@rmyndharis/aimhooman 0.1.6 → 0.1.8

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
             "name": "aimhooman",
             "source": "./",
             "description": "Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
-            "version": "0.1.6",
+            "version": "0.1.8",
             "license": "MIT",
             "keywords": [
                 "git",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.6",
+    "version": "0.1.8",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.6",
+    "version": "0.1.8",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman maintainers",

package/CHANGELOG.md

@@ -5,6 +5,114 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.8] - 2026-07-18
+
+This release works through the findings of the real-world scenario report
+(191 scenarios across 11 repos, 8 languages). The headline: a read-only
+command copied from `gh`'s own docs no longer gets denied, and editing an
+unrelated line in a file that carries a private-key header elsewhere no
+longer blocks the commit.
+
+### Fixed
+
+- Read-only commands with unquoted braces (`gh api repos/{owner}/{repo}/pulls`,
+  `ls {owner}`, `cp x.{js,ts}`) are no longer denied as opaque commit-hiding
+  pipelines. Brace expansion is argument-level and cannot feed code into a pipe
+  sink; brace groups (`{ list; }`) and PowerShell script blocks remain opaque.
+  The opaque-deny message also no longer names a pipe when the command has none.
+- Editing an unrelated line in a file that contains a private-key header
+  elsewhere (e.g. a PEM fixture inside a Go test string) no longer blocks the
+  commit. Content scanning is now narrowed to the changed hunks; a header added
+  in the diff still blocks, a header carried outside the diff stays silent.
+  Binary blobs keep their whole-blob secret scan.
+- AWS's documented example secret access key (`wJalrXUtnFEMI/...EXAMPLEKEY`)
+  no longer blocks commits. Its access-key-ID pair was already excepted; the
+  secret-key half now is too. Real keys — including ones containing `EXAMPLEKEY`
+  as a substring — still block.
+- `aimhooman <subcommand> --help` now prints usage and exits 0 instead of
+  erroring on the unknown `--help` option.
+- The human finding report renders every remediation entry (a rule's second
+  line, e.g. "rotate the key if it was ever exposed", was silently dropped), and
+  its summary line agrees on number (`1 finding`, not `1 findings`). A scan
+  firing many findings (a vendored OpenSSL corpus can produce 99) now caps the
+  printed blocks at 20 and collapses the rest into one truncation line; the JSON
+  report stays uncapped.
+- The `secret.private-key` message now states the match is by filename, not by
+  content, and offers renaming the file when the name is coincidental.
+- A chained hook predecessor that resolves sibling scripts via `$(dirname "$0")`
+  — the dominant husky and vanilla `.githooks` pattern — no longer breaks after
+  `aimhooman init`. The dispatcher now sources the predecessor in a subshell,
+  which preserves the original `$0`. (Bash-only predecessors remain out of
+  scope.)
+
+### Changed
+
+- **Breaking:** an untracked `core.hooksPath` inside the worktree (a freshly
+  created `.husky` before its first commit, a team-local `.team-hooks`) is now
+  treated as repository content and refuses to receive a dispatcher — the next
+  `git add` would otherwise stage the dispatcher's machine-local absolute CLI,
+  Node, and PATH into history. Add the path to `.gitignore` or
+  `.git/info/exclude` to keep it local; the refusal message names this and
+  points at `aimhooman uninstall`. A `.git/hooks/` path and a tracked `.husky`
+  are unaffected.
+- `aimhooman review` advisories now persist per path across edits on the
+  `clean` and `compliance` profiles, so editing a reviewed agent-instruction
+  file (CLAUDE.md, AGENTS.md, `.github/copilot-instructions.md`) no longer
+  re-surfaces the review message on every edit. The `strict` profile keeps the
+  exact-blob binding unchanged; reviewed deletions (tombstones) keep it in every
+  profile.
+- The `aimhooman init` refusal message names the two remedies (unset
+  `core.hooksPath`, or exclude the worktree path) and points at
+  `aimhooman uninstall`, so a refused init is no longer a dead end.
+
+### Performance
+
+- A commit no longer pays a duplicate tree scan in `commit-msg` for the staged
+  tree that `pre-commit` just verified. `pre-commit` records the staged tree sha
+  after a clean, complete scan; `commit-msg` skips its ~170 ms tree scan when the
+  sha matches. The marker is self-invalidating (any index mutation changes the
+  sha) and a missing/stale/mismatched marker falls back to the full scan, so
+  this is purely an optimization. Net ~150 ms saved per commit.
+
+## [0.1.7] - 2026-07-18
+
+### Fixed
+
+- The final reference guard no longer holds a branch hostage to a file already
+  in its history. A commit was scanned against the full tree it inherited, so a
+  path allowed in once and then un-allowed blocked every later commit on the
+  branch, even one-line edits to an unrelated file — and the only way out was to
+  rewrite history. The guard now judges a commit by what it changes: a newly
+  staged `.env` still stops the commit, while a file the commit merely carries
+  forward from its parent stays silent. A secret already in history is not
+  forgotten — `aimhooman check --tracked` still names it — but it no longer
+  bricks the branch.
+- Imported history no longer trips the attribution guard. `gh pr checkout` and
+  `git fetch` bring in other people's commits, whose messages a local developer
+  cannot edit; scanning them for AI co-author trailers blocked the checkout
+  whenever a PR commit carried one. The guard now scopes attribution and marker
+  rules to commits written in the repository (a plain commit, an `--amend`, a
+  local merge), and leaves imported commits' messages alone. A locally authored
+  `git commit --no-verify` that smuggles the same trailer is still stopped at the
+  final guard.
+- `aimhooman status` no longer advertises a profile the hooks are not applying.
+  The enforcing guards resolve the project policy from the index, so a worktree
+  `.aimhooman.json` that has not been `git add`ed was invisible to them — yet
+  `status` reported its profile as active. `status` now shows the staged profile
+  the hooks actually enforce, prints the worktree value alongside when the two
+  differ, and names the remedy (`git add .aimhooman.json`).
+- A pipeline into a shell with no commit in it is still refused, but the reason
+  no longer tells the developer to retry a commit they never wrote. The deny
+  text for `echo x | bash` and similar now names the real shape — a pipeline
+  whose sink can run arbitrary commands — instead of reusing the commit-themed
+  message.
+- A timing or scheduling prefix no longer reads as a hook bypass. `time`,
+  `timeout`, `nice`, and `ionice` run the inner command with the same argv in the
+  same place, so `time git commit` is judged like `git commit` instead of being
+  refused as opaque shell indirection. The carve-out only applies when nothing
+  else injects risk; a `--no-verify` or a hooks-path override wrapped in the
+  prefix is still caught.
+
 ## [0.1.6] - 2026-07-18
 
 ### Fixed

package/README.md

@@ -9,7 +9,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/github/actions/workflow/status/rmyndharis/aimhooman/test.yml?branch=main&label=CI" alt="CI">
-  <img src="https://img.shields.io/badge/version-v0.1.6-blue" alt="v0.1.6">
+  <img src="https://img.shields.io/badge/version-v0.1.8-blue" alt="v0.1.8">
   <img src="https://img.shields.io/badge/node-%E2%89%A522.8-339933?logo=node.js&logoColor=white" alt="Node 22.8+">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero dependencies">
   <img src="https://img.shields.io/badge/license-MIT-111111" alt="MIT">
@@ -76,7 +76,7 @@ flowchart TD
     DIRECT([Sequencer or direct ref path<br/>cherry-pick · rebase · fetch · worktree · update-ref]) --> REF
     PRE -->|clean: safe repair| MSG["commit-msg snapshots would-be tree,<br/>runs predecessor, then checks<br/>the message and pinned full tree"]
     PRE -->|strict violation, incomplete scan,<br/>or failed repair| BLOCK([Operation stops])
-    MSG -->|message and tree accepted| REF["reference-transaction prepared<br/>full-scans every introduced commit"]
+    MSG -->|message and tree accepted| REF["reference-transaction prepared<br/>scans what each introduced commit changes<br/>(messages of locally authored commits only)"]
     MSG -->|unsafe or unrepairable| BLOCK
     REF -->|accepted| SHIP([Ref update commits])
     REF -->|violation or incomplete scan| BLOCK