8 +304,33 @@
         ]
     },
     {
-        "id": "generic.agent-instructions",
+        "id": "secret.claude-credentials",
         "version": 1,
+        "provider": "claude-code",
+        "category": "secret",
+        "confidence": "high",
+        "kind": "path",
+        "match": {
+            "path_case": "insensitive",
+            "paths": [
+                ".claude/.credentials.json",
+                "**/.claude/.credentials.json"
+            ]
+        },
+        "actions": {
+            "clean": "block",
+            "strict": "block",
+            "compliance": "block"
+        },
+        "reason": "This file holds an OAuth access token and must never be committed.",
+        "remediation": [
+            "git restore --staged <path>",
+            "Revoke the token if it already reached a commit."
+        ]
+    },
+    {
+        "id": "generic.agent-instructions",
+        "version": 2,
         "provider": "generic",
         "category": "ambiguous-instructions",
         "confidence": "medium",
@@ -328,18 +354,19 @@
         },
         "reason": "Agent instruction files may be intentional team config. Review before committing.",
         "remediation": [
-            "aimhooman allow <path> --reason \"shared team config\"",
+            "aimhooman review <path> --head <commit> --reason \"shared team config\"",
             "or unstage if it is personal"
         ]
     },
     {
         "id": "generic.project-policy",
-        "version": 1,
+        "version": 2,
         "provider": "aimhooman",
         "category": "policy-config",
         "confidence": "high",
         "kind": "path",
         "match": {
+            "path_case": "insensitive",
             "paths": [
                 ".aimhooman.json",
                 "**/.aimhooman.json"
@@ -352,54 +379,54 @@
         },
         "reason": "Versioned enforcement policy changes require explicit human review.",
         "remediation": [
-            "aimhooman allow .aimhooman.json --reason \"reviewed team policy change\"",
+            "aimhooman review .aimhooman.json --head <commit> --reason \"reviewed team policy change\"",
             "or unstage the policy change"
         ]
     },
     {
         "id": "playwright-mcp.state",
-        "version": 1,
+        "version": 2,
         "provider": "playwright-mcp",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "paths": [".playwright-mcp/**", "**/.playwright-mcp/**"] },
+        "match": { "path_case": "insensitive", "paths": [".playwright-mcp/**", "**/.playwright-mcp/**"] },
         "actions": { "clean": "block", "strict": "block", "compliance": "block" },
         "reason": "Playwright MCP session artifacts are local, not repository content.",
         "remediation": ["git restore --staged <path>"]
     },
     {
         "id": "remember.state",
-        "version": 1,
+        "version": 2,
         "provider": "remember",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "paths": [".remember/**", "**/.remember/**"] },
+        "match": { "path_case": "insensitive", "paths": [".remember/**", "**/.remember/**"] },
         "actions": { "clean": "block", "strict": "block", "compliance": "block" },
         "reason": "Remember second-brain data is local, not repository content.",
         "remediation": ["git restore --staged <path>"]
     },
     {
         "id": "superpowers.state",
-        "version": 1,
+        "version": 2,
         "provider": "superpowers",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "paths": [".superpowers/**", "**/.superpowers/**"] },
+        "match": { "path_case": "insensitive", "paths": [".superpowers/**", "**/.superpowers/**"] },
         "actions": { "clean": "block", "strict": "block", "compliance": "block" },
         "reason": "Superpowers plugin state is local, not repository content.",
         "remediation": ["git restore --staged <path>"]
     },
     {
         "id": "agent.state",
-        "version": 2,
+        "version": 3,
         "provider": "generic",
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "paths": [".agent/**", "**/.agent/**"] },
+        "match": { "path_case": "insensitive", "paths": [".agent/**", "**/.agent/**"] },
         "actions": { "clean": "block", "strict": "block", "compliance": "block" },
         "reason": "Generic agent state is local, not repository content.",
         "remediation": ["git restore --staged <path>"]

package/rules/secrets.json

@@ -74,7 +74,8 @@
         "kind": "code",
         "match": {
             "content": [
-                "\\b(?:gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{60,255}|glpat-[A-Za-z0-9_-]{20,255}|npm_[A-Za-z0-9]{36,255}|xox[baprs]-[A-Za-z0-9-]{20,255})\\b"
+                "\\b(?:gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{60,255}|glpat-[A-Za-z0-9_-]{20,255}|npm_[A-Za-z0-9]{36,255}|xox[baprs]-[A-Za-z0-9-]{20,255})\\b",
+                "\\b(?:sk-ant-api[0-9]{2}-[A-Za-z0-9_-]{80,255}|sk-proj-[A-Za-z0-9_-]{40,255}|AIza[A-Za-z0-9_-]{35}|(?:sk|rk)_live_[A-Za-z0-9]{20,255}|hf_[A-Za-z0-9]{34}|SG\\.[A-Za-z0-9_-]{20,255}\\.[A-Za-z0-9_-]{40,255})\\b"
             ]
         },
         "actions": {

package/skills/aimhooman/SKILL.md

@@ -17,7 +17,7 @@ This repository uses aimhooman to keep AI tooling artifacts out of Git history.
 Its policy:
 
 - Never stage or commit local AI session/state files. Examples include
-  `.claude.json`, `.claude/.credentials.json`, `.claude/session*.json`,
+  `.claude.json`, `.claude/session*.json`,
   `.claude/history*`, `.claude/todos/*`, `.claude/shell-snapshots/*`,
   `.claude/statsig/*`, `.claude/projects/*`, `.claude/logs/*`,
   `.codex/sessions/*`, `.codex/history*`, `.codex/log/*`, `.codex/logs/*`,
@@ -27,8 +27,10 @@ Its policy:
   exhaustive; the packaged `rules/paths.json` is the detection source of truth.
   If one is staged, unstage it and keep it out of Git instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
-  (`id_rsa` and files containing a private-key header), `.aws/credentials`, or
-  service-account keys. Public certificates are allowed.
+  (`id_rsa` and files containing a private-key header), `.aws/credentials`,
+  `.claude/.credentials.json`, service-account keys, or a provider API key
+  (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
+  SendGrid). Public certificates are allowed.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.

package/src/atomic-write.mjs

@@ -111,6 +111,7 @@ function syncDirectory(directory, operations) {
 }
 
 const LOCK_WAIT_BUFFER = new Int32Array(new SharedArrayBuffer(4));
+const IDENTITY_PROBE_TIMEOUT_MS = 5_000;
 
 function waitForLock(milliseconds) {
     if (milliseconds > 0) Atomics.wait(LOCK_WAIT_BUFFER, 0, 0, milliseconds);
@@ -136,6 +137,12 @@ function processIdentity(pid) {
             const started = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
                 encoding: 'utf8',
                 stdio: ['ignore', 'pipe', 'ignore'],
+                // This is the only spawn on the lock path, and it runs on macOS
+                // and BSD alone: Linux reads /proc and Windows returns early.
+                // The retry loop below budgets milliseconds per attempt, so a
+                // probe that stalls must lose rather than stretch the loop. A
+                // timeout throws into the catch below, which fails safe.
+                timeout: IDENTITY_PROBE_TIMEOUT_MS,
             }).trim();
             return started ? `ps:${started}` : null;
         }
@@ -283,7 +290,17 @@ export function withLock(lockPath, fn, options = {}) {
             if (attempt + 1 < retries) waitForLock(retryDelayMs);
         }
         if (!held) {
-            throw new Error(`cannot acquire state lock "${lockPath}" after ${retries} attempts`);
+            // Name the queue, not just the lock. This scheme writes no file at lockPath;
+            // only the legacy holder checked above would, so a reader of this error
+            // usually goes looking for a path that is not there. What blocks is a
+            // candidate in the queue directory, retained because its owner cannot be
+            // disproved, and a holder killed outright never reaches the finally below
+            // that would have removed its own.
+            throw new Error(
+                `cannot acquire state lock "${lockPath}" after ${retries} attempts. Contenders `
+                + `queue in "${queueDir}"; if no other aimhooman command is running, a candidate `
+                + 'there outlived the process that published it, and removing that directory clears it',
+            );
         }
         return fn();
     } catch (error) {

package/src/git-environment.mjs

@@ -3,3 +3,13 @@
 export function gitEnvironment(environment = process.env) {
     return { ...environment, GIT_NO_REPLACE_OBJECTS: '1' };
 }
+
+// execFileSync has no default timeout, so a git child that never exits blocks
+// the caller forever. One did: it held a CI runner until the platform's 6-hour
+// ceiling killed the job, with no error to read afterwards.
+//
+// Real calls here finish in milliseconds. This bound exists to end a stuck one,
+// not to pace a slow one, so it sits far above any legitimate call: a huge
+// repository on a slow disk stays well inside it, and a hang now raises an
+// error naming the command instead of going quiet.
+export const GIT_TIMEOUT_MS = 120_000;

package/src/githooks.mjs

@@ -1,5 +1,6 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
+import { GIT_TIMEOUT_MS } from './git-environment.mjs';
 import {
     accessSync,
     chmodSync,
@@ -38,13 +39,19 @@ function hooksDir(repo) {
 
     const scope = configScope(repo, 'core.hooksPath');
     const localScope = ['local', 'worktree'].includes(scope);
-    const repositoryOwned = localScope && repositoryOwnsPath(repo, dir);
+    const inside = localScope && repositoryOwnsPath(repo, dir);
+    // Inside the worktree is not the same as ours. A hooks directory Git tracks
+    // (husky, the vanilla .githooks pattern) is repository content: a dispatcher
+    // written there stages this machine's absolute CLI, Node, and PATH for
+    // everyone who clones.
+    const tracked = inside && trackedPath(repo, dir);
+    const repositoryOwned = inside && !tracked;
     const shared = !repositoryOwned || resolve(dir) === resolve(globalHooksDir());
     if (shared) {
         const where = scope ? `${scope} scope` : 'a non-local scope';
-        const reason = localScope && !repositoryOwned
-            ? `${where}, outside this repository`
-            : where;
+        let reason = where;
+        if (tracked) reason = `${where}, tracked by this repository`;
+        else if (localScope && !inside) reason = `${where}, outside this repository`;
         return {
             dir,
             shared: true,
@@ -60,16 +67,43 @@ function hooksDir(repo) {
     };
 }
 
+function pathContains(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel));
+}
+
 function repositoryOwnsPath(repo, path) {
     const candidate = canonicalPath(path);
     return [repo.root, repo.commonDir, repo.gitDir]
         .filter(Boolean)
         .map(canonicalPath)
-        .some((root) => {
-            const rel = relative(root, candidate);
-            return rel === '' || (!rel.startsWith(`..${sep}`)
-                && rel !== '..' && !isAbsolute(rel));
-        });
+        .some((root) => pathContains(root, candidate));
+}
+
+// insideGitDir is the part of repositoryOwnsPath that cannot be shared. A .git
+// belongs to exactly one repository, while a directory in the worktree can be
+// the core.hooksPath of a second one.
+function insideGitDir(repo, path) {
+    const candidate = canonicalPath(path);
+    return [repo.commonDir, repo.gitDir]
+        .filter(Boolean)
+        .map(canonicalPath)
+        .some((root) => pathContains(root, candidate));
+}
+
+// trackedPath reports whether Git tracks anything under path. A Git that cannot
+// answer counts as tracked: refusing to install costs a warning, while guessing
+// wrong commits this machine's absolute paths into a shared repository.
+function trackedPath(repo, path) {
+    try {
+        return execFileSync(
+            'git',
+            ['--literal-pathspecs', 'ls-files', '-z', '--', String(path)],
+            { cwd: repo.root, encoding: 'utf8', timeout: GIT_TIMEOUT_MS }
+        ).length > 0;
+    } catch {
+        return true;
+    }
 }
 
 function canonicalPath(path) {
@@ -95,13 +129,14 @@ function effectiveHooksDir(repo) {
         return execFileSync(
             'git',
             ['rev-parse', '--path-format=absolute', '--git-path', 'hooks'],
-            { cwd: repo.root, encoding: 'utf8' }
+            { cwd: repo.root, encoding: 'utf8', timeout: GIT_TIMEOUT_MS }
         ).trim();
     } catch {
         try {
             const path = execFileSync('git', ['rev-parse', '--git-path', 'hooks'], {
                 cwd: repo.root,
                 encoding: 'utf8',
+                timeout: GIT_TIMEOUT_MS,
             }).trim();
             return isAbsolute(path) ? path : resolve(repo.root, path);
         } catch {
@@ -115,6 +150,7 @@ function configScope(repo, key) {
         const line = execFileSync('git', ['config', '--show-scope', '--get', key], {
             cwd: repo.root,
             encoding: 'utf8',
+            timeout: GIT_TIMEOUT_MS,
         }).trim();
         return line.split(/\s/, 1)[0];
     } catch {
@@ -125,6 +161,7 @@ function configScope(repo, key) {
             execFileSync('git', ['config', '--local', '--get', key], {
                 cwd: repo.root,
                 stdio: ['ignore', 'ignore', 'ignore'],
+                timeout: GIT_TIMEOUT_MS,
             });
             return 'local';
         } catch {
@@ -307,7 +344,7 @@ function installHooksLocked(repo, cliPath, options, dir, warnings) {
             continue;
         }
         if (current && ownedHook(readFileSync(dest, 'utf8'), name)
-            && !ownedForChain(readFileSync(dest, 'utf8'), name, chainedPath)) {
+            && !ownedByRepo(repo, dir, readFileSync(dest, 'utf8'), name, chainedPath)) {
             warnings.push(`${name} is managed for another repository; refusing to overwrite it`);
             unsafe = true;
         }
@@ -381,13 +418,18 @@ function uninstallHooksLocked(repo, dir, warnings) {
             const chained = join(chainedDir, name);
             const content = readFileSync(dest, 'utf8');
             if (!ownedHook(content, name)) continue;
-            if (!ownedForChain(content, name, chained)) {
-                warnings.push(`${name} is managed for another repository; refusing to remove it`);
+            if (!ownedByRepo(repo, dir, content, name, chained)) {
+                failures.push(`${name}: managed for another repository; left in place at ${dest}`);
                 continue;
             }
             const predecessor = entry(chained);
             if (predecessor?.isSymbolicLink()) {
-                warnings.push(`${name} chained backup is a symlink; refusing to restore it`);
+                // Never read or copy through the symlink, but do let go of the
+                // dispatcher: holding the repository hostage over a backup we
+                // refuse to touch helps nobody.
+                warnings.push(`${name} chained backup is a symlink; ${chained} left in place and your original hook was not restored`);
+                unlinkSync(dest);
+                removed.push(name);
                 continue;
             }
             if (predecessor) {
@@ -407,6 +449,34 @@ function uninstallHooksLocked(repo, dir, warnings) {
     return { removed: removed.sort(), restored: restored.sort(), warnings, failures };
 }
 
+// remainingDispatchers lists aimhooman dispatchers a local uninstall was meant
+// to remove and did not. uninstall checks the directory rather than trusting its
+// own report: a refusal that only produced a warning would otherwise be printed
+// under a success headline, and "uninstalled" while four dispatchers still block
+// every commit is the one lie a guard must never tell.
+//
+// A shared hooks directory is skipped because uninstallHooks does not touch one
+// either — the global directory has `uninstall --global`, and a foreign or
+// tracked one is reported by its own warning. This asks hooksDir rather than
+// comparing paths: two spellings of one directory differ on Windows, and
+// deciding ownership by string is the bug this change exists to remove.
+export function remainingDispatchers(repo) {
+    const { dir, shared } = hooksDir(repo);
+    if (shared) return [];
+    return Object.keys(MANAGED).sort().flatMap((name) => {
+        const path = join(dir, name);
+        try {
+            const stat = entry(path);
+            if (!stat || stat.isSymbolicLink()) return [];
+            return ownedHook(readFileSync(path, 'utf8'), name) ? [path] : [];
+        } catch {
+            // Unreadable: cannot prove it is gone, so report it rather than
+            // claim a clean removal.
+            return [path];
+        }
+    });
+}
+
 // hookDiagnostics reports both dispatcher integrity and whether its configured
 // command can be reached from the current environment.
 export function hookDiagnostics(repo) {
@@ -414,8 +484,12 @@ export function hookDiagnostics(repo) {
     // Global hooks (installGlobalHooks) keep chained backups in the hooks dir
     // itself; local hooks keep them in repo state via chainDir. Diagnose the
     // path the dispatcher actually embeds, not the repo-relative default.
+    // canonicalPath, not resolve: a HOME behind a symlink (Fedora Silverblue
+    // ships /home -> /var/home; NFS and autofs homes are everywhere) makes the
+    // two spellings differ, and every global dispatcher would then be diagnosed
+    // as belonging to another repository.
     const globalDir = globalHooksDir();
-    const chained = resolve(dir) === resolve(globalDir)
+    const chained = canonicalPath(dir) === canonicalPath(globalDir)
         ? join(globalDir, 'chained')
         : chainDir(repo);
     return Object.keys(MANAGED).sort().map((name) => {
@@ -458,7 +532,7 @@ export function hookDiagnostics(repo) {
                 reason: inspected.reason,
             };
         }
-        if (!ownedForChain(content, name, base.chainedPath)) {
+        if (!ownedByRepo(repo, dir, content, name, base.chainedPath)) {
             return {
                 ...base,
                 managed: false,
@@ -580,8 +654,20 @@ AIMHOOMAN_CLI=${shq(resolvedCliPath)}
 AIMHOOMAN_NODE=${shq(nodePath)}
 AIMHOOMAN_PATH=${shq(shellPathValue)}
 ${captureTree}${captureTransaction}run_aimhooman() {
-  if [ ! -f "$AIMHOOMAN_CLI" ] || [ ! -f "$AIMHOOMAN_NODE" ]; then
-    echo "aimhooman: guard unavailable (aimhooman CLI or Node is missing); allowing this operation without protection. Reinstall aimhooman or remove the managed hooks." >&2
+  if [ ! -f "$AIMHOOMAN_CLI" ]; then
+    echo "aimhooman: guard unavailable (aimhooman CLI is missing); allowing this operation without protection. Reinstall aimhooman or remove the managed hooks." >&2
+    return 0
+  fi
+  if [ ! -f "$AIMHOOMAN_NODE" ]; then
+    # Both remedies below are Node programs, so stopping is only fair when a Node
+    # exists to run them with. Without one the CLI file is inert: 'init' and
+    # 'uninstall' cannot run, and refusing would leave the repository unusable
+    # with no way to remove these hooks except deleting them by hand.
+    if command -v node >/dev/null 2>&1; then
+      echo "aimhooman: the pinned Node interpreter is missing (\$AIMHOOMAN_NODE); the operation was stopped. Run 'aimhooman init' to re-pin it, or 'aimhooman uninstall' to remove the guard." >&2
+      return 20
+    fi
+    echo "aimhooman: guard unavailable (no Node interpreter found); allowing this operation without protection. Install Node and run 'aimhooman init' to restore the guard." >&2
     return 0
   fi
   (
@@ -698,8 +784,16 @@ function ownedHook(content, name) {
     return inspected.valid || legacyHook(content, name);
 }
 
-function ownedForChain(content, name, chainedPath) {
+// ownedByRepo decides whether this repository may rewrite or remove a dispatcher.
+// Inside our own .git the fingerprint settles it: we wrote the file, and no
+// second repository can own anything there. The baked chained path only earns a
+// vote where the hooks directory can genuinely be shared — two repositories may
+// point core.hooksPath at one directory, and then it is the only way to tell the
+// installs apart. Comparing paths everywhere means a renamed repository stops
+// recognising the guard it installed itself, with no way to re-pin or remove it.
+function ownedByRepo(repo, dir, content, name, chainedPath) {
     if (!ownedHook(content, name)) return false;
+    if (insideGitDir(repo, dir)) return true;
     return assignmentValue(content, 'CHAINED') === String(chainedPath);
 }