| name | aimhooman |
| description | Keep AI tooling artifacts out of Git. Use whenever staging, committing, or pushing changes: block AI session/state files (.claude/session.json, .codex/history, .copilot, .cursor/session, .aider.*, .specstory, .agent) and unwanted AI attribution in commit messages (Co-authored-by an AI, "Generated with AI"). Also use when the user says "aimhooman", "ship it like a hooman", or asks to clean AI residue before a commit.
|
| license | MIT |
aimhooman
This repository uses aimhooman to keep AI tooling artifacts out of Git history.
Its policy:
- Never stage or commit local AI session/state files. Examples include
.claude.json, .claude/session*.json,
.claude/history*, .claude/todos/*, .claude/shell-snapshots/*,
.claude/statsig/*, .claude/projects/*, .claude/logs/*,
.codex/sessions/*, .codex/history*, .codex/log/*, .codex/logs/*,
.copilot/*, .cursor/session*, .cursor/chats/*, .cursor/logs/*,
.aider.*, .specstory/*, .continue/sessions/*, .playwright-mcp/*,
.remember/*, .superpowers/*, and .agent/*. The examples are not
exhaustive; the packaged rules/paths.json is the detection source of truth
for these artifacts. If one is staged, unstage it and keep it out of Git
instead.
- Never commit secrets: a real
.env (not .env.example), private keys
(id_rsa and files containing a private-key header), .aws/credentials,
.claude/.credentials.json, service-account keys, or a provider API key
(GitHub, GitLab, npm, Slack, Anthropic, OpenAI, Google, Stripe, Hugging Face,
SendGrid). Public certificates are allowed. aimhooman does not scan for
secrets — this rule is on you, and a dedicated scanner such as gitleaks is
the right backstop for it.
- Never add AI attribution to commit messages: no
Co-authored-by trailer naming
an AI (Claude, Copilot, Codex), no "Generated with/by " lines, no AI-service
noreply emails. A commit message reads as if a human wrote it.
- Write in a human voice, not an AI voice. No
delve, leverage, utilize,
seamless, robust, comprehensive, underscore, foster, pivotal, myriad,
tapestry, landscape; no "This PR addresses…", "adversarial self-review",
"live-verified", "thoroughly tested with comprehensive examples", "in today's",
"let's dive in", "in conclusion"; no bold lead-in on every bullet and no paired
em-dash asides. Say what broke or what changed, pick the plain short verb, name the
number, and vary sentence length. If the first line could open any PR on any repo,
delete it.
- Treat
AGENTS.md, CLAUDE.md, GEMINI.md, and .github/copilot-instructions.md
as review-required: they may be intentional team config, so confirm before
committing them.
Project map:
src/scan.mjs and src/rules.mjs load rules and make policy decisions.src/hook.mjs and src/githooks.mjs enforce them in agent and Git hooks.src/state.mjs owns local policy state. bin/aimhooman.mjs is the CLI.tests/ mirrors the production paths and includes real temporary Git repos.
Use Node.js 22.8 or newer. Before finishing a change, run:
npm run check
npm test
npm run test:coverage
aimhooman also enforces the artifact and attribution rules at commit time, so
a blocked commit means a real violation to fix, not a check to bypass. The rule
is simple: AI works, hoomans ship.
