@heroiclands/package-build 22.9.1 → 22.9.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @heroiclands/package-build
 
+## 22.9.2
+
+### Patch Changes
+
 ## 22.9.1
 
 ### Patch Changes

package/docs/project-setup.md

@@ -95,6 +95,29 @@ precedence: a plain `git config` sets one clone, `--global` sets a machine.
 The defaults differ deliberately: a guard that costs nothing is on unless
 refused, and one that runs a container for minutes is off unless asked for.
 
+The commit-message guard requires Node, like the rest of the toolchain. It checks
+complete coauthor trailers and standalone credit clauses, with indentation,
+bullets, emoji, Markdown emphasis and inline links permitted as decoration.
+Supported identities are Codex, ChatGPT, OpenAI Codex, OpenAI ChatGPT, OpenAI,
+Claude, Claude Code, Anthropic,
+GitHub Copilot, Gemini, Cursor, and generic AI assistant credits. Signature forms
+are generated by/with, assisted by, written by, AI-assisted and AI-generated.
+Matching ignores case. Human coauthors such as Claudette Smith and Jean-Claude
+Martin, explanatory prose, and ordinary mentions of these tools pass.
+
+Specific assistant mailbox identities also identify a coauthor credit:
+`codex@openai.com`, `chatgpt@openai.com`, `noreply@openai.com`,
+`claude@anthropic.com` and `noreply@anthropic.com`. A provider's email domain
+alone does not identify an assistant. This is an explicit set of credit forms,
+not a classifier for arbitrary natural-language attribution.
+
+Git comment lines and the verbose diff after a scissors comment are excluded.
+Findings report the original message line and column. This local hook examines
+commit messages only; the shared No Attribution workflow also checks pull
+request titles and bodies. Neither examines repository files, issues, comments,
+or Git author/committer metadata. The package-build repository's own hook uses
+the same matching code and remains enabled independently of the consumer switch.
+
 The branch guard is the one you meet first:
 
 ```console

package/githooks/attribution.mjs

@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2024-2026 Tom Rodriguez ("Toasty") — <toasty@heroiclands.org>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/** Bounded identities and standalone credit forms shared with the commit hooks. */
+export const identities = [
+    "Codex",
+    "ChatGPT",
+    "OpenAI",
+    "OpenAI Codex",
+    "OpenAI ChatGPT",
+    "Claude",
+    "Claude Code",
+    "Anthropic",
+    "GitHub Copilot",
+    "Gemini",
+    "Cursor",
+    "AI",
+    "AI assistant",
+    "an AI assistant",
+];
+export const phrases = ["Generated by", "Generated with", "Assisted by", "Written by"];
+export const mailboxes = [
+    "codex@openai.com",
+    "chatgpt@openai.com",
+    "noreply@openai.com",
+    "claude@anthropic.com",
+    "noreply@anthropic.com",
+];
+const identity = new RegExp(`^(?:${identities.join("|")})$`, "i");
+const signature = new RegExp(`^(?:${phrases.join("|")})\\s+(.+?)[.!]?$`, "i");
+
+/** Normalize decoration while keeping each character's original UTF-16 offset. */
+function normalize(line) {
+    let chars = Array.from({ length: line.length }, (_, offset) => ({
+        text: line[offset],
+        offset,
+    }));
+    const replace = (pattern, keep) => {
+        const text = chars.map((char) => char.text).join("");
+        const matches = [...text.matchAll(pattern)];
+        for (const match of matches.reverse()) {
+            const retained = keep(match);
+            chars.splice(
+                match.index,
+                match[0].length,
+                ...chars.slice(match.index + retained.start, match.index + retained.end),
+            );
+        }
+    };
+    replace(/\[([^\]]+)\]\([^\s)]*\)/g, (match) => ({ start: 1, end: 1 + match[1].length }));
+    replace(/[*_`~]/g, () => ({ start: 0, end: 0 }));
+    replace(/^[^\p{L}]+/gu, () => ({ start: 0, end: 0 }));
+    return {
+        text: chars
+            .map((char) => char.text)
+            .join("")
+            .trimEnd(),
+        column: (chars[0]?.offset ?? 0) + 1,
+    };
+}
+
+/** Find a complete credit clause; ordinary prose and human identities pass. */
+export function attribution(line) {
+    const normalized = normalize(line);
+    const trailer = normalized.text.match(/^co-authored-by:\s*(.*?)\s*(?:<([^<>]+)>)?$/i);
+    if (trailer && (identity.test(trailer[1]) || mailboxes.includes(trailer[2]?.toLowerCase()))) {
+        return { column: normalized.column, kind: "Co-Authored-By trailer naming an assistant" };
+    }
+    const credit = normalized.text.match(signature);
+    const generic = normalized.text.match(
+        /^AI-(?:assisted|generated)(?:\s+(?:by|with)\s+(.+?))?[.!]?$/i,
+    );
+    if (
+        (credit && identity.test(credit[1])) ||
+        (generic && (!generic[1] || identity.test(generic[1])))
+    ) {
+        return { column: normalized.column, kind: "assistant signature" };
+    }
+    return null;
+}

package/githooks/commit-message.mjs

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2024-2026 Tom Rodriguez ("Toasty") — <toasty@heroiclands.org>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+import { readFileSync } from "node:fs";
+import { relative } from "node:path";
+import { attribution } from "./attribution.mjs";
+
+const file = process.argv[2];
+const lines = readFileSync(file, "utf8").split(/\r?\n/);
+let rejected = false;
+for (const [index, line] of lines.entries()) {
+    // Git's verbose diff starts at the scissors comment; other comments are inert.
+    if (/^#.*>8/.test(line)) break;
+    if (line.startsWith("#")) continue;
+    const finding = attribution(line);
+    if (!finding) continue;
+    console.error(
+        `${relative(process.cwd(), file)}:${index + 1}:${finding.column}: error: ${finding.kind}; attribution is not allowed in commit messages.`,
+    );
+    rejected = true;
+}
+if (rejected) {
+    console.error("Remove the assistant credit and commit again.");
+    process.exitCode = 1;
+}

package/githooks/commit-msg

@@ -1,40 +1,8 @@
 #!/usr/bin/env sh
-#
-# Reject commit messages that carry AI/assistant attribution.
-#
-# This project does not want Co-Authored-By trailers naming an AI assistant, nor
-# "Generated with Claude Code"-style signatures, in its history. The matching CI
-# guard is the shared HeroicLands/.github/actions/no-attribution action, which
-# this repository's .github/workflows/no-attribution.yml calls. That action holds
-# the pattern for every repository; this hook is the only other copy, because a
-# git hook runs from your checkout and cannot live in an action. Keep them in sync.
-#
-# Installed for everyone via the package.json "prepare" script, which points
-# git at this directory (`git config core.hooksPath .githooks`) on `npm install`.
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Check the commit message using the same contract as the shared CI action.
 
 . "$(dirname "$0")/hook-enabled.sh"
-
-# On unless refused: it costs nothing, and the No Attribution workflow enforces
-# the same rule on GitHub, so opting out locally only moves the failure later.
 hook_enabled noAttribution true || exit 0
 
-msg_file="$1"
-
-# Scan only the real message: drop the diff appended by `commit --verbose` (from
-# the scissors comment onward) and strip remaining comment lines.
-content="$(sed '/^#.*>8/,$d' "$msg_file" | grep -v '^#')"
-
-# Anchored to the start of a line: real attribution is a trailer / signature at
-# column 0, so prose that merely *mentions* these phrases mid-sentence (e.g. this
-# hook's own docs) does not trip it. The generated-with branch tolerates a
-# leading emoji/space.
-pattern='^[[:space:]]*co-authored-by:.*(claude|anthropic)|^[^[:alpha:]]*generated with .*claude code'
-
-if printf '%s\n' "$content" | grep -iEq "$pattern"; then
-    echo "commit-msg: AI/assistant attribution is not allowed in commit messages." >&2
-    printf '%s\n' "$content" | grep -iEn "$pattern" | sed 's/^/    /' >&2
-    echo "Remove the 'Co-Authored-By: …' / 'Generated with Claude Code' line and commit again." >&2
-    exit 1
-fi
-
-exit 0
+exec node "$(dirname "$0")/commit-message.mjs" "$1"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@heroiclands/package-build",
-    "version": "22.9.1",
+    "version": "22.9.2",
     "description": "Shared toolchain for building and shipping a HeroicLands Foundry VTT package — content compilation, manifest, localization, staging, bundle, release and deployment.",
     "license": "GPL-3.0-or-later",
     "type": "module",