@rmyndharis/aimhooman 0.1.6 → 0.1.8

package/src/scan-target.mjs

@@ -215,21 +215,39 @@ function scanCommit(repo, options) {
     if (floor && !isVersionedStrict(rawPolicy)) {
         accumulator.add([protectedPolicyFinding(rawPolicy, policy, snapshot)]);
     }
-    scanEntryGroup(repo, loaded.engine, snapshot.entries, policy, accumulator, {
+    // A commit is judged by what it changes, not by the whole tree it inherits.
+    // Scanning snapshot.entries (a full `ls-tree`) re-applied path rules to
+    // every file the commit merely carried forward from its parent, so a path
+    // allowed into history once (under an override that was later removed, or
+    // before the guard existed) blocked every later commit on the branch. The
+    // change set already drives content scanning; routing path rules through it
+    // too means a newly added `.env` still fires while an inherited one stays
+    // silent, matching how scanRange has always judged history.
+    scanEntryGroup(repo, loaded.engine, snapshot.changes, policy, accumulator, {
         reviewPathEntries: snapshot.changes,
         contentEntries: snapshot.changes,
         allowMissingPolicy: acknowledged && !rawPolicy.policy_object_id,
         transition: snapshot.commit,
     });
-    accumulator.add(loaded.engine.checkMessage(snapshot.message)
-        .map((finding) => decorate(finding, snapshot, policy)));
-    accumulator.addSkipped(loaded.engine.takeSkipped());
+    // The message is the author's words, so it is scanned for attribution and
+    // markers only when the commit was written here. Fetched history (a PR
+    // checked out for review, a branch pulled from a remote) carries other
+    // people's commit text that a local developer cannot edit, so flagging it
+    // only blocks the review. cmdRefcheck passes messageScope='changes-only'
+    // for commits that were imported rather than authored; a direct `aimhooman
+    // check --commit` still defaults to scanning the message.
+    const scanMessageText = options.messageScope !== 'changes-only';
+    if (scanMessageText) {
+        accumulator.add(loaded.engine.checkMessage(snapshot.message)
+            .map((finding) => decorate(finding, snapshot, policy)));
+        accumulator.addSkipped(loaded.engine.takeSkipped());
+    }
     return result({
         target: `commit:${snapshot.commit}`,
         policy,
         accumulator,
         diagnostics,
-        messageScanned: true,
+        messageScanned: scanMessageText,
         commit: snapshot.commit,
     });
 }

package/src/scan.mjs

@@ -51,13 +51,35 @@ export class Engine {
     decide(base, target, rule, context = {}) {
         if (this.denyPaths.has(target) || this.denyRules.has(rule.id)) return 'block';
         if (context.transientAllowRules?.has(rule.id)) return 'allow';
-        if (this.scopedAllow.some((entry) => (
-            entry.target === target
-            && entry.ruleId === rule.id
-            && entry.transition === context.transition
-            && entry.newObjectId === context.objectId
-            && entry.newMode === context.mode
-        ))) return 'allow';
+        // W11 (F2): review binding is profile-dependent.
+        //   - strict: review binds the EXACT reviewed blob. A changed/copied/
+        //     symlinked/mode-flipped target is NOT covered — it must be re-
+        //     reviewed. This is the security property the strict lifecycle tests
+        //     pin, and strict is the profile that exits 11 on review.
+        //   - clean/compliance: review is ADVISORY (a stderr message, exit 0),
+        //     so re-surfacing it on every edit of a reviewed agent-instruction
+        //     file (CLAUDE.md, AGENTS.md) is pure friction with no security
+        //     payoff — the security boundary is secret scanning, strict blocks,
+        //     and reference-transaction. A LIVE-FILE review (newObjectId set)
+        //     therefore persists per path + rule across edits. A TOMBSTONE
+        //     review (newObjectId null — a reviewed deletion) keeps the exact
+        //     match in every profile: a deletion review must not silently cover
+        //     a later re-adding of the file.
+        const strictReview = this.profile === 'strict';
+        if (this.scopedAllow.some((entry) => {
+            if (entry.target !== target || entry.ruleId !== rule.id) return false;
+            if (entry.newObjectId === null) {
+                // Tombstone: exact match in every profile.
+                return entry.transition === context.transition
+                    && entry.newObjectId === context.objectId
+                    && entry.newMode === context.mode;
+            }
+            // Live-file review: exact in strict; path-anchored in clean/compliance.
+            return !strictReview
+                || (entry.transition === context.transition
+                    && entry.newObjectId === context.objectId
+                    && entry.newMode === context.mode);
+        })) return 'allow';
         // A rule-level allow cannot bypass the secret-category guard that the
         // path-level allow below enforces: secret rules require an explicit
         // --scope secret-path override on a specific path, never a blanket rule allow.
@@ -119,7 +141,18 @@ export class Engine {
         const categories = Array.isArray(options.categories)
             ? new Set(options.categories)
             : null;
+        // lineRanges narrows content scanning to changed hunks (W4, bug 12d-F1).
+        // When provided (an array of inclusive 1-based {start,end} ranges), only
+        // lines falling in a range are evaluated; this stops a file that contains
+        // a secret-bearing line ELSEWHERE (a PEM header inside a test string on
+        // line 200) from blocking a commit that only edited line 50. Findings
+        // keep their real line numbers because lineRecords already anchors them.
+        // Absent = scan every line (the pre-W4 behaviour).
+        const ranges = Array.isArray(options.lineRanges) && options.lineRanges.length
+            ? options.lineRanges
+            : null;
         for (const record of lineRecords(String(content))) {
+            if (ranges && !ranges.some((range) => record.line >= range.start && record.line <= range.end)) continue;
             this.#markLocalInputSkip('code', p, record.text, categories);
             const result = this.#evaluate('code', p, record.text, { categories });
             if (result) out.push(finding(result, { path: p, line: record.line, text: record.text }));