@rmyndharis/aimhooman 0.2.0 → 0.3.0

package/.agents/rules/aimhooman.md

@@ -12,13 +12,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -49,7 +52,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->

package/.claude-plugin/marketplace.json

@@ -3,13 +3,13 @@
     "owner": {
         "name": "aimhooman"
     },
-    "description": "AI works. Hoomans ship. Keep AI session files, secrets, and attribution out of your commits.",
+    "description": "AI works. Hoomans ship. Keep AI session files and attribution out of your commits.",
     "plugins": [
         {
             "name": "aimhooman",
             "source": "./",
-            "description": "Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
-            "version": "0.2.0",
+            "description": "Keeps AI session files and unwanted attribution out at the agent and Git boundary.",
+            "version": "0.3.0",
             "license": "MIT",
             "keywords": [
                 "git",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
     "name": "aimhooman",
-    "version": "0.2.0",
-    "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
+    "version": "0.3.0",
+    "description": "AI works. Hoomans ship. Keeps AI session files and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman"
     },

package/.clinerules/aimhooman.md

@@ -12,13 +12,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -49,7 +52,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
     "name": "aimhooman",
-    "version": "0.2.0",
-    "description": "AI works. Hoomans ship. Keeps AI session files, secrets, and unwanted attribution out at the agent and Git boundary.",
+    "version": "0.3.0",
+    "description": "AI works. Hoomans ship. Keeps AI session files and unwanted attribution out at the agent and Git boundary.",
     "author": {
         "name": "aimhooman maintainers",
         "email": "yudhi@rmyndharis.com",
@@ -19,7 +19,7 @@
     "interface": {
         "displayName": "aimhooman",
         "shortDescription": "Keep AI tooling residue out of Git",
-        "longDescription": "Detects AI session files, secrets, and unwanted attribution before they enter Git history.",
+        "longDescription": "Detects AI session files and unwanted attribution before they enter Git history.",
         "developerName": "aimhooman maintainers",
         "category": "Developer Tools",
         "capabilities": [

package/.cursor/rules/aimhooman.mdc

@@ -18,13 +18,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -55,7 +58,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->

package/.github/copilot-instructions.md

@@ -12,13 +12,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -49,7 +52,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->

package/.kiro/steering/aimhooman.md

@@ -12,13 +12,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -49,7 +52,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->

package/.windsurf/rules/aimhooman.md

@@ -16,13 +16,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -53,7 +56,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->

package/AGENTS.md

@@ -12,13 +12,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -49,7 +52,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->

package/CHANGELOG.md

@@ -5,6 +5,66 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-07-19
+
+This release narrows aimhooman to the job it does better than anyone else:
+keeping AI tooling residue and attribution out of Git history. Secret
+scanning leaves the product — dedicated tools do it better, and
+`docs/secrets.md` shows the gitleaks setup that replaces it. Commits also
+get less brittle: a scan that cannot cover everything now warns on the
+frictionless profiles instead of stopping the first hook, while the final
+reference-transaction guard keeps its veto on every profile.
+
+### Removed
+
+- **Breaking: built-in secret scanning is gone.** `rules/secrets.json` and
+  the four secret path rules (`secret.dotenv`, `secret.private-key`,
+  `secret.aws-credentials`, `secret.claude-credentials`) no longer ship, so
+  `.env` files, private keys, and provider tokens are not detected by
+  aimhooman anymore. Pair it with gitleaks — `docs/secrets.md` has the
+  pre-commit and GitHub Actions setup. The agent-facing instruction files
+  still tell agents not to commit secrets; only the mechanical scanner
+  moved out.
+- `init --grandfather-secrets` and the `--scope secret-path` override are
+  gone with the scanner. Legacy `secret-path` entries in an existing
+  `overrides.json` are dropped on load with a warning naming the file.
+  A secret already in history needs rotation and a gitleaks run, not
+  aimhooman.
+- With no rule reading binary content, an oversized binary file no longer
+  makes a scan incomplete; oversized text still does.
+
+### Added
+
+- `aimhooman init --gitignore`: opt-in that also writes the managed
+  AI-artifact pattern block into the worktree `.gitignore`, so a team can
+  commit it and share the ignore set across clones. The default stays
+  local (`.git/info/exclude`); `status` shows the block and `uninstall`
+  removes it. Gitignore matching is case-sensitive.
+- `docs/ai-artifacts.gitignore` and `docs/catalog.md`: the detection
+  catalog as a standalone resource, generated from `rules/*.json` by
+  `npm run sync:catalog` and kept honest in CI. Just want the ignore
+  list? Copy the first file.
+- `.pre-commit-hooks.yaml`: run aimhooman from the pre-commit.com
+  framework (`aimhooman check --staged`).
+- `action.yml`: a composite GitHub Action that runs
+  `aimhooman check --range <base>...<head>` in CI. See
+  `docs/integrations.md` for it, the pre-commit.com config, and honest
+  husky/lint-staged notes.
+- Docs gained `docs/policy.md`, `docs/cli-reference.md`, `docs/faq.md`,
+  `docs/integrations.md`, and `docs/secrets.md`.
+
+### Changed
+
+- An incomplete scan (an oversized file, a budget hit, an unloadable
+  local rule pack) now warns and continues on `clean`/`compliance` in
+  `check`, `fix`, `pre-commit`, and `commit-msg` instead of stopping at
+  exit 31. `strict` stays fail-closed, and so does the
+  reference-transaction guard on every profile — the stop moved from the
+  first hook to the final ref boundary, which `--no-verify` cannot skip.
+- The README slimmed from 481 to 162 lines. The detail it carried —
+  versioned team policy, overrides, command and exit-code references,
+  the FAQ — moved into `docs/` unchanged in substance.
+
 ## [0.2.0] - 2026-07-19
 
 This release works through the findings of the cross-ecosystem field test

package/CONTRIBUTING.md

@@ -31,9 +31,8 @@ npm run verify    # schemas, workflows, dead code, coverage, package, installed
 ## Adding a rule
 
 Rules live in `rules/` as JSON arrays: `paths.json` (staged paths),
-`attribution.json` (commit-message lines), `markers.json` (staged content),
-`secrets.json` (high-confidence secret patterns). Each
-rule has the shape:
+`attribution.json` (commit-message lines), `markers.json` (staged content).
+Each rule has the shape:
 
 ```json
 {

package/GEMINI.md

@@ -12,13 +12,16 @@ Its policy:
   `.copilot/*`, `.cursor/session*`, `.cursor/chats/*`, `.cursor/logs/*`,
   `.aider.*`, `.specstory/*`, `.continue/sessions/*`, `.playwright-mcp/*`,
   `.remember/*`, `.superpowers/*`, and `.agent/*`. The examples are not
-  exhaustive; the packaged `rules/paths.json` is the detection source of truth.
-  If one is staged, unstage it and keep it out of Git instead.
+  exhaustive; the packaged `rules/paths.json` is the detection source of truth
+  for these artifacts. If one is staged, unstage it and keep it out of Git
+  instead.
 - Never commit secrets: a real `.env` (not `.env.example`), private keys
   (`id_rsa` and files containing a private-key header), `.aws/credentials`,
   `.claude/.credentials.json`, service-account keys, or a provider API key
   (GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
-  SendGrid). Public certificates are allowed.
+  SendGrid). Public certificates are allowed. aimhooman does not scan for
+  secrets — this rule is on you, and a dedicated scanner such as gitleaks is
+  the right backstop for it.
 - Never add AI attribution to commit messages: no `Co-authored-by` trailer naming
   an AI (Claude, Copilot, Codex), no "Generated with/by <AI>" lines, no AI-service
   noreply emails. A commit message reads as if a human wrote it.
@@ -49,7 +52,7 @@ npm test
 npm run test:coverage
 ```
 
-aimhooman also enforces this at commit time, so a blocked commit means a real
-violation to fix, not a check to bypass. The rule is simple: AI works, hoomans
-ship.
+aimhooman also enforces the artifact and attribution rules at commit time, so
+a blocked commit means a real violation to fix, not a check to bypass. The rule
+is simple: AI works, hoomans ship.
 <!-- aimhooman:ruleset-end -->