@rmyndharis/aimhooman 0.1.7 → 0.2.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
             "name": "aimhooman",
             "source": "./",
             "description": "Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
-            "version": "0.1.7",
+            "version": "0.2.0",
             "license": "MIT",
             "keywords": [
                 "git",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.7",
+    "version": "0.2.0",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "aimhooman",
-    "version": "0.1.7",
+    "version": "0.2.0",
     "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman maintainers",

package/CHANGELOG.md

@@ -5,6 +5,162 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-07-19
+
+This release works through the findings of the cross-ecosystem field test
+(8 upstream clones, 6 language loops, a local bare remote, and a private
+GitHub sandbox). The headline: `allow` no longer says yes when it means no —
+a path allow on a file whose content holds a secret is refused up front,
+with the working escape hatch named in the same breath.
+
+### Fixed
+
+- Tracked-tree scans (`audit`, `check --tracked`, `init --grandfather-secrets`)
+  no longer die with `spawnSync git EPIPE` on a partial clone of a repository
+  with submodule pins. A gitlink names a commit of another repository, so
+  asking `cat-file` about it triggered a promisor fetch that aborted the
+  whole metadata batch ("not our ref"). Gitlinks now skip the metadata read;
+  their type comes from the mode. Found by the OpenSSL field run, whose 11
+  submodule pins made the grandfather flag seed zero allows.
+- `init --grandfather-secrets` now runs its one-shot tracked scan with the
+  total-byte budget raised to the env cap and the finding budget raised to
+  100,000. The commit-time defaults (64 MiB, 1,000 findings) silently missed
+  fixtures beyond them in exactly the large, fixture-heavy repositories the
+  flag exists for; the per-file budget and an explicit env override still
+  apply.
+- `aimhooman allow <path>` on a file whose content matches a secret rule
+  (e.g. a private key inside an ordinary-looking filename) no longer reports
+  `allowed` while the commit stays blocked. The guard now runs the engine's
+  secret content rules over the file's bytes, refuses the allow, and points
+  at `--scope secret-path`. Files over the scan budget or unreadable skip
+  the check; the commit-time scanner still fails closed on those.
+- The scan-incomplete summary now names what was skipped
+  (`skipped: size-limit=1 file`) instead of `(size-limit=1)`, which read as
+  a one-byte budget rather than a count of files.
+
+### Added
+
+- `aimhooman init --grandfather-secrets`: after a successful init, scan the
+  tracked tree once and write a `--scope secret-path` allow for every path
+  already tracking secret-looking material (test certs, sample keys). New
+  secrets stay blocked; only paths found in that scan are allowed. A failed
+  or incomplete scan warns without failing the init.
+- Provider-token findings name the provider in human output
+  (`A provider access token (GitHub) must not enter Git history.`), so the
+  developer knows which credential to revoke. The token itself stays
+  redacted; the JSON report is unchanged.
+- Secret content rules now carry a remediation line naming the fixture
+  escape hatch: `aimhooman allow <path> --scope secret-path --reason
+  "test fixture"`.
+- The pre-commit hook now names locally-ignored AI artifacts once per set
+  change (`3 AI artifact(s) present locally are kept out of commits: ...`).
+  The prevention layer keeps them out of `git status`, which also kept their
+  exclusion silent: a `git add .` never told the developer the chat log did
+  not make the commit. The worktree walk is pathspec-pruned to the managed
+  exclude patterns, so it costs ~15ms; informational only, it never changes
+  an exit code.
+- The reference-transaction veto now notes that the rejected commit object
+  remains in the local object store — collected by `git gc --prune=now` when
+  nothing else references it — so a secret payload is not mistaken for gone.
+
+### Changed
+
+- Repeated findings of the same rule print the remediation once, then
+  `fix: as above for <rule id>`, instead of reprinting an identical fix
+  block for every hit.
+- `init` output now prints `undo: aimhooman uninstall` and notes that known
+  AI artifacts are ignored locally (`git status --ignored` shows them).
+
+### Performance
+
+- `openRepo` resolves the repository in one `git rev-parse` call instead of
+  three; every hook spawn pays this, so it was the cheapest milliseconds on
+  the commit path. The common-dir answer is resolved against the invoking
+  cwd and canonicalized, preserving the previous spelling on symlinked
+  paths (macOS `/tmp`), and a path containing a newline falls back to one
+  flag per call.
+- The reference-transaction dispatcher exits before the Node spawn for a
+  `prepared` transaction that moves neither a branch nor HEAD (ORIG_HEAD,
+  tags, remote-tracking refs). Such payloads carry nothing `refcheck`
+  scans — but the skip first proves the four dispatchers are still
+  installed, so a hook manager wiping them mid-operation is answered with
+  a stop, not silence. An ordinary commit's hook time drops by roughly a
+  third in the field measurement (982ms → 649ms).
+- Installed Git hook shims export `NODE_COMPILE_CACHE` pointing at a
+  per-install directory under the state dir (removed by
+  `uninstall --purge-state`), shaving the module parse/compile cost off
+  each hook spawn. An unwritable cache dir degrades to the old cold start,
+  never to a hook failure.
+
+## [0.1.8] - 2026-07-18
+
+This release works through the findings of the real-world scenario report
+(191 scenarios across 11 repos, 8 languages). The headline: a read-only
+command copied from `gh`'s own docs no longer gets denied, and editing an
+unrelated line in a file that carries a private-key header elsewhere no
+longer blocks the commit.
+
+### Fixed
+
+- Read-only commands with unquoted braces (`gh api repos/{owner}/{repo}/pulls`,
+  `ls {owner}`, `cp x.{js,ts}`) are no longer denied as opaque commit-hiding
+  pipelines. Brace expansion is argument-level and cannot feed code into a pipe
+  sink; brace groups (`{ list; }`) and PowerShell script blocks remain opaque.
+  The opaque-deny message also no longer names a pipe when the command has none.
+- Editing an unrelated line in a file that contains a private-key header
+  elsewhere (e.g. a PEM fixture inside a Go test string) no longer blocks the
+  commit. Content scanning is now narrowed to the changed hunks; a header added
+  in the diff still blocks, a header carried outside the diff stays silent.
+  Binary blobs keep their whole-blob secret scan.
+- AWS's documented example secret access key (`wJalrXUtnFEMI/...EXAMPLEKEY`)
+  no longer blocks commits. Its access-key-ID pair was already excepted; the
+  secret-key half now is too. Real keys — including ones containing `EXAMPLEKEY`
+  as a substring — still block.
+- `aimhooman <subcommand> --help` now prints usage and exits 0 instead of
+  erroring on the unknown `--help` option.
+- The human finding report renders every remediation entry (a rule's second
+  line, e.g. "rotate the key if it was ever exposed", was silently dropped), and
+  its summary line agrees on number (`1 finding`, not `1 findings`). A scan
+  firing many findings (a vendored OpenSSL corpus can produce 99) now caps the
+  printed blocks at 20 and collapses the rest into one truncation line; the JSON
+  report stays uncapped.
+- The `secret.private-key` message now states the match is by filename, not by
+  content, and offers renaming the file when the name is coincidental.
+- A chained hook predecessor that resolves sibling scripts via `$(dirname "$0")`
+  — the dominant husky and vanilla `.githooks` pattern — no longer breaks after
+  `aimhooman init`. The dispatcher now sources the predecessor in a subshell,
+  which preserves the original `$0`. (Bash-only predecessors remain out of
+  scope.)
+
+### Changed
+
+- **Breaking:** an untracked `core.hooksPath` inside the worktree (a freshly
+  created `.husky` before its first commit, a team-local `.team-hooks`) is now
+  treated as repository content and refuses to receive a dispatcher — the next
+  `git add` would otherwise stage the dispatcher's machine-local absolute CLI,
+  Node, and PATH into history. Add the path to `.gitignore` or
+  `.git/info/exclude` to keep it local; the refusal message names this and
+  points at `aimhooman uninstall`. A `.git/hooks/` path and a tracked `.husky`
+  are unaffected.
+- `aimhooman review` advisories now persist per path across edits on the
+  `clean` and `compliance` profiles, so editing a reviewed agent-instruction
+  file (CLAUDE.md, AGENTS.md, `.github/copilot-instructions.md`) no longer
+  re-surfaces the review message on every edit. The `strict` profile keeps the
+  exact-blob binding unchanged; reviewed deletions (tombstones) keep it in every
+  profile.
+- The `aimhooman init` refusal message names the two remedies (unset
+  `core.hooksPath`, or exclude the worktree path) and points at
+  `aimhooman uninstall`, so a refused init is no longer a dead end.
+
+### Performance
+
+- A commit no longer pays a duplicate tree scan in `commit-msg` for the staged
+  tree that `pre-commit` just verified. `pre-commit` records the staged tree sha
+  after a clean, complete scan; `commit-msg` skips its ~170 ms tree scan when the
+  sha matches. The marker is self-invalidating (any index mutation changes the
+  sha) and a missing/stale/mismatched marker falls back to the full scan, so
+  this is purely an optimization. Net ~150 ms saved per commit.
+
 ## [0.1.7] - 2026-07-18
 
 ### Fixed

package/README.md

@@ -9,7 +9,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/github/actions/workflow/status/rmyndharis/aimhooman/test.yml?branch=main&label=CI" alt="CI">
-  <img src="https://img.shields.io/badge/version-v0.1.7-blue" alt="v0.1.7">
+  <img src="https://img.shields.io/badge/version-v0.2.0-blue" alt="v0.2.0">
   <img src="https://img.shields.io/badge/node-%E2%89%A522.8-339933?logo=node.js&logoColor=white" alt="Node 22.8+">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero dependencies">
   <img src="https://img.shields.io/badge/license-MIT-111111" alt="MIT">
@@ -130,6 +130,7 @@ Guard a repository:
 
 ```sh
 aimhooman init        # git hooks + local excludes; normally no worktree files
+aimhooman init --grandfather-secrets # also allow --scope secret-path for every secret already tracked (fixtures); new secrets stay blocked
 aimhooman status
 aimhooman uninstall   # restore hooks/excludes; keep local policy state
 aimhooman uninstall --purge-state # also delete common Git-directory state