Lines 137-177markdown
137- `secret.dotenv` now excepts `*.minimal`. A `.env.minimal` shipped as a template
138 was blocked by the same rule that catches a real `.env`, because `*.sample`,
139 `*.template`, `*.dist`, and `*.defaults` were excepted but `*.minimal` was not.
140 The rule's version bumps to 4.
144- Incomplete-scan messages name the files that were dropped and why. A budget
145 miss used to print a count (`size-limit=3`) with no path, so the owner had to
146 hunt for the offender. The CLI now lists up to five skipped paths with their
147 sizes and reason, and the JSON scan report carries a `skippedPaths` object so a
148 caller can see every dropped file the same way. The schema documents the field.
149- `aimhooman explain` prints a rule's `except` clause when it has one, so an
150 `allow`/`deny` override can be reasoned about without opening the rule pack.
152## [0.1.5] - 2026-07-18
156- AWS's own published example key no longer blocks a commit. 0.1.4 began matching bare
157 `AKIA…`/`ASIA…` access key IDs, which also matched `AKIAIOSFODNN7EXAMPLE` — the value AWS
158 prints in its own documentation, and one that lands in READMEs, Terraform samples, and test
159 fixtures. Because the rule's category is `secret`, neither a rule allow nor a plain path
160 allow is accepted, so a documentation example became an unconditional block on every profile
161 with only a per-file escape. Every AWS example key ends in `EXAMPLE`, so the pattern now
162 excludes that suffix and keeps blocking real keys. Path scoping was deliberately not used:
163 excluding `docs/` or `tests/` from secret scanning would hide genuine keys in the places they
165- `uninstall --purge-state` no longer leaves a backup behind in a linked worktree. Git writes
166 the commit message file into the per-worktree Git directory, so 0.1.4's sweep — which looked
167 only in the common directory — printed "state purged" with `COMMIT_EDITMSG.aimhooman-bak`
168 still on disk. Uninstall disarms every worktree at once, so it now sweeps the main Git
169 directory and each linked one, and matches the `.aimhooman-bak` suffix so a backup left by a
171- A plain `uninstall` keeps the attribution backup. It printed "state kept" and then deleted
172 the one file holding the lines stripped from the last commit message. Only `--purge-state`,
173 which promises to remove everything, takes it now.
174- Sweeping an empty lock queue can no longer stop a concurrent `aimhooman init`. Between its
175 `mkdir` and its first publication a lock contender owns no file in the queue, so the sweep
176 saw an empty directory and removed it, and the contender then failed on a bare `ENOENT`. The
177 window is wide enough to lose because building the candidate probes the process identity,